arkgate 2.13.0 → 3.0.1

package/bin/lib/analysis-engine.mjs

@@ -0,0 +1,1171 @@
+// GENERATED from src/kernel/analysis.ts by scripts/generate-analysis-engine.mjs.
+// Do not edit this file directly.
+// src/domain/analysis.ts
+var ANALYSIS_IR_SCHEMA_VERSION = "1.0";
+function deterministicHash(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return `fnv1a-${(hash >>> 0).toString(16).padStart(8, "0")}`;
+}
+function stableSerialize(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableSerialize).join(",")}]`;
+  const object = value;
+  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableSerialize(object[key])}`).join(",")}}`;
+}
+
+// src/domain/configContract.ts
+var ARK_CONFIG_SCHEMA_VERSION = "1.0";
+var ARK_CONFIG_SCHEMA_URL = "https://unpkg.com/arkgate@2/schemas/ark.config.schema.json";
+var DEFAULT_LAYER_NAMES = [
+  "DomainModel",
+  "ApplicationOrchestration",
+  "PersistenceAdapters",
+  "IntegrationAdapters",
+  "WorkflowSagaEngine",
+  "BackgroundJobsScheduling",
+  "PresentationAdapters",
+  "ReportingReadModels",
+  "ExtensibilityMetadata",
+  "SecurityAuditObservability",
+  "Kernel"
+];
+var DEFAULT_ALLOWED_FLOWS = /* @__PURE__ */ new Set([
+  "PresentationAdapters->ApplicationOrchestration",
+  "ApplicationOrchestration->DomainModel",
+  "WorkflowSagaEngine->ApplicationOrchestration",
+  "WorkflowSagaEngine->DomainModel",
+  "BackgroundJobsScheduling->ApplicationOrchestration"
+]);
+function createDefaultRules() {
+  const rules = [];
+  for (const from of DEFAULT_LAYER_NAMES) {
+    for (const to of DEFAULT_LAYER_NAMES) {
+      if (from === to || DEFAULT_ALLOWED_FLOWS.has(`${from}->${to}`)) continue;
+      rules.push({ from, to, allowed: false });
+    }
+  }
+  return rules;
+}
+var DEFAULT_ARK_CONFIG_RULES = createDefaultRules();
+var stringArraySchema = {
+  type: "array",
+  items: { type: "string", minLength: 1 },
+  uniqueItems: true
+};
+var ARK_CONFIG_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: ARK_CONFIG_SCHEMA_URL,
+  title: "ArkGate architecture contract",
+  description: "Versioned contract consumed identically by ArkGate CLI, MCP, and ESLint surfaces.",
+  type: "object",
+  additionalProperties: false,
+  required: ["$schema", "schemaVersion", "include", "layers", "rules"],
+  properties: {
+    $schema: {
+      type: "string",
+      minLength: 1,
+      default: ARK_CONFIG_SCHEMA_URL,
+      description: "Editor-facing URL or local path for this JSON Schema."
+    },
+    schemaVersion: {
+      type: "string",
+      const: ARK_CONFIG_SCHEMA_VERSION,
+      default: ARK_CONFIG_SCHEMA_VERSION
+    },
+    name: { type: "string", minLength: 1 },
+    include: { ...stringArraySchema, minItems: 1, default: ["src"] },
+    exclude: { ...stringArraySchema, default: [] },
+    excludeGenerated: { type: "boolean", default: true },
+    frameworkOverlay: { type: "string", minLength: 1 },
+    layers: {
+      type: "array",
+      default: [],
+      items: { $ref: "#/$defs/layer" }
+    },
+    rules: {
+      type: "array",
+      default: DEFAULT_ARK_CONFIG_RULES,
+      items: { $ref: "#/$defs/rule" }
+    },
+    cyclePolicy: {
+      type: "string",
+      enum: ["strict", "soft", "framework-soft", "off"],
+      default: "strict"
+    },
+    dynamicImportAllowlist: { ...stringArraySchema, default: [] },
+    safety: {
+      $ref: "#/$defs/safety",
+      default: {
+        maxTsSuppressions: 0,
+        maxAnyCasts: 0,
+        allowInMemory: false,
+        allowDisabledPeerIsolation: false
+      }
+    }
+  },
+  $defs: {
+    layer: {
+      type: "object",
+      additionalProperties: false,
+      required: ["name", "patterns"],
+      properties: {
+        name: { type: "string", minLength: 1 },
+        patterns: { ...stringArraySchema, minItems: 1 },
+        exclude: stringArraySchema,
+        intentPrefixes: stringArraySchema,
+        description: { type: "string", minLength: 1 },
+        forbiddenGlobals: stringArraySchema,
+        mayImportInfrastructure: { type: "boolean" },
+        optional: { type: "boolean" }
+      }
+    },
+    rule: {
+      type: "object",
+      additionalProperties: false,
+      required: ["from", "to", "allowed"],
+      properties: {
+        from: { type: "string", minLength: 1 },
+        to: { type: "string", minLength: 1 },
+        allowed: { type: "boolean" },
+        message: { type: "string", minLength: 1 },
+        peerIsolation: { type: "boolean" },
+        sliceFolders: { ...stringArraySchema, minItems: 1 }
+      }
+    },
+    safety: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        maxTsSuppressions: { type: "integer", minimum: 0, default: 0 },
+        maxAnyCasts: { type: "integer", minimum: 0, default: 0 },
+        allowInMemory: { type: "boolean", default: false },
+        allowDisabledPeerIsolation: { type: "boolean", default: false }
+      }
+    }
+  }
+};
+var ArkConfigValidationError = class extends Error {
+  issues;
+  source;
+  constructor(source, issues) {
+    super(
+      `Invalid ArkGate config (${source}):
+${issues.map((issue) => `- ${issue.path}: ${issue.message}`).join("\n")}`
+    );
+    this.name = "ArkConfigValidationError";
+    this.source = source;
+    this.issues = issues;
+  }
+};
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function propertyPath(parent, key) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? `${parent}.${key}` : `${parent}[${JSON.stringify(key)}]`;
