arkgate 2.7.0 → 2.8.1

package/dist/nestjs/index.js

@@ -81,41 +81,6 @@ function createAuditTrail(options = {}) {
   );
 }
 
-// src/kernel/intent/validateIntentName.ts
-var ALLOWED_PREFIXES = [
-  "Domain.",
-  "Application.",
-  "Adapter.",
-  "Workflow.",
-  "Job.",
-  "Presentation.",
-  "Reporting.",
-  "Metadata.",
-  "Security.",
-  "Audit.",
-  "Observability.",
-  "Kernel."
-];
-function validateIntentName(name) {
-  if (!name || typeof name !== "string") {
-    return { valid: false, reason: "Intent name must be a non-empty string" };
-  }
-  if (!ALLOWED_PREFIXES.some((p) => name.startsWith(p))) {
-    return {
-      valid: false,
-      reason: `Intent "${name}" must start with one of: ${ALLOWED_PREFIXES.join(", ")}`
-    };
-  }
-  const rest = name.slice(name.indexOf(".") + 1);
-  if (!rest || !/^[A-Za-z][A-Za-z0-9_.]*$/.test(rest)) {
-    return {
-      valid: false,
-      reason: `Intent "${name}" has an invalid segment after the layer prefix`
-    };
-  }
-  return { valid: true };
-}
-
 // src/kernel/policy/PolicyViolationError.ts
 var PolicyViolationError = class extends Error {
   violations;
@@ -382,12 +347,74 @@ var ObservedLayerFlowViolationError = class extends Error {
   }
 };
 
-// src/kernel/event-bus/EventBus.ts
-var interceptorSequence = 0;
-function nextInterceptorRegistrationId() {
-  interceptorSequence += 1;
-  return `interceptor-${Date.now()}-${interceptorSequence}`;
+// src/kernel/intent/validateIntentName.ts
+var ALLOWED_PREFIXES = [
+  "Domain.",
+  "Application.",
+  "Adapter.",
+  "Workflow.",
+  "Job.",
+  "Presentation.",
+  "Reporting.",
+  "Metadata.",
+  "Security.",
+  "Audit.",
+  "Observability.",
+  "Kernel."
+];
+function validateIntentName(name) {
+  if (!name || typeof name !== "string") {
+    return { valid: false, reason: "Intent name must be a non-empty string" };
+  }
+  if (!ALLOWED_PREFIXES.some((p) => name.startsWith(p))) {
+    return {
+      valid: false,
+      reason: `Intent "${name}" must start with one of: ${ALLOWED_PREFIXES.join(", ")}`
+    };
+  }
+  const rest = name.slice(name.indexOf(".") + 1);
+  if (!rest || !/^[A-Za-z][A-Za-z0-9_.]*$/.test(rest)) {
+    return {
+      valid: false,
+      reason: `Intent "${name}" has an invalid segment after the layer prefix`
+    };
+  }
+  return { valid: true };
+}
+
+// src/kernel/event-bus/publishGuards.ts
+function assertIntentAllowed(intentName, options) {
+  if (!options.strictRegistry && !options.validateIntentNaming) {
+    return;
+  }
+  if (options.validateIntentNaming) {
+    const validation = validateIntentName(intentName);
+    if (!validation.valid) {
+      throw new InvalidIntentNameError(intentName, validation.reason);
+    }
+  }
+  if (options.strictRegistry && options.intentRegistry && !options.intentRegistry.has(intentName)) {
+    throw new UnregisteredIntentError(intentName);
+  }
+}
+function assertSourceAllowed(event, options) {
+  if (!options.requireKnownSource) return;
+  if (!event.metadata.source || event.metadata.source === "unknown") {
+    throw new UnknownEventSourceError(event.intent);
+  }
+  if (options.intentRegistry && !options.intentRegistry.has(event.metadata.source)) {
+    throw new UnknownEventSourceError(event.intent, event.metadata.source);
+  }
+}
+function assertContractAllowed(event, options) {
+  if (!options.eventContracts) return;
+  const result = options.eventContracts.validate(event);
+  if (!result.ok && (options.strictEventContracts || result.contract)) {
+    throw new EventContractViolationError(event.intent, result.issues);
+  }
 }
+
+// src/kernel/event-bus/payloadPatch.ts
 function isPlainRecord(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return false;
@@ -458,29 +485,318 @@ function applyPayloadPatch(payload, patch) {
   }
   return mergeRecordPatch(payload, patch);
