arkgate 2.13.0 → 3.0.0

package/dist/index.js

@@ -1,666 +1,90 @@
 // src/version.ts
-var version = "2.13.0";
+var version = "3.0.0";
 
-// src/kernel/intent/IntentRegistry.ts
-var IntentRegistry = class {
-  intents = /* @__PURE__ */ new Map();
-  dependencies = /* @__PURE__ */ new Map();
-  productions = /* @__PURE__ */ new Map();
-  /**
-   * Define/register a new intent.
-   *
-   * @param name - Semantic intent name following the convention (Domain.*, Application.*, etc.)
-   * @param options - Optional relationship declarations
-   * @throws Error if an intent with the same name is already registered
-   */
-  define(name, options) {
-    if (this.intents.has(name)) {
-      throw new Error(
-        `Intent "${name}" is already registered. Intent names must be unique within a registry.`
-      );
-    }
-    const fn = (payload) => ({
-      intent: name,
-      payload,
-      metadata: {
-        occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
-        source: "unknown"
-      }
-    });
-    Object.defineProperty(fn, "name", {
-      value: name,
-      enumerable: true,
-      configurable: false,
-      writable: false
-    });
-    const creator = fn;
-    this.intents.set(name, creator);
-    if (options?.dependsOn) {
-      for (const dep of options.dependsOn) {
-        this.declareDependency(name, dep);
-      }
-    }
-    if (options?.produces) {
-      for (const prod of options.produces) {
-        this.declareProduction(name, prod);
-      }
-    }
-    return creator;
-  }
-  /**
-   * Declare that one intent depends on / relates to another.
-   * This information is used by the DependencyGraph (future iterations) and for policy checks.
-   *
-   * @param from - The source intent (e.g. an Application operation)
-   * @param to - The target intent it depends on (e.g. a Domain event or concept)
-   */
-  declareDependency(from, to) {
-    if (!this.dependencies.has(from)) {
-      this.dependencies.set(from, /* @__PURE__ */ new Set());
-    }
-    this.dependencies.get(from).add(to);
-  }
-  /**
-   * Declare that one intent produces / emits another (e.g. use case → domain event).
-   */
-  declareProduction(from, to) {
-    if (!this.productions.has(from)) {
-      this.productions.set(from, /* @__PURE__ */ new Set());
-    }
-    this.productions.get(from).add(to);
-  }
-  /**
-   * Retrieve a previously defined intent creator by name.
-   */
-  get(name) {
-    return this.intents.get(name);
-  }
-  /**
-   * List all registered intent creators.
-   */
-  list() {
-    return Array.from(this.intents.values());
-  }
-  /**
-   * Get all declared dependencies for a given intent.
-   */
-  getDependencies(intentName) {
-    const deps = this.dependencies.get(intentName);
-    return deps ? Array.from(deps) : [];
-  }
-  /**
-   * Get all intents produced / emitted by a given intent.
-   */
-  getProductions(intentName) {
-    const prods = this.productions.get(intentName);
-    return prods ? Array.from(prods) : [];
-  }
-  /**
-   * Get all declared relationships (useful for graph generation).
-   */
-  getAllRelationships() {
-    const result = [];
-    for (const [from, tos] of this.dependencies.entries()) {
-      for (const to of tos) {
-        result.push({ from, to, kind: "dependsOn" });
-      }
-    }
-    for (const [from, tos] of this.productions.entries()) {
-      for (const to of tos) {
-        result.push({ from, to, kind: "produces" });
-      }
-    }
-    return result;
-  }
-  /**
-   * Check if an intent name has been registered.
-   */
-  has(name) {
-    return this.intents.has(name);
-  }
-  /**
-   * Clear the registry. Primarily useful for tests.
-   */
-  clear() {
-    this.intents.clear();
-    this.dependencies.clear();
-    this.productions.clear();
-  }
-};
-
-// src/kernel/intent/defineIntent.ts
-var defaultRegistry = new IntentRegistry();
-function defineIntent(name, options) {
-  return defaultRegistry.define(name, options);
-}
-function createIntentRegistry() {
-  return new IntentRegistry();
-}
-var defaultIntentRegistry = defaultRegistry;
-
-// src/kernel/intent/validateIntentName.ts
-var ALLOWED_PREFIXES = [
-  "Domain.",
-  "Application.",
-  "Adapter.",
-  "Workflow.",
-  "Job.",
-  "Presentation.",
-  "Reporting.",
-  "Metadata.",
-  "Security.",
-  "Audit.",
-  "Observability.",
-  "Kernel."
-];
-function validateIntentName(name) {
-  if (!name || typeof name !== "string") {
-    return { valid: false, reason: "Intent name must be a non-empty string" };
-  }
-  if (!ALLOWED_PREFIXES.some((p) => name.startsWith(p))) {
-    return {
-      valid: false,
-      reason: `Intent "${name}" must start with one of: ${ALLOWED_PREFIXES.join(", ")}`
-    };
-  }
-  const rest = name.slice(name.indexOf(".") + 1);
-  if (!rest || !/^[A-Za-z][A-Za-z0-9_.]*$/.test(rest)) {
-    return {
-      valid: false,
-      reason: `Intent "${name}" has an invalid segment after the layer prefix`
-    };
-  }
-  return { valid: true };
-}
-
-// src/kernel/policy/PolicyViolationError.ts
-var PolicyViolationError = class extends Error {
-  violations;
-  constructor(violations) {
-    const messages = violations.map((v) => `- ${v.policyName}: ${v.message}`).join("\n");
-    super(`Hard policy violation(s) detected:
-${messages}`);
-    this.name = "PolicyViolationError";
-    this.violations = violations;
-  }
-};
-
-// src/kernel/policy/PolicyEngine.ts
-var PolicyEngine = class {
-  policies = [];
-  constructor(initialPolicies = []) {
-    for (const policy of initialPolicies) {
-      this.add(policy);
-    }
-  }
-  /**
-   * Adds a policy to the engine.
-   */
-  add(policy) {
-    if (this.policies.some((p) => p.name === policy.name)) {
-      throw new Error(`Policy "${policy.name}" is already registered in this engine.`);
-    }
-    this.policies.push(policy);
-  }
-  /**
-   * Returns all registered policies.
-   */
-  getPolicies() {
-    return [...this.policies];
-  }
-  /**
-   * Evaluates all policies against the provided context.
-   */
-  evaluate(context) {
-    const violations = [];
-    for (const policy of this.policies) {
-      const result = policy.check(context);
-      if (result === true) {
-        continue;
-      }
-      if (result === false) {
-        violations.push({
-          policyName: policy.name,
-          severity: policy.severity,
-          message: `Policy "${policy.name}" was violated.`
-        });
-        continue;
-      }
-      if (Array.isArray(result)) {
-        for (const v of result) {
-          violations.push({
-            policyName: policy.name,
-            severity: policy.severity,
-            message: v.message,
-            details: v.details
-          });
-        }
-      } else {
-        violations.push({
-          policyName: policy.name,
-          severity: policy.severity,
-          message: result.message,
-          details: result.details
-        });
-      }
-    }
-    const hardViolations = violations.filter((v) => v.severity === "hard");
-    const softViolations = violations.filter((v) => v.severity === "soft");
-    return {
-      passed: violations.length === 0,
-      violations,
-      hardViolations,
-      softViolations
-    };
-  }
-  /**
-   * Enforces all policies.
-   *
-   * - Soft violations are collected and can be observed (returned or logged).
-   * - Hard violations cause an error to be thrown (by default).
-   *
-   * @returns Evaluation result (including any soft violations)
-   * @throws Error if any hard policy is violated
-   */
-  enforce(context) {
-    const result = this.evaluate(context);
-    if (result.hardViolations.length > 0) {
-      throw new PolicyViolationError(result.hardViolations);
-    }
-    return result;
-  }
-  /**
-   * Clears all registered policies.
-   */
-  clear() {
-    this.policies.length = 0;
-  }
-};
-
-// src/kernel/policy/definePolicy.ts
-function definePolicy(options) {
-  const severity = options.severity ?? "soft";
-  const policy = {
-    name: options.name,
-    severity,
-    tags: options.tags,
-    owner: options.owner,
-    version: options.version,
-    rationale: options.rationale,
-    enforcementMode: options.enforcementMode,
-    deprecated: options.deprecated,
-    replacedBy: options.replacedBy,
-    check: options.check
+// src/domain/adapterContract.ts
+var ARK_ANALYSIS_RESULT_SCHEMA_VERSION = "1.0";
+function text(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function positiveInteger(value, fallback) {
+  return Number.isInteger(value) && Number(value) > 0 ? Number(value) : fallback;
+}
+function toAdapterDiagnostic(violation2, fallbackSeverity = "error") {
+  const ruleId = text(violation2.ruleId) ?? text(violation2.code) ?? "ARK_UNKNOWN";
+  const severity = violation2.severity === "warning" ? "warning" : fallbackSeverity;
+  const evidence = {
+    ...text(violation2.target) ? { target: text(violation2.target) } : {},
+    ...text(violation2.fromLayer) ? { fromLayer: text(violation2.fromLayer) } : {},
+    ...text(violation2.toLayer) ? { toLayer: text(violation2.toLayer) } : {},
+    ...typeof violation2.typeOnly === "boolean" ? { typeOnly: violation2.typeOnly } : {}
   };
-  return policy;
-}
-
-// src/kernel/policy/builtins.ts
-function defaultLayerOf(name) {
-  const dot = name.indexOf(".");
-  return dot >= 0 ? name.slice(0, dot) : name;
-}
-function resolveLayer(name, options) {
-  return options.resolveLayer?.(name) ?? defaultLayerOf(name);
-}
-function matchesRule(fromLayer, toLayer, rule) {
-  return fromLayer === rule.from && toLayer === rule.to;
-}
-function defineLayerPolicy(options) {
-  const name = options.name ?? "Layer isolation";
-  const severity = options.severity ?? "hard";
-  return definePolicy({
-    name,
+  return {
+    ruleId,
     severity,
-    tags: ["layer"],
-    check: (ctx) => {
-      const edges = [
-        ...(ctx.edges ?? []).filter((e) => e.kind === "declared" || e.kind === "produces").map((e) => ({ from: e.from, to: e.to })),
-        ...(ctx.relationships ?? []).filter((r) => r.kind === "dependsOn").map((r) => ({ from: r.from, to: r.to }))
-      ];
-      const violations = [];
-      for (const edge of edges) {
-        const fromLayer = resolveLayer(edge.from, options);
-        const toLayer = resolveLayer(edge.to, options);
-        for (const rule of options.rules) {
-          if (!rule.allowed && matchesRule(fromLayer, toLayer, rule)) {
-            violations.push({
-              policyName: name,
-              severity,
-              message: rule.message ?? `Layer violation: ${edge.from} (${fromLayer}) must not relate to ${edge.to} (${toLayer})`
-            });
-          }
-        }
-      }
-      return violations.length > 0 ? violations : true;
-    }
-  });
-}
-function isLayerPolicy(policy) {
-  return policy.tags?.includes("layer") ?? false;
-}
-var architecturalPolicies = {
-  /**
-   * @deprecated Use cleanArchitectureMatrix() for full layer rules.
-   * Blocks Domain → Adapter declared dependencies only.
-   */
-  layerIsolation() {
-    return architecturalPolicies.cleanArchitectureMatrix();
-  },
-  /**
-   * Clean-architecture dependency matrix (declared dependsOn / declared edges only).
-   * Does not block observed event flows (Domain events consumed by Application).
-   */
-  cleanArchitectureMatrix() {
-    return defineLayerPolicy({
-      name: "Clean architecture matrix",
-      severity: "hard",
-      rules: [
-        { from: "Domain", to: "Adapter", allowed: false },
-        { from: "Domain", to: "Application", allowed: false },
-        { from: "Adapter", to: "Application", allowed: false },
-        { from: "Adapter", to: "Domain", allowed: false }
-      ]
-    });
-  }
-};
-function defineArchitectureProfilePolicy(profile, options = {}) {
-  return defineLayerPolicy({
-    name: options.name ?? `${profile.name} layer policy`,
-    severity: options.severity ?? "hard",
-    rules: profile.rules,
-    resolveLayer: profile.resolveLayer
-  });
-}
-
-// src/kernel/event-bus/policyContext.ts
-function buildPublishPolicyContext(options) {
-  return (event) => ({
-    event,
-    relationships: options.intentRegistry?.getAllRelationships(),
-    edges: options.dependencyGraph?.getEdges()
-  });
-}
-function definePublishPolicy(options) {
-  return definePolicy(options);
-}
-
-// src/kernel/event-bus/errors.ts
-var UnregisteredIntentError = class extends Error {
-  intentName;
-  constructor(intentName) {
-    super(
-      `Intent "${intentName}" is not registered. Register it with IntentRegistry.define() before publish/subscribe, including metadata.source producer intents in strict mode.`
-    );
-    this.name = "UnregisteredIntentError";
-    this.intentName = intentName;
-  }
-};
-var InvalidIntentNameError = class extends Error {
-  intentName;
-  reason;
-  constructor(intentName, reason) {
-    super(`Invalid intent name "${intentName}": ${reason}`);
-    this.name = "InvalidIntentNameError";
-    this.intentName = intentName;
-    this.reason = reason;
-  }
-};
-var LayerPolicyContextError = class extends Error {
-  constructor() {
-    super(
-      "Layer/architecture policies require intentRegistry, dependencyGraph, or a custom getPolicyContext. Without graph/registry context, layer policies cannot inspect relationships."
-    );
-    this.name = "LayerPolicyContextError";
-  }
-};
-var EventContractViolationError = class extends Error {
-  intentName;
-  issues;
-  constructor(intentName, issues) {
-    super(
-      `Event contract violation for "${intentName}". Register a matching event contract/version or fix the payload before publishing.`
-    );
-    this.name = "EventContractViolationError";
-    this.intentName = intentName;
-    this.issues = issues;
-  }
-};
-var UnknownEventSourceError = class extends Error {
-  intentName;
-  source;
-  constructor(intentName, source) {
-    super(
-      source ? `Event "${intentName}" metadata.source "${source}" is not registered. Register the producer intent or publish from a known source.` : `Event "${intentName}" must include metadata.source. Strict Ark uses source to enforce observed layer flow.`
-    );
-    this.name = "UnknownEventSourceError";
-    this.intentName = intentName;
-    this.source = source;
-  }
-};
-var SourceMetadataOverrideError = class extends Error {
-  boundSource;
-  attemptedSource;
-  constructor(boundSource, attemptedSource) {
-    super(
-      `Source-bound publisher for "${boundSource}" cannot publish with metadata.source "${attemptedSource}". Create a publisher for the intended source instead.`
-    );
-    this.name = "SourceMetadataOverrideError";
-    this.boundSource = boundSource;
-    this.attemptedSource = attemptedSource;
-  }
-};
-var ObservedLayerFlowViolationError = class extends Error {
-  source;
-  intentName;
-  fromLayer;
-  toLayer;
-  constructor(source, intentName, fromLayer, toLayer, message) {
-    super(
-      message ?? `Observed layer violation: "${source}" (${fromLayer}) must not produce "${intentName}" (${toLayer}). Route this through an allowed layer or adjust the architecture profile rule.`
-    );
-    this.name = "ObservedLayerFlowViolationError";
-    this.source = source;
-    this.intentName = intentName;
-    this.fromLayer = fromLayer;
-    this.toLayer = toLayer;
-  }
-};
-
-// src/kernel/event-bus/publishGuards.ts
-function assertIntentAllowed(intentName, options) {
-  if (!options.strictRegistry && !options.validateIntentNaming) {
-    return;
-  }
-  if (options.validateIntentNaming) {
-    const validation = validateIntentName(intentName);
-    if (!validation.valid) {
-      throw new InvalidIntentNameError(intentName, validation.reason);
-    }
-  }
-  if (options.strictRegistry && options.intentRegistry && !options.intentRegistry.has(intentName)) {
-    throw new UnregisteredIntentError(intentName);
-  }
-}
-function assertSourceAllowed(event, options) {
-  if (!options.requireKnownSource) return;
-  if (!event.metadata.source || event.metadata.source === "unknown") {
-    throw new UnknownEventSourceError(event.intent);
-  }
-  if (options.intentRegistry && !options.intentRegistry.has(event.metadata.source)) {
-    throw new UnknownEventSourceError(event.intent, event.metadata.source);
-  }
-}
-function assertContractAllowed(event, options) {
-  if (!options.eventContracts) return;
-  const result = options.eventContracts.validate(event);
-  if (!result.ok && (options.strictEventContracts || result.contract)) {
-    throw new EventContractViolationError(event.intent, result.issues);
-  }
-}
-
-// src/kernel/event-bus/payloadPatch.ts
-function isPlainRecord(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-  const proto = Object.getPrototypeOf(value);
-  return proto === Object.prototype || proto === null;
-}
-function clonePatchValue(value) {
-  if (Array.isArray(value)) return value.map(clonePatchValue);
-  if (isPlainRecord(value)) {
-    return Object.fromEntries(
-      Object.entries(value).map(([key, child]) => [key, clonePatchValue(child)])
-    );
-  }
-  return value;
-}
-function mergeRecordPatch(target, patch, path = "payload") {
-  const next = { ...target };
-  for (const [key, value] of Object.entries(patch)) {
-    const childPath = `${path}.${key}`;
-    if (!(key in next) || next[key] === void 0) {
-      next[key] = clonePatchValue(value);
-      continue;
-    }
-    if (isPlainRecord(next[key]) && isPlainRecord(value)) {
-      next[key] = mergeRecordPatch(next[key], value, childPath);
-      continue;
-    }
-    if (Array.isArray(next[key]) && Array.isArray(value)) {
-      next[key] = mergeArrayPatch(next[key], value, childPath);
-      continue;
-    }
-    throw new Error(`Interceptor patch cannot overwrite existing ${childPath}.`);
-  }
-  return next;
-}
-function mergeArrayPatch(target, patch, path = "payload") {
-  const next = [...target];
-  patch.forEach((value, index) => {
-    const childPath = `${path}[${index}]`;
-    if (index >= next.length || next[index] === void 0) {
-      next[index] = clonePatchValue(value);
-      return;
-    }
-    if (isPlainRecord(next[index]) && isPlainRecord(value)) {
-      next[index] = mergeRecordPatch(next[index], value, childPath);
-      return;
-    }
-    if (Array.isArray(next[index]) && Array.isArray(value)) {
-      next[index] = mergeArrayPatch(next[index], value, childPath);
-      return;
-    }
-    throw new Error(`Interceptor patch cannot overwrite existing ${childPath}.`);
-  });
-  return next;
+    message: text(violation2.message) ?? ruleId,
+    location: {
+      file: text(violation2.file) ?? "<unknown>",
+      line: positiveInteger(violation2.line, 1),
+      column: positiveInteger(violation2.column, 1)
+    },
+    evidence
+  };
 }
-function applyPayloadPatch(payload, patch) {
-  if (Array.isArray(patch)) {
-    if (payload === void 0) return clonePatchValue(patch);
-    if (!Array.isArray(payload)) {
-      throw new Error("Array interceptor patch requires an array payload.");
-    }
-    return mergeArrayPatch(payload, patch);
-  }
-  if (payload === void 0) return clonePatchValue(patch);
-  if (!isPlainRecord(payload)) {
-    throw new Error("Object interceptor patch requires an object payload.");
-  }
-  return mergeRecordPatch(payload, patch);
+function createAdapterResult(input) {
+  return {
+    schemaVersion: ARK_ANALYSIS_RESULT_SCHEMA_VERSION,
+    valid: input.valid,
+    diagnostics: [
+      ...(input.violations ?? []).map((item) => toAdapterDiagnostic(item, "error")),
+      ...(input.warnings ?? []).map((item) => toAdapterDiagnostic(item, "warning"))
+    ]
+  };
 }
-
-// src/kernel/event-bus/publishInterceptors.ts
-async function applyInterceptors(event, deps) {
-  if (event.metadata.allowInterception === false) {
-    return event;
-  }
-  const matching = [...deps.interceptorsForIntent(event.intent)];
-  let current = event;
-  for (const registration of matching) {
-    const patches = [];
-    try {
-      await Promise.resolve(
-        registration.interceptor({
-          event: current,
-          intercept: (patch) => {
-            patches.push(patch);
+var ARK_ANALYSIS_RESULT_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://unpkg.com/arkgate@2/schemas/ark.analysis-result.schema.json",
+  title: "ArkGate analysis result",
+  type: "object",
+  additionalProperties: false,
+  required: ["schemaVersion", "valid", "diagnostics"],
+  properties: {
+    schemaVersion: { const: ARK_ANALYSIS_RESULT_SCHEMA_VERSION },
+    valid: { type: "boolean" },
+    diagnostics: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        required: ["ruleId", "severity", "message", "location", "evidence"],
+        properties: {
+          ruleId: { type: "string", minLength: 1 },
+          severity: { enum: ["error", "warning"] },
+          message: { type: "string", minLength: 1 },
+          location: {
+            type: "object",
+            additionalProperties: false,
+            required: ["file", "line", "column"],
+            properties: {
+              file: { type: "string", minLength: 1 },
+              line: { type: "integer", minimum: 1 },
+              column: { type: "integer", minimum: 1 }
+            }
+          },
+          evidence: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+              target: { type: "string" },
+              fromLayer: { type: "string" },
+              toLayer: { type: "string" },
+              typeOnly: { type: "boolean" }
+            }
           }
-        })
-      );
-      if (patches.length === 0) {
-        continue;
-      }
-      const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-      let candidate = {
-        ...current,
-        metadata: {
-          ...current.metadata,
-          interceptions: [
-            ...current.metadata.interceptions ?? [],
-            { interceptorId: registration.interceptorId, timestamp }
-          ]
         }
-      };
-      for (const patch of patches) {
-        candidate = {
-          ...candidate,
-          payload: applyPayloadPatch(candidate.payload, patch),
-          metadata: { ...candidate.metadata }
-        };
       }
-      assertContractAllowed(candidate, {
-        eventContracts: deps.eventContracts,
-        strictEventContracts: deps.strictEventContracts
-      });
-      current = candidate;
-      registration.lastInterceptedAt = timestamp;
-      deps.appendTrace({
-        type: "event.intercepted",
-        timestamp,
-        intent: current.intent,
-        correlationId: current.metadata.correlationId,
-        traceId: current.metadata.traceId,
-        spanId: current.metadata.spanId,
-        details: {
-          registrationId: registration.registrationId,
-          interceptorId: registration.interceptorId,
-          patchesApplied: patches.length
-        }
-      });
-      await deps.recordAudit("event.intercepted", current, {
-        registrationId: registration.registrationId,
-        interceptorId: registration.interceptorId,
-        patchesApplied: patches.length
-      });
-    } catch (err) {
-      await recordInterceptorError(registration, current, err, deps);
     }
   }
-  return current;
-}
-async function recordInterceptorError(interceptor, event, error, deps) {
-  const message = error instanceof Error ? error.message : String(error);
-  deps.appendTrace({
-    type: "interceptor.error",
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    intent: event.intent,
-    correlationId: event.metadata.correlationId,
-    traceId: event.metadata.traceId,
-    spanId: event.metadata.spanId,
-    details: {
-      registrationId: interceptor.registrationId,
-      interceptorId: interceptor.interceptorId,
-      error: message
-    }
-  });
-  await deps.recordAudit("interceptor.error", event, {
-    registrationId: interceptor.registrationId,
-    interceptorId: interceptor.interceptorId,
-    error: message
-  });
-}
+};
 
 // src/domain/layerMatch.ts
 var regexpCache = /* @__PURE__ */ new Map();
@@ -827,1897 +251,353 @@ function findDeniedEdgeRule(rules, from, to, options) {
   return void 0;
 }
 
-// src/kernel/event-bus/observedLayerFlow.ts
-async function assertObservedLayerFlowAllowed(event, deps) {
-  if (deps.mode === "off" || !deps.architectureProfile) {
-    return;
-  }
-  const source = event.metadata.source;
-  if (!source || source === "unknown") return;
-  const profile = deps.architectureProfile;
-  const fromLayer = profile.resolveLayer(source);
-  const toLayer = profile.resolveLayer(event.intent);
-  if (!fromLayer || !toLayer) return;
-  const blocked = findDeniedEdgeRule(profile.rules, fromLayer, toLayer);
-  if (!blocked) return;
-  const severity = deps.mode;
-  const message = blocked.message ?? `Observed layer violation: "${source}" (${fromLayer}) must not produce "${event.intent}" (${toLayer}).`;
-  const details = {
-    source,
-    intent: event.intent,
-    fromLayer,
-    toLayer,
-    severity,
-    message,
-    rule: blocked
-  };
-  deps.appendTrace({
-    type: "layer.observedViolation",
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    intent: event.intent,
-    correlationId: event.metadata.correlationId,
-    traceId: event.metadata.traceId,
-    spanId: event.metadata.spanId,
-    details
-  });
-  await deps.recordAudit("layer.observedViolation", event, details);
-  if (severity === "hard") {
-    throw new ObservedLayerFlowViolationError(
-      source,
-      event.intent,
-      fromLayer,
-      toLayer,
-      message
-    );
-  }
+// src/domain/sourcePolicy.ts
+var SOURCE_POLICY_MESSAGES = {
+  RAW_EVENT_PUBLISH: "Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts and tooling.",
+  PUBLISH_MISSING_SOURCE: "Strict Ark publish calls must include metadata.source."