+}
+function valueType(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  return typeof value;
+}
+function resolveSchemaRef(ref, root) {
+  const prefix = "#/$defs/";
+  if (!ref.startsWith(prefix)) return void 0;
+  return root.$defs[ref.slice(prefix.length)];
+}
+function validateNode(value, schema, path, root, issues) {
+  if (schema.$ref) {
+    const referenced = resolveSchemaRef(schema.$ref, root);
+    if (!referenced) {
+      issues.push({ path, message: `schema reference ${schema.$ref} cannot be resolved` });
+      return;
+    }
+    validateNode(value, referenced, path, root, issues);
+    return;
+  }
+  if (schema.const !== void 0 && !Object.is(value, schema.const)) {
+    issues.push({ path, message: `must equal ${JSON.stringify(schema.const)}` });
+    return;
+  }
+  if (schema.enum && !schema.enum.some((candidate) => Object.is(candidate, value))) {
+    issues.push({ path, message: `must be one of ${schema.enum.map(String).join(", ")}` });
+    return;
+  }
+  if (schema.type === "object") {
+    if (!isObject(value)) {
+      issues.push({ path, message: `must be an object; received ${valueType(value)}` });
+      return;
+    }
+    const properties = schema.properties ?? {};
+    for (const key of schema.required ?? []) {
+      if (value[key] === void 0) {
+        issues.push({ path: propertyPath(path, key), message: "is required" });
+      }
+    }
+    if (schema.additionalProperties === false) {
+      for (const key of Object.keys(value)) {
+        if (!(key in properties)) {
+          issues.push({ path: propertyPath(path, key), message: "unknown field" });
+        }
+      }
+    }
+    for (const [key, childSchema] of Object.entries(properties)) {
+      if (value[key] !== void 0) {
+        validateNode(value[key], childSchema, propertyPath(path, key), root, issues);
+      }
+    }
+    return;
+  }
+  if (schema.type === "array") {
+    if (!Array.isArray(value)) {
+      issues.push({ path, message: `must be an array; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minItems !== void 0 && value.length < schema.minItems) {
+      issues.push({ path, message: `must contain at least ${schema.minItems} item(s)` });
+    }
+    if (schema.uniqueItems) {
+      const serialized = value.map((entry) => JSON.stringify(entry));
+      if (new Set(serialized).size !== serialized.length) {
+        issues.push({ path, message: "must not contain duplicate items" });
+      }
+    }
+    if (schema.items) {
+      value.forEach(
+        (entry, index) => validateNode(entry, schema.items, `${path}[${index}]`, root, issues)
+      );
+    }
+    return;
+  }
+  if (schema.type === "string") {
+    if (typeof value !== "string") {
+      issues.push({ path, message: `must be a string; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minLength !== void 0 && value.length < schema.minLength) {
+      issues.push({ path, message: `must contain at least ${schema.minLength} character(s)` });
+    }
+    return;
+  }
+  if (schema.type === "boolean") {
+    if (typeof value !== "boolean") {
+      issues.push({ path, message: `must be a boolean; received ${valueType(value)}` });
+    }
+    return;
+  }
+  if (schema.type === "integer") {
+    if (!Number.isInteger(value)) {
+      issues.push({ path, message: `must be an integer; received ${valueType(value)}` });
+      return;
+    }
+    if (schema.minimum !== void 0 && value < schema.minimum) {
+      issues.push({ path, message: `must be at least ${schema.minimum}` });
+    }
+  }
+}
+function defaultedConfig(input) {
+  return {
+    ...input,
+    $schema: input.$schema === void 0 ? ARK_CONFIG_SCHEMA_URL : input.$schema,
+    schemaVersion: input.schemaVersion === void 0 ? ARK_CONFIG_SCHEMA_VERSION : input.schemaVersion,
+    include: input.include === void 0 ? ["src"] : input.include,
+    layers: input.layers === void 0 ? [] : input.layers,
+    rules: input.rules === void 0 ? DEFAULT_ARK_CONFIG_RULES.map((rule) => ({ ...rule })) : input.rules
+  };
+}
+function migrateArkConfig(input, source = "ark.config.json") {
+  if (!isObject(input)) {
+    throw new ArkConfigValidationError(source, [
+      { path: "$", message: `must be an object; received ${valueType(input)}` }
+    ]);
+  }
+  const migratedFrom = input.schemaVersion === void 0 ? "unversioned" : null;
+  if (input.schemaVersion !== void 0 && input.schemaVersion !== ARK_CONFIG_SCHEMA_VERSION) {
+    throw new ArkConfigValidationError(source, [
+      {
+        path: "$.schemaVersion",
+        message: `unsupported version ${JSON.stringify(input.schemaVersion)}; expected ${ARK_CONFIG_SCHEMA_VERSION}`
+      }
+    ]);
+  }
+  return { candidate: defaultedConfig(input), migratedFrom };
+}
+function loadArkConfigContract(input, source = "ark.config.json") {
+  const { candidate, migratedFrom } = migrateArkConfig(input, source);
+  const issues = [];
+  validateNode(
+    candidate,
+    ARK_CONFIG_SCHEMA,
+    "$",
+    ARK_CONFIG_SCHEMA,
+    issues
+  );
+  if (issues.length > 0) throw new ArkConfigValidationError(source, issues);
+  return { config: candidate, migratedFrom };
+}
+function parseArkConfigJson(json, source = "ark.config.json") {
+  let input;
+  try {
+    input = JSON.parse(json);
+  } catch (error) {
+    throw new ArkConfigValidationError(source, [
+      {
+        path: "$",