 }
+
+// src/kernel/event-bus/publishInterceptors.ts
+async function applyInterceptors(event, deps) {
+  if (event.metadata.allowInterception === false) {
+    return event;
+  }
+  const matching = [...deps.interceptorsForIntent(event.intent)];
+  let current = event;
+  for (const registration of matching) {
+    const patches = [];
+    try {
+      await Promise.resolve(
+        registration.interceptor({
+          event: current,
+          intercept: (patch) => {
+            patches.push(patch);
+          }
+        })
+      );
+      if (patches.length === 0) {
+        continue;
+      }
+      const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+      let candidate = {
+        ...current,
+        metadata: {
+          ...current.metadata,
+          interceptions: [
+            ...current.metadata.interceptions ?? [],
+            { interceptorId: registration.interceptorId, timestamp }
+          ]
+        }
+      };
+      for (const patch of patches) {
+        candidate = {
+          ...candidate,
+          payload: applyPayloadPatch(candidate.payload, patch),
+          metadata: { ...candidate.metadata }
+        };
+      }
+      assertContractAllowed(candidate, {
+        eventContracts: deps.eventContracts,
+        strictEventContracts: deps.strictEventContracts
+      });
+      current = candidate;
+      registration.lastInterceptedAt = timestamp;
+      deps.appendTrace({
+        type: "event.intercepted",
+        timestamp,
+        intent: current.intent,
+        correlationId: current.metadata.correlationId,
+        traceId: current.metadata.traceId,
+        spanId: current.metadata.spanId,
+        details: {
+          registrationId: registration.registrationId,
+          interceptorId: registration.interceptorId,
+          patchesApplied: patches.length
+        }
+      });
+      await deps.recordAudit("event.intercepted", current, {
+        registrationId: registration.registrationId,
+        interceptorId: registration.interceptorId,
+        patchesApplied: patches.length
+      });
+    } catch (err) {
+      await recordInterceptorError(registration, current, err, deps);
+    }
+  }
+  return current;
+}
+async function recordInterceptorError(interceptor, event, error, deps) {
+  const message = error instanceof Error ? error.message : String(error);
+  deps.appendTrace({
+    type: "interceptor.error",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    intent: event.intent,
+    correlationId: event.metadata.correlationId,
+    traceId: event.metadata.traceId,
+    spanId: event.metadata.spanId,
+    details: {
+      registrationId: interceptor.registrationId,
+      interceptorId: interceptor.interceptorId,
+      error: message
+    }
+  });
+  await deps.recordAudit("interceptor.error", event, {
+    registrationId: interceptor.registrationId,
+    interceptorId: interceptor.interceptorId,
+    error: message
+  });
+}
+
+// src/kernel/event-bus/observedLayerFlow.ts
+async function assertObservedLayerFlowAllowed(event, deps) {
+  if (deps.mode === "off" || !deps.architectureProfile) {
+    return;
+  }
+  const source = event.metadata.source;
+  if (!source || source === "unknown") return;
+  const profile = deps.architectureProfile;
+  const fromLayer = profile.resolveLayer(source);
+  const toLayer = profile.resolveLayer(event.intent);
+  if (!fromLayer || !toLayer) return;
+  const blocked = profile.rules.find(
+    (rule) => !rule.allowed && rule.from === fromLayer && rule.to === toLayer
+  );
+  if (!blocked) return;
+  const severity = deps.mode;
+  const message = blocked.message ?? `Observed layer violation: "${source}" (${fromLayer}) must not produce "${event.intent}" (${toLayer}).`;
+  const details = {
+    source,
+    intent: event.intent,
+    fromLayer,