+};
+function looksLikeArkIntent(value) {
+  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\.[A-Za-z0-9_.]+$/.test(
+    value
+  );
 }
-
-// src/kernel/event-bus/publishPolicy.ts
-async function enforcePublishPolicy(event, deps) {
-  const ctx = deps.getPolicyContext(event);
-  let policyResult;
-  try {
-    policyResult = deps.policyEngine.enforce(ctx);
-  } catch (err) {
-    if (err instanceof PolicyViolationError) {
-      deps.appendTrace({
-        type: "policy.hardViolation",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        intent: event.intent,
-        correlationId: event.metadata.correlationId,
-        traceId: event.metadata.traceId,
-        spanId: event.metadata.spanId,
-        details: { violations: err.violations }
-      });
-      await deps.recordAudit("policy.hardViolation", event, {
-        violations: err.violations
-      });
-    }
-    throw err;
-  }
-  if (policyResult.softViolations.length > 0) {
-    deps.appendTrace({
-      type: "policy.softViolation",
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      intent: event.intent,
-      correlationId: event.metadata.correlationId,
-      traceId: event.metadata.traceId,
-      spanId: event.metadata.spanId,
-      details: { violations: policyResult.softViolations }
+function classifyPublishFacts(facts) {
+  if (!facts.publishCall) return [];
+  const findings = [];
+  if (facts.rawIntentName !== void 0 && looksLikeArkIntent(facts.rawIntentName) || facts.objectHasIntent) {
+    findings.push({
+      ruleId: "RAW_EVENT_PUBLISH",
+      message: SOURCE_POLICY_MESSAGES.RAW_EVENT_PUBLISH
     });
-    await deps.recordAudit("policy.softViolation", event, {
-      violations: policyResult.softViolations
+  }
+  if (facts.arkPublishCandidate && !facts.hasSource) {
+    findings.push({
+      ruleId: "PUBLISH_MISSING_SOURCE",
+      message: SOURCE_POLICY_MESSAGES.PUBLISH_MISSING_SOURCE
     });
-    if (deps.onSoftViolation) {
-      await deps.safeHook(
-        () => deps.onSoftViolation(policyResult, event),
-        "onSoftViolation",
-        event
-      );
-    }
   }
+  return findings;
 }
 
-// src/kernel/event-bus/publishRecording.ts
-function appendHistory(buffers, record) {
-  buffers.history.push(record);
-  if (buffers.maxHistorySize !== void 0 && buffers.history.length > buffers.maxHistorySize) {
-    buffers.history.splice(0, buffers.history.length - buffers.maxHistorySize);
-  }
+// src/kernel/semanticAnalysis.ts
+function literalText(ts, node) {
+  return node && ts.isStringLiteralLike(node) ? node.text : void 0;
 }
-function appendTrace(buffers, record) {
-  buffers.trace.push(record);
-  if (buffers.maxHistorySize !== void 0 && buffers.trace.length > buffers.maxHistorySize) {
-    buffers.trace.splice(0, buffers.trace.length - buffers.maxHistorySize);
+function lineOf(sourceFile, node) {
+  return sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+}
+function isTypeOnlyReference(ts, node) {
+  if (ts.isImportDeclaration(node)) {
+    const clause = node.importClause;
+    if (!clause) return false;
+    if (clause.isTypeOnly) return true;
+    const named = clause.namedBindings;
+    return Boolean(
+      named && ts.isNamedImports(named) && named.elements.length > 0 && named.elements.every((element) => element.isTypeOnly)
+    );
   }
-  for (const sink of buffers.traceSinks) {
-    try {
-      sink(record);
-    } catch {
-    }
+  if (ts.isExportDeclaration(node)) {
+    if (node.isTypeOnly) return true;
+    const clause = node.exportClause;
+    return Boolean(
+      clause && ts.isNamedExports(clause) && clause.elements.length > 0 && clause.elements.every((element) => element.isTypeOnly)
+    );
   }
+  return false;
 }
-async function recordAudit(buffers, type, event, details) {
-  if (!buffers.auditTrail) return;
+function singleFileChecker(ts, sourceFile) {
+  const options = { noLib: true, noResolve: true, target: ts.ScriptTarget.Latest };
+  const host = ts.createCompilerHost(options, true);
+  host.getSourceFile = (fileName) => fileName === sourceFile.fileName ? sourceFile : void 0;
+  host.fileExists = (fileName) => fileName === sourceFile.fileName;
+  host.readFile = (fileName) => fileName === sourceFile.fileName ? sourceFile.text : void 0;
+  return ts.createProgram([sourceFile.fileName], options, host).getTypeChecker();
+}
+function symbolAt(checker, node) {
   try {
-    await buffers.auditTrail.record({
-      type,
-      source: event.metadata.source,
-      intent: event.intent,
-      correlationId: event.metadata.correlationId,
-      causationId: event.metadata.causationId,
-      subject: event.intent,
-      details
-    });
-  } catch (err) {
-    appendTrace(buffers, {
-      type: "hook.error",
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      intent: event.intent,
-      correlationId: event.metadata.correlationId,
-      traceId: event.metadata.traceId,
-      spanId: event.metadata.spanId,
-      details: {
-        hook: "auditTrail",
-        error: err instanceof Error ? err.message : String(err)
-      }
-    });
+    return checker.getSymbolAtLocation(node);
+  } catch {
+    return void 0;
   }
 }
-async function recordRawPublishDiagnostic(buffers, event) {
-  const details = {
-    intent: event.intent,
-    source: event.metadata.source,
-    suggestion: "Publish through a registered intent creator so strict registry, contracts, and agent tooling share one source of truth."
-  };
-  appendTrace(buffers, {
-    type: "event.rawPublish",
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    intent: event.intent,
-    correlationId: event.metadata.correlationId,
-    traceId: event.metadata.traceId,
-    spanId: event.metadata.spanId,
-    details
-  });
-  await recordAudit(buffers, "event.rawPublish", event, details);
+function localDeclaration(ts, checker, sourceFile, node) {
+  const shorthand = node.parent && ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node;
+  let symbol;
+  try {
+    symbol = shorthand ? checker.getShorthandAssignmentValueSymbol(node.parent) : symbolAt(checker, node);
+  } catch {
+    symbol = void 0;
+  }
+  return Boolean(
+    symbol?.declarations?.some(
+      (declaration) => declaration.getSourceFile().fileName === sourceFile.fileName
+    )
+  );
 }
-async function recordSuccessfulPublish(buffers, event, subscribersNotified) {
-  const record = {
-    event,
-    publishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    subscribersNotified
-  };
-  appendHistory(buffers, record);
-  await buffers.outbox?.enqueue(event);
-  appendTrace(buffers, {
-    type: "event.published",
-    timestamp: record.publishedAt,
-    intent: event.intent,
-    correlationId: event.metadata.correlationId,
-    traceId: event.metadata.traceId,
-    spanId: event.metadata.spanId,
-    details: { subscribersNotified }
+function extractSemanticDependencies(ts, sourceFile) {
+  let checker;
+  const dependencies = [];
+  const add = (node, kind, specifier, typeOnly = false) => dependencies.push({
+    specifier,
+    kind,
+    line: lineOf(sourceFile, node),
+    typeOnly,
+    unresolved: specifier === void 0,
+    node
   });
-  await recordAudit(buffers, "event.published", event, {
-    subscribersNotified
-  });
-  return record;
-}
-function enrichMetadata(base, extra, instanceId) {
-  return {
-    ...base,
-    ...extra,
-    occurredAt: extra.occurredAt || base.occurredAt || (/* @__PURE__ */ new Date()).toISOString(),
-    source: extra.source || base.source || "unknown",
-    kernelInstanceId: extra.kernelInstanceId ?? base.kernelInstanceId ?? instanceId,
-    eventVersion: extra.eventVersion ?? base.eventVersion,
-    schemaVersion: extra.schemaVersion ?? base.schemaVersion,
-    allowInterception: extra.allowInterception ?? base.allowInterception,
-    interceptions: extra.interceptions ?? base.interceptions,
-    correlationId: extra.correlationId ?? base.correlationId,
-    causationId: extra.causationId ?? base.causationId,
-    traceId: extra.traceId ?? base.traceId,
-    spanId: extra.spanId ?? base.spanId,
-    parentSpanId: extra.parentSpanId ?? base.parentSpanId
+  const visit = (node) => {
+    if (ts.isImportDeclaration(node)) {
+      add(node, "import", literalText(ts, node.moduleSpecifier), isTypeOnlyReference(ts, node));
+    } else if (ts.isExportDeclaration(node) && node.moduleSpecifier) {
+      add(node, "export", literalText(ts, node.moduleSpecifier), isTypeOnlyReference(ts, node));
+    } else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference)) {
+      add(node, "require", literalText(ts, node.moduleReference.expression));
+    } else if (ts.isCallExpression(node)) {
+      const dynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword;
+      const requireCall = ts.isIdentifier(node.expression) && node.expression.text === "require";
+      const directRequire = requireCall && !localDeclaration(
+        ts,
+        checker ?? (checker = singleFileChecker(ts, sourceFile)),
+        sourceFile,
+        node.expression
+      );
+      if (dynamicImport || directRequire) {
+        add(node, directRequire ? "require" : "dynamic-import", literalText(ts, node.arguments[0]));
+      }
+    }
+    ts.forEachChild(node, visit);
   };
+  visit(sourceFile);
+  return dependencies;
 }
-
-// src/kernel/event-bus/EventBus.ts
-var interceptorSequence = 0;
-function nextInterceptorRegistrationId() {
-  interceptorSequence += 1;
-  return `interceptor-${Date.now()}-${interceptorSequence}`;
-}
-var EventBusImpl = class {
-  subscriptions = [];
-  subscriptionsByIntent = /* @__PURE__ */ new Map();
-  interceptors = [];
-  interceptorsByIntent = /* @__PURE__ */ new Map();
-  recording;
-  onPublish;
-  onSoftViolation;
-  onHandlerError;
-  eventContracts;
-  strictEventContracts;
-  requireKnownSource;
-  architectureProfile;
-  enforceObservedLayerFlowMode;
-  rethrowHandlerErrors;
-  policyEngine;
-  getPolicyContext;
-  intentRegistry;
-  dependencyGraph;
-  strictRegistry;
-  validateIntentNaming;
-  constructor(options = {}) {
-    this.onPublish = options.onPublish;
-    this.onSoftViolation = options.onSoftViolation;
-    this.onHandlerError = options.onHandlerError;
-    this.eventContracts = options.eventContracts;
-    this.strictEventContracts = options.strictEventContracts ?? false;
-    this.requireKnownSource = options.requireKnownSource ?? false;
-    this.architectureProfile = options.architectureProfile;
-    this.enforceObservedLayerFlowMode = options.enforceObservedLayerFlow ?? "off";
-    this.rethrowHandlerErrors = options.rethrowHandlerErrors ?? false;
-    this.intentRegistry = options.intentRegistry;
-    this.dependencyGraph = options.dependencyGraph;
-    this.strictRegistry = options.strictRegistry ?? options.intentRegistry !== void 0;
-    this.validateIntentNaming = options.validateIntentNaming ?? this.strictRegistry;
-    this.recording = {
-      history: [],
-      trace: [],
-      maxHistorySize: options.maxHistorySize,
-      traceSinks: [...options.traceSinks ?? []],
-      auditTrail: options.auditTrail,
-      outbox: options.outbox,
-      instanceId: options.instanceId
-    };
-    if (options.policyEngine) {
-      this.policyEngine = options.policyEngine;
-    } else if (options.policies && options.policies.length > 0) {
-      this.policyEngine = new PolicyEngine(options.policies);
-    }
-    const allPolicies = this.policyEngine?.getPolicies() ?? options.policies ?? [];
-    if (allPolicies.some(isLayerPolicy) && !options.intentRegistry && !options.dependencyGraph && !options.getPolicyContext) {
-      throw new LayerPolicyContextError();
-    }
-    if (options.getPolicyContext) {
-      this.getPolicyContext = options.getPolicyContext;
-    } else if (options.intentRegistry || options.dependencyGraph) {
-      this.getPolicyContext = buildPublishPolicyContext({
-        intentRegistry: options.intentRegistry,
-        dependencyGraph: options.dependencyGraph
-      });
-    } else {
-      this.getPolicyContext = (event) => ({ event });
+function staticAccessPath(ts, node) {
+  const segments = [];
+  let current = node;
+  while (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+    if (ts.isPropertyAccessExpression(current)) segments.unshift(current.name.text);
+    else {
+      const property = literalText(ts, current.argumentExpression);
+      if (property === void 0) return void 0;
+      segments.unshift(property);
     }
+    current = current.expression;
   }
-  async publish(eventOrCreator, payloadOrMeta, metadata) {
-    let event;
-    const rawPublish = typeof eventOrCreator !== "function";
-    if (!rawPublish) {
-      const creator = eventOrCreator;
-      const payload = payloadOrMeta;
-      const extraMeta = metadata ?? {};
-      const created = creator(payload);
-      event = {
-        ...created,
-        metadata: enrichMetadata(
-          created.metadata,
-          extraMeta,
-          this.recording.instanceId
-        )
-      };
-    } else {
-      const rawEvent = eventOrCreator;
-      const extraMeta = metadata ?? payloadOrMeta ?? {};
-      event = {
-        ...rawEvent,
-        metadata: enrichMetadata(
-          rawEvent.metadata,
-          extraMeta,
-          this.recording.instanceId
-        )
-      };
+  if (!ts.isIdentifier(current)) return void 0;
+  segments.unshift(current.text);
+  return { root: current, segments };
+}
+function runtimeIdentifierReference(ts, node) {
+  const parent = node.parent;
+  if (ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) return false;
+  return ts.isExpressionNode(node) && !ts.isInTypeQuery(node) || ts.isShorthandPropertyAssignment(parent) && parent.name === node;
+}
+function bestForbiddenMatch(entries, segments) {
+  const normalized = segments[0] === "globalThis" ? segments.slice(1) : segments;
+  for (let length = normalized.length; length >= 1; length -= 1) {
+    const candidate = normalized.slice(0, length).join(".");
+    if (entries.has(candidate)) return candidate;
+  }
+  return void 0;
+}
+function collectForbiddenCapabilityUses(ts, sourceFile, forbidden) {
+  if (forbidden.length === 0) return [];
+  const entries = new Set(forbidden);
+  const checker = singleFileChecker(ts, sourceFile);
+  const aliases = /* @__PURE__ */ new Map();
+  const topLevelNames = /* @__PURE__ */ new Set();
+  for (const statement of sourceFile.statements) {
+    if (ts.isVariableStatement(statement)) {
+      for (const declaration of statement.declarationList.declarations) {
+        if (ts.isIdentifier(declaration.name)) topLevelNames.add(declaration.name.text);
+      }
     }
-    if (rawPublish && this.strictRegistry) {
-      await recordRawPublishDiagnostic(this.recording, event);
+  }
+  const resolvePath = (node) => {
+    const path = staticAccessPath(ts, node);
+    if (!path) return void 0;
+    const symbol = symbolAt(checker, path.root);
+    const alias = symbol ? aliases.get(symbol) : void 0;
+    if (alias) return [...alias, ...path.segments.slice(1)];
+    return localDeclaration(ts, checker, sourceFile, path.root) || topLevelNames.has(path.root.text) ? void 0 : path.segments;
+  };
+  for (const statement of sourceFile.statements) {
+    if (!ts.isVariableStatement(statement)) continue;
+    for (const declaration of statement.declarationList.declarations) {
+      if (!declaration.initializer || !ts.isIdentifier(declaration.name)) continue;
+      const path = resolvePath(declaration.initializer);
+      const symbol = symbolAt(checker, declaration.name);
+      if (!path || !symbol) continue;
+      aliases.set(symbol, path);
     }
-    assertIntentAllowed(event.intent, {
-      strictRegistry: this.strictRegistry,