+        message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
+      }
+    ]);
+  }
+  return loadArkConfigContract(input, source);
+}
+
+// src/domain/layerMatch.ts
+var regexpCache = /* @__PURE__ */ new Map();
+function escapeLiteral(ch) {
+  return /[.*+?^${}()|[\]\\]/.test(ch) ? `\\${ch}` : ch;
+}
+function normalizeGlobSeparators(pattern) {
+  let out = "";
+  for (let i = 0; i < pattern.length; i += 1) {
+    const c = pattern[i];
+    if (c === "\\" && i + 1 < pattern.length) {
+      const next = pattern[i + 1];
+      if ("*?{}[],".includes(next) || next === "\\") {
+        out += "\\" + next;
+        i += 1;
+        continue;
+      }
+      out += "/";
+      continue;
+    }
+    out += c;
+  }
+  return out;
+}
+function bracesBalanced(glob) {
+  let depth = 0;
+  for (let i = 0; i < glob.length; i += 1) {
+    const c = glob[i];
+    if (c === "\\") {
+      i += 1;
+      continue;
+    }
+    if (c === "{") depth += 1;
+    else if (c === "}") {
+      depth -= 1;
+      if (depth < 0) return false;
+    }
+  }
+  return depth === 0;
+}
+function globToRegExp(pattern) {
+  const cached = regexpCache.get(pattern);
+  if (cached) return cached;
+  const glob = normalizeGlobSeparators(pattern);
+  const useBraces = bracesBalanced(glob);
+  let out = "";
+  let braceDepth = 0;
+  for (let i = 0; i < glob.length; i += 1) {
+    const c = glob[i];
+    if (c === "\\" && i + 1 < glob.length) {
+      out += escapeLiteral(glob[i + 1]);
+      i += 1;
+    } else if (c === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          out += "(?:.*/)?";
+          i += 2;
+        } else {
+          out += ".*";
+          i += 1;
+        }
+      } else {
+        out += "[^/]*";
+      }
+    } else if (c === "?") {
+      out += "[^/]";
+    } else if (c === "{" && useBraces) {
+      out += "(?:";
+      braceDepth += 1;
+    } else if (c === "}" && useBraces && braceDepth > 0) {
+      out += ")";
+      braceDepth -= 1;
+    } else if (c === "," && useBraces && braceDepth > 0) {
+      out += "|";
+    } else {
+      out += escapeLiteral(c);
+    }
+  }
+  const re = new RegExp(`^${out}$`);
+  regexpCache.set(pattern, re);
+  return re;
+}
+function patternSpecificity(pattern) {
+  const glob = normalizeGlobSeparators(String(pattern));
+  const beforeWildcard = glob.split("*")[0];
+  const literalSegments = beforeWildcard.split("/").filter(Boolean).length;
+  const literalLength = glob.replace(/\*/g, "").length;
+  return literalSegments * 1e4 + literalLength;
+}
+function layerForRelativePath(relPath, layers) {
+  const rel = String(relPath).split(/[/\\]/).join("/");
+  let bestName;
+  let bestScore = -1;
+  for (const layer of layers ?? []) {
+    if ((layer.exclude ?? []).some((pattern) => globToRegExp(pattern).test(rel))) {
+      continue;
+    }
+    for (const pattern of layer.patterns ?? []) {
+      if (globToRegExp(pattern).test(rel)) {
+        const score = patternSpecificity(pattern);
+        if (score > bestScore) {
+          bestScore = score;
+          bestName = layer.name;
+        }
+      }
+    }
+  }
+  return bestName;
+}
+function sliceIdForPath(relPath, sliceFolders) {
+  if (!sliceFolders?.length) return void 0;
+  const parts = String(relPath).split(/[/\\]/).filter(Boolean);
+  const folders = new Set(sliceFolders.map((s) => String(s).toLowerCase()));
+  for (let i = 0; i < parts.length - 1; i += 1) {
+    if (folders.has(parts[i].toLowerCase())) {
+      return `${parts[i]}/${parts[i + 1]}`;
+    }
+  }
+  return void 0;
+}
+function inferSliceFoldersFromPatterns(patterns) {
+  const out = /* @__PURE__ */ new Set();
+  for (const pattern of patterns ?? []) {
+    const glob = normalizeGlobSeparators(String(pattern));
+    const parts = glob.split("/").filter(Boolean);
+    for (let i = 0; i < parts.length; i += 1) {
+      const part = parts[i];
+      if ((part === "**" || part === "*") && i > 0) {
+        const prev = parts[i - 1];
+        if (prev && !prev.includes("*") && !prev.includes("{") && !prev.includes("}")) {
+          out.add(prev);
+        }
+      }
+    }
+  }
+  return [...out];
+}
+function resolveSliceFolders(rule, layerName, layers) {
+  if (Array.isArray(rule.sliceFolders) && rule.sliceFolders.length > 0) {
+    return rule.sliceFolders.filter((s) => typeof s === "string" && s.length > 0);
+  }
+  const layer = (layers ?? []).find((l) => l.name === layerName);
+  return inferSliceFoldersFromPatterns(layer?.patterns);
+}
+function findDeniedEdgeRule(rules, from, to, options) {
+  for (const rule of rules ?? []) {
+    if (rule.from !== from || rule.to !== to) continue;
+    if (rule.allowed !== false) continue;
+    if (rule.peerIsolation) {
+      const fromPath = options?.fromPath;
+      const toPath = options?.toPath;
+      if (!fromPath || !toPath) continue;
+      const folders = resolveSliceFolders(rule, from, options?.layers);
+      if (folders.length === 0) continue;
+      const fromSlice = sliceIdForPath(fromPath, folders);
+      const toSlice = sliceIdForPath(toPath, folders);
+      if (!fromSlice || !toSlice) continue;
+      if (fromSlice !== toSlice) return rule;
+      continue;
+    }
+    if (from === to) continue;
+    return rule;
+  }
+  return void 0;
+}
+
+// src/kernel/semanticAnalysis.ts
+function literalText(ts, node) {
+  return node && ts.isStringLiteralLike(node) ? node.text : void 0;
+}