+    toLayer,
+    severity,
+    message,
+    rule: blocked
+  };
+  deps.appendTrace({
+    type: "layer.observedViolation",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    intent: event.intent,
+    correlationId: event.metadata.correlationId,
+    traceId: event.metadata.traceId,
+    spanId: event.metadata.spanId,
+    details
+  });
+  await deps.recordAudit("layer.observedViolation", event, details);
+  if (severity === "hard") {
+    throw new ObservedLayerFlowViolationError(
+      source,
+      event.intent,
+      fromLayer,
+      toLayer,
+      message
+    );
+  }
+}
+
+// src/kernel/event-bus/publishPolicy.ts
+async function enforcePublishPolicy(event, deps) {
+  const ctx = deps.getPolicyContext(event);
+  let policyResult;
+  try {
+    policyResult = deps.policyEngine.enforce(ctx);
+  } catch (err) {
+    if (err instanceof PolicyViolationError) {
+      deps.appendTrace({
+        type: "policy.hardViolation",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        intent: event.intent,
+        correlationId: event.metadata.correlationId,
+        traceId: event.metadata.traceId,
+        spanId: event.metadata.spanId,
+        details: { violations: err.violations }
+      });
+      await deps.recordAudit("policy.hardViolation", event, {
+        violations: err.violations
+      });
+    }
+    throw err;
+  }
+  if (policyResult.softViolations.length > 0) {
+    deps.appendTrace({
+      type: "policy.softViolation",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      intent: event.intent,
+      correlationId: event.metadata.correlationId,
+      traceId: event.metadata.traceId,
+      spanId: event.metadata.spanId,
+      details: { violations: policyResult.softViolations }
+    });
+    await deps.recordAudit("policy.softViolation", event, {
+      violations: policyResult.softViolations
+    });
+    if (deps.onSoftViolation) {
+      await deps.safeHook(
+        () => deps.onSoftViolation(policyResult, event),
+        "onSoftViolation",
+        event
+      );
+    }
+  }
+}
+
+// src/kernel/event-bus/publishRecording.ts
+function appendHistory(buffers, record) {
+  buffers.history.push(record);
+  if (buffers.maxHistorySize !== void 0 && buffers.history.length > buffers.maxHistorySize) {
+    buffers.history.splice(0, buffers.history.length - buffers.maxHistorySize);
+  }
+}
+function appendTrace(buffers, record) {
+  buffers.trace.push(record);
+  if (buffers.maxHistorySize !== void 0 && buffers.trace.length > buffers.maxHistorySize) {
+    buffers.trace.splice(0, buffers.trace.length - buffers.maxHistorySize);
+  }
+  for (const sink of buffers.traceSinks) {
+    try {
+      sink(record);
+    } catch {
+    }
+  }
+}
+async function recordAudit(buffers, type, event, details) {
+  if (!buffers.auditTrail) return;
+  try {
+    await buffers.auditTrail.record({
+      type,
+      source: event.metadata.source,
+      intent: event.intent,
+      correlationId: event.metadata.correlationId,
+      causationId: event.metadata.causationId,
+      subject: event.intent,
+      details
+    });
+  } catch (err) {
+    appendTrace(buffers, {
+      type: "hook.error",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      intent: event.intent,
+      correlationId: event.metadata.correlationId,
+      traceId: event.metadata.traceId,
+      spanId: event.metadata.spanId,
+      details: {
+        hook: "auditTrail",
+        error: err instanceof Error ? err.message : String(err)
+      }
+    });
+  }
+}
+async function recordRawPublishDiagnostic(buffers, event) {
+  const details = {
+    intent: event.intent,
+    source: event.metadata.source,
+    suggestion: "Publish through a registered intent creator so strict registry, contracts, and agent tooling share one source of truth."
