arkgate 3.2.0 → 3.4.0

package/dist/index.d.cts

@@ -1,8 +1,240 @@
-import { a as ArkConfigRule, b as ArkConfigLayer, A as ArkConfig, c as ArkConfigLoadResult } from './configContract-BxSIwVRo.cjs';
-export { d as ARK_CONFIG_SCHEMA, e as ARK_CONFIG_SCHEMA_VERSION, l as loadArkConfigContract, p as parseArkConfigJson } from './configContract-BxSIwVRo.cjs';
+import { a as ArkConfigRule, b as ArkConfigSchemaVersion, c as ArkConfigLoadResult, d as ArkConfigLayer, A as ArkConfig } from './configTypes-DAPvBqK6.cjs';
+
+/**
+ * Canonical, pure contract for ark.config.json.
+ *
+ * Tooling adapters own filesystem I/O; this module owns JSON parsing, deterministic
+ * migration, defaults, validation, diagnostics, and the published JSON Schema.
+ * The standalone CLI artifact is generated into bin/lib/config-contract.mjs.
+ */
+
+declare const ARK_CONFIG_SCHEMA_VERSION: ArkConfigSchemaVersion;
+declare const ARK_CONFIG_SCHEMA: {
+    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
+    readonly $id: "https://unpkg.com/arkgate@2/schemas/ark.config.schema.json";
+    readonly title: "ArkGate architecture contract";
+    readonly description: "Versioned contract consumed identically by ArkGate CLI, MCP, and ESLint surfaces.";
+    readonly type: "object";
+    readonly additionalProperties: false;
+    readonly required: readonly ["$schema", "schemaVersion", "include", "layers", "rules"];
+    readonly properties: {
+        readonly $schema: {
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly default: "https://unpkg.com/arkgate@2/schemas/ark.config.schema.json";
+            readonly description: "Editor-facing URL or local path for this JSON Schema.";
+        };
+        readonly schemaVersion: {
+            readonly type: "string";
+            readonly const: "1.0";
+            readonly default: "1.0";
+        };
+        readonly name: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly include: {
+            readonly minItems: 1;
+            readonly default: readonly ["src"];
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+                readonly minLength: 1;
+            };
+            readonly uniqueItems: true;
+        };
+        readonly exclude: {
+            readonly default: readonly [];
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+                readonly minLength: 1;
+            };
+            readonly uniqueItems: true;
+        };
+        readonly excludeGenerated: {
+            readonly type: "boolean";
+            readonly default: true;
+        };
+        readonly frameworkOverlay: {
+            readonly type: "string";
+            readonly minLength: 1;
+        };
+        readonly layers: {
+            readonly type: "array";
+            readonly default: readonly [];
+            readonly items: {
+                readonly $ref: "#/$defs/layer";
+            };
+        };
+        readonly rules: {
+            readonly type: "array";
+            readonly default: ArkConfigRule[];
+            readonly items: {
+                readonly $ref: "#/$defs/rule";
+            };
+        };
+        readonly cyclePolicy: {
+            readonly type: "string";
+            readonly enum: readonly ["strict", "soft", "framework-soft", "off"];
+            readonly default: "strict";
+        };
+        readonly dynamicImportAllowlist: {
+            readonly default: readonly [];
+            readonly type: "array";
+            readonly items: {
+                readonly type: "string";
+                readonly minLength: 1;
+            };
+            readonly uniqueItems: true;
+        };
+        readonly safety: {
+            readonly $ref: "#/$defs/safety";
+            readonly default: {
+                readonly maxTsSuppressions: 0;
+                readonly maxAnyCasts: 0;
+                readonly allowInMemory: false;
+                readonly allowDisabledPeerIsolation: false;
+            };
+        };
+    };
+    readonly $defs: {
+        readonly layer: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["name", "patterns"];
+            readonly properties: {
+                readonly name: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly patterns: {
+                    readonly minItems: 1;
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly exclude: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly intentPrefixes: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly description: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly forbiddenGlobals: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly uniqueItems: true;
+                };
+                readonly capabilities: {
+                    readonly type: "object";
+                    readonly additionalProperties: false;
+                    readonly properties: {
+                        readonly deny: {
+                            readonly type: "array";
+                            readonly uniqueItems: true;
+                            readonly items: {
+                                readonly type: "string";
+                                readonly enum: readonly ["network", "filesystem", "clock", "randomness", "environment", "process", "persistence"];
+                            };
+                        };
+                    };
+                };
+                readonly pure: {
+                    readonly type: "boolean";
+                };
+                readonly mayImportInfrastructure: {
+                    readonly type: "boolean";
+                };
+                readonly optional: {
+                    readonly type: "boolean";
+                };
+            };
+        };
+        readonly rule: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["from", "to", "allowed"];
+            readonly properties: {
+                readonly from: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly to: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly allowed: {
+                    readonly type: "boolean";
+                };
+                readonly message: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly peerIsolation: {
+                    readonly type: "boolean";
+                };
+                readonly sliceFolders: {
+                    readonly minItems: 1;
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly uniqueItems: true;
+                };
+            };
+        };
+        readonly safety: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly maxTsSuppressions: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly default: 0;
+                };
+                readonly maxAnyCasts: {
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                    readonly default: 0;
+                };
+                readonly allowInMemory: {
+                    readonly type: "boolean";
+                    readonly default: false;
+                };
+                readonly allowDisabledPeerIsolation: {
+                    readonly type: "boolean";
+                    readonly default: false;
+                };
+            };
+        };
+    };
+};
+declare function loadArkConfigContract(input: unknown, source?: string): ArkConfigLoadResult;
+declare function parseArkConfigJson(json: string, source?: string): ArkConfigLoadResult;
 