-      validateIntentNaming: this.validateIntentNaming,
-      intentRegistry: this.intentRegistry
-    });
-    assertSourceAllowed(event, {
-      requireKnownSource: this.requireKnownSource,
-      intentRegistry: this.intentRegistry
-    });
-    assertContractAllowed(event, {
-      eventContracts: this.eventContracts,
-      strictEventContracts: this.strictEventContracts
-    });
-    event = await applyInterceptors(event, {
-      interceptorsForIntent: (intent) => this.interceptorsByIntent.get(intent) ?? [],
-      eventContracts: this.eventContracts,
-      strictEventContracts: this.strictEventContracts,
-      appendTrace: (r) => this.appendTrace(r),
-      recordAudit: (type, e, details) => this.recordAudit(type, e, details)
-    });
-    assertContractAllowed(event, {
-      eventContracts: this.eventContracts,
-      strictEventContracts: this.strictEventContracts
-    });
-    await assertObservedLayerFlowAllowed(event, {
-      mode: this.enforceObservedLayerFlowMode,
-      architectureProfile: this.architectureProfile,
-      appendTrace: (r) => this.appendTrace(r),
-      recordAudit: (type, e, details) => this.recordAudit(type, e, details)
-    });
-    this.dependencyGraph?.registerEventFlow(event.metadata.source, event.intent);
-    const matching = [...this.subscriptionsByIntent.get(event.intent) ?? []];
-    if (this.policyEngine) {
-      await enforcePublishPolicy(event, {
-        policyEngine: this.policyEngine,
-        getPolicyContext: this.getPolicyContext,
-        appendTrace: (r) => this.appendTrace(r),
-        recordAudit: (type, e, details) => this.recordAudit(type, e, details),
-        onSoftViolation: this.onSoftViolation,
-        safeHook: (fn, name, e) => this.safeHook(fn, name, e)
-      });
-    }
-    await recordSuccessfulPublish(
-      this.recording,
-      event,
-      matching.length
-    );
-    await Promise.all(
-      matching.map((sub) => this.invokeHandler(sub, event))
-    );
-    if (this.onPublish) {
-      await this.safeHook(
-        () => this.onPublish(event),
-        "onPublish",
-        event
-      );
-    }
-  }
-  createPublisher(source) {
-    const sourceName = typeof source === "string" ? source : source.name;
-    assertIntentAllowed(sourceName, {
-      strictRegistry: this.strictRegistry,
-      validateIntentNaming: this.validateIntentNaming,
-      intentRegistry: this.intentRegistry
-    });
-    return {
-      source: sourceName,
-      publish: async (intent, payload, metadata = {}) => {
-        if (metadata.source && metadata.source !== sourceName) {
-          throw new SourceMetadataOverrideError(sourceName, metadata.source);
-        }
-        await this.publish(intent, payload, {
-          ...metadata,
-          source: sourceName
-        });
-      }
-    };
-  }
-  subscribe(intent, handler) {
-    const intentName = typeof intent === "string" ? intent : intent.name;
-    assertIntentAllowed(intentName, {
-      strictRegistry: this.strictRegistry,
-      validateIntentNaming: this.validateIntentNaming,
-      intentRegistry: this.intentRegistry
-    });
-    const sub = {
-      intentName,
-      handler
-    };
-    this.subscriptions.push(sub);
-    const subscriptionsForIntent = this.subscriptionsByIntent.get(intentName) ?? [];
-    subscriptionsForIntent.push(sub);
-    this.subscriptionsByIntent.set(intentName, subscriptionsForIntent);
-    return () => {
-      const idx = this.subscriptions.indexOf(sub);
-      if (idx >= 0) this.subscriptions.splice(idx, 1);
-      const byIntent = this.subscriptionsByIntent.get(intentName);
-      if (!byIntent) return;
-      const intentIdx = byIntent.indexOf(sub);
-      if (intentIdx >= 0) byIntent.splice(intentIdx, 1);
-      if (byIntent.length === 0) this.subscriptionsByIntent.delete(intentName);
-    };
-  }
-  registerInterceptor(intent, interceptor, interceptorId) {
-    const intentName = typeof intent === "string" ? intent : intent.name;
-    assertIntentAllowed(intentName, {
-      strictRegistry: this.strictRegistry,
-      validateIntentNaming: this.validateIntentNaming,
-      intentRegistry: this.intentRegistry
-    });
-    const registration = {
-      registrationId: nextInterceptorRegistrationId(),
-      interceptorId: interceptorId ?? intentName,
-      intentName,
-      interceptor,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    this.interceptors.push(registration);
-    const interceptorsForIntent = this.interceptorsByIntent.get(intentName) ?? [];
-    interceptorsForIntent.push(registration);
-    this.interceptorsByIntent.set(intentName, interceptorsForIntent);
-    return registration.registrationId;
-  }
-  unregisterInterceptor(registrationId) {
-    const interceptor = this.interceptors.find(
-      (candidate) => candidate.registrationId === registrationId
-    );
-    if (!interceptor) return false;
-    const idx = this.interceptors.indexOf(interceptor);
-    if (idx >= 0) this.interceptors.splice(idx, 1);
-    const byIntent = this.interceptorsByIntent.get(interceptor.intentName);
-    if (byIntent) {
-      const intentIdx = byIntent.indexOf(interceptor);
-      if (intentIdx >= 0) byIntent.splice(intentIdx, 1);
-      if (byIntent.length === 0) this.interceptorsByIntent.delete(interceptor.intentName);
-    }
-    return true;
   }
-  listInterceptors(intent) {
-    return this.interceptors.filter((interceptor) => !intent || interceptor.intentName === intent).map((interceptor) => ({
-      registrationId: interceptor.registrationId,
-      interceptorId: interceptor.interceptorId,
-      intent: interceptor.intentName,
-      createdAt: interceptor.createdAt,
-      lastInterceptedAt: interceptor.lastInterceptedAt
-    }));
-  }
-  getHistory() {
-    return [...this.recording.history];
-  }
-  clearHistory() {
-    this.recording.history.length = 0;
-  }
-  getTrace() {
-    return [...this.recording.trace];
-  }
-  clearTrace() {
-    this.recording.trace.length = 0;
-  }
-  appendTrace(record) {
-    appendTrace(this.recording, record);
-  }
-  async recordAudit(type, event, details) {
-    await recordAudit(this.recording, type, event, details);
-  }
-  async invokeHandler(sub, event) {
-    try {
-      await Promise.resolve(sub.handler(event));
-    } catch (err) {
-      this.appendTrace({
-        type: "handler.error",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        intent: event.intent,
-        correlationId: event.metadata.correlationId,
-        traceId: event.metadata.traceId,
-        spanId: event.metadata.spanId,
-        details: { error: err instanceof Error ? err.message : String(err) }
-      });
-      await this.recordAudit("handler.error", event, {
-        handlerIntent: sub.intentName,
-        error: err instanceof Error ? err.message : String(err)
-      });
-      if (this.onHandlerError) {
-        await this.safeHook(
-          () => this.onHandlerError(err, event, sub.intentName),
-          "onHandlerError",
-          event
-        );
-      }
-      if (this.rethrowHandlerErrors) {
-        throw err;
-      }
+  const uses = [];
+  const seen = /* @__PURE__ */ new Set();
+  const flag = (name, node) => {
+    const line = lineOf(sourceFile, node);
+    const key = `${name}:${node.getStart(sourceFile)}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    uses.push({ name, line, node });
+  };
+  const visit = (node) => {
+    const parentContinuesPath = node.parent && (ts.isPropertyAccessExpression(node.parent) || ts.isElementAccessExpression(node.parent)) && node.parent.expression === node;
+    if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && !parentContinuesPath) {
+      const path = resolvePath(node);
+      const match = path ? bestForbiddenMatch(entries, path) : void 0;
+      if (match) flag(match, node);
+    } else if (ts.isIdentifier(node) && entries.has(node.text) && runtimeIdentifierReference(ts, node) && !localDeclaration(ts, checker, sourceFile, node)) {
+      flag(node.text, node);
     }
-  }
-  async safeHook(fn, hookName, event) {
-    try {
-      await Promise.resolve(fn());
-    } catch (err) {
-      this.appendTrace({
-        type: "hook.error",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        intent: event.intent,
-        correlationId: event.metadata.correlationId,
-        traceId: event.metadata.traceId,
-        spanId: event.metadata.spanId,
-        details: {
-          hook: hookName,
-          error: err instanceof Error ? err.message : String(err)
+    if (ts.isVariableDeclaration(node) && ts.isObjectBindingPattern(node.name) && node.initializer) {
+      const base = resolvePath(node.initializer);
+      if (base) {
+        for (const element of node.name.elements) {
+          if (!ts.isIdentifier(element.name)) continue;
+          const property = element.propertyName ? literalText(ts, element.propertyName) ?? element.propertyName.text : element.name.text;
+          const match = bestForbiddenMatch(entries, [...base, property]);
+          if (match) flag(match, node.initializer);
         }
-      });
-      await this.recordAudit("hook.error", event, {
-        hook: hookName,
-        error: err instanceof Error ? err.message : String(err)
-      });
+      }
     }
-  }
-};
-function createEventBus(options) {
-  return new EventBusImpl(options);
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return uses;
 }
 
-// src/kernel/event-contracts/EventContractRegistry.ts
-function formatStandardSchemaPath(path) {
-  if (!path || path.length === 0) return void 0;
-  return path.map(
-    (segment) => typeof segment === "object" && segment !== null && "key" in segment ? String(segment.key) : String(segment)
-  ).join(".");
-}
-function actualType(value) {
-  if (Array.isArray(value)) return "array";
-  if (value === null) return "object";
-  const type = typeof value;
-  if (type === "string" || type === "number" || type === "boolean" || type === "object") {
-    return type;
-  }
-  return "unknown";
-}
-function formatPath(parent, field) {
-  return parent ? `${parent}.${field}` : field;
-}
-function validateSchemaField(value, fieldSchema, path, contract, issues) {
-  const valueType2 = actualType(value);
-  if (fieldSchema.type !== "unknown" && valueType2 !== fieldSchema.type) {
-    issues.push({
-      intent: contract.intent,
-      version: contract.version,
-      field: path,
-      message: `Expected ${fieldSchema.type}, received ${valueType2}.`
-    });
-    return;
-  }
-  if (fieldSchema.enum && !fieldSchema.enum.some((allowed) => Object.is(allowed, value))) {
-    issues.push({
-      intent: contract.intent,
-      version: contract.version,
-      field: path,
-      message: "Value is not allowed by event contract enum."
-    });
-  }
-  if (fieldSchema.type === "object" && fieldSchema.fields) {
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-      issues.push({
-        intent: contract.intent,
-        version: contract.version,
-        field: path,
-        message: "Nested object field must be a non-array object."
-      });
-      return;
-    }
-    validateObjectSchema(
-      value,
-      fieldSchema.fields,
-      contract,
-      issues,
-      path
-    );
-  }
-  if (fieldSchema.type === "array" && fieldSchema.items && Array.isArray(value)) {
-    value.forEach((item, index) => {
-      validateSchemaField(
-        item,
-        fieldSchema.items,
-        `${path}[${index}]`,
-        contract,
-        issues
-      );
-    });
-  }
+// src/kernel/ai-gate/AICodeGate.ts
+function violation(ruleId, message, extra) {
+  return { ruleId, code: ruleId, message, ...extra };
 }
-function validateObjectSchema(payload, schema, contract, issues, parentPath) {
-  for (const [field, fieldSchema] of Object.entries(schema)) {
-    const path = formatPath(parentPath, field);
-    const value = payload[field];
-    if (value === void 0) {
-      if (fieldSchema.required) {
-        issues.push({
-          intent: contract.intent,
-          version: contract.version,
-          field: path,
-          message: "Required field is missing."
-        });
-      }
-      continue;
-    }
-    validateSchemaField(value, fieldSchema, path, contract, issues);
-  }
+function lineOf2(source, index) {
+  return source.slice(0, index).split("\n").length;
 }
-var EventContractRegistryImpl = class {
-  contracts = /* @__PURE__ */ new Map();
-  register(contract) {
-    const key = this.key(contract.intent, contract.version);
-    if (this.contracts.has(key)) {
-      throw new Error(`Event contract "${key}" is already registered.`);
-    }
-    this.contracts.set(key, { allowAdditionalFields: true, ...contract });
-  }
-  get(intent, version2) {
-    if (version2) return this.contracts.get(this.key(intent, version2));
-    return this.list(intent).at(-1);
-  }
-  list(intent) {
-    return Array.from(this.contracts.values()).filter(
-      (contract) => !intent || contract.intent === intent
-    );
+function extractQuotedStrings(source) {
+  const matches = [];
+  const re = /['"`]([A-Za-z][A-Za-z0-9_.]*)['"`]/g;
+  let m;
+  while ((m = re.exec(source)) !== null) {
+    matches.push({ value: m[1], index: m.index });
   }
-  validate(event) {
-    const version2 = event.metadata.eventVersion;
-    const contract = this.get(event.intent, version2);
-    const issues = [];
-    if (!contract) {
-      return {
-        ok: false,
-        issues: [
-          {
-            intent: event.intent,
-            version: version2,
-            message: version2 ? `No event contract registered for version "${version2}".` : "No event contract registered for intent."
-          }
-        ]
-      };
-    }
-    if (contract.deprecated) {
-      issues.push({
-        intent: event.intent,
-        version: contract.version,
-        message: typeof contract.deprecated === "string" ? contract.deprecated : "Event contract is deprecated."
-      });
-    }
-    const payload = event.payload != null && typeof event.payload === "object" ? event.payload : void 0;
-    if (contract.schema) {
-      if (!payload) {
-        issues.push({
-          intent: event.intent,
-          version: contract.version,
-          message: "Payload must be an object for schema validation."
-        });
-      } else {
-        validateObjectSchema(payload, contract.schema, contract, issues);
-        if (contract.allowAdditionalFields === false) {
-          for (const field of Object.keys(payload)) {
-            if (!contract.schema[field]) {
-              issues.push({
-                intent: event.intent,
-                version: contract.version,
-                field,
-                message: "Additional field is not allowed by event contract."
-              });
-            }
-          }
-        }
-      }
+  return matches;
+}
+function extractModuleSpecifiers(source) {
+  const matches = [];
+  const patterns = [
+    {
+      kind: "import",
+      re: /\bimport\s+(?:type\s+)?(?:[^'"]*?\s+from\s*)?['"]([^'"]+)['"]/g
+    },
+    {
+      kind: "export",
+      re: /\bexport\s+(?:type\s+)?[^'"]*?\s+from\s*['"]([^'"]+)['"]/g
+    },
+    {
+      kind: "dynamic-import",
+      re: /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g
+    },
+    {
+      kind: "require",
+      re: /\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g
     }
-    if (contract.standardSchema) {
-      const result = contract.standardSchema["~standard"].validate(event.payload);
-      if (result instanceof Promise) {
-        issues.push({
-          intent: event.intent,
-          version: contract.version,
-          message: "Standard Schema validator returned a Promise; event contract validation is synchronous."