+  };
+  appendTrace(buffers, {
+    type: "event.rawPublish",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    intent: event.intent,
+    correlationId: event.metadata.correlationId,
+    traceId: event.metadata.traceId,
+    spanId: event.metadata.spanId,
+    details
+  });
+  await recordAudit(buffers, "event.rawPublish", event, details);
+}
+async function recordSuccessfulPublish(buffers, event, subscribersNotified) {
+  const record = {
+    event,
+    publishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    subscribersNotified
+  };
+  appendHistory(buffers, record);
+  await buffers.outbox?.enqueue(event);
+  appendTrace(buffers, {
+    type: "event.published",
+    timestamp: record.publishedAt,
+    intent: event.intent,
+    correlationId: event.metadata.correlationId,
+    traceId: event.metadata.traceId,
+    spanId: event.metadata.spanId,
+    details: { subscribersNotified }
+  });
+  await recordAudit(buffers, "event.published", event, {
+    subscribersNotified
+  });
+  return record;
+}
+function enrichMetadata(base, extra, instanceId) {
+  return {
+    ...base,
+    ...extra,
+    occurredAt: extra.occurredAt || base.occurredAt || (/* @__PURE__ */ new Date()).toISOString(),
+    source: extra.source || base.source || "unknown",
+    kernelInstanceId: extra.kernelInstanceId ?? base.kernelInstanceId ?? instanceId,
+    eventVersion: extra.eventVersion ?? base.eventVersion,
+    schemaVersion: extra.schemaVersion ?? base.schemaVersion,
+    allowInterception: extra.allowInterception ?? base.allowInterception,
+    interceptions: extra.interceptions ?? base.interceptions,
+    correlationId: extra.correlationId ?? base.correlationId,
+    causationId: extra.causationId ?? base.causationId,
+    traceId: extra.traceId ?? base.traceId,
+    spanId: extra.spanId ?? base.spanId,
+    parentSpanId: extra.parentSpanId ?? base.parentSpanId
+  };
+}
+
+// src/kernel/event-bus/EventBus.ts
+var interceptorSequence = 0;
+function nextInterceptorRegistrationId() {
+  interceptorSequence += 1;
+  return `interceptor-${Date.now()}-${interceptorSequence}`;
+}
 var EventBusImpl = class {
   subscriptions = [];
   subscriptionsByIntent = /* @__PURE__ */ new Map();
   interceptors = [];
   interceptorsByIntent = /* @__PURE__ */ new Map();
-  history = [];
-  trace = [];
+  recording;
   onPublish;
   onSoftViolation;
   onHandlerError;
-  auditTrail;
   eventContracts;
   strictEventContracts;
   requireKnownSource;
   architectureProfile;
   enforceObservedLayerFlowMode;
-  outbox;
-  instanceId;
-  traceSinks;
   rethrowHandlerErrors;
   policyEngine;
   getPolicyContext;
-  maxHistorySize;
   intentRegistry;
   dependencyGraph;
   strictRegistry;
@@ -489,21 +805,25 @@ var EventBusImpl = class {
     this.onPublish = options.onPublish;
     this.onSoftViolation = options.onSoftViolation;
     this.onHandlerError = options.onHandlerError;
-    this.auditTrail = options.auditTrail;
     this.eventContracts = options.eventContracts;
     this.strictEventContracts = options.strictEventContracts ?? false;
     this.requireKnownSource = options.requireKnownSource ?? false;
     this.architectureProfile = options.architectureProfile;
     this.enforceObservedLayerFlowMode = options.enforceObservedLayerFlow ?? "off";
-    this.outbox = options.outbox;
-    this.instanceId = options.instanceId;
-    this.traceSinks = [...options.traceSinks ?? []];
     this.rethrowHandlerErrors = options.rethrowHandlerErrors ?? false;
-    this.maxHistorySize = options.maxHistorySize;
     this.intentRegistry = options.intentRegistry;
     this.dependencyGraph = options.dependencyGraph;
     this.strictRegistry = options.strictRegistry ?? options.intentRegistry !== void 0;
     this.validateIntentNaming = options.validateIntentNaming ?? this.strictRegistry;
+    this.recording = {
+      history: [],
+      trace: [],
+      maxHistorySize: options.maxHistorySize,
+      traceSinks: [...options.traceSinks ?? []],
+      auditTrail: options.auditTrail,
+      outbox: options.outbox,
+      instanceId: options.instanceId
+    };
     if (options.policyEngine) {
       this.policyEngine = options.policyEngine;
     } else if (options.policies && options.policies.length > 0) {
@@ -534,94 +854,77 @@ var EventBusImpl = class {
       const created = creator(payload);
       event = {
         ...created,
-        metadata: this.enrichMetadata(created.metadata, extraMeta)