+function lineOf(sourceFile, node) {
+  return sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+}
+function isTypeOnlyReference(ts, node) {
+  if (ts.isImportDeclaration(node)) {
+    const clause = node.importClause;
+    if (!clause) return false;
+    if (clause.isTypeOnly) return true;
+    const named = clause.namedBindings;
+    return Boolean(
+      named && ts.isNamedImports(named) && named.elements.length > 0 && named.elements.every((element) => element.isTypeOnly)
+    );
+  }
+  if (ts.isExportDeclaration(node)) {
+    if (node.isTypeOnly) return true;
+    const clause = node.exportClause;
+    return Boolean(
+      clause && ts.isNamedExports(clause) && clause.elements.length > 0 && clause.elements.every((element) => element.isTypeOnly)
+    );
+  }
+  return false;
+}
+function singleFileChecker(ts, sourceFile) {
+  const options = { noLib: true, noResolve: true, target: ts.ScriptTarget.Latest };
+  const host = ts.createCompilerHost(options, true);
+  host.getSourceFile = (fileName) => fileName === sourceFile.fileName ? sourceFile : void 0;
+  host.fileExists = (fileName) => fileName === sourceFile.fileName;
+  host.readFile = (fileName) => fileName === sourceFile.fileName ? sourceFile.text : void 0;
+  return ts.createProgram([sourceFile.fileName], options, host).getTypeChecker();
+}
+function symbolAt(checker, node) {
+  try {
+    return checker.getSymbolAtLocation(node);
+  } catch {
+    return void 0;
+  }
+}
+function localDeclaration(ts, checker, sourceFile, node) {
+  const shorthand = node.parent && ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node;
+  let symbol;
+  try {
+    symbol = shorthand ? checker.getShorthandAssignmentValueSymbol(node.parent) : symbolAt(checker, node);
+  } catch {
+    symbol = void 0;
+  }
+  return Boolean(
+    symbol?.declarations?.some(
+      (declaration) => declaration.getSourceFile().fileName === sourceFile.fileName
+    )
+  );
+}
+function extractSemanticDependencies(ts, sourceFile) {
+  let checker;
+  const dependencies = [];
+  const add = (node, kind, specifier, typeOnly = false) => dependencies.push({
+    specifier,
+    kind,
+    line: lineOf(sourceFile, node),
+    typeOnly,
+    unresolved: specifier === void 0,
+    node
+  });
+  const visit = (node) => {
+    if (ts.isImportDeclaration(node)) {
+      add(node, "import", literalText(ts, node.moduleSpecifier), isTypeOnlyReference(ts, node));
+    } else if (ts.isExportDeclaration(node) && node.moduleSpecifier) {
+      add(node, "export", literalText(ts, node.moduleSpecifier), isTypeOnlyReference(ts, node));
+    } else if (ts.isImportEqualsDeclaration(node) && ts.isExternalModuleReference(node.moduleReference)) {
+      add(node, "require", literalText(ts, node.moduleReference.expression));
+    } else if (ts.isCallExpression(node)) {
+      const dynamicImport = node.expression.kind === ts.SyntaxKind.ImportKeyword;
+      const requireCall = ts.isIdentifier(node.expression) && node.expression.text === "require";
+      const directRequire = requireCall && !localDeclaration(
+        ts,
+        checker ?? (checker = singleFileChecker(ts, sourceFile)),
+        sourceFile,
+        node.expression
+      );
+      if (dynamicImport || directRequire) {
+        add(node, directRequire ? "require" : "dynamic-import", literalText(ts, node.arguments[0]));
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return dependencies;
+}
+function staticAccessPath(ts, node) {
+  const segments = [];
+  let current = node;
+  while (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+    if (ts.isPropertyAccessExpression(current)) segments.unshift(current.name.text);
+    else {
+      const property = literalText(ts, current.argumentExpression);
+      if (property === void 0) return void 0;
+      segments.unshift(property);
+    }
+    current = current.expression;
+  }
+  if (!ts.isIdentifier(current)) return void 0;
+  segments.unshift(current.text);
+  return { root: current, segments };
+}
+function runtimeIdentifierReference(ts, node) {
+  const parent = node.parent;
+  if (ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) return false;
+  return ts.isExpressionNode(node) && !ts.isInTypeQuery(node) || ts.isShorthandPropertyAssignment(parent) && parent.name === node;
+}
+function bestForbiddenMatch(entries, segments) {
+  const normalized = segments[0] === "globalThis" ? segments.slice(1) : segments;
+  for (let length = normalized.length; length >= 1; length -= 1) {
+    const candidate = normalized.slice(0, length).join(".");
+    if (entries.has(candidate)) return candidate;
+  }
+  return void 0;
+}
+function collectForbiddenCapabilityUses(ts, sourceFile, forbidden) {
+  if (forbidden.length === 0) return [];
+  const entries = new Set(forbidden);
+  const checker = singleFileChecker(ts, sourceFile);
+  const aliases = /* @__PURE__ */ new Map();
+  const topLevelNames = /* @__PURE__ */ new Set();
+  for (const statement of sourceFile.statements) {
+    if (ts.isVariableStatement(statement)) {
+      for (const declaration of statement.declarationList.declarations) {
+        if (ts.isIdentifier(declaration.name)) topLevelNames.add(declaration.name.text);
+      }
+    }
+  }
+  const resolvePath = (node) => {
+    const path = staticAccessPath(ts, node);
+    if (!path) return void 0;
+    const symbol = symbolAt(checker, path.root);