-        });
-      } else if (result.issues) {
-        for (const issue of result.issues) {
-          issues.push({
-            intent: event.intent,
-            version: contract.version,
-            field: formatStandardSchemaPath(issue.path),
-            message: issue.message
-          });
-        }
-      }
+  ];
+  for (const pattern of patterns) {
+    let match;
+    while ((match = pattern.re.exec(source)) !== null) {
+      const index = match.index + match[0].indexOf(match[1]);
+      const raw = match[0];
+      const typeOnly = pattern.kind === "import" && /\bimport\s+type\b/.test(raw) || pattern.kind === "export" && /\bexport\s+type\b/.test(raw);
+      matches.push({ value: match[1], index, kind: pattern.kind, typeOnly });
     }
-    return { ok: issues.length === 0, contract, issues };
   }
-  clear() {
-    this.contracts.clear();
-  }
-  key(intent, version2) {
-    return `${intent}@${version2}`;
-  }
-};
-function createEventContractRegistry() {
-  return new EventContractRegistryImpl();
-}
-
-// src/kernel/outbox/InMemoryOutboxStore.ts
-var outboxSequence = 0;
-function nextOutboxId() {
-  outboxSequence += 1;
-  return `outbox-${Date.now()}-${outboxSequence}`;
+  return matches.sort((a, b) => a.index - b.index);
 }
-function cloneRecord(record) {
-  return {
-    ...record,
-    event: {
-      ...record.event,
-      metadata: { ...record.event.metadata }
+function extractQuotedStringsAst(ts, source) {
+  const sourceFile = ts.createSourceFile("generated.ts", source, ts.ScriptTarget.Latest, true);
+  const matches = [];
+  const visit = (node) => {
+    if (ts.isStringLiteralLike(node)) {
+      matches.push({ value: node.text, index: node.getStart(sourceFile) });
     }
+    ts.forEachChild(node, visit);
   };
+  visit(sourceFile);
+  return matches;
 }
-var InMemoryOutboxStore = class {
-  records = /* @__PURE__ */ new Map();
-  async enqueue(event) {
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const record = {
-      id: nextOutboxId(),
-      event,
-      status: "pending",
-      attempts: 0,
-      createdAt: now,
-      updatedAt: now
-    };
-    this.records.set(record.id, record);
-    return cloneRecord(record);
-  }
-  async markDispatched(id) {
-    const record = this.records.get(id);
-    if (!record) return;
-    record.status = "dispatched";
-    record.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  }
-  async markFailed(id, error) {
-    const record = this.records.get(id);
-    if (!record) return;
-    record.status = "failed";
-    record.attempts += 1;
-    record.error = error instanceof Error ? error.message : String(error);
-    record.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  }
-  async list(status) {
-    return Array.from(this.records.values()).filter((record) => !status || record.status === status).map(cloneRecord);
-  }
-  async clear() {
-    this.records.clear();
-  }
-};
-
-// src/kernel/observability/ObservabilityReporter.ts
-function flowKey(flow) {
-  return `${flow.from}->${flow.to}`;
+function hasInfrastructureToken(specifier) {
+  const tokens = specifier.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+  return [
+    "adapter",
+    "adapters",
+    "infra",
+    "infrastructure",
+    "persistence",
+    "repository",
+    "repositories",
+    "integration",
+    "database",
+    "db"
+  ].some((token) => tokens.includes(token));
 }
-function uniqueFlows(flows) {
-  const seen = /* @__PURE__ */ new Set();
-  const result = [];
-  for (const flow of flows) {
-    const key = flowKey(flow);
-    if (seen.has(key)) continue;
-    seen.add(key);
-    result.push(flow);
-  }
-  return result;
+function isKnownInfrastructurePackage(specifier) {
+  const normalized = specifier.toLowerCase();
+  return ["sequelize", "prisma", "typeorm", "mongoose", "knex"].some(
+    (name) => normalized === name || normalized.startsWith(`${name}/`)
+  );
 }
-function difference(left, right) {
-  const rightKeys = new Set(right.map(flowKey));
-  return left.filter((flow) => !rightKeys.has(flowKey(flow)));
+function layerHasInfrastructureRole(layerName) {
+  const normalized = layerName.toLowerCase();
+  return [
+    "adapter",
+    "infra",
+    "persistence",
+    "repository",
+    "repositories",
+    "integration",
+    "database"
+  ].some((token) => normalized.includes(token));
 }
-function createObservabilityReporter(options) {
-  const registry = options.registry;
-  const eventBus = options.eventBus;
-  const graph = options.graph;
-  return {
-    report() {
-      const declaredFromRegistry = registry ? registry.getAllRelationships().filter((relationship) => relationship.kind === "produces").map((relationship) => ({
-        from: relationship.from,
-        to: relationship.to
-      })) : [];
-      const declaredFromGraph = declaredFromRegistry.length > 0 || !graph ? [] : graph.getEdges().filter((edge) => edge.kind === "produces").map((edge) => ({ from: edge.from, to: edge.to }));
-      const observedFromHistory = eventBus?.getHistory().map((record) => ({
-        from: record.event.metadata.source,
-        to: record.event.intent
-      })) ?? [];
-      const observedFromGraph = observedFromHistory.length > 0 || !graph ? [] : graph.getEdges().filter((edge) => edge.kind === "observed").map((edge) => ({ from: edge.from, to: edge.to }));
-      const declaredProductions = uniqueFlows([
-        ...declaredFromRegistry,
-        ...declaredFromGraph
-      ]);
-      const observedProductions = uniqueFlows([
-        ...observedFromHistory,
-        ...observedFromGraph
-      ]);
-      const unknownSources = observedProductions.filter(
-        (flow) => !flow.from || flow.from === "unknown"
-      );
-      const unregisteredObservedSources = registry ? Array.from(
-        new Set(
-          observedProductions.map((flow) => flow.from).filter(
-            (source) => source && source !== "unknown" && !registry.has(source)
-          )
-        )
-      ) : [];
-      const unregisteredObservedIntents = registry ? Array.from(
-        new Set(
-          observedProductions.map((flow) => flow.to).filter((intent) => !registry.has(intent))
-        )
-      ) : [];
-      const observedIntentNames = new Set(
-        observedProductions.flatMap((flow) => [flow.from, flow.to])
-      );
-      const registeredButNeverObserved = registry ? registry.list().map((intent) => intent.name).filter((intent) => !observedIntentNames.has(intent)) : [];
-      return {
-        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        declaredProductions,
-        observedProductions,
-        declaredButUnobserved: difference(declaredProductions, observedProductions),
-        observedButUndeclared: difference(
-          observedProductions.filter((flow) => flow.from !== "unknown"),
-          declaredProductions
-        ),
-        unknownSources,
-        unregisteredObservedSources,
-        unregisteredObservedIntents,
-        registeredButNeverObserved
-      };
-    }
-  };
+function tsStringLiteralText(ts, node) {
+  return node && ts.isStringLiteralLike(node) ? node.text : void 0;
 }
-
-// src/kernel/testing/ArkTestHarness.ts
-function createArkTestHarness(kernel) {
-  return {
-    events(intent) {
-      return kernel.eventBus.getHistory().map((record) => record.event).filter((event) => !intent || event.intent === intent);
-    },
-    traces(type) {
-      return kernel.eventBus.getTrace().filter((record) => !type || record.type === type);
-    },
-    audit(query) {
-      return kernel.auditTrail.query(query);
-    },
-    outbox(status) {
-      return kernel.outbox.list(status);
-    },
-    observability() {
-      kernel.syncGraph();
-      return kernel.observability.report();
-    },
-    async snapshot() {
-      return {
-        events: this.events(),
-        traces: this.traces(),
-        audit: await this.audit(),
-        outbox: await this.outbox(),
-        observability: this.observability()
-      };
-    },
-    async clear() {
-      kernel.eventBus.clearHistory();
-      kernel.eventBus.clearTrace();
-      await kernel.auditTrail.clear();
-      await kernel.outbox.clear();
-    }
-  };
+function tsPropertyName(ts, node) {
+  if (!node) return void 0;
+  if (ts.isIdentifier(node) || ts.isStringLiteralLike(node)) return node.text;
+  return void 0;
 }
-
-// src/kernel/audit/AuditTrail.ts
-var auditSequence = 0;
-function createAuditId() {
-  auditSequence += 1;
-  return `audit-${Date.now()}-${auditSequence}`;
-}
-function matchesQuery(record, query) {
-  if (query.type && record.type !== query.type) return false;
-  if (query.intent && record.intent !== query.intent) return false;
-  if (query.correlationId && record.correlationId !== query.correlationId) return false;
-  if (query.subject && record.subject !== query.subject) return false;
-  if (query.since && record.timestamp < query.since) return false;
-  if (query.until && record.timestamp > query.until) return false;
-  return true;
-}
-var InMemoryAuditStore = class {
-  constructor(maxRecords) {
-    this.maxRecords = maxRecords;
-  }
-  maxRecords;
-  records = [];
-  append(record) {
-    this.records.push(record);
-    if (this.maxRecords !== void 0 && this.records.length > this.maxRecords) {
-      this.records.splice(0, this.records.length - this.maxRecords);
+function tsObjectProperty(ts, node, name) {
+  if (!node || !ts.isObjectLiteralExpression(node)) return void 0;
+  return node.properties.find((property) => {
+    if (!ts.isPropertyAssignment(property) && !ts.isShorthandPropertyAssignment(property)) {
+      return false;
     }
-  }
-  query(query = {}) {
-    const records = this.records.filter((record) => matchesQuery(record, query));
-    return query.limit === void 0 ? [...records] : records.slice(-query.limit);
-  }
-  clear() {
-    this.records.length = 0;
-  }
-};
-var AuditTrailImpl = class {
-  constructor(store) {
-    this.store = store;
-  }
-  store;
-  async record(input) {
-    const record = {
-      id: createAuditId(),
-      timestamp: input.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
-      type: input.type,
-      source: input.source,
-      actor: input.actor,
-      intent: input.intent,
-      correlationId: input.correlationId,
-      causationId: input.causationId,
-      subject: input.subject,
-      details: input.details
-    };
-    await this.store.append(record);
-    return record;
-  }
-  async query(query) {
-    return this.store.query(query);
-  }
-  async clear() {
-    await this.store.clear();
-  }
-};
-function createAuditTrail(options = {}) {
-  return new AuditTrailImpl(
-    options.store ?? new InMemoryAuditStore(options.maxRecords)
-  );
+    return tsPropertyName(ts, property.name) === name;
+  });
 }
-
-// src/kernel/graph/DependencyGraph.ts
-var DependencyGraphImpl = class {
-  nodes = /* @__PURE__ */ new Map();
-  edges = [];
-  registerDependency(from, to, kind = "declared") {
-    this.ensureNode(from);
-    this.ensureNode(to);
-    this.addEdge({ from, to, kind });
-  }
-  registerEventFlow(producer, consumer) {
-    this.ensureNode(producer);
-    this.ensureNode(consumer);
-    this.addEdge({ from: producer, to: consumer, kind: "observed" });
-  }
-  getNodes() {
-    return Array.from(this.nodes.values());
-  }
-  getEdges() {
-    return [...this.edges];
+function tsObjectHasProperty(ts, node, name) {
+  return tsObjectProperty(ts, node, name) !== void 0;
+}
+function tsObjectPropertyValue(ts, node, name) {
+  const property = tsObjectProperty(ts, node, name);
+  return property && ts.isPropertyAssignment(property) ? property.initializer : void 0;
+}
+function tsObjectHasMetadataSource(ts, node) {
+  const metadata = tsObjectPropertyValue(ts, node, "metadata");
+  return tsObjectHasProperty(ts, metadata, "source");
+}
+function tsLooksLikeIntentCreatorExpression(ts, node) {
+  if (!node) return false;
+  if (ts.isIdentifier(node)) return /^[A-Z]/.test(node.text);
+  if (ts.isPropertyAccessExpression(node)) {
+    return tsLooksLikeIntentCreatorExpression(ts, node.name);
   }
-  toJSON() {
-    return {
-      nodes: this.getNodes(),
-      edges: this.getEdges()
-    };
-  }
-  toMermaid() {
-    let out = "flowchart TD\n";
-    for (const edge of this.edges) {
-      const label = edge.kind ? `|${edge.kind}|` : "";
-      out += `  ${this.safeId(edge.from)} -->${label} ${this.safeId(edge.to)}
-`;
-    }
-    const connected = new Set(
-      this.edges.flatMap((e) => [e.from, e.to])
-    );
-    for (const node of this.nodes.keys()) {
-      if (!connected.has(node)) {
-        out += `  ${this.safeId(node)}
-`;
-      }
-    }
-    return out.trim();
-  }
-  toLayerMermaid(profile) {
-    const nodesByLayer = /* @__PURE__ */ new Map();
-    for (const node of this.nodes.keys()) {
-      const layer = profile.resolveLayer(node) ?? "Unclassified";
-      const current = nodesByLayer.get(layer) ?? [];
-      current.push(node);
-      nodesByLayer.set(layer, current);
-    }
-    let out = "flowchart TD\n";
-    for (const layer of profile.layers) {
-      const nodes = nodesByLayer.get(layer.name) ?? [];
-      if (nodes.length === 0) continue;
-      out += `  subgraph ${this.safeId(layer.name)}[${layer.name}]
-`;
-      for (const node of nodes) {
-        out += `    ${this.safeId(node)}[${node}]
-`;
-      }
-      out += "  end\n";
-    }
-    const unclassified = nodesByLayer.get("Unclassified") ?? [];
-    if (unclassified.length > 0) {
-      out += "  subgraph Unclassified[Unclassified]\n";
-      for (const node of unclassified) {
-        out += `    ${this.safeId(node)}[${node}]
-`;
-      }
-      out += "  end\n";
-    }
-    for (const edge of this.edges) {
-      const label = edge.kind ? `|${edge.kind}|` : "";
-      out += `  ${this.safeId(edge.from)} -->${label} ${this.safeId(edge.to)}
-`;
-    }
-    return out.trim();
-  }
-  detectViolations(rules = []) {
-    const violations = [];
-    const cycles = this.findSimpleCycles();
-    if (cycles.length > 0) {
-      violations.push(`Cycle detected: ${cycles.map((c) => c.join("->")).join(", ")}`);
-    }
-    for (const rule of rules) {
-      try {
-        const res = rule(this.edges);
-        if (res && res.length) violations.push(...res);
-      } catch (e) {
-        violations.push(`Rule error: ${e.message}`);
-      }
-    }
-    return violations;
-  }
-  ensureNode(id) {
-    if (!this.nodes.has(id)) {
-      this.nodes.set(id, { id });
-    }
-  }
-  addEdge(edge) {
-    const exists = this.edges.some(
-      (e) => e.from === edge.from && e.to === edge.to && e.kind === edge.kind
-    );
-    if (!exists) {
-      this.edges.push(edge);
-    }
-  }
-  // Very naive cycle detection for small graphs
-  findSimpleCycles() {
-    const graph = /* @__PURE__ */ new Map();
-    for (const e of this.edges) {
-      if (!graph.has(e.from)) graph.set(e.from, []);
-      graph.get(e.from).push(e.to);
-    }
-    const cycles = [];
-    const visited = /* @__PURE__ */ new Set();
-    const stack = [];
-    const dfs = (node) => {
-      visited.add(node);
-      stack.push(node);
-      for (const nei of graph.get(node) || []) {
-        if (!visited.has(nei)) {
-          dfs(nei);
-        } else if (stack.includes(nei)) {
-          const cycleStart = stack.indexOf(nei);
-          const cycle = stack.slice(cycleStart).concat(nei);
-          cycles.push(cycle);
-        }
-      }
-      stack.pop();
-    };
-    for (const node of graph.keys()) {
-      if (!visited.has(node)) dfs(node);
-    }
-    const unique = new Set(cycles.map((c) => c.join("->")));
-    return Array.from(unique).map((s) => s.split("->"));
-  }
-  safeId(id) {
-    return id.replace(/[^a-zA-Z0-9_]/g, "_");
-  }
-};
-function createDependencyGraph() {
-  return new DependencyGraphImpl();
-}
-
-// src/kernel/graph/sync.ts
-function syncRegistryToGraph(registry, graph, options = {}) {
-  const requireRegistered = options.requireRegisteredTargets ?? false;
-  for (const rel of registry.getAllRelationships()) {
-    if (requireRegistered && !registry.has(rel.to)) {
-      continue;
-    }
-    if (rel.kind === "dependsOn") {
-      graph.registerDependency(rel.from, rel.to, "declared");
-    } else {
-      graph.registerDependency(rel.from, rel.to, "produces");
-    }
-  }
-}
-
-// src/domain/configContract.ts
-var ARK_CONFIG_SCHEMA_VERSION = "1.0";
-var ARK_CONFIG_SCHEMA_URL = "https://unpkg.com/arkgate@2/schemas/ark.config.schema.json";
-var DEFAULT_LAYER_NAMES = [
-  "DomainModel",
-  "ApplicationOrchestration",
-  "PersistenceAdapters",
-  "IntegrationAdapters",
-  "WorkflowSagaEngine",
-  "BackgroundJobsScheduling",
-  "PresentationAdapters",
-  "ReportingReadModels",
-  "ExtensibilityMetadata",
-  "SecurityAuditObservability",
-  "Kernel"
-];
-var DEFAULT_ALLOWED_FLOWS = /* @__PURE__ */ new Set([
-  "PresentationAdapters->ApplicationOrchestration",
-  "ApplicationOrchestration->DomainModel",
-  "WorkflowSagaEngine->ApplicationOrchestration",
-  "WorkflowSagaEngine->DomainModel",
-  "BackgroundJobsScheduling->ApplicationOrchestration"
-]);
-function createDefaultRules() {
-  const rules = [];
-  for (const from of DEFAULT_LAYER_NAMES) {
-    for (const to of DEFAULT_LAYER_NAMES) {
-      if (from === to || DEFAULT_ALLOWED_FLOWS.has(`${from}->${to}`)) continue;
-      rules.push({ from, to, allowed: false });
-    }
-  }
-  return rules;
-}
-var DEFAULT_ARK_CONFIG_RULES = createDefaultRules();
-var stringArraySchema = {
-  type: "array",
-  items: { type: "string", minLength: 1 },
-  uniqueItems: true
-};
-var ARK_CONFIG_SCHEMA = {
-  $schema: "https://json-schema.org/draft/2020-12/schema",
-  $id: ARK_CONFIG_SCHEMA_URL,
-  title: "ArkGate architecture contract",
-  description: "Versioned contract consumed identically by ArkGate CLI, MCP, and ESLint surfaces.",
-  type: "object",
-  additionalProperties: false,
-  required: ["$schema", "schemaVersion", "include", "layers", "rules"],
-  properties: {
-    $schema: {
-      type: "string",
-      minLength: 1,
-      default: ARK_CONFIG_SCHEMA_URL,
-      description: "Editor-facing URL or local path for this JSON Schema."
-    },
-    schemaVersion: {
-      type: "string",
-      const: ARK_CONFIG_SCHEMA_VERSION,
-      default: ARK_CONFIG_SCHEMA_VERSION
-    },
-    name: { type: "string", minLength: 1 },
-    include: { ...stringArraySchema, minItems: 1, default: ["src"] },
-    exclude: { ...stringArraySchema, default: [] },
-    excludeGenerated: { type: "boolean", default: true },
-    frameworkOverlay: { type: "string", minLength: 1 },
-    layers: {
-      type: "array",
-      default: [],
-      items: { $ref: "#/$defs/layer" }
-    },
-    rules: {
-      type: "array",
-      default: DEFAULT_ARK_CONFIG_RULES,
-      items: { $ref: "#/$defs/rule" }
-    },
-    cyclePolicy: {
-      type: "string",
-      enum: ["strict", "soft", "framework-soft", "off"],
-      default: "strict"
-    },
-    dynamicImportAllowlist: { ...stringArraySchema, default: [] },
-    safety: {
-      $ref: "#/$defs/safety",
-      default: {
-        maxTsSuppressions: 0,
-        maxAnyCasts: 0,
-        allowInMemory: false,
-        allowDisabledPeerIsolation: false
-      }
-    }
-  },
-  $defs: {
-    layer: {
-      type: "object",
-      additionalProperties: false,
-      required: ["name", "patterns"],
-      properties: {
-        name: { type: "string", minLength: 1 },
-        patterns: { ...stringArraySchema, minItems: 1 },
-        exclude: stringArraySchema,
-        intentPrefixes: stringArraySchema,
-        description: { type: "string", minLength: 1 },
-        forbiddenGlobals: stringArraySchema,
-        mayImportInfrastructure: { type: "boolean" },
-        optional: { type: "boolean" }
-      }
-    },
-    rule: {
-      type: "object",
-      additionalProperties: false,
-      required: ["from", "to", "allowed"],
-      properties: {
-        from: { type: "string", minLength: 1 },
-        to: { type: "string", minLength: 1 },
-        allowed: { type: "boolean" },
-        message: { type: "string", minLength: 1 },
-        peerIsolation: { type: "boolean" },
-        sliceFolders: { ...stringArraySchema, minItems: 1 }
-      }
-    },
-    safety: {
-      type: "object",
-      additionalProperties: false,
-      properties: {
-        maxTsSuppressions: { type: "integer", minimum: 0, default: 0 },
-        maxAnyCasts: { type: "integer", minimum: 0, default: 0 },
-        allowInMemory: { type: "boolean", default: false },
-        allowDisabledPeerIsolation: { type: "boolean", default: false }
-      }
-    }
-  }
-};
-var ArkConfigValidationError = class extends Error {
-  issues;
-  source;
-  constructor(source, issues) {
-    super(
-      `Invalid ArkGate config (${source}):
-${issues.map((issue) => `- ${issue.path}: ${issue.message}`).join("\n")}`
-    );
-    this.name = "ArkConfigValidationError";
-    this.source = source;
-    this.issues = issues;
-  }
-};
-function isObject(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function propertyPath(parent, key) {
-  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? `${parent}.${key}` : `${parent}[${JSON.stringify(key)}]`;
-}
-function valueType(value) {
-  if (value === null) return "null";
-  if (Array.isArray(value)) return "array";
-  return typeof value;
-}
-function resolveSchemaRef(ref, root) {
-  const prefix = "#/$defs/";
-  if (!ref.startsWith(prefix)) return void 0;
-  return root.$defs[ref.slice(prefix.length)];
-}
-function validateNode(value, schema, path, root, issues) {
-  if (schema.$ref) {
-    const referenced = resolveSchemaRef(schema.$ref, root);
-    if (!referenced) {
-      issues.push({ path, message: `schema reference ${schema.$ref} cannot be resolved` });
-      return;
-    }
-    validateNode(value, referenced, path, root, issues);
-    return;
-  }
-  if (schema.const !== void 0 && !Object.is(value, schema.const)) {
-    issues.push({ path, message: `must equal ${JSON.stringify(schema.const)}` });
-    return;
-  }
-  if (schema.enum && !schema.enum.some((candidate) => Object.is(candidate, value))) {
-    issues.push({ path, message: `must be one of ${schema.enum.map(String).join(", ")}` });
-    return;
-  }
-  if (schema.type === "object") {
-    if (!isObject(value)) {
-      issues.push({ path, message: `must be an object; received ${valueType(value)}` });
-      return;
-    }
-    const properties = schema.properties ?? {};
-    for (const key of schema.required ?? []) {
-      if (value[key] === void 0) {
-        issues.push({ path: propertyPath(path, key), message: "is required" });
-      }
-    }
-    if (schema.additionalProperties === false) {
-      for (const key of Object.keys(value)) {
-        if (!(key in properties)) {
-          issues.push({ path: propertyPath(path, key), message: "unknown field" });
-        }
-      }
-    }
-    for (const [key, childSchema] of Object.entries(properties)) {
-      if (value[key] !== void 0) {
-        validateNode(value[key], childSchema, propertyPath(path, key), root, issues);
-      }
-    }
-    return;
-  }
-  if (schema.type === "array") {
-    if (!Array.isArray(value)) {
-      issues.push({ path, message: `must be an array; received ${valueType(value)}` });
-      return;
-    }
-    if (schema.minItems !== void 0 && value.length < schema.minItems) {
-      issues.push({ path, message: `must contain at least ${schema.minItems} item(s)` });
-    }
-    if (schema.uniqueItems) {
-      const serialized = value.map((entry) => JSON.stringify(entry));
-      if (new Set(serialized).size !== serialized.length) {