+        metadata: enrichMetadata(
+          created.metadata,
+          extraMeta,
+          this.recording.instanceId
+        )
       };
     } else {
       const rawEvent = eventOrCreator;
       const extraMeta = metadata ?? payloadOrMeta ?? {};
       event = {
         ...rawEvent,
-        metadata: this.enrichMetadata(rawEvent.metadata, extraMeta)
+        metadata: enrichMetadata(
+          rawEvent.metadata,
+          extraMeta,
+          this.recording.instanceId
+        )
       };
     }
     if (rawPublish && this.strictRegistry) {
-      await this.recordRawPublishDiagnostic(event);
-    }
-    this.assertIntentAllowed(event.intent);
-    this.assertSourceAllowed(event);
-    this.assertContractAllowed(event);
-    event = await this.applyInterceptors(event);
-    this.assertContractAllowed(event);
-    await this.assertObservedLayerFlowAllowed(event);
+      await recordRawPublishDiagnostic(this.recording, event);
+    }
+    assertIntentAllowed(event.intent, {
+      strictRegistry: this.strictRegistry,
+      validateIntentNaming: this.validateIntentNaming,
+      intentRegistry: this.intentRegistry
+    });
+    assertSourceAllowed(event, {
+      requireKnownSource: this.requireKnownSource,
+      intentRegistry: this.intentRegistry
+    });
+    assertContractAllowed(event, {
+      eventContracts: this.eventContracts,
+      strictEventContracts: this.strictEventContracts
+    });
+    event = await applyInterceptors(event, {
+      interceptorsForIntent: (intent) => this.interceptorsByIntent.get(intent) ?? [],
+      eventContracts: this.eventContracts,
+      strictEventContracts: this.strictEventContracts,
+      appendTrace: (r) => this.appendTrace(r),
+      recordAudit: (type, e, details) => this.recordAudit(type, e, details)
+    });
+    assertContractAllowed(event, {
+      eventContracts: this.eventContracts,
+      strictEventContracts: this.strictEventContracts
+    });
+    await assertObservedLayerFlowAllowed(event, {
+      mode: this.enforceObservedLayerFlowMode,
+      architectureProfile: this.architectureProfile,
+      appendTrace: (r) => this.appendTrace(r),
+      recordAudit: (type, e, details) => this.recordAudit(type, e, details)
+    });
     this.dependencyGraph?.registerEventFlow(event.metadata.source, event.intent);
     const matching = [...this.subscriptionsByIntent.get(event.intent) ?? []];
     if (this.policyEngine) {
-      const ctx = this.getPolicyContext(event);
-      let policyResult;
-      try {
-        policyResult = this.policyEngine.enforce(ctx);
-      } catch (err) {
-        if (err instanceof PolicyViolationError) {
-          this.appendTrace({
-            type: "policy.hardViolation",
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            intent: event.intent,
-            correlationId: event.metadata.correlationId,
-            traceId: event.metadata.traceId,
-            spanId: event.metadata.spanId,
-            details: { violations: err.violations }
-          });
-          await this.recordAudit("policy.hardViolation", event, {
-            violations: err.violations
-          });
-        }
-        throw err;
-      }
-      if (policyResult.softViolations.length > 0) {
-        this.appendTrace({
-          type: "policy.softViolation",
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          intent: event.intent,
-          correlationId: event.metadata.correlationId,
-          traceId: event.metadata.traceId,
-          spanId: event.metadata.spanId,
-          details: { violations: policyResult.softViolations }
-        });
-        await this.recordAudit("policy.softViolation", event, {
-          violations: policyResult.softViolations
-        });
-        if (this.onSoftViolation) {
-          await this.safeHook(
-            () => this.onSoftViolation(policyResult, event),
-            "onSoftViolation",
-            event
-          );
-        }
-      }
+      await enforcePublishPolicy(event, {
+        policyEngine: this.policyEngine,
+        getPolicyContext: this.getPolicyContext,
+        appendTrace: (r) => this.appendTrace(r),
+        recordAudit: (type, e, details) => this.recordAudit(type, e, details),
+        onSoftViolation: this.onSoftViolation,
+        safeHook: (fn, name, e) => this.safeHook(fn, name, e)
+      });
     }
-    const record = {
+    await recordSuccessfulPublish(
+      this.recording,
       event,