+    const alias = symbol ? aliases.get(symbol) : void 0;
+    if (alias) return [...alias, ...path.segments.slice(1)];
+    return localDeclaration(ts, checker, sourceFile, path.root) || topLevelNames.has(path.root.text) ? void 0 : path.segments;
+  };
+  for (const statement of sourceFile.statements) {
+    if (!ts.isVariableStatement(statement)) continue;
+    for (const declaration of statement.declarationList.declarations) {
+      if (!declaration.initializer || !ts.isIdentifier(declaration.name)) continue;
+      const path = resolvePath(declaration.initializer);
+      const symbol = symbolAt(checker, declaration.name);
+      if (!path || !symbol) continue;
+      aliases.set(symbol, path);
+    }
+  }
+  const uses = [];
+  const seen = /* @__PURE__ */ new Set();
+  const flag = (name, node) => {
+    const line = lineOf(sourceFile, node);
+    const key = `${name}:${node.getStart(sourceFile)}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    uses.push({ name, line, node });
+  };
+  const visit = (node) => {
+    const parentContinuesPath = node.parent && (ts.isPropertyAccessExpression(node.parent) || ts.isElementAccessExpression(node.parent)) && node.parent.expression === node;
+    if ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && !parentContinuesPath) {
+      const path = resolvePath(node);
+      const match = path ? bestForbiddenMatch(entries, path) : void 0;
+      if (match) flag(match, node);
+    } else if (ts.isIdentifier(node) && entries.has(node.text) && runtimeIdentifierReference(ts, node) && !localDeclaration(ts, checker, sourceFile, node)) {
+      flag(node.text, node);
+    }
+    if (ts.isVariableDeclaration(node) && ts.isObjectBindingPattern(node.name) && node.initializer) {
+      const base = resolvePath(node.initializer);
+      if (base) {
+        for (const element of node.name.elements) {
+          if (!ts.isIdentifier(element.name)) continue;
+          const property = element.propertyName ? literalText(ts, element.propertyName) ?? element.propertyName.text : element.name.text;
+          const match = bestForbiddenMatch(entries, [...base, property]);
+          if (match) flag(match, node.initializer);
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return uses;
+}
+
+// src/domain/sourcePolicy.ts
+var SOURCE_POLICY_MESSAGES = {
+  RAW_EVENT_PUBLISH: "Publish through a registered intent creator; raw event objects or intent strings bypass Ark contracts and tooling.",
+  PUBLISH_MISSING_SOURCE: "Strict Ark publish calls must include metadata.source."
+};
+function looksLikeArkIntent(value) {
+  return /^(Domain|Application|Adapter|Workflow|Job|Presentation|Reporting|Metadata|Security|Audit|Observability|Kernel)\.[A-Za-z0-9_.]+$/.test(
+    value
+  );
+}
+function classifyPublishFacts(facts) {
+  if (!facts.publishCall) return [];
+  const findings = [];
+  if (facts.rawIntentName !== void 0 && looksLikeArkIntent(facts.rawIntentName) || facts.objectHasIntent) {
+    findings.push({
+      ruleId: "RAW_EVENT_PUBLISH",
+      message: SOURCE_POLICY_MESSAGES.RAW_EVENT_PUBLISH
+    });
+  }
+  if (facts.arkPublishCandidate && !facts.hasSource) {
+    findings.push({
+      ruleId: "PUBLISH_MISSING_SOURCE",
+      message: SOURCE_POLICY_MESSAGES.PUBLISH_MISSING_SOURCE
+    });
+  }
+  return findings;
+}
+
+// src/kernel/analysis.ts
+function loadContract(input, source) {
+  const loaded = typeof input === "string" ? parseArkConfigJson(input, source) : loadArkConfigContract(input, source);
+  return { ...loaded, policyHash: deterministicHash(stableSerialize(loaded.config)) };
+}
+function normalizePath(value) {
+  return value.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function isIdentifierCharacter(value) {
+  return value !== void 0 && /[A-Za-z0-9_$]/.test(value);
+}
+function skipWhitespace(source, index) {
+  while (index < source.length && /\s/.test(source[index])) index += 1;
+  return index;
+}
+function readString(source, index) {
+  const quote = source[index];
+  if (quote !== "'" && quote !== '"') return void 0;
+  const start = index;
+  let value = "";
+  for (index += 1; index < source.length; index += 1) {
+    const current = source[index];
+    if (current === quote) {
+      return { value, offset: start, excerpt: source.slice(start, index + 1) };
+    }
+    if (current === "\\" && index + 1 < source.length) {
+      value += source[index + 1];
+      index += 1;
+    } else {
+      value += current;
+    }
+  }
+  return void 0;
+}
+function isWordAt(source, word, index) {
+  return source.startsWith(word, index) && !isIdentifierCharacter(source[index - 1]) && !isIdentifierCharacter(source[index + word.length]);
+}
+function specifierAfterImport(source, index) {
+  index = skipWhitespace(source, index + "import".length);
+  if (source[index] === "(") return readString(source, skipWhitespace(source, index + 1));
+  return specifierInStaticStatement(source, index, true);
+}
+function specifierAfterExport(source, index) {
+  return specifierInStaticStatement(source, index + "export".length, false);
+}
+function specifierInStaticStatement(source, index, allowDirectSpecifier) {
+  for (; index < source.length; index += 1) {
+    if (source[index] === ";") return void 0;
+    if (isWordAt(source, "from", index)) {
+      return readString(source, skipWhitespace(source, index + "from".length));
+    }