-        issues.push({ path, message: "must not contain duplicate items" });
-      }
-    }
-    if (schema.items) {
-      value.forEach(
-        (entry, index) => validateNode(entry, schema.items, `${path}[${index}]`, root, issues)
-      );
-    }
-    return;
-  }
-  if (schema.type === "string") {
-    if (typeof value !== "string") {
-      issues.push({ path, message: `must be a string; received ${valueType(value)}` });
-      return;
-    }
-    if (schema.minLength !== void 0 && value.length < schema.minLength) {
-      issues.push({ path, message: `must contain at least ${schema.minLength} character(s)` });
-    }
-    return;
-  }
-  if (schema.type === "boolean") {
-    if (typeof value !== "boolean") {
-      issues.push({ path, message: `must be a boolean; received ${valueType(value)}` });
-    }
-    return;
-  }
-  if (schema.type === "integer") {
-    if (!Number.isInteger(value)) {
-      issues.push({ path, message: `must be an integer; received ${valueType(value)}` });
-      return;
-    }
-    if (schema.minimum !== void 0 && value < schema.minimum) {
-      issues.push({ path, message: `must be at least ${schema.minimum}` });
-    }
-  }
-}
-function defaultedConfig(input) {
-  return {
-    ...input,
-    $schema: input.$schema === void 0 ? ARK_CONFIG_SCHEMA_URL : input.$schema,
-    schemaVersion: input.schemaVersion === void 0 ? ARK_CONFIG_SCHEMA_VERSION : input.schemaVersion,
-    include: input.include === void 0 ? ["src"] : input.include,
-    layers: input.layers === void 0 ? [] : input.layers,
-    rules: input.rules === void 0 ? DEFAULT_ARK_CONFIG_RULES.map((rule) => ({ ...rule })) : input.rules
-  };
-}
-function migrateArkConfig(input, source = "ark.config.json") {
-  if (!isObject(input)) {
-    throw new ArkConfigValidationError(source, [
-      { path: "$", message: `must be an object; received ${valueType(input)}` }
-    ]);
-  }
-  const migratedFrom = input.schemaVersion === void 0 ? "unversioned" : null;
-  if (input.schemaVersion !== void 0 && input.schemaVersion !== ARK_CONFIG_SCHEMA_VERSION) {
-    throw new ArkConfigValidationError(source, [
-      {
-        path: "$.schemaVersion",
-        message: `unsupported version ${JSON.stringify(input.schemaVersion)}; expected ${ARK_CONFIG_SCHEMA_VERSION}`
-      }
-    ]);
-  }
-  return { candidate: defaultedConfig(input), migratedFrom };
-}
-function loadArkConfigContract(input, source = "ark.config.json") {
-  const { candidate, migratedFrom } = migrateArkConfig(input, source);
-  const issues = [];
-  validateNode(
-    candidate,
-    ARK_CONFIG_SCHEMA,
-    "$",
-    ARK_CONFIG_SCHEMA,
-    issues
-  );
-  if (issues.length > 0) throw new ArkConfigValidationError(source, issues);
-  return { config: candidate, migratedFrom };
-}
-function parseArkConfigJson(json, source = "ark.config.json") {
-  let input;
-  try {
-    input = JSON.parse(json);
-  } catch (error) {
-    throw new ArkConfigValidationError(source, [
-      {
-        path: "$",
-        message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
-      }
-    ]);
-  }
-  return loadArkConfigContract(input, source);
-}
-function withArkConfigMetadata(config) {
-  const result = {
-    $schema: typeof config.$schema === "string" && config.$schema.length > 0 ? config.$schema : ARK_CONFIG_SCHEMA_URL,
-    schemaVersion: ARK_CONFIG_SCHEMA_VERSION
-  };
-  for (const [key, value] of Object.entries(config)) {
-    if (key !== "$schema" && key !== "schemaVersion") result[key] = value;
-  }
-  return result;
-}
-
-// src/kernel/layers/ArchitectureProfile.ts
-function normalizePrefix(prefix) {
-  return prefix.endsWith(".") ? prefix : `${prefix}.`;
-}
-function byLongestPrefix(a, b) {
-  const maxA = a.prefixes.length ? Math.max(...a.prefixes.map((p) => p.length)) : 0;
-  const maxB = b.prefixes.length ? Math.max(...b.prefixes.map((p) => p.length)) : 0;
-  return maxB - maxA;
-}
-function createArchitectureProfile(options) {
-  const layers = options.layers.map((layer) => ({
-    ...layer,
-    prefixes: layer.prefixes.map(normalizePrefix)
-  }));
-  const sortedLayers = [...layers].sort(byLongestPrefix);
-  const rules = [...options.rules ?? []];
-  return {
-    name: options.name,
-    layers,
-    rules,
-    resolveLayer(name) {
-      return layers.find((layer) => layer.match?.(name))?.name ?? sortedLayers.find(
-        (layer) => layer.prefixes.some((prefix) => name.startsWith(prefix))
-      )?.name;
-    }
-  };
-}
-function createArchitectureProfileFromArkConfig(config, options = {}) {
-  return createArchitectureProfile({
-    name: options.name ?? config.name ?? "ark.config.json",
-    layers: config.layers.map((layer, index) => ({
-      name: layer.name,
-      prefixes: layer.intentPrefixes ?? [],
-      description: layer.description,
-      order: index + 1
-    })),
-    rules: config.rules ?? []
-  });
-}
-var elevenLayerProfileLayers = [
-  {
-    name: "DomainModel",
-    prefixes: ["Domain"],
-    description: "Rich domain model, business rules, and domain events.",
-    order: 1
-  },
-  {
-    name: "ApplicationOrchestration",
-    prefixes: ["Application"],
-    description: "Use cases and command orchestration.",
-    order: 2
-  },
-  {
-    name: "PersistenceAdapters",
-    prefixes: ["Adapter.Persistence", "Adapter.Repository"],
-    description: "Database, repository, and storage adapters.",
-    order: 3
-  },
-  {
-    name: "IntegrationAdapters",
-    prefixes: ["Adapter.Integration", "Adapter.External"],
-    description: "External systems, APIs, and integration adapters.",
-    order: 4
-  },
-  {
-    name: "WorkflowSagaEngine",
-    prefixes: ["Workflow"],
-    description: "Sagas, workflows, and long-running processes.",
-    order: 5
-  },
-  {
-    name: "BackgroundJobsScheduling",
-    prefixes: ["Job"],
-    description: "Background jobs, scheduled work, and async processors.",
-    order: 6
-  },
-  {
-    name: "PresentationAdapters",
-    prefixes: ["Presentation", "Adapter.Presentation", "Adapter.Api"],
-    description: "API, UI, controller, and presentation adapters.",
-    order: 7
-  },
-  {
-    name: "ReportingReadModels",
-    prefixes: ["Reporting"],
-    description: "Read models, projections, and reporting surfaces.",
-    order: 8
-  },
-  {
-    name: "ExtensibilityMetadata",
-    prefixes: ["Metadata"],
-    description: "Metadata, extensions, and schema contracts.",
-    order: 9
-  },
-  {
-    name: "SecurityAuditObservability",
-    prefixes: ["Security", "Audit", "Observability"],
-    description: "Security, audit, and observability concerns.",
-    order: 10
-  },
-  {
-    name: "Kernel",
-    prefixes: ["Kernel"],
-    description: "Ark-owned governance and kernel signals.",
-    order: 11
-  }
-];
-var elevenLayerProfile = createArchitectureProfile({
-  name: "Ark 11-layer Hexagonal Event-Driven Profile",
-  layers: elevenLayerProfileLayers,
-  rules: DEFAULT_ARK_CONFIG_RULES.map((rule) => ({ ...rule }))
-});
-var defaultElevenLayerDirectories = {
-  DomainModel: ["domain"],
-  ApplicationOrchestration: ["application", "app"],
-  PersistenceAdapters: [
-    "adapters/persistence",
-    "adapters/repository",
-    "repositories",
-    "infra/persistence"
-  ],
-  IntegrationAdapters: ["adapters/integration", "adapters/external", "integrations"],
-  WorkflowSagaEngine: ["workflows", "sagas"],
-  BackgroundJobsScheduling: ["jobs", "schedules"],
-  PresentationAdapters: ["presentation", "adapters/presentation", "adapters/api"],
-  ReportingReadModels: ["reporting", "read-models", "projections"],
-  ExtensibilityMetadata: ["metadata", "extensions"],
-  SecurityAuditObservability: ["security", "audit", "observability"],
-  Kernel: ["kernel"]
-};
-function createElevenLayerArkConfig(options = {}) {
-  const rootDir = options.rootDir ?? "src";
-  const optional = options.optionalLayers ?? true;
-  const prefix = rootDir === "." ? "" : `${rootDir}/`;
-  return withArkConfigMetadata({
-    include: options.include ?? [rootDir],
-    layers: elevenLayerProfile.layers.map((layer) => ({
-      name: layer.name,
-      patterns: (defaultElevenLayerDirectories[layer.name] ?? [layer.name]).map(
-        (directory) => `${prefix}${directory}/**`
-      ),
-      intentPrefixes: layer.prefixes,
-      optional
-    })),
-    rules: [...elevenLayerProfile.rules]
-  });
-}
-
-// src/kernel/metadata/MetadataRegistry.ts
-var MetadataRegistryImpl = class {
-  entities = /* @__PURE__ */ new Map();
-  entity(name, meta, options = {}) {
-    if (this.entities.has(name) && !options.allowOverwrite) {
-      throw new Error(`Entity metadata "${name}" is already registered.`);
-    }
-    const full = { name, fields: {}, ...meta };
-    this.entities.set(name, full);
-    return full;
-  }
-  getEntity(name) {
-    return this.entities.get(name);
-  }
-  listEntities() {
-    return Array.from(this.entities.values());
-  }
-  findEntitiesByIntent(intentName) {
-    return this.listEntities().filter(
-      (entity) => entity.emits?.includes(intentName) || entity.consumes?.includes(intentName)
-    );
-  }
-  validate() {
-    const issues = [];
-    for (const entity of this.entities.values()) {
-      if (!entity.name.trim()) {
-        issues.push({ entity: entity.name, message: "Entity name is required." });
-      }
-      for (const [fieldName, field] of Object.entries(entity.fields)) {
-        if (!fieldName.trim()) {
-          issues.push({ entity: entity.name, field: fieldName, message: "Field name is required." });
-        }
-        if (!field.type || typeof field.type !== "string") {
-          issues.push({
-            entity: entity.name,
-            field: fieldName,
-            message: "Field type must be a non-empty string."
-          });
-        }
-        if (field.relation && !this.entities.has(field.relation.entity)) {
-          issues.push({
-            entity: entity.name,
-            field: fieldName,
-            message: `Related entity "${field.relation.entity}" is not registered.`
-          });
-        }
-      }
-    }
-    return { ok: issues.length === 0, issues };
-  }
-  toJSON() {
-    return this.listEntities();
-  }
-};
-function createMetadataRegistry() {
-  return new MetadataRegistryImpl();
-}
-
-// src/kernel/adapters/ports.ts
-function definePort(name, options = {}) {
-  return {
-    name,
-    ownerLayer: options.ownerLayer,
-    intent: options.intent,
-    allowedAdapters: options.allowedAdapters ? [...options.allowedAdapters] : void 0
-  };
-}
-function createAdapter(port, impl, requiredKeysOrOptions, adapterOptions = {}) {
-  const options = Array.isArray(requiredKeysOrOptions) ? { ...adapterOptions, requiredKeys: requiredKeysOrOptions } : { ...requiredKeysOrOptions ?? {} };
-  const requiredKeys = options.requiredKeys;
-  if (requiredKeys && requiredKeys.length > 0) {
-    const missing = requiredKeys.filter((k) => !hasMember(impl, k));
-    if (missing.length > 0) {
-      throw new Error(
-        `Adapter for port "${port.name}" is missing required members: ${missing.join(", ")}`
-      );
-    }
-  }
-  const adapter = {
-    name: options.name,
-    layer: options.layer,
-    intent: options.intent,
-    port,
-    impl
-  };
-  const governance = checkAdapterGovernance(adapter);
-  if (!governance.ok) {
-    throw new Error(governance.issues.map((issue) => issue.message).join("\n"));
-  }
-  return adapter;
-}
-function checkContract(impl, requiredKeys = []) {
-  const missing = requiredKeys.filter((k) => !hasMember(impl, k));
-  return missing.length === 0 ? { ok: true } : { ok: false, missing };
-}
-function checkAdapterGovernance(adapter) {
-  const allowed = adapter.port.allowedAdapters ?? [];
-  if (allowed.length === 0) {
-    return { ok: true, issues: [] };
-  }
-  const adapterNames = [adapter.name, adapter.intent].filter(
-    (value) => typeof value === "string" && value.length > 0
-  );
-  const matched = adapterNames.some((name) => allowed.includes(name));
-  if (matched) {
-    return { ok: true, issues: [] };
-  }
-  return {
-    ok: false,
-    issues: [
-      {
-        ruleId: "ADAPTER_NOT_ALLOWED_FOR_PORT",
-        port: adapter.port.name,
-        adapter: adapter.name ?? adapter.intent,
-        message: `Adapter "${adapter.name ?? adapter.intent ?? "unknown"}" is not allowed for port "${adapter.port.name}".`
-      }
-    ]
-  };
-}
-function hasMember(value, key) {
-  return value != null && (typeof value === "object" || typeof value === "function") && key in value;
-}
-
-// src/kernel/ai-gate/AICodeGate.ts
-function violation(ruleId, message, extra) {
-  return { ruleId, code: ruleId, message, ...extra };
-}
-function lineOf(source, index) {
-  return source.slice(0, index).split("\n").length;
-}
-function extractQuotedStrings(source) {
-  const matches = [];
-  const re = /['"`]([A-Za-z][A-Za-z0-9_.]*)['"`]/g;
-  let m;
-  while ((m = re.exec(source)) !== null) {
-    matches.push({ value: m[1], index: m.index });
-  }
-  return matches;
-}
-function extractModuleSpecifiers(source) {
-  const matches = [];
-  const patterns = [
-    {
-      kind: "import",
-      re: /\bimport\s+(?:type\s+)?(?:[^'"]*?\s+from\s*)?['"]([^'"]+)['"]/g
-    },
-    {
-      kind: "export",
-      re: /\bexport\s+(?:type\s+)?[^'"]*?\s+from\s*['"]([^'"]+)['"]/g
-    },
-    {
-      kind: "dynamic-import",
-      re: /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g
-    },
-    {
-      kind: "require",
-      re: /\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g
-    }
-  ];
-  for (const pattern of patterns) {
-    let match;
-    while ((match = pattern.re.exec(source)) !== null) {
-      const index = match.index + match[0].indexOf(match[1]);
-      const raw = match[0];
-      const typeOnly = pattern.kind === "import" && /\bimport\s+type\b/.test(raw) || pattern.kind === "export" && /\bexport\s+type\b/.test(raw);
-      matches.push({ value: match[1], index, kind: pattern.kind, typeOnly });
-    }
-  }
-  return matches.sort((a, b) => a.index - b.index);
-}
-function extractModuleSpecifiersAst(ts, source) {
-  const sourceFile = ts.createSourceFile("generated.ts", source, ts.ScriptTarget.Latest, true);
-  const matches = [];
-  const push = (node, value, kind, typeOnly = false) => {
-    matches.push({
-      value,
-      index: node.getStart(sourceFile),
-      kind,
-      typeOnly
-    });
-  };
-  const visit = (node) => {
-    if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
-      const clause = node.importClause;
-      const namedBindings = clause?.namedBindings;
-      const specifiersOnly = clause && !clause.name && namedBindings && ts.isNamedImports(namedBindings) && namedBindings.elements.length > 0 && namedBindings.elements.every((element) => element.isTypeOnly === true);
-      push(
-        node.moduleSpecifier,
-        node.moduleSpecifier.text,
-        "import",
-        Boolean(clause?.isTypeOnly || specifiersOnly)
-      );
-    } else if (ts.isExportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
-      const clause = node.exportClause;
-      const specifiersOnly = clause && ts.isNamedExports(clause) && clause.elements.length > 0 && clause.elements.every((element) => element.isTypeOnly === true);
-      push(
-        node.moduleSpecifier,
-        node.moduleSpecifier.text,
-        "export",
-        Boolean(node.isTypeOnly || specifiersOnly)
-      );
-    } else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference)) {
-      const argument = node.moduleReference.expression;
-      const value = tsStringLiteralText(ts, argument);
-      if (value !== void 0) push(argument, value, "require");
-    } else if (ts.isCallExpression(node)) {
-      const argument = node.arguments[0];
-      const value = tsStringLiteralText(ts, argument);
-      if (value !== void 0 && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
-        push(argument, value, "dynamic-import");
-      } else if (value !== void 0 && ts.isIdentifier(node.expression) && node.expression.text === "require") {
-        push(argument, value, "require");
-      }
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
-  return matches.sort((a, b) => a.index - b.index);
-}
-function nonLiteralDynamicDependencies(ts, source) {
-  const sourceFile = ts.createSourceFile("generated.ts", source, ts.ScriptTarget.Latest, true);
-  const uses = [];
-  const visit = (node) => {
-    if (ts.isCallExpression(node)) {
-      const dynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword;
-      const directRequire = ts.isIdentifier(node.expression) && node.expression.text === "require";
-      const argument = node.arguments[0];
-      if ((dynamicImport || directRequire) && (!argument || !ts.isStringLiteralLike(argument))) {
-        uses.push({
-          line: sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1,
-          kind: directRequire ? "require" : "import"
-        });
-      }
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
-  return uses;
-}
-function extractQuotedStringsAst(ts, source) {
-  const sourceFile = ts.createSourceFile("generated.ts", source, ts.ScriptTarget.Latest, true);
-  const matches = [];
-  const visit = (node) => {
-    if (ts.isStringLiteralLike(node)) {
-      matches.push({ value: node.text, index: node.getStart(sourceFile) });
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
-  return matches;
-}
-function looksLikeIntentName(s) {
-  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\.[A-Za-z0-9_.]+$/.test(s);
-}
-function hasInfrastructureToken(specifier) {
-  const tokens = specifier.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
-  return [
-    "adapter",
-    "adapters",
-    "infra",
-    "infrastructure",
-    "persistence",
-    "repository",
-    "repositories",
-    "integration",
-    "database",
-    "db"
-  ].some((token) => tokens.includes(token));
-}
-function isKnownInfrastructurePackage(specifier) {
-  const normalized = specifier.toLowerCase();
-  return ["sequelize", "prisma", "typeorm", "mongoose", "knex"].some(
-    (name) => normalized === name || normalized.startsWith(`${name}/`)
-  );
-}
-function layerHasInfrastructureRole(layerName) {
-  const normalized = layerName.toLowerCase();
-  return [
-    "adapter",
-    "infra",
-    "persistence",
-    "repository",
-    "repositories",
-    "integration",
-    "database"
-  ].some((token) => normalized.includes(token));
-}
-function tsStringLiteralText(ts, node) {
-  return node && ts.isStringLiteralLike(node) ? node.text : void 0;
-}
-function tsPropertyName(ts, node) {
-  if (!node) return void 0;
-  if (ts.isIdentifier(node) || ts.isStringLiteralLike(node)) return node.text;
-  return void 0;
-}
-function tsObjectProperty(ts, node, name) {
-  if (!node || !ts.isObjectLiteralExpression(node)) return void 0;
-  return node.properties.find((property) => {
-    if (!ts.isPropertyAssignment(property) && !ts.isShorthandPropertyAssignment(property)) {
-      return false;
-    }
-    return tsPropertyName(ts, property.name) === name;
-  });
-}
-function tsObjectHasProperty(ts, node, name) {
-  return tsObjectProperty(ts, node, name) !== void 0;
-}
-function tsObjectPropertyValue(ts, node, name) {
-  const property = tsObjectProperty(ts, node, name);
-  return property && ts.isPropertyAssignment(property) ? property.initializer : void 0;
-}
-function tsObjectHasMetadataSource(ts, node) {
-  const metadata = tsObjectPropertyValue(ts, node, "metadata");
-  return tsObjectHasProperty(ts, metadata, "source");
-}
-function tsLooksLikeIntentCreatorExpression(ts, node) {
-  if (!node) return false;
-  if (ts.isIdentifier(node)) return /^[A-Z]/.test(node.text);
-  if (ts.isPropertyAccessExpression(node)) {
-    return tsLooksLikeIntentCreatorExpression(ts, node.name);
-  }
-  return false;
-}
-function tsIsPublishCall(ts, node) {
-  if (!ts.isCallExpression(node)) return false;
-  const expression = node.expression;
-  if (ts.isPropertyAccessExpression(expression)) {
-    return expression.name.text === "publish";
+  return false;
+}
+function tsIsPublishCall(ts, node) {
+  if (!ts.isCallExpression(node)) return false;
+  const expression = node.expression;
+  if (ts.isPropertyAccessExpression(expression)) {
+    return expression.name.text === "publish";
   }
   return ts.isIdentifier(expression) && expression.text === "publish";
 }
@@ -2725,7 +605,7 @@ function tsIsArkPublishCandidate(ts, node) {
   if (!ts.isCallExpression(node)) return false;
   const firstArg = node.arguments[0];
   const rawIntent = tsStringLiteralText(ts, firstArg);
-  return rawIntent !== void 0 && looksLikeIntentName(rawIntent) || tsObjectHasProperty(ts, firstArg, "intent") || tsLooksLikeIntentCreatorExpression(ts, firstArg);
+  return rawIntent !== void 0 && looksLikeArkIntent(rawIntent) || tsObjectHasProperty(ts, firstArg, "intent") || tsLooksLikeIntentCreatorExpression(ts, firstArg);
 }
 function tsPublishHasSource(ts, node) {
   if (!ts.isCallExpression(node)) return false;
@@ -2738,80 +618,6 @@ function tsPublishSourceLiteral(ts, node) {
   const rawMetadata = tsObjectPropertyValue(ts, firstArg, "metadata");
   return tsStringLiteralText(ts, tsObjectPropertyValue(ts, rawMetadata, "source")) ?? tsStringLiteralText(ts, tsObjectPropertyValue(ts, secondArg, "source")) ?? tsStringLiteralText(ts, tsObjectPropertyValue(ts, thirdArg, "source"));
 }
-function singleFileTypeChecker(ts, sourceFile) {
-  const options = {
-    noLib: true,
-    noResolve: true,
-    target: ts.ScriptTarget.Latest
-  };
-  const host = ts.createCompilerHost(options, true);
-  host.getSourceFile = (fileName) => fileName === sourceFile.fileName ? sourceFile : void 0;
-  host.fileExists = (fileName) => fileName === sourceFile.fileName;
-  host.readFile = (fileName) => fileName === sourceFile.fileName ? sourceFile.text : void 0;
-  return ts.createProgram([sourceFile.fileName], options, host).getTypeChecker();
-}
-function propertyAccessPath(ts, node) {
-  const segments = [];
-  let current = node;
-  while (ts.isPropertyAccessExpression(current)) {
-    segments.unshift(current.name.text);
-    current = current.expression;
-  }
-  if (!ts.isIdentifier(current)) return void 0;
-  segments.unshift(current.text);
-  return { root: current, segments };
-}
-function isRuntimeIdentifierReference(ts, node) {
-  if (ts.isPropertyAccessExpression(node.parent) && node.parent.name === node) return false;
-  return ts.isExpressionNode(node) && !ts.isInTypeQuery(node) || ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node;
-}
-function hasLocalDeclaration(ts, checker, sourceFile, node) {
-  const shorthand = ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node;
-  const symbol = shorthand ? checker.getShorthandAssignmentValueSymbol(node.parent) : checker.getSymbolAtLocation(node);
-  return Boolean(
-    symbol?.declarations?.some((declaration) => declaration.getSourceFile() === sourceFile)
-  );
-}
-function analyzeForbiddenGlobals(ts, source, filePath, layer, forbidden) {
-  const entries = new Set(forbidden);
-  if (entries.size === 0) return [];
-  const sourceFile = ts.createSourceFile("generated.ts", source, ts.ScriptTarget.Latest, true);
-  const checker = singleFileTypeChecker(ts, sourceFile);
-  const violations = [];
-  const flag = (name, node) => violations.push(
-    violation("FORBIDDEN_GLOBAL", `${layer} must not use the ambient global "${name}".`, {
-      line: sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1,
-      filePath,
-      target: name,
-      fromLayer: layer,
-      suggestion: "Inject the capability through a port (e.g. a Clock, IdGenerator, or HttpPort) instead of reaching for the ambient global."