 /** ArkGate library version — single source of truth. */
-declare const version = "3.2.0";
+declare const version = "3.4.0";
 
 /** Versioned public result contract shared by every ArkGate enforcement adapter. */
 declare const ARK_ANALYSIS_RESULT_SCHEMA_VERSION: "1.1";
@@ -23,6 +255,8 @@ type AdapterViolationInput = {
     peerIsolation?: unknown;
     severity?: unknown;
     nextAction?: unknown;
+    /** U04: the denied capability id on CAPABILITY_VIOLATION. */
+    capability?: unknown;
 };
 type AdapterDiagnostic = {
     ruleId: string;
@@ -386,6 +620,13 @@ interface AICodeGateOptions<Context = AICodeGateContext> {
      * to a listed layer — mirrors ark-check's FORBIDDEN_GLOBAL rule.
      */
     forbiddenGlobals?: Record<string, string[]>;
+    /**
+     * Layer → effective capability deny set (U04 walls; ADR 0009). Enforced like
+     * forbiddenGlobals when the target file's layer is known. An ambient use
+     * already covered by the layer's forbiddenGlobals reports only
+     * FORBIDDEN_GLOBAL (D7 — one violation, one voice).
+     */
+    capabilityWalls?: Record<string, string[]>;
     /**
      * Layer names whose role is infrastructure and may therefore import infrastructure
      * (a persistence adapter importing the DB is correct, not a violation). The built-in
@@ -421,6 +662,85 @@ interface AICodeGateOptions<Context = AICodeGateContext> {
 }
 declare function createAICodeGate<Context = AICodeGateContext>(options?: AICodeGateOptions<Context>): AICodeGate<Context>;
 