+    if (allowDirectSpecifier && (source[index] === "'" || source[index] === '"')) {
+      return readString(source, index);
+    }
+    if (index > 0 && (isWordAt(source, "import", index) || isWordAt(source, "export", index))) {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+function moduleSpecifiers(source) {
+  const result = [];
+  for (let index = 0; index < source.length; index += 1) {
+    const current = source[index];
+    if (current === "/" && source[index + 1] === "/") {
+      index = source.indexOf("\n", index + 2);
+      if (index < 0) break;
+      continue;
+    }
+    if (current === "/" && source[index + 1] === "*") {
+      const end = source.indexOf("*/", index + 2);
+      if (end < 0) break;
+      index = end + 1;
+      continue;
+    }
+    if (current === "'" || current === '"' || current === "`") {
+      const string = readString(source, index);
+      if (string) index = string.offset + string.excerpt.length - 1;
+      continue;
+    }
+    const specifier = isWordAt(source, "import", index) ? specifierAfterImport(source, index) : isWordAt(source, "export", index) ? specifierAfterExport(source, index) : void 0;
+    if (specifier) result.push(specifier);
+  }
+  return result;
+}
+function importEdges(file, files) {
+  const edges = [];
+  for (const moduleSpecifier of moduleSpecifiers(file.content)) {
+    const specifier = moduleSpecifier.value;
+    if (!specifier.startsWith(".")) continue;
+    const line = file.content.slice(0, moduleSpecifier.offset).split("\n").length;
+    const evidence = {
+      kind: "import",
+      file: file.path,
+      line,
+      excerpt: moduleSpecifier.excerpt
+    };
+    const target = resolveSpecifier(file.path, specifier, files);
+    edges.push({
+      from: file.path,
+      specifier,
+      to: target?.path ?? null,
+      resolution: target ? "resolved" : "unresolved",
+      fromLayer: file.layer,
+      toLayer: target?.layer ?? null,
+      evidence
+    });
+  }
+  return edges;
+}
+function resolveSpecifier(from, specifier, files) {
+  const segments = from.split("/");
+  segments.pop();
+  for (const segment of specifier.split("/")) {
+    if (segment === "." || segment === "") continue;
+    if (segment === "..") segments.pop();
+    else segments.push(segment);
+  }
+  const base = segments.join("/");
+  for (const candidate of [base, `${base}.ts`, `${base}.tsx`, `${base}.mts`, `${base}.cts`, `${base}/index.ts`, `${base}/index.tsx`]) {
+    const found = files.get(candidate);
+    if (found) return found;
+  }
+  return void 0;
+}
+function violationsFor(edges, config) {
+  const violations = [];
+  for (const edge of edges) {
+    if (!edge.to || !edge.fromLayer || !edge.toLayer) continue;
+    const rule = findDeniedEdgeRule(config.rules, edge.fromLayer, edge.toLayer, {
+      fromPath: edge.from,
+      toPath: edge.to,
+      layers: config.layers
+    });
+    if (!rule) continue;
+    violations.push({
+      ruleId: `layer-dependency:${rule.from}->${rule.to}`,
+      message: rule.message ?? `${rule.from} must not depend on ${rule.to}.`,
+      edge,
+      evidence: edge.evidence
+    });
+  }
+  return violations;
+}
+function analyzeProject(input) {
+  const files = input.files.map((inputFile) => {
+    const path = normalizePath(inputFile.path);
+    return {
+      path,
+      content: inputFile.content,
+      contentHash: deterministicHash(inputFile.content),
+      layer: layerForRelativePath(path, input.contract.config.layers) ?? null
+    };
+  }).sort((left, right) => left.path.localeCompare(right.path));
+  const fileByPath = new Map(files.map((file) => [file.path, file]));
+  const edges = files.flatMap((file) => importEdges(file, fileByPath));
+  const capabilityUses = [];
+  const violations = violationsFor(edges, input.contract.config);
+  return {
+    ir: {
+      schemaVersion: ANALYSIS_IR_SCHEMA_VERSION,
+      policyHash: input.contract.policyHash,
+      compilerOptionsHash: deterministicHash(stableSerialize(input.compilerOptions ?? {})),
+      files,
+      layers: input.contract.config.layers.map((layer) => layer.name),
+      edges,
+      capabilityUses,
+      violations
+    }
+  };
+}
+function analyzeChange(input) {
+  const files = new Map(input.files.map((file) => [normalizePath(file.path), file]));
+  for (const change of input.changes) {
+    const path = normalizePath(change.path);
+    if ("delete" in change && change.delete) files.delete(path);
+    else if ("content" in change) files.set(path, { path, content: change.content });
+  }
+  return analyzeProject({
+    contract: input.contract,
+    files: [...files.values()],
+    compilerOptions: input.compilerOptions
+  });
+}
+function explainViolation(violation) {
+  const location = `${violation.evidence.file}:${violation.evidence.line}`;
+  if (!violation.edge) return `${violation.ruleId} at ${location}: ${violation.message}`;
+  const target = violation.edge.to ?? violation.edge.specifier;
+  return `${violation.ruleId} at ${location}: ${violation.edge.from} imports ${target}. ${violation.message}`;
+}
+function detectArchitectureCycles(graph) {
+  let index = 0;
+  const indices = /* @__PURE__ */ new Map();
+  const low = /* @__PURE__ */ new Map();
+  const onStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  const components = [];
+  const connect = (file) => {
+    indices.set(file, index);
+    low.set(file, index);
+    index += 1;