-    })
-  );
-  const visit = (node) => {
-    const nestedPropertyAccess = ts.isPropertyAccessExpression(node) && ts.isPropertyAccessExpression(node.parent) && node.parent.expression === node;
-    if (ts.isPropertyAccessExpression(node) && !nestedPropertyAccess) {
-      const path = propertyAccessPath(ts, node);
-      if (path && !hasLocalDeclaration(ts, checker, sourceFile, path.root)) {
-        const explicitGlobalThis = path.segments[0] === "globalThis";
-        const normalized = explicitGlobalThis ? path.segments.slice(1) : path.segments;
-        let match;
-        for (let length = normalized.length; length >= (explicitGlobalThis ? 1 : 2); length -= 1) {
-          const candidate = normalized.slice(0, length).join(".");
-          if (entries.has(candidate)) {
-            match = candidate;
-            break;
-          }
-        }
-        if (match) flag(match, node);
-      }
-    } else if (ts.isIdentifier(node) && entries.has(node.text) && isRuntimeIdentifierReference(ts, node) && !hasLocalDeclaration(ts, checker, sourceFile, node)) {
-      flag(node.text, node);
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
-  return violations;
-}
 function analyzePublishAst(ts, source, context, profile) {
   const sourceFile = ts.createSourceFile(
     "generated.ts",
@@ -2826,26 +632,21 @@ function analyzePublishAst(ts, source, context, profile) {
   const lineForNode = (node) => sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
   const visit = (node) => {
     if (tsIsPublishCall(ts, node)) {
-      const firstArg = node.arguments[0];
-      const rawIntent = tsStringLiteralText(ts, firstArg);
-      if (rawIntent && looksLikeIntentName(rawIntent) || tsObjectHasProperty(ts, firstArg, "intent")) {
-        violations.push(
-          violation("RAW_EVENT_PUBLISH", "Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts and tooling.", {
-            line: lineForNode(node),
-            filePath
-          })
-        );
-      }
-      if (tsIsArkPublishCandidate(ts, node) && !tsPublishHasSource(ts, node)) {
+      const firstArg = node.arguments[0];
+      const rawIntent = tsStringLiteralText(ts, firstArg);
+      for (const finding of classifyPublishFacts({
+        publishCall: true,
+        rawIntentName: rawIntent,
+        objectHasIntent: tsObjectHasProperty(ts, firstArg, "intent"),
+        arkPublishCandidate: tsIsArkPublishCandidate(ts, node),
+        hasSource: tsPublishHasSource(ts, node)
+      })) {
         violations.push(
-          violation("PUBLISH_MISSING_SOURCE", "Strict Ark publish calls must include metadata.source.", {
-            line: lineForNode(node),
-            filePath
-          })
+          violation(finding.ruleId, finding.message, { line: lineForNode(node), filePath })
         );
       }
       const sourceIntent = tsPublishSourceLiteral(ts, node);
-      if (profile && contextLayer && sourceIntent && looksLikeIntentName(sourceIntent)) {
+      if (profile && contextLayer && sourceIntent && looksLikeArkIntent(sourceIntent)) {
         const sourceLayer = profile.resolveLayer(sourceIntent);
         if (sourceLayer && sourceLayer !== contextLayer) {
           violations.push(
@@ -2882,10 +683,23 @@ function createAICodeGate(options = {}) {
       const gateContext = context;
       const filePath = gateContext?.filePath;
       const contextLayer = gateContext?.layer;
-      const moduleSpecifiers2 = options.typescript ? extractModuleSpecifiersAst(options.typescript, source) : extractModuleSpecifiers(source);
+      const semanticTypescript = options.typescript;
+      const semanticSourceFile = semanticTypescript ? semanticTypescript.createSourceFile(
+        filePath ?? "generated.ts",
+        source,
+        semanticTypescript.ScriptTarget.Latest,
+        true
+      ) : void 0;
+      const semanticDependencies = semanticSourceFile ? extractSemanticDependencies(options.typescript, semanticSourceFile) : void 0;
+      const moduleSpecifiers2 = semanticDependencies ? semanticDependencies.filter((dependency) => dependency.specifier !== void 0).map((dependency) => ({
+        value: dependency.specifier,
+        index: dependency.node.getStart(semanticSourceFile),
+        kind: dependency.kind,
+        typeOnly: dependency.typeOnly
+      })) : extractModuleSpecifiers(source);
       const quotedStrings = options.typescript ? extractQuotedStringsAst(options.typescript, source) : extractQuotedStrings(source);
       if (options.typescript && !options.allowNonLiteralDynamicImport?.(filePath)) {
-        for (const dependency of nonLiteralDynamicDependencies(options.typescript, source)) {
+        for (const dependency of semanticDependencies?.filter(({ unresolved }) => unresolved) ?? []) {
           const isRequire = dependency.kind === "require";
           violations.push(
             violation(
@@ -2906,7 +720,7 @@ function createAICodeGate(options = {}) {
           if (match) {
             violations.push(
               violation("FORBIDDEN_PATTERN", `Forbidden pattern matched: ${pat}`, {
-                line: match.index === void 0 ? void 0 : lineOf(source, match.index),
+                line: match.index === void 0 ? void 0 : lineOf2(source, match.index),
                 filePath,
                 suggestion: "Remove infrastructure imports from domain/application layers." + infraLayerEscapeHatch
               })
@@ -2915,7 +729,7 @@ function createAICodeGate(options = {}) {
         } else if (source.includes(pat)) {
           violations.push(
             violation("FORBIDDEN_SUBSTRING", `Forbidden substring: ${pat}`, {
-              line: lineOf(source, source.indexOf(pat)),
+              line: lineOf2(source, source.indexOf(pat)),
               filePath
             })
           );
@@ -2946,7 +760,7 @@ function createAICodeGate(options = {}) {
                 "LAYER_IMPORT_VIOLATION",
                 blocked.message ?? (peer ? `Layer "${contextLayer}" must not import across slices into "${targetLayer}".` : `Layer "${contextLayer}" must not import "${targetLayer}".`),
                 {
-                  line: lineOf(source, specifier.index),
+                  line: lineOf2(source, specifier.index),
                   source: specifier.value,
                   target: specifier.value,
                   filePath,
@@ -2976,7 +790,7 @@ function createAICodeGate(options = {}) {
             "FORBIDDEN_IMPORT",
             `Forbidden ${specifier.kind} target: "${specifier.value}".`,
             {
-              line: lineOf(source, specifier.index),
+              line: lineOf2(source, specifier.index),
               source: specifier.value,
               target: specifier.value,
               filePath,
@@ -3011,114 +825,587 @@ function createAICodeGate(options = {}) {
           }
         }
       }
-      if (enforceAllowlist && intentNames.size > 0) {
-        for (const literal of quotedStrings) {
-          if (looksLikeIntentName(literal.value) && !intentNames.has(literal.value)) {
-            violations.push(
-              violation(
-                "UNKNOWN_INTENT",
-                `Unknown intent reference: "${literal.value}"`,
-                {
-                  line: lineOf(source, literal.index),
-                  filePath,
-                  target: literal.value,
-                  suggestion: `Register intent "${literal.value}" via defineIntent() or remove the reference.`
-                }
-              )
-            );
-          }
+      if (enforceAllowlist && intentNames.size > 0) {
+        for (const literal of quotedStrings) {
+          if (looksLikeArkIntent(literal.value) && !intentNames.has(literal.value)) {
+            violations.push(
+              violation(
+                "UNKNOWN_INTENT",
+                `Unknown intent reference: "${literal.value}"`,
+                {
+                  line: lineOf2(source, literal.index),
+                  filePath,
+                  target: literal.value,
+                  suggestion: `Register intent "${literal.value}" via defineIntent() or remove the reference.`
+                }
+              )
+            );
+          }
+        }
+      }
+      if (options.architectureProfile && contextLayer) {
+        for (const literal of quotedStrings) {
+          if (!looksLikeArkIntent(literal.value)) continue;
+          const targetLayer = options.architectureProfile.resolveLayer(literal.value);
+          if (!targetLayer) continue;
+          const blocked = findDeniedEdgeRule(
+            options.architectureProfile.rules,
+            contextLayer,
+            targetLayer
+          );
+          if (blocked) {
+            violations.push(
+              violation(
+                "LAYER_REFERENCE_VIOLATION",
+                blocked.message ?? `Layer "${contextLayer}" must not reference "${targetLayer}" through "${literal.value}".`,
+                {
+                  line: lineOf2(source, literal.index),
+                  filePath,
+                  target: literal.value,
+                  fromLayer: contextLayer,
+                  toLayer: targetLayer,
+                  suggestion: "Route the dependency through an allowed intent, port, or event.",
+                  details: { rule: blocked }
+                }
+              )
+            );
+          }
+        }
+      }
+      if (options.extensions) {
+        for (const ext of options.extensions) {
+          try {
+            const extViolations = ext.analyze(source, context);
+            violations.push(...extViolations);
+          } catch (err) {
+            violations.push(
+              violation(
+                "EXTENSION_ERROR",
+                `Extension "${ext.name}" failed: ${err instanceof Error ? err.message : String(err)}`
+              )
+            );
+          }
+        }
+      }
+      if (options.typescript && semanticSourceFile && contextLayer && options.forbiddenGlobals?.[contextLayer]?.length) {
+        try {
+          violations.push(
+            ...collectForbiddenCapabilityUses(
+              options.typescript,
+              semanticSourceFile,
+              options.forbiddenGlobals[contextLayer]
+            ).map(
+              (use) => violation(
+                "FORBIDDEN_GLOBAL",
+                `${contextLayer} must not use the ambient global "${use.name}".`,
+                {
+                  line: use.line,
+                  filePath,
+                  target: use.name,
+                  fromLayer: contextLayer,
+                  suggestion: "Inject the capability through a port (e.g. a Clock, IdGenerator, or HttpPort) instead of reaching for the ambient global."
+                }
+              )
+            )
+          );
+        } catch (err) {
+          violations.push(
+            violation(
+              "AST_ANALYZER_ERROR",
+              `TypeScript AST analyzer failed: ${err instanceof Error ? err.message : String(err)}`
+            )
+          );
+        }
+      }
+      if (options.typescript) {
+        try {
+          violations.push(
+            ...analyzePublishAst(
+              options.typescript,
+              source,
+              context,
+              options.architectureProfile
+            )
+          );
+        } catch (err) {
+          violations.push(
+            violation(
+              "AST_ANALYZER_ERROR",
+              `TypeScript AST analyzer failed: ${err instanceof Error ? err.message : String(err)}`
+            )
+          );
+        }
+      }
+      return {
+        valid: violations.length === 0,
+        violations
+      };
+    }
+  };
+}
+
+// src/domain/configContract.ts
+var ARK_CONFIG_SCHEMA_VERSION = "1.0";
+var ARK_CONFIG_SCHEMA_URL = "https://unpkg.com/arkgate@2/schemas/ark.config.schema.json";
+var DEFAULT_LAYER_NAMES = [
+  "DomainModel",
+  "ApplicationOrchestration",
+  "PersistenceAdapters",
+  "IntegrationAdapters",
+  "WorkflowSagaEngine",
+  "BackgroundJobsScheduling",
+  "PresentationAdapters",
+  "ReportingReadModels",
+  "ExtensibilityMetadata",
+  "SecurityAuditObservability",
+  "Kernel"
+];
+var DEFAULT_ALLOWED_FLOWS = /* @__PURE__ */ new Set([
+  "PresentationAdapters->ApplicationOrchestration",
+  "ApplicationOrchestration->DomainModel",
+  "WorkflowSagaEngine->ApplicationOrchestration",
+  "WorkflowSagaEngine->DomainModel",
+  "BackgroundJobsScheduling->ApplicationOrchestration"
+]);
+function createDefaultRules() {
+  const rules = [];
+  for (const from of DEFAULT_LAYER_NAMES) {
+    for (const to of DEFAULT_LAYER_NAMES) {
+      if (from === to || DEFAULT_ALLOWED_FLOWS.has(`${from}->${to}`)) continue;
+      rules.push({ from, to, allowed: false });
+    }
+  }
+  return rules;
+}
+var DEFAULT_ARK_CONFIG_RULES = createDefaultRules();
+var stringArraySchema = {
+  type: "array",
+  items: { type: "string", minLength: 1 },
+  uniqueItems: true
+};
+var ARK_CONFIG_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: ARK_CONFIG_SCHEMA_URL,
+  title: "ArkGate architecture contract",
+  description: "Versioned contract consumed identically by ArkGate CLI, MCP, and ESLint surfaces.",
+  type: "object",
+  additionalProperties: false,
+  required: ["$schema", "schemaVersion", "include", "layers", "rules"],
+  properties: {
+    $schema: {
+      type: "string",
+      minLength: 1,
+      default: ARK_CONFIG_SCHEMA_URL,
+      description: "Editor-facing URL or local path for this JSON Schema."