-      publishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      subscribersNotified: matching.length
-    };
-    this.appendHistory(record);
-    await this.outbox?.enqueue(event);
-    this.appendTrace({
-      type: "event.published",
-      timestamp: record.publishedAt,
-      intent: event.intent,
-      correlationId: event.metadata.correlationId,
-      traceId: event.metadata.traceId,
-      spanId: event.metadata.spanId,
-      details: { subscribersNotified: matching.length }
-    });
-    await this.recordAudit("event.published", event, {
-      subscribersNotified: matching.length
-    });
-    const notifications = matching.map(
-      (sub) => this.invokeHandler(sub, event)
+      matching.length
+    );
+    await Promise.all(
+      matching.map((sub) => this.invokeHandler(sub, event))
     );
-    await Promise.all(notifications);
     if (this.onPublish) {
       await this.safeHook(
         () => this.onPublish(event),
@@ -632,7 +935,11 @@ var EventBusImpl = class {
   }
   createPublisher(source) {
     const sourceName = typeof source === "string" ? source : source.name;
-    this.assertIntentAllowed(sourceName);
+    assertIntentAllowed(sourceName, {
+      strictRegistry: this.strictRegistry,
+      validateIntentNaming: this.validateIntentNaming,
+      intentRegistry: this.intentRegistry
+    });
     return {
       source: sourceName,
       publish: async (intent, payload, metadata = {}) => {
@@ -648,7 +955,11 @@ var EventBusImpl = class {
   }
   subscribe(intent, handler) {
     const intentName = typeof intent === "string" ? intent : intent.name;
-    this.assertIntentAllowed(intentName);
+    assertIntentAllowed(intentName, {
+      strictRegistry: this.strictRegistry,
+      validateIntentNaming: this.validateIntentNaming,
+      intentRegistry: this.intentRegistry
+    });
     const sub = {
       intentName,
       handler
@@ -669,7 +980,11 @@ var EventBusImpl = class {
   }
   registerInterceptor(intent, interceptor, interceptorId) {
     const intentName = typeof intent === "string" ? intent : intent.name;
-    this.assertIntentAllowed(intentName);
+    assertIntentAllowed(intentName, {
+      strictRegistry: this.strictRegistry,
+      validateIntentNaming: this.validateIntentNaming,
+      intentRegistry: this.intentRegistry
+    });
     const registration = {
       registrationId: nextInterceptorRegistrationId(),
       interceptorId: interceptorId ?? intentName,
@@ -708,174 +1023,22 @@ var EventBusImpl = class {
     }));
   }
   getHistory() {
-    return [...this.history];
+    return [...this.recording.history];
   }
   clearHistory() {
-    this.history.length = 0;
+    this.recording.history.length = 0;
   }
   getTrace() {
-    return [...this.trace];
+    return [...this.recording.trace];
   }
   clearTrace() {
-    this.trace.length = 0;
-  }
-  assertIntentAllowed(intentName) {
-    if (!this.strictRegistry && !this.validateIntentNaming) {
-      return;
-    }
-    if (this.validateIntentNaming) {
-      const validation = validateIntentName(intentName);
-      if (!validation.valid) {
-        throw new InvalidIntentNameError(intentName, validation.reason);
-      }
-    }
-    if (this.strictRegistry && this.intentRegistry && !this.intentRegistry.has(intentName)) {
-      throw new UnregisteredIntentError(intentName);
-    }
-  }
-  assertSourceAllowed(event) {
-    if (!this.requireKnownSource) return;
-    if (!event.metadata.source || event.metadata.source === "unknown") {
-      throw new UnknownEventSourceError(event.intent);
-    }
-    if (this.intentRegistry && !this.intentRegistry.has(event.metadata.source)) {
-      throw new UnknownEventSourceError(event.intent, event.metadata.source);
-    }
-  }
-  assertContractAllowed(event) {
-    if (!this.eventContracts) return;
-    const result = this.eventContracts.validate(event);
-    if (!result.ok && (this.strictEventContracts || result.contract)) {
-      throw new EventContractViolationError(event.intent, result.issues);
-    }
-  }
-  /**
-   * Enforce the OBSERVED producer→event flow (metadata.source → intent) against the
-   * architecture profile's layer rules. This is the runtime counterpart to the
-   * declared-model layer policy: it checks what the system actually did, resolving both
-   * layers directly from the profile. It runs BEFORE the flow is recorded via
-   * registerEventFlow, so in hard mode a rejected flow leaves no edge in the graph.