+    stack.push(file);
+    onStack.add(file);
+    for (const target of [...graph.get(file) ?? []].sort()) {
+      if (!graph.has(target)) continue;
+      if (!indices.has(target)) {
+        connect(target);
+        low.set(file, Math.min(low.get(file) ?? 0, low.get(target) ?? 0));
+      } else if (onStack.has(target)) {
+        low.set(file, Math.min(low.get(file) ?? 0, indices.get(target) ?? 0));
+      }
+    }
+    if (low.get(file) !== indices.get(file)) return;
+    const component = [];
+    let member;
+    do {
+      member = stack.pop();
+      if (member === void 0) break;
+      onStack.delete(member);
+      component.push(member);
+    } while (member !== file);
+    if (component.length > 1) components.push(component.sort());
+  };
+  for (const file of [...graph.keys()].sort()) {
+    if (!indices.has(file)) connect(file);
+  }
+  return components.sort((left, right) => left[0].localeCompare(right[0])).map((members) => ({
+    ruleId: "CIRCULAR_DEPENDENCY",
+    file: members[0],
+    line: 1,
+    target: members.join(" \u2192 "),
+    message: `Circular dependency among ${members.length} files: ${members.join(" \u2192 ")} \u2192 ${members[0]}.`,
+    cycleKind: "value"
+  }));
+}
+function evaluateArchitectureGraph(input) {
+  const violations = input.contentViolations.map((violation) => ({ ...violation }));
+  const warnings = (input.warnings ?? []).map((warning) => ({ ...warning }));
+  const graph = new Map(
+    input.files.map((file) => [file, /* @__PURE__ */ new Set()])
+  );
+  for (const edge of input.edges) {
+    if (edge.to && edge.to !== edge.from && !edge.typeOnly && graph.has(edge.from)) {
+      graph.get(edge.from)?.add(edge.to);
+    }
+    if (!edge.to || !edge.toLayer) continue;
+    const rule = findDeniedEdgeRule(input.rules, edge.fromLayer, edge.toLayer, {
+      fromPath: edge.from,
+      toPath: edge.to,
+      layers: input.config.layers
+    });
+    if (!rule) continue;
+    const peerIsolation = Boolean(rule.peerIsolation);
+    violations.push({
+      ruleId: "LAYER_IMPORT_VIOLATION",
+      file: edge.from,
+      line: edge.line,
+      fromLayer: edge.fromLayer,
+      toLayer: edge.toLayer,
+      target: edge.to,
+      ...edge.typeOnly ? { typeOnly: true } : {},
+      ...edge.targetTypeOnlyExports ? { targetTypeOnlyExports: true } : {},
+      ...edge.sourcePureTypeModule ? { sourcePureTypeModule: true } : {},
+      ...edge.namedBindingsTypeOnly ? { namedBindingsTypeOnly: true } : {},
+      ...!peerIsolation && edge.portProofEligible ? { portProofEligible: true } : {},
+      ...edge.kind ? { edgeKind: edge.kind } : {},
+      ...peerIsolation ? { peerIsolation: true } : {},
+      message: rule.message ?? (peerIsolation ? `${edge.fromLayer} must not ${edge.kind} another slice of ${edge.toLayer} (${edge.from} \u2192 ${edge.to}). Extract shared code or use events/ports across slices.` : `${edge.fromLayer} must not ${edge.kind} ${edge.toLayer}.`)
+    });
+  }
+  const cyclePolicy = String(input.config.cyclePolicy ?? "strict").toLowerCase();
+  if (cyclePolicy !== "off") {
+    const cycles = detectArchitectureCycles(graph);
+    if (cyclePolicy === "soft" || cyclePolicy === "framework-soft") {
+      warnings.push(
+        ...cycles.map((cycle) => ({
+          ...cycle,
+          message: `${cycle.message} (soft cycle policy \u2014 advisory only; set cyclePolicy: "strict" to fail the check)`,
+          failsStrict: false
+        }))
+      );
+    } else {
+      violations.push(...cycles);
+    }
+  }
+  return { violations, warnings, safety: input.safety };
+}
+function configWarning(ruleId, message, extra = {}) {
+  return { ruleId, message, ...extra };
+}
+function collectAnalysisConfigWarnings(input) {
+  const { config, rules, files, manifest } = input;
+  const warnings = [];
+  if (config.dynamicImportAllowlist !== void 0 && (!Array.isArray(config.dynamicImportAllowlist) || config.dynamicImportAllowlist.some((entry) => typeof entry !== "string"))) {
+    warnings.push(
+      configWarning(
+        "CONFIG_INVALID_DYNAMIC_IMPORT_ALLOWLIST",
+        "dynamicImportAllowlist must be an array of file globs."
+      )
+    );
+  }
+  if (config.safety !== void 0 && (config.safety === null || typeof config.safety !== "object" || Array.isArray(config.safety))) {
+    warnings.push(configWarning("CONFIG_INVALID_SAFETY", "safety must be an object."));
+  } else if (config.safety) {
+    for (const key of ["maxTsSuppressions", "maxAnyCasts"]) {
+      const value = config.safety[key];
+      if (value !== void 0 && (!Number.isInteger(value) || value < 0)) {
+        warnings.push(
+          configWarning(
+            "CONFIG_INVALID_SAFETY_THRESHOLD",
+            `safety.${key} must be a non-negative integer.`
+          )
+        );
+      }
+    }
+  }
+  const layers = Array.isArray(config.layers) ? config.layers : [];
+  const manifestLayers = Array.isArray(manifest?.architecture?.layers) ? manifest.architecture.layers : [];
+  const knownLayers = /* @__PURE__ */ new Set([
+    ...layers.map((layer) => layer.name).filter(Boolean),
+    ...manifestLayers.map((layer) => layer.name).filter((name) => Boolean(name))
+  ]);
+  if (layers.length === 0) {
+    warnings.push(
+      configWarning(
+        "CONFIG_NO_LAYERS",
+        "No file layers are configured; ark-check cannot classify files for import-boundary enforcement."