+    },
+    schemaVersion: {
+      type: "string",
+      const: ARK_CONFIG_SCHEMA_VERSION,
+      default: ARK_CONFIG_SCHEMA_VERSION
+    },
+    name: { type: "string", minLength: 1 },
+    include: { ...stringArraySchema, minItems: 1, default: ["src"] },
+    exclude: { ...stringArraySchema, default: [] },
+    excludeGenerated: { type: "boolean", default: true },
+    frameworkOverlay: { type: "string", minLength: 1 },
+    layers: {
+      type: "array",
+      default: [],
+      items: { $ref: "#/$defs/layer" }
+    },
+    rules: {
+      type: "array",
+      default: DEFAULT_ARK_CONFIG_RULES,
+      items: { $ref: "#/$defs/rule" }
+    },
+    cyclePolicy: {
+      type: "string",
+      enum: ["strict", "soft", "framework-soft", "off"],
+      default: "strict"
+    },
+    dynamicImportAllowlist: { ...stringArraySchema, default: [] },
+    safety: {
+      $ref: "#/$defs/safety",
+      default: {
+        maxTsSuppressions: 0,
+        maxAnyCasts: 0,
+        allowInMemory: false,
+        allowDisabledPeerIsolation: false
+      }
+    }
+  },
+  $defs: {
+    layer: {
+      type: "object",
+      additionalProperties: false,
+      required: ["name", "patterns"],
+      properties: {
+        name: { type: "string", minLength: 1 },
+        patterns: { ...stringArraySchema, minItems: 1 },
+        exclude: stringArraySchema,
+        intentPrefixes: stringArraySchema,
+        description: { type: "string", minLength: 1 },
+        forbiddenGlobals: stringArraySchema,
+        mayImportInfrastructure: { type: "boolean" },
+        optional: { type: "boolean" }
+      }
+    },
+    rule: {
+      type: "object",
+      additionalProperties: false,
+      required: ["from", "to", "allowed"],
+      properties: {
+        from: { type: "string", minLength: 1 },
+        to: { type: "string", minLength: 1 },
+        allowed: { type: "boolean" },
+        message: { type: "string", minLength: 1 },
+        peerIsolation: { type: "boolean" },
+        sliceFolders: { ...stringArraySchema, minItems: 1 }
+      }
+    },
+    safety: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        maxTsSuppressions: { type: "integer", minimum: 0, default: 0 },
+        maxAnyCasts: { type: "integer", minimum: 0, default: 0 },
+        allowInMemory: { type: "boolean", default: false },
+        allowDisabledPeerIsolation: { type: "boolean", default: false }
+      }
+    }
+  }
+};
+var ArkConfigValidationError = class extends Error {
+  issues;
+  source;
+  constructor(source, issues) {
+    super(
+      `Invalid ArkGate config (${source}):
+${issues.map((issue) => `- ${issue.path}: ${issue.message}`).join("\n")}`
+    );
+    this.name = "ArkConfigValidationError";
+    this.source = source;
+    this.issues = issues;
+  }
+};
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function propertyPath(parent, key) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? `${parent}.${key}` : `${parent}[${JSON.stringify(key)}]`;
+}
+function valueType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function resolveSchemaRef(ref, root) {
+  const prefix = "#/$defs/";
+  if (!ref.startsWith(prefix)) return void 0;
+  return root.$defs[ref.slice(prefix.length)];
+}
+function validateNode(value, schema, path, root, issues) {
+  if (schema.$ref) {
+    const referenced = resolveSchemaRef(schema.$ref, root);
+    if (!referenced) {
+      issues.push({ path, message: `schema reference ${schema.$ref} cannot be resolved` });
+      return;
+    }
+    validateNode(value, referenced, path, root, issues);
+    return;
+  }
+  if (schema.const !== void 0 && !Object.is(value, schema.const)) {
+    issues.push({ path, message: `must equal ${JSON.stringify(schema.const)}` });
+    return;
+  }
+  if (schema.enum && !schema.enum.some((candidate) => Object.is(candidate, value))) {
+    issues.push({ path, message: `must be one of ${schema.enum.map(String).join(", ")}` });
+    return;
+  }
+  if (schema.type === "object") {
+    if (!isObject(value)) {
+      issues.push({ path, message: `must be an object; received ${valueType(value)}` });
+      return;
+    }
+    const properties = schema.properties ?? {};
+    for (const key of schema.required ?? []) {
+      if (value[key] === void 0) {
+        issues.push({ path: propertyPath(path, key), message: "is required" });
+      }
+    }
+    if (schema.additionalProperties === false) {
+      for (const key of Object.keys(value)) {
+        if (!(key in properties)) {
+          issues.push({ path: propertyPath(path, key), message: "unknown field" });
         }
       }
-      if (options.architectureProfile && contextLayer) {
-        for (const literal of quotedStrings) {
-          if (!looksLikeIntentName(literal.value)) continue;
-          const targetLayer = options.architectureProfile.resolveLayer(literal.value);
-          if (!targetLayer) continue;
-          const blocked = findDeniedEdgeRule(
-            options.architectureProfile.rules,
-            contextLayer,
-            targetLayer
-          );
-          if (blocked) {
-            violations.push(
-              violation(
-                "LAYER_REFERENCE_VIOLATION",
-                blocked.message ?? `Layer "${contextLayer}" must not reference "${targetLayer}" through "${literal.value}".`,
-                {
-                  line: lineOf(source, literal.index),
-                  filePath,
-                  target: literal.value,
-                  fromLayer: contextLayer,
-                  toLayer: targetLayer,
-                  suggestion: "Route the dependency through an allowed intent, port, or event.",
-                  details: { rule: blocked }
-                }
-              )
-            );
-          }
-        }
+    }
+    for (const [key, childSchema] of Object.entries(properties)) {
+      if (value[key] !== void 0) {
+        validateNode(value[key], childSchema, propertyPath(path, key), root, issues);
       }
-      if (options.extensions) {
-        for (const ext of options.extensions) {
-          try {
-            const extViolations = ext.analyze(source, context);
-            violations.push(...extViolations);
-          } catch (err) {
-            violations.push(
-              violation(
-                "EXTENSION_ERROR",
-                `Extension "${ext.name}" failed: ${err instanceof Error ? err.message : String(err)}`
-              )
-            );
-          }
-        }
+    }
+    return;
+  }
+  if (schema.type === "array") {
+    if (!Array.isArray(value)) {
+      issues.push({ path, message: `must be an array; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minItems !== void 0 && value.length < schema.minItems) {
+      issues.push({ path, message: `must contain at least ${schema.minItems} item(s)` });
+    }
+    if (schema.uniqueItems) {
+      const serialized = value.map((entry) => JSON.stringify(entry));
+      if (new Set(serialized).size !== serialized.length) {
+        issues.push({ path, message: "must not contain duplicate items" });
       }
-      if (options.typescript && contextLayer && options.forbiddenGlobals?.[contextLayer]?.length) {
-        try {
-          violations.push(
-            ...analyzeForbiddenGlobals(
-              options.typescript,
-              source,
-              filePath,
-              contextLayer,
-              options.forbiddenGlobals[contextLayer]
-            )
-          );
-        } catch (err) {
-          violations.push(
-            violation(
-              "AST_ANALYZER_ERROR",
-              `TypeScript AST analyzer failed: ${err instanceof Error ? err.message : String(err)}`
-            )
-          );
-        }
+    }
+    if (schema.items) {
+      value.forEach(
+        (entry, index) => validateNode(entry, schema.items, `${path}[${index}]`, root, issues)
+      );
+    }
+    return;
+  }
+  if (schema.type === "string") {
+    if (typeof value !== "string") {
+      issues.push({ path, message: `must be a string; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minLength !== void 0 && value.length < schema.minLength) {
+      issues.push({ path, message: `must contain at least ${schema.minLength} character(s)` });
+    }
+    return;
+  }
+  if (schema.type === "boolean") {
+    if (typeof value !== "boolean") {
+      issues.push({ path, message: `must be a boolean; received ${valueType(value)}` });
+    }
+    return;
+  }
+  if (schema.type === "integer") {
+    if (!Number.isInteger(value)) {
+      issues.push({ path, message: `must be an integer; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minimum !== void 0 && value < schema.minimum) {
+      issues.push({ path, message: `must be at least ${schema.minimum}` });
+    }
+  }
+}
+function defaultedConfig(input) {
+  return {
+    ...input,
+    $schema: input.$schema === void 0 ? ARK_CONFIG_SCHEMA_URL : input.$schema,
+    schemaVersion: input.schemaVersion === void 0 ? ARK_CONFIG_SCHEMA_VERSION : input.schemaVersion,
+    include: input.include === void 0 ? ["src"] : input.include,
+    layers: input.layers === void 0 ? [] : input.layers,
+    rules: input.rules === void 0 ? DEFAULT_ARK_CONFIG_RULES.map((rule) => ({ ...rule })) : input.rules
+  };
+}
+function migrateArkConfig(input, source = "ark.config.json") {
+  if (!isObject(input)) {
+    throw new ArkConfigValidationError(source, [
+      { path: "$", message: `must be an object; received ${valueType(input)}` }
+    ]);
+  }
+  const migratedFrom = input.schemaVersion === void 0 ? "unversioned" : null;
+  if (input.schemaVersion !== void 0 && input.schemaVersion !== ARK_CONFIG_SCHEMA_VERSION) {
+    throw new ArkConfigValidationError(source, [
+      {
+        path: "$.schemaVersion",
+        message: `unsupported version ${JSON.stringify(input.schemaVersion)}; expected ${ARK_CONFIG_SCHEMA_VERSION}`
       }
-      if (options.typescript) {
-        try {
-          violations.push(
-            ...analyzePublishAst(
-              options.typescript,
-              source,
-              context,
-              options.architectureProfile
-            )
-          );
-        } catch (err) {
-          violations.push(
-            violation(
-              "AST_ANALYZER_ERROR",
-              `TypeScript AST analyzer failed: ${err instanceof Error ? err.message : String(err)}`
-            )
-          );
-        }
+    ]);
+  }
+  return { candidate: defaultedConfig(input), migratedFrom };
+}
+function loadArkConfigContract(input, source = "ark.config.json") {
+  const { candidate, migratedFrom } = migrateArkConfig(input, source);
+  const issues = [];
+  validateNode(
+    candidate,
+    ARK_CONFIG_SCHEMA,
+    "$",
+    ARK_CONFIG_SCHEMA,
+    issues
+  );
+  if (issues.length > 0) throw new ArkConfigValidationError(source, issues);
+  return { config: candidate, migratedFrom };
+}
+function parseArkConfigJson(json, source = "ark.config.json") {
+  let input;
+  try {
+    input = JSON.parse(json);
+  } catch (error) {
+    throw new ArkConfigValidationError(source, [
+      {
+        path: "$",
+        message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
       }
-      return {
-        valid: violations.length === 0,
-        violations
-      };
+    ]);
+  }
+  return loadArkConfigContract(input, source);
+}
+function withArkConfigMetadata(config) {
+  const result = {
+    $schema: typeof config.$schema === "string" && config.$schema.length > 0 ? config.$schema : ARK_CONFIG_SCHEMA_URL,
+    schemaVersion: ARK_CONFIG_SCHEMA_VERSION
+  };
+  for (const [key, value] of Object.entries(config)) {
+    if (key !== "$schema" && key !== "schemaVersion") result[key] = value;
+  }
+  return result;
+}
+
+// src/kernel/layers/ArchitectureProfile.ts
+function normalizePrefix(prefix) {
+  return prefix.endsWith(".") ? prefix : `${prefix}.`;
+}
+function byLongestPrefix(a, b) {
+  const maxA = a.prefixes.length ? Math.max(...a.prefixes.map((p) => p.length)) : 0;
+  const maxB = b.prefixes.length ? Math.max(...b.prefixes.map((p) => p.length)) : 0;
+  return maxB - maxA;
+}
+function createArchitectureProfile(options) {
+  const layers = options.layers.map((layer) => ({
+    ...layer,
+    prefixes: layer.prefixes.map(normalizePrefix)
+  }));
+  const sortedLayers = [...layers].sort(byLongestPrefix);
+  const rules = [...options.rules ?? []];
+  return {
+    name: options.name,
+    layers,
+    rules,
+    resolveLayer(name) {
+      return layers.find((layer) => layer.match?.(name))?.name ?? sortedLayers.find(
+        (layer) => layer.prefixes.some((prefix) => name.startsWith(prefix))
+      )?.name;
     }
   };
 }
+function createArchitectureProfileFromArkConfig(config, options = {}) {
+  return createArchitectureProfile({
+    name: options.name ?? config.name ?? "ark.config.json",
+    layers: config.layers.map((layer, index) => ({
+      name: layer.name,
+      prefixes: layer.intentPrefixes ?? [],
+      description: layer.description,
+      order: index + 1
+    })),
+    rules: config.rules ?? []
+  });
+}
+var elevenLayerProfileLayers = [
+  {
+    name: "DomainModel",
+    prefixes: ["Domain"],
+    description: "Rich domain model, business rules, and domain events.",
+    order: 1
+  },
+  {
+    name: "ApplicationOrchestration",
+    prefixes: ["Application"],
+    description: "Use cases and command orchestration.",
+    order: 2
+  },
+  {
+    name: "PersistenceAdapters",
+    prefixes: ["Adapter.Persistence", "Adapter.Repository"],
+    description: "Database, repository, and storage adapters.",
+    order: 3
+  },
+  {
+    name: "IntegrationAdapters",
+    prefixes: ["Adapter.Integration", "Adapter.External"],
+    description: "External systems, APIs, and integration adapters.",
+    order: 4
+  },
+  {
+    name: "WorkflowSagaEngine",
+    prefixes: ["Workflow"],
+    description: "Sagas, workflows, and long-running processes.",
+    order: 5
+  },
+  {
+    name: "BackgroundJobsScheduling",
+    prefixes: ["Job"],
+    description: "Background jobs, scheduled work, and async processors.",
+    order: 6
+  },
+  {
+    name: "PresentationAdapters",
+    prefixes: ["Presentation", "Adapter.Presentation", "Adapter.Api"],
+    description: "API, UI, controller, and presentation adapters.",
+    order: 7
+  },
+  {
+    name: "ReportingReadModels",
+    prefixes: ["Reporting"],
+    description: "Read models, projections, and reporting surfaces.",
+    order: 8
+  },
+  {
+    name: "ExtensibilityMetadata",
+    prefixes: ["Metadata"],
+    description: "Metadata, extensions, and schema contracts.",
+    order: 9
+  },
+  {
+    name: "SecurityAuditObservability",
+    prefixes: ["Security", "Audit", "Observability"],
+    description: "Security, audit, and observability concerns.",
+    order: 10
+  },
+  {
+    name: "Kernel",
+    prefixes: ["Kernel"],
+    description: "Ark-owned governance and kernel signals.",
+    order: 11
+  }
+];
+var elevenLayerProfile = createArchitectureProfile({
+  name: "Ark 11-layer Hexagonal Event-Driven Profile",
+  layers: elevenLayerProfileLayers,
+  rules: DEFAULT_ARK_CONFIG_RULES.map((rule) => ({ ...rule }))
+});
+var defaultElevenLayerDirectories = {
+  DomainModel: ["domain"],
+  ApplicationOrchestration: ["application", "app"],
+  PersistenceAdapters: [
+    "adapters/persistence",
+    "adapters/repository",
+    "repositories",
+    "infra/persistence"
+  ],
+  IntegrationAdapters: ["adapters/integration", "adapters/external", "integrations"],
+  WorkflowSagaEngine: ["workflows", "sagas"],
+  BackgroundJobsScheduling: ["jobs", "schedules"],
+  PresentationAdapters: ["presentation", "adapters/presentation", "adapters/api"],
+  ReportingReadModels: ["reporting", "read-models", "projections"],
+  ExtensibilityMetadata: ["metadata", "extensions"],
+  SecurityAuditObservability: ["security", "audit", "observability"],
+  Kernel: ["kernel"]
+};
+function createElevenLayerArkConfig(options = {}) {
+  const rootDir = options.rootDir ?? "src";
+  const optional = options.optionalLayers ?? true;
+  const prefix = rootDir === "." ? "" : `${rootDir}/`;
+  return withArkConfigMetadata({
+    include: options.include ?? [rootDir],
+    layers: elevenLayerProfile.layers.map((layer) => ({
+      name: layer.name,
+      patterns: (defaultElevenLayerDirectories[layer.name] ?? [layer.name]).map(
+        (directory) => `${prefix}${directory}/**`
+      ),
+      intentPrefixes: layer.prefixes,
+      optional
+    })),
+    rules: [...elevenLayerProfile.rules]
+  });
+}
 
 // src/domain/analysis.ts
 var ANALYSIS_IR_SCHEMA_VERSION = "1.0";
@@ -3327,599 +1614,295 @@ function explainViolation(violation2) {
   const target = violation2.edge.to ?? violation2.edge.specifier;
   return `${violation2.ruleId} at ${location}: ${violation2.edge.from} imports ${target}. ${violation2.message}`;
 }
-
-// src/kernel/projections/ProjectionRegistry.ts
-var InMemoryReadModelStore = class {
-  states = /* @__PURE__ */ new Map();
-  load(name) {
-    return this.states.get(name);
-  }
-  save(name, state) {
-    this.states.set(name, state);
-  }
-  clear(name) {
-    if (name) {
-      this.states.delete(name);
-    } else {
-      this.states.clear();
+function detectArchitectureCycles(graph) {
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const low = /* @__PURE__ */ new Map();
+  const onStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  const components = [];
+  const connect = (file) => {
+    indices.set(file, index);
+    low.set(file, index);
+    index += 1;
+    stack.push(file);
+    onStack.add(file);
+    for (const target of [...graph.get(file) ?? []].sort()) {
+      if (!graph.has(target)) continue;
+      if (!indices.has(target)) {
+        connect(target);
+        low.set(file, Math.min(low.get(file) ?? 0, low.get(target) ?? 0));
+      } else if (onStack.has(target)) {
+        low.set(file, Math.min(low.get(file) ?? 0, indices.get(target) ?? 0));
+      }
     }
-  }
-};
-function initialState(definition) {
-  return typeof definition.initialState === "function" ? definition.initialState() : definition.initialState;
-}
-var ProjectionRegistryImpl = class {
-  definitions = /* @__PURE__ */ new Map();
-  checkpoints = /* @__PURE__ */ new Map();
-  store;
-  auditTrail;
-  constructor(options = {}) {
-    this.store = options.store ?? new InMemoryReadModelStore();
-    this.auditTrail = options.auditTrail;
-  }
-  register(definition) {
-    if (this.definitions.has(definition.name)) {
-      throw new Error(`Projection "${definition.name}" is already registered.`);
+    if (low.get(file) !== indices.get(file)) return;
+    const component = [];
+    let member;
+    do {
+      member = stack.pop();
+      if (member === void 0) break;
+      onStack.delete(member);
+      component.push(member);
+    } while (member !== file);
+    if (component.length > 1) components.push(component.sort());
+  };
+  for (const file of [...graph.keys()].sort()) {
+    if (!indices.has(file)) connect(file);
+  }
+  return components.sort((left, right) => left[0].localeCompare(right[0])).map((members) => ({
+    ruleId: "CIRCULAR_DEPENDENCY",
+    file: members[0],
+    line: 1,
+    target: members.join(" \u2192 "),
+    message: `Circular dependency among ${members.length} files: ${members.join(" \u2192 ")} \u2192 ${members[0]}.`,
+    cycleKind: "value"
+  }));
+}
+function evaluateArchitectureGraph(input) {
+  const violations = input.contentViolations.map((violation2) => ({ ...violation2 }));
+  const warnings = (input.warnings ?? []).map((warning) => ({ ...warning }));
+  const graph = new Map(
+    input.files.map((file) => [file, /* @__PURE__ */ new Set()])
+  );
+  for (const edge of input.edges) {
+    if (edge.to && edge.to !== edge.from && !edge.typeOnly && graph.has(edge.from)) {
+      graph.get(edge.from)?.add(edge.to);
     }
-    this.definitions.set(definition.name, definition);
-    this.checkpoints.set(definition.name, {
-      projection: definition.name,
-      appliedCount: 0
+    if (!edge.to || !edge.toLayer) continue;
+    const rule = findDeniedEdgeRule(input.rules, edge.fromLayer, edge.toLayer, {
+      fromPath: edge.from,
+      toPath: edge.to,
+      layers: input.config.layers
+    });
+    if (!rule) continue;
+    const peerIsolation = Boolean(rule.peerIsolation);
+    violations.push({
+      ruleId: "LAYER_IMPORT_VIOLATION",
+      file: edge.from,
+      line: edge.line,
+      fromLayer: edge.fromLayer,
+      toLayer: edge.toLayer,
+      target: edge.to,
+      ...edge.typeOnly ? { typeOnly: true } : {},
+      ...edge.targetTypeOnlyExports ? { targetTypeOnlyExports: true } : {},
+      ...edge.sourcePureTypeModule ? { sourcePureTypeModule: true } : {},
+      ...edge.namedBindingsTypeOnly ? { namedBindingsTypeOnly: true } : {},
+      ...!peerIsolation && edge.portProofEligible ? { portProofEligible: true } : {},
+      ...edge.kind ? { edgeKind: edge.kind } : {},
+      ...peerIsolation ? { peerIsolation: true } : {},
+      message: rule.message ?? (peerIsolation ? `${edge.fromLayer} must not ${edge.kind} another slice of ${edge.toLayer} (${edge.from} \u2192 ${edge.to}). Extract shared code or use events/ports across slices.` : `${edge.fromLayer} must not ${edge.kind} ${edge.toLayer}.`)
     });
   }
-  list() {
-    return Array.from(this.definitions.values());
-  }
-  async apply(event) {
-    const applied = [];
-    for (const definition of this.definitions.values()) {
-      if (!definition.sourceIntents.includes(event.intent)) continue;
-      const current = await this.store.load(definition.name) ?? initialState(definition);
-      const next = await definition.project(event, current);
-      await this.store.save(definition.name, next);
-      const previous = this.checkpoints.get(definition.name);
-      this.checkpoints.set(definition.name, {
-        projection: definition.name,
-        appliedCount: (previous?.appliedCount ?? 0) + 1,
-        lastIntent: event.intent,
-        lastCorrelationId: event.metadata.correlationId,
-        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-      await this.auditTrail?.record({
-        type: "projection.applied",
-        source: "Kernel.ProjectionRegistry",
-        intent: event.intent,
-        correlationId: event.metadata.correlationId,
-        causationId: event.metadata.causationId,
-        subject: definition.name,
-        details: { projection: definition.name }
-      });
-      applied.push(definition.name);
-    }
-    return applied;
-  }
-  async getState(name) {
-    return this.store.load(name);
-  }
-  getCheckpoint(name) {
-    return this.checkpoints.get(name);
-  }
-  getCheckpoints() {
-    return Array.from(this.checkpoints.values());
-  }
-  async clear() {
-    await this.store.clear();
-    for (const definition of this.definitions.values()) {
-      this.checkpoints.set(definition.name, {
-        projection: definition.name,
-        appliedCount: 0
-      });
+  const cyclePolicy = String(input.config.cyclePolicy ?? "strict").toLowerCase();
+  if (cyclePolicy !== "off") {
+    const cycles = detectArchitectureCycles(graph);
+    if (cyclePolicy === "soft" || cyclePolicy === "framework-soft") {
+      warnings.push(
+        ...cycles.map((cycle) => ({
+          ...cycle,
+          message: `${cycle.message} (soft cycle policy \u2014 advisory only; set cyclePolicy: "strict" to fail the check)`,
+          failsStrict: false
+        }))
+      );
+    } else {
+      violations.push(...cycles);
     }
   }
-};
-function createProjectionRegistry(options) {
-  return new ProjectionRegistryImpl(options);
-}
-
-// src/kernel/manifest/constants.ts
-var MANIFEST_SCHEMA_VERSION = "1.0";
-
-// src/kernel/manifest/createArkManifest.ts
-function policyId(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-}
-var ArkManifestImpl = class {
-  constructor(data) {
-    this.data = data;
-  }
-  data;
-  toJSON() {
-    return { ...this.data };
-  }
-};
-function createArkManifest(options = {}) {
-  const registry = options.registry;
-  const policyEngine = options.policyEngine;
-  const metadata = options.metadata;
-  const graph = options.graph;
-  const profile = options.profile;
-  const projections = options.projections;
-  const eventContracts = options.eventContracts;
-  const observability = options.observability;
-  const intents = registry ? registry.list().map((creator) => ({
-    name: creator.name,
-    dependencies: registry.getDependencies(creator.name),
-    productions: registry.getProductions(creator.name)
-  })) : [];
-  const relationships = registry ? registry.getAllRelationships() : [];
-  const policies = policyEngine ? policyEngine.getPolicies().map((p) => ({
-    id: policyId(p.name),
-    name: p.name,
-    severity: p.severity,
-    tags: p.tags ? [...p.tags] : void 0,
-    owner: p.owner,
-    version: p.version,
-    rationale: p.rationale,
-    enforcementMode: p.enforcementMode,
-    deprecated: p.deprecated,
-    replacedBy: p.replacedBy,
-    description: p.tags?.includes("layer") ? "Enforces clean-architecture layer dependency rules on declared relationships." : void 0
-  })) : [];
-  const entities = metadata ? metadata.toJSON() : [];
-  const graphData = graph ? graph.toJSON() : { nodes: [], edges: [] };
-  const entityIntents = entities.filter((e) => (e.emits?.length ?? 0) > 0 || (e.consumes?.length ?? 0) > 0).map((e) => ({
-    entity: e.name,
-    emits: e.emits,
-    consumes: e.consumes
-  }));
-  const projectionData = projections ? projections.list().map((projection) => ({
-    name: projection.name,
-    sourceIntents: projection.sourceIntents,
-    checkpoint: projections.getCheckpoint(projection.name)
-  })) : [];
-  const data = {
-    schemaVersion: MANIFEST_SCHEMA_VERSION,
-    version,
-    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    intents,
-    relationships,
-    policies,
-    entities,
-    graph: graphData,
-    architecture: profile ? {
-      profile: profile.name,
-      layers: profile.layers,
-      rules: profile.rules
-    } : void 0,
-    projections: projectionData,
-    eventContracts: eventContracts?.list() ?? [],
-    observability: observability?.report(),
-    links: { entityIntents }
-  };
-  return new ArkManifestImpl(data);
-}
-
-// src/kernel/workflow/Saga.ts
-var workflowSequence = 0;
-function createWorkflowId(prefix) {
-  workflowSequence += 1;
-  return `${prefix}-${Date.now()}-${workflowSequence}`;
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function sleep(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
+  return { violations, warnings, safety: input.safety };
 }
-async function withTimeout(operation, timeoutMs, stepName) {
-  const controller = new AbortController();
-  if (timeoutMs === void 0) return operation(controller.signal);
-  let timeout;
-  const timeoutPromise = new Promise((_, reject) => {
-    timeout = setTimeout(() => {
-      const error = new Error(`Workflow step "${stepName}" timed out after ${timeoutMs}ms.`);
-      controller.abort(error);
-      reject(error);
-    }, timeoutMs);
-  });
-  try {
-    return await Promise.race([operation(controller.signal), timeoutPromise]);
-  } finally {
-    if (timeout) clearTimeout(timeout);
-  }
+function configWarning(ruleId, message, extra = {}) {
+  return { ruleId, message, ...extra };
 }
-var InMemoryWorkflowStore = class {
-  snapshots = /* @__PURE__ */ new Map();
-  save(snapshot) {
-    this.snapshots.set(snapshot.id, { ...snapshot, context: { ...snapshot.context } });
-  }
-  get(id) {
-    const snapshot = this.snapshots.get(id);
-    return snapshot ? { ...snapshot, context: { ...snapshot.context } } : void 0;
-  }
-  list(workflowName) {
-    return Array.from(this.snapshots.values()).filter((snapshot) => !workflowName || snapshot.workflowName === workflowName).map((snapshot) => ({ ...snapshot, context: { ...snapshot.context } }));
-  }
-  clear() {
-    this.snapshots.clear();
-  }
-};
-var WorkflowEngineImpl = class {
-  constructor(bus, options = {}) {
-    this.bus = bus;
-    this.options = options;
-    this.store = options.store ?? new InMemoryWorkflowStore();
+function collectAnalysisConfigWarnings(input) {
+  const { config, rules, files, manifest } = input;
+  const warnings = [];
+  if (config.dynamicImportAllowlist !== void 0 && (!Array.isArray(config.dynamicImportAllowlist) || config.dynamicImportAllowlist.some((entry) => typeof entry !== "string"))) {
+    warnings.push(
+      configWarning(
+        "CONFIG_INVALID_DYNAMIC_IMPORT_ALLOWLIST",
+        "dynamicImportAllowlist must be an array of file globs."