-   */
-  async assertObservedLayerFlowAllowed(event) {
-    if (this.enforceObservedLayerFlowMode === "off" || !this.architectureProfile) {
-      return;
-    }
-    const source = event.metadata.source;
-    if (!source || source === "unknown") return;
-    const profile = this.architectureProfile;
-    const fromLayer = profile.resolveLayer(source);
-    const toLayer = profile.resolveLayer(event.intent);
-    if (!fromLayer || !toLayer) return;
-    const blocked = profile.rules.find(
-      (rule) => !rule.allowed && rule.from === fromLayer && rule.to === toLayer
-    );
-    if (!blocked) return;
-    const severity = this.enforceObservedLayerFlowMode;
-    const message = blocked.message ?? `Observed layer violation: "${source}" (${fromLayer}) must not produce "${event.intent}" (${toLayer}).`;
-    const details = {
-      source,
-      intent: event.intent,
-      fromLayer,
-      toLayer,
-      severity,
-      message,
-      rule: blocked
-    };
-    this.appendTrace({
-      type: "layer.observedViolation",
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      intent: event.intent,
-      correlationId: event.metadata.correlationId,
-      traceId: event.metadata.traceId,
-      spanId: event.metadata.spanId,
-      details
-    });
-    await this.recordAudit("layer.observedViolation", event, details);
-    if (severity === "hard") {
-      throw new ObservedLayerFlowViolationError(source, event.intent, fromLayer, toLayer, message);
-    }
+    this.recording.trace.length = 0;
   }
-  async recordRawPublishDiagnostic(event) {
-    const details = {
-      intent: event.intent,
-      source: event.metadata.source,
-      suggestion: "Publish through a registered intent creator so strict registry, contracts, and agent tooling share one source of truth."
-    };
-    this.appendTrace({
-      type: "event.rawPublish",
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      intent: event.intent,
-      correlationId: event.metadata.correlationId,
-      traceId: event.metadata.traceId,
-      spanId: event.metadata.spanId,
-      details
-    });
-    await this.recordAudit("event.rawPublish", event, details);
+  appendTrace(record) {
+    appendTrace(this.recording, record);
   }
-  async applyInterceptors(event) {
-    if (event.metadata.allowInterception === false) {
-      return event;
-    }
-    const matching = [...this.interceptorsByIntent.get(event.intent) ?? []];
-    let current = event;
-    for (const registration of matching) {
-      const patches = [];
-      try {
-        await Promise.resolve(
-          registration.interceptor({
-            event: current,
-            intercept: (patch) => {
-              patches.push(patch);
-            }
-          })
-        );
-        if (patches.length === 0) {
-          continue;
-        }
-        const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-        let candidate = {
-          ...current,
-          metadata: {
-            ...current.metadata,
-            interceptions: [
-              ...current.metadata.interceptions ?? [],
-              { interceptorId: registration.interceptorId, timestamp }
-            ]
-          }
-        };
-        for (const patch of patches) {
-          candidate = {
-            ...candidate,
-            payload: applyPayloadPatch(candidate.payload, patch),
-            metadata: { ...candidate.metadata }
-          };
-        }
-        this.assertContractAllowed(candidate);
-        current = candidate;
-        registration.lastInterceptedAt = timestamp;
-        this.appendTrace({
-          type: "event.intercepted",
-          timestamp,
-          intent: current.intent,
-          correlationId: current.metadata.correlationId,
-          traceId: current.metadata.traceId,
-          spanId: current.metadata.spanId,
-          details: {
-            registrationId: registration.registrationId,
-            interceptorId: registration.interceptorId,
-            patchesApplied: patches.length