+      )
+    );
+  }
+  const seenLayers = /* @__PURE__ */ new Set();
+  const duplicateLayers = /* @__PURE__ */ new Set();
+  for (const layer of layers) {
+    if (!layer.name) {
+      warnings.push(configWarning("CONFIG_LAYER_WITHOUT_NAME", "A configured layer is missing a name."));
+      continue;
+    }
+    if (seenLayers.has(layer.name)) duplicateLayers.add(layer.name);
+    seenLayers.add(layer.name);
+    if (layer.forbiddenGlobals !== void 0 && (!Array.isArray(layer.forbiddenGlobals) || layer.forbiddenGlobals.some((entry) => typeof entry !== "string"))) {
+      warnings.push(
+        configWarning(
+          "CONFIG_INVALID_FORBIDDEN_GLOBALS",
+          `Layer "${layer.name}" has an invalid forbiddenGlobals value; expected an array of strings (e.g. ["fetch", "Date.now"]). The entry is ignored.`,
+          { layer: layer.name }
+        )
+      );
+    }
+    const patterns = Array.isArray(layer.patterns) ? layer.patterns : [];
+    if (patterns.length === 0) {
+      warnings.push(
+        configWarning(
+          "CONFIG_LAYER_WITHOUT_PATTERNS",
+          `Layer "${layer.name}" has no file patterns and will never classify files.`,
+          { layer: layer.name }
+        )
+      );
+      continue;
+    }
+    for (const pattern of patterns) {
+      let expression;
+      try {
+        expression = globToRegExp(pattern);
+      } catch (error) {
+        warnings.push(
+          configWarning(
+            "CONFIG_INVALID_LAYER_PATTERN",
+            `Layer "${layer.name}" has an invalid pattern "${pattern}": ${error instanceof Error ? error.message : String(error)}`,
+            { layer: layer.name, pattern }
+          )
+        );
+        continue;
+      }
+      if (!files.some((file) => expression.test(file)) && !layer.optional) {
+        warnings.push(
+          configWarning(
+            "CONFIG_LAYER_PATTERN_NO_MATCHES",
+            `Layer "${layer.name}" pattern "${pattern}" matched no included files.`,
+            { layer: layer.name, pattern, failsStrict: false }
+          )
+        );
+      }
+    }
+  }
+  for (const name of duplicateLayers) {
+    warnings.push(
+      configWarning("CONFIG_DUPLICATE_LAYER", `Layer "${name}" is configured more than once.`, {
+        layer: name
+      })
+    );
+  }
+  if (knownLayers.size > 0) {
+    for (const rule of rules ?? []) {
+      if (rule.from && !knownLayers.has(rule.from)) {
+        warnings.push(
+          configWarning(
+            "CONFIG_RULE_UNKNOWN_FROM_LAYER",
+            `Rule references unknown source layer "${rule.from}".`,
+            { fromLayer: rule.from, toLayer: rule.to }
+          )
+        );
+      }
+      if (rule.to && !knownLayers.has(rule.to)) {
+        warnings.push(
+          configWarning(
+            "CONFIG_RULE_UNKNOWN_TO_LAYER",
+            `Rule references unknown target layer "${rule.to}".`,
+            { fromLayer: rule.from, toLayer: rule.to }
+          )
+        );
+      }
+    }
+  }
+  const ambiguousPairs = /* @__PURE__ */ new Set();
+  if (layers.length > 1) {
+    for (const file of files) {
+      let topScore = -1;
+      let topLayers = [];
+      for (const layer of layers) {
+        for (const pattern of layer.patterns ?? []) {
+          if (!globToRegExp(pattern).test(file)) continue;
+          const score = patternSpecificity(pattern);
+          if (score > topScore) {
+            topScore = score;
+            topLayers = [layer.name];
+          } else if (score === topScore && !topLayers.includes(layer.name)) {
+            topLayers.push(layer.name);
+          }
+        }
+      }
+      if (topLayers.length > 1) ambiguousPairs.add([...topLayers].sort().join(" + "));
+    }
+  }
+  if (ambiguousPairs.size > 0) {
+    warnings.push(
+      configWarning(
+        "CONFIG_AMBIGUOUS_LAYERS",
+        `Some files match multiple layers at equal specificity; classification falls back to declaration order. Disambiguate the overlapping patterns: ${[...ambiguousPairs].join(", ")}.`,
+        { pairs: [...ambiguousPairs] }
+      )
+    );
+  }
+  const unclassified = files.filter((file) => !layerForRelativePath(file, layers));
+  if (unclassified.length > 0) {
+    warnings.push(
+      configWarning(
+        "CONFIG_UNCLASSIFIED_FILES",
+        `${unclassified.length} included source file(s) are not matched by any configured layer; ark-check will not enforce import rules for those source files.`,
+        { count: unclassified.length, samples: unclassified.slice(0, 5) }
+      )
+    );
+  }
+  return warnings;
+}
+export {
+  SOURCE_POLICY_MESSAGES,
+  analyzeChange,
+  analyzeProject,
+  classifyPublishFacts,
+  collectAnalysisConfigWarnings,
+  collectForbiddenCapabilityUses,
+  detectArchitectureCycles,
+  evaluateArchitectureGraph,
+  explainViolation,
+  extractSemanticDependencies,
+  loadContract,
+  looksLikeArkIntent
+};