+      )
+    );
   }
-  bus;
-  options;
-  definitions = /* @__PURE__ */ new Map();
-  store;
-  register(definition) {
-    if (this.definitions.has(definition.name)) {
-      throw new Error(`Workflow "${definition.name}" is already registered.`);
-    }
-    const names = /* @__PURE__ */ new Set();
-    for (const step of definition.steps) {
-      if (names.has(step.name)) {
-        throw new Error(
-          `Workflow "${definition.name}" has duplicate step name "${step.name}".`
+  if (config.safety !== void 0 && (config.safety === null || typeof config.safety !== "object" || Array.isArray(config.safety))) {
+    warnings.push(configWarning("CONFIG_INVALID_SAFETY", "safety must be an object."));
+  } else if (config.safety) {
+    for (const key of ["maxTsSuppressions", "maxAnyCasts"]) {
+      const value = config.safety[key];
+      if (value !== void 0 && (!Number.isInteger(value) || value < 0)) {
+        warnings.push(
+          configWarning(
+            "CONFIG_INVALID_SAFETY_THRESHOLD",
+            `safety.${key} must be a non-negative integer.`
+          )
         );
       }
-      names.add(step.name);
-    }
-    this.definitions.set(definition.name, definition);
-    if (definition.startOn) {
-      const trigger = definition.startOn;
-      this.bus.subscribe(trigger.intent, async (event) => {
-        await this.start(definition.name, trigger.mapEventToPayload(event));
-      });
     }
   }
-  async start(workflowName, initialPayload, options = {}) {
-    const definition = this.definitions.get(workflowName);
-    if (!definition) {
-      throw new Error(`Workflow "${workflowName}" is not registered.`);
+  const layers = Array.isArray(config.layers) ? config.layers : [];
+  const manifestLayers = Array.isArray(manifest?.architecture?.layers) ? manifest.architecture.layers : [];
+  const knownLayers = /* @__PURE__ */ new Set([
+    ...layers.map((layer) => layer.name).filter(Boolean),
+    ...manifestLayers.map((layer) => layer.name).filter((name) => Boolean(name))
+  ]);
+  if (layers.length === 0) {
+    warnings.push(
+      configWarning(
+        "CONFIG_NO_LAYERS",
+        "No file layers are configured; ark-check cannot classify files for import-boundary enforcement."
+      )
+    );
+  }
+  const seenLayers = /* @__PURE__ */ new Set();
+  const duplicateLayers = /* @__PURE__ */ new Set();
+  for (const layer of layers) {
+    if (!layer.name) {
+      warnings.push(configWarning("CONFIG_LAYER_WITHOUT_NAME", "A configured layer is missing a name."));
+      continue;
     }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const snapshot = {
-      id: options.id ?? createWorkflowId(workflowName),
-      workflowName,
-      status: "running",
-      context: { ...initialPayload },
-      completedSteps: [],
-      attempts: {},
-      startedAt: now,
-      updatedAt: now
-    };
-    await this.store.save(snapshot);
-    await this.audit("workflow.started", snapshot, { workflowName });
-    try {
-      for (const step of definition.steps) {
-        await this.runStep(snapshot, step);
-      }
-      snapshot.status = "completed";
-      snapshot.currentStep = void 0;
-      snapshot.completedAt = (/* @__PURE__ */ new Date()).toISOString();
-      snapshot.updatedAt = snapshot.completedAt;
-      await this.store.save(snapshot);
-      await this.audit("workflow.completed", snapshot, { workflowName });
-      return { ...snapshot, context: { ...snapshot.context } };
-    } catch (err) {
-      await this.compensate(snapshot, definition.steps, err);
-      snapshot.status = "failed";
-      snapshot.currentStep = void 0;
-      snapshot.error = errorMessage(err);
-      snapshot.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      await this.store.save(snapshot);
-      await this.audit("workflow.failed", snapshot, {
-        workflowName,
-        error: snapshot.error,
-        failedStep: snapshot.failedStep
-      });
-      throw err;
+    if (seenLayers.has(layer.name)) duplicateLayers.add(layer.name);
+    seenLayers.add(layer.name);
+    if (layer.forbiddenGlobals !== void 0 && (!Array.isArray(layer.forbiddenGlobals) || layer.forbiddenGlobals.some((entry) => typeof entry !== "string"))) {
+      warnings.push(
+        configWarning(
+          "CONFIG_INVALID_FORBIDDEN_GLOBALS",
+          `Layer "${layer.name}" has an invalid forbiddenGlobals value; expected an array of strings (e.g. ["fetch", "Date.now"]). The entry is ignored.`,
+          { layer: layer.name }
+        )
+      );
     }
-  }
-  async get(id) {
-    return this.store.get(id);
-  }
-  async list(workflowName) {
-    return this.store.list(workflowName);
-  }
-  async runStep(snapshot, step) {
-    const retry = step.retry ?? this.options.defaultRetry ?? { attempts: 1 };
-    const maxAttempts = Math.max(1, retry.attempts);
-    snapshot.currentStep = step.name;
-    snapshot.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-    await this.store.save(snapshot);
-    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-      snapshot.attempts[step.name] = attempt;
-      await this.store.save(snapshot);
-      let result;
+    const patterns = Array.isArray(layer.patterns) ? layer.patterns : [];
+    if (patterns.length === 0) {
+      warnings.push(
+        configWarning(
+          "CONFIG_LAYER_WITHOUT_PATTERNS",
+          `Layer "${layer.name}" has no file patterns and will never classify files.`,
+          { layer: layer.name }
+        )
+      );
+      continue;
+    }
+    for (const pattern of patterns) {
+      let expression;
       try {
-        result = await withTimeout(
-          (signal) => Promise.resolve(step.execute(snapshot.context, this.bus, signal)),
-          step.timeoutMs,
-          step.name
+        expression = globToRegExp(pattern);
+      } catch (error) {
+        warnings.push(
+          configWarning(
+            "CONFIG_INVALID_LAYER_PATTERN",
+            `Layer "${layer.name}" has an invalid pattern "${pattern}": ${error instanceof Error ? error.message : String(error)}`,
+            { layer: layer.name, pattern }
+          )
+        );
+        continue;
+      }
+      if (!files.some((file) => expression.test(file)) && !layer.optional) {
+        warnings.push(
+          configWarning(
+            "CONFIG_LAYER_PATTERN_NO_MATCHES",
+            `Layer "${layer.name}" pattern "${pattern}" matched no included files.`,
+            { layer: layer.name, pattern, failsStrict: false }
+          )
         );
-      } catch (err) {
-        if (attempt < maxAttempts) {
-          if (retry.delayMs) await sleep(retry.delayMs);
-          continue;
-        }
-        snapshot.failedStep = step.name;
-        snapshot.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-        await this.store.save(snapshot);
-        await this.audit("workflow.step.failed", snapshot, {
-          step: step.name,
-          attempt,
-          error: errorMessage(err)
-        });
-        throw err;
       }
-      if (result) Object.assign(snapshot.context, result);
-      snapshot.completedSteps.push(step.name);
-      snapshot.currentStep = void 0;
-      snapshot.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      await this.store.save(snapshot);
-      await this.audit("workflow.step.completed", snapshot, {
-        step: step.name,
-        attempt
-      });
-      return;
     }
-    throw new Error(`Workflow step "${step.name}" did not complete.`);
   }
-  async compensate(snapshot, steps, error) {
-    snapshot.status = "compensating";
-    snapshot.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-    await this.store.save(snapshot);
-    const completed = steps.filter(
-      (step) => snapshot.completedSteps.includes(step.name)
+  for (const name of duplicateLayers) {
+    warnings.push(
+      configWarning("CONFIG_DUPLICATE_LAYER", `Layer "${name}" is configured more than once.`, {
+        layer: name
+      })
     );
-    for (let index = completed.length - 1; index >= 0; index -= 1) {
-      const step = completed[index];
-      if (!step.compensate) continue;
-      try {
-        await Promise.resolve(step.compensate(snapshot.context, this.bus, error));
-        await this.audit("workflow.compensation.completed", snapshot, {
-          step: step.name
-        });
-      } catch (compensationError) {
-        await this.audit("workflow.step.failed", snapshot, {
-          step: step.name,
-          compensation: true,
-          error: errorMessage(compensationError)
-        });
+  }
+  if (knownLayers.size > 0) {
+    for (const rule of rules ?? []) {
+      if (rule.from && !knownLayers.has(rule.from)) {
+        warnings.push(
+          configWarning(
+            "CONFIG_RULE_UNKNOWN_FROM_LAYER",
+            `Rule references unknown source layer "${rule.from}".`,
+            { fromLayer: rule.from, toLayer: rule.to }
+          )
+        );
+      }
+      if (rule.to && !knownLayers.has(rule.to)) {
+        warnings.push(
+          configWarning(
+            "CONFIG_RULE_UNKNOWN_TO_LAYER",
+            `Rule references unknown target layer "${rule.to}".`,
+            { fromLayer: rule.from, toLayer: rule.to }
+          )
+        );
       }
     }
   }
-  async audit(type, snapshot, details) {
-    await this.options.auditTrail?.record({
-      type,
-      source: "Kernel.WorkflowEngine",
-      subject: snapshot.id,
-      details
-    });
-  }
-};
-function createWorkflowEngine(bus, options) {
-  return new WorkflowEngineImpl(bus, options);
-}
-function createSaga(def, bus, options = {}) {
-  const engine = createWorkflowEngine(bus, options);
-  const definition = { name: def.name, steps: def.steps };
-  engine.register(definition);
-  const sagaId = options.id ?? createWorkflowId(def.name);
-  let status = "idle";
-  let completedStepNames = [];
-  return {
-    id: sagaId,
-    definition: def,
-    get status() {
-      return status;
-    },
-    get completedSteps() {
-      return [...completedStepNames];
-    },
-    async run(initialPayload) {
-      status = "running";
-      completedStepNames = [];
-      try {
-        const snapshot = await engine.start(def.name, initialPayload, { id: sagaId });
-        status = snapshot.status === "waiting" ? "idle" : snapshot.status;
-        completedStepNames = [...snapshot.completedSteps];
-      } catch (err) {
-        const snapshot = await engine.get(sagaId);
-        status = snapshot?.status === "waiting" ? "idle" : snapshot?.status ?? "failed";
-        completedStepNames = snapshot?.completedSteps ?? [];
-        throw err;
+  const ambiguousPairs = /* @__PURE__ */ new Set();
+  if (layers.length > 1) {
+    for (const file of files) {
+      let topScore = -1;
+      let topLayers = [];
+      for (const layer of layers) {
+        for (const pattern of layer.patterns ?? []) {
+          if (!globToRegExp(pattern).test(file)) continue;
+          const score = patternSpecificity(pattern);
+          if (score > topScore) {
+            topScore = score;
+            topLayers = [layer.name];
+          } else if (score === topScore && !topLayers.includes(layer.name)) {
+            topLayers.push(layer.name);
+          }
+        }
       }
+      if (topLayers.length > 1) ambiguousPairs.add([...topLayers].sort().join(" + "));
     }
-  };
-}
-
-// src/kernel/runtime/createArkKernel.ts
-var DEFAULT_MAX_HISTORY_SIZE = 1e3;
-var kernelSequence = 0;
-function nextKernelInstanceId() {
-  kernelSequence += 1;
-  return `ark-kernel-${Date.now()}-${kernelSequence}`;
-}
-function createArkKernel(options = {}) {
-  const strict = options.strict ?? true;
-  const instanceId = options.instanceId ?? nextKernelInstanceId();
-  const profile = options.profile ?? elevenLayerProfile;
-  const maxHistorySize = options.maxHistorySize ?? DEFAULT_MAX_HISTORY_SIZE;
-  const registry = createIntentRegistry();
-  const graph = createDependencyGraph();
-  const metadata = options.metadata ?? createMetadataRegistry();
-  const auditTrail = options.auditTrail ?? createAuditTrail({ maxRecords: maxHistorySize });
-  const eventContracts = options.eventContracts ?? createEventContractRegistry();
-  const outbox = options.outbox ?? new InMemoryOutboxStore();
-  const projections = options.projections ?? createProjectionRegistry({ auditTrail });
-  const policyEngine = new PolicyEngine([
-    defineArchitectureProfilePolicy(profile),
-    ...options.policies ?? []
-  ]);
-  const syncGraph = () => {
-    syncRegistryToGraph(registry, graph, { requireRegisteredTargets: true });
-  };
-  const eventBus = createEventBus({
-    intentRegistry: registry,
-    dependencyGraph: graph,
-    policyEngine,
-    strictRegistry: true,
-    validateIntentNaming: true,
-    auditTrail,
-    eventContracts,
-    strictEventContracts: options.strictEventContracts ?? strict,
-    requireKnownSource: options.requireKnownSource ?? true,
-    architectureProfile: profile,
-    enforceObservedLayerFlow: options.enforceObservedLayerFlow ?? (strict ? "hard" : "off"),
-    outbox,
-    instanceId,
-    maxHistorySize,
-    onPublish: options.autoApplyProjections === false ? void 0 : async (event) => {
-      await projections.apply(event);
-    }
-  });
-  const workflowEngine = createWorkflowEngine(eventBus, { auditTrail });
-  const observability = createObservabilityReporter({
-    registry,
-    eventBus,
-    graph
-  });
-  return {
-    instanceId,
-    profile,
-    registry,
-    graph,
-    metadata,
-    auditTrail,
-    eventContracts,
-    outbox,
-    projections,
-    policyEngine,
-    eventBus,
-    workflowEngine,
-    observability,
-    publisher(source) {
-      return eventBus.createPublisher(source);
-    },
-    syncGraph,
-    manifest() {
-      syncGraph();
-      return createArkManifest({
-        registry,
-        policyEngine,
-        metadata,
-        graph,
-        profile,
-        projections,
-        eventContracts,
-        observability
-      });
-    }
-  };
-}
-function createStrictArkKernel(options = {}) {
-  return createArkKernel({
-    ...options,
-    strict: true,
-    strictEventContracts: options.strictEventContracts ?? true,
-    requireKnownSource: options.requireKnownSource ?? true,
-    enforceObservedLayerFlow: options.enforceObservedLayerFlow ?? "hard"
-  });
-}
-function createOptionsFromConfig(config, options = {}) {
-  const { profileName, ...kernelOptions } = options;
-  return {
-    ...kernelOptions,
-    profile: createArchitectureProfileFromArkConfig(config, { name: profileName })
-  };
-}
-function createArkKernelFromConfig(config, options = {}) {
-  return createArkKernel(createOptionsFromConfig(config, options));
-}
-function createStrictArkKernelFromConfig(config, options = {}) {
-  return createStrictArkKernel(createOptionsFromConfig(config, options));
-}
-function createLenientArkKernelFromConfig(config, options = {}) {
-  return createLenientArkKernel(createOptionsFromConfig(config, options));
-}
-function createLenientArkKernel(options = {}) {
-  return createArkKernel({
-    ...options,
-    strict: false,
-    strictEventContracts: options.strictEventContracts ?? false,
-    enforceObservedLayerFlow: options.enforceObservedLayerFlow ?? "off"
-  });
+  }
+  if (ambiguousPairs.size > 0) {
+    warnings.push(
+      configWarning(
+        "CONFIG_AMBIGUOUS_LAYERS",
+        `Some files match multiple layers at equal specificity; classification falls back to declaration order. Disambiguate the overlapping patterns: ${[...ambiguousPairs].join(", ")}.`,
+        { pairs: [...ambiguousPairs] }
+      )
+    );
+  }
+  const unclassified = files.filter((file) => !layerForRelativePath(file, layers));
+  if (unclassified.length > 0) {
+    warnings.push(
+      configWarning(
+        "CONFIG_UNCLASSIFIED_FILES",
+        `${unclassified.length} included source file(s) are not matched by any configured layer; ark-check will not enforce import rules for those source files.`,
+        { count: unclassified.length, samples: unclassified.slice(0, 5) }
+      )
+    );
+  }
+  return warnings;
 }
 export {
   ANALYSIS_IR_SCHEMA_VERSION,
-  DEFAULT_MAX_HISTORY_SIZE,
-  EventContractRegistryImpl,
-  EventContractViolationError,
-  InMemoryAuditStore,
-  InMemoryOutboxStore,
-  InMemoryReadModelStore,
-  InMemoryWorkflowStore,
-  IntentRegistry,
-  InvalidIntentNameError,
-  LayerPolicyContextError,
-  MANIFEST_SCHEMA_VERSION,
-  ObservedLayerFlowViolationError,
-  PolicyEngine,
-  PolicyViolationError,
-  SourceMetadataOverrideError,
-  UnknownEventSourceError,
-  UnregisteredIntentError,
+  ARK_ANALYSIS_RESULT_SCHEMA,
+  ARK_ANALYSIS_RESULT_SCHEMA_VERSION,
+  ARK_CONFIG_SCHEMA,
+  ARK_CONFIG_SCHEMA_VERSION,
   analyzeChange,
   analyzeProject,
-  architecturalPolicies,
-  buildPublishPolicyContext,
-  checkAdapterGovernance,
-  checkContract,
+  collectAnalysisConfigWarnings,
+  collectForbiddenCapabilityUses,
   createAICodeGate,
-  createAdapter,
+  createAdapterResult,
   createArchitectureProfile,
   createArchitectureProfileFromArkConfig,
-  createArkKernel,
-  createArkKernelFromConfig,
-  createArkManifest,
-  createArkTestHarness,
-  createAuditTrail,
-  createDependencyGraph,
   createElevenLayerArkConfig,
-  createEventBus,
-  createEventContractRegistry,
-  createIntentRegistry,
-  createLenientArkKernel,
-  createLenientArkKernelFromConfig,
-  createMetadataRegistry,
-  createObservabilityReporter,
-  createProjectionRegistry,
-  createSaga,
-  createStrictArkKernel,
-  createStrictArkKernelFromConfig,
-  createWorkflowEngine,
-  defaultIntentRegistry,
-  defineArchitectureProfilePolicy,
-  defineIntent,
-  defineLayerPolicy,
-  definePolicy,
-  definePort,
-  definePublishPolicy,
+  detectArchitectureCycles,
   deterministicHash,
   elevenLayerProfile,
+  evaluateArchitectureGraph,
   explainViolation,
-  isLayerPolicy,
+  extractSemanticDependencies,
+  loadArkConfigContract,
   loadContract,
+  parseArkConfigJson,
   stableSerialize,
-  syncRegistryToGraph,
-  validateIntentName,
+  toAdapterDiagnostic,
   version
 };
-//# sourceMappingURL=index.js.map