-          }
-        });
-        await this.recordAudit("event.intercepted", current, {
-          registrationId: registration.registrationId,
-          interceptorId: registration.interceptorId,
-          patchesApplied: patches.length
-        });
-      } catch (err) {
-        await this.recordInterceptorError(registration, current, err);
-      }
-    }
-    return current;
+  async recordAudit(type, event, details) {
+    await recordAudit(this.recording, type, event, details);
   }
   async invokeHandler(sub, event) {
     try {
@@ -928,90 +1091,6 @@ var EventBusImpl = class {
       });
     }
   }
-  async recordInterceptorError(interceptor, event, error) {
-    const message = error instanceof Error ? error.message : String(error);
-    this.appendTrace({
-      type: "interceptor.error",
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      intent: event.intent,
-      correlationId: event.metadata.correlationId,
-      traceId: event.metadata.traceId,
-      spanId: event.metadata.spanId,
-      details: {
-        registrationId: interceptor.registrationId,
-        interceptorId: interceptor.interceptorId,
-        error: message
-      }
-    });
-    await this.recordAudit("interceptor.error", event, {
-      registrationId: interceptor.registrationId,
-      interceptorId: interceptor.interceptorId,
-      error: message
-    });
-  }
-  appendHistory(record) {
-    this.history.push(record);
-    if (this.maxHistorySize !== void 0 && this.history.length > this.maxHistorySize) {
-      this.history.splice(0, this.history.length - this.maxHistorySize);
-    }
-  }
-  appendTrace(record) {
-    this.trace.push(record);
-    if (this.maxHistorySize !== void 0 && this.trace.length > this.maxHistorySize) {
-      this.trace.splice(0, this.trace.length - this.maxHistorySize);
-    }
-    for (const sink of this.traceSinks) {
-      try {
-        sink(record);
-      } catch {
-      }
-    }
-  }
-  async recordAudit(type, event, details) {
-    if (!this.auditTrail) return;
-    try {
-      await this.auditTrail.record({
-        type,
-        source: event.metadata.source,
-        intent: event.intent,
-        correlationId: event.metadata.correlationId,
-        causationId: event.metadata.causationId,
-        subject: event.intent,
-        details
-      });
-    } catch (err) {
-      this.appendTrace({
-        type: "hook.error",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        intent: event.intent,
-        correlationId: event.metadata.correlationId,
-        traceId: event.metadata.traceId,
-        spanId: event.metadata.spanId,
-        details: {
-          hook: "auditTrail",
-          error: err instanceof Error ? err.message : String(err)
-        }
-      });
-    }
-  }
-  enrichMetadata(base, extra) {
-    return {
-      ...base,
-      ...extra,
-      occurredAt: extra.occurredAt || base.occurredAt || (/* @__PURE__ */ new Date()).toISOString(),
-      source: extra.source || base.source || "unknown",
-      kernelInstanceId: extra.kernelInstanceId ?? base.kernelInstanceId ?? this.instanceId,
-      eventVersion: extra.eventVersion ?? base.eventVersion,
-      schemaVersion: extra.schemaVersion ?? base.schemaVersion,
-      allowInterception: extra.allowInterception ?? base.allowInterception,
-      interceptions: extra.interceptions ?? base.interceptions,
-      correlationId: extra.correlationId ?? base.correlationId,
-      causationId: extra.causationId ?? base.causationId,
-      traceId: extra.traceId ?? base.traceId,
-      spanId: extra.spanId ?? base.spanId,
-      parentSpanId: extra.parentSpanId ?? base.parentSpanId
-    };
-  }
 };
 function createEventBus(options) {
   return new EventBusImpl(options);
@@ -1625,7 +1704,7 @@ var elevenLayerProfile = createArchitectureProfile({
 var MANIFEST_SCHEMA_VERSION = "1.0";
 
 // src/version.ts
-var version = "2.7.0";
+var version = "2.8.1";
 
 // src/kernel/manifest/createArkManifest.ts
 function policyId(name) {