+declare const ARK_CHANGE_MAP_SCHEMA_VERSION: "1.0";
+type ArchitectureChangeOperation = 'create' | 'update' | 'delete';
+type ArchitectureChangeMapFile = {
+    path: string;
+    operation: ArchitectureChangeOperation;
+    layer: string;
+};
+type ArchitectureChangeMapDependency = {
+    from: string;
+    to: string;
+};
+type ArchitectureChangeMap = {
+    $schema: string;
+    schemaVersion: typeof ARK_CHANGE_MAP_SCHEMA_VERSION;
+    files: ArchitectureChangeMapFile[];
+    dependencies: ArchitectureChangeMapDependency[];
+};
+type ArchitectureChangeMapContract = {
+    map: ArchitectureChangeMap;
+    hash: string;
+};
+
+type ArchitectureDependency = {
+    from: string;
+    to: string;
+};
+type ArchitectureActualChange = {
+    path: string;
+    operation: ArchitectureChangeOperation;
+};
+type ArchitectureConvergenceClassification = 'satisfied' | 'missing' | 'contradictory' | 'unplanned';
+type ArchitectureConvergenceFinding = {
+    id: string;
+    classification: ArchitectureConvergenceClassification;
+    subject: 'file' | 'dependency';
+    message: string;
+    nextAction?: string;
+    path?: string;
+    from?: string;
+    to?: string;
+    expectedOperation?: ArchitectureChangeOperation;
+    actualOperation?: ArchitectureChangeOperation | 'added' | 'removed';
+};
+type ArchitectureConvergenceResult = {
+    schemaVersion: '1.0';
+    readOnly: true;
+    changeMapHash: string;
+    structurallyConverged: boolean;
+    behavioralCompletion: 'not-evaluated';
+    summary: Record<ArchitectureConvergenceClassification, number>;
+    findings: ArchitectureConvergenceFinding[];
+};
+type AnalyzeArchitectureConvergenceInput = {
+    changeMap: ArchitectureChangeMapContract;
+    changes: readonly ArchitectureActualChange[];
+    baseDependencies: readonly ArchitectureDependency[];
+    candidateDependencies: readonly ArchitectureDependency[];
+};
+declare function analyzeArchitectureConvergence(input: AnalyzeArchitectureConvergenceInput): ArchitectureConvergenceResult;
+
+type SemanticDependencyKind = 'import' | 'export' | 'dynamic-import' | 'require';
+type SemanticDependency = {
+    specifier?: string;
+    kind: SemanticDependencyKind;
+    line: number;
+    typeOnly: boolean;
+    unresolved: boolean;
+    node: unknown;
+};
+type ForbiddenCapabilityUse = {
+    name: string;
+    line: number;
+    node: unknown;
+};
+/** Extract every dependency form whose specifier is statically knowable, plus unresolved calls. */
+declare function extractSemanticDependencies(ts: any, sourceFile: any): SemanticDependency[];
+/** Resolve forbidden ambient capabilities through symbols, aliases, globalThis, and static keys. */
+declare function collectForbiddenCapabilityUses(ts: any, sourceFile: any, forbidden: readonly string[]): ForbiddenCapabilityUse[];
+
 /**
  * Stable, pure vocabulary for ArkGate's importable analysis engine.
  *
@@ -470,6 +790,10 @@ type AnalysisViolation = {
     ruleId: string;
     message: string;
     edge?: AnalysisImportEdge;
+    /** U04 (additive): present on CAPABILITY_VIOLATION — the denied capability id. */
+    capability?: string;
+    /** U04 (additive): the matched module specifier or ambient path. */
+    symbol?: string;
     evidence: AnalysisEvidence;
 };
 type AnalysisIr = {
@@ -521,84 +845,12 @@ declare function policyDeltaAcknowledgementMatches(acknowledgement: PolicyDeltaA
     findingIds: readonly string[];
 }): boolean;
 
-declare const ARK_CHANGE_MAP_SCHEMA_VERSION: "1.0";
-type ArchitectureChangeOperation = 'create' | 'update' | 'delete';
-type ArchitectureChangeMapFile = {
-    path: string;
-    operation: ArchitectureChangeOperation;
-    layer: string;
-};
-type ArchitectureChangeMapDependency = {
-    from: string;
-    to: string;
-};
-type ArchitectureChangeMap = {
-    $schema: string;
-    schemaVersion: typeof ARK_CHANGE_MAP_SCHEMA_VERSION;
-    files: ArchitectureChangeMapFile[];
-    dependencies: ArchitectureChangeMapDependency[];
-};
-type ArchitectureChangeMapContract = {
-    map: ArchitectureChangeMap;
-    hash: string;
-};
-
-type ArchitectureDependency = {
-    from: string;
-    to: string;
-};
-type ArchitectureActualChange = {
-    path: string;
-    operation: ArchitectureChangeOperation;
-};
-type ArchitectureConvergenceClassification = 'satisfied' | 'missing' | 'contradictory' | 'unplanned';
-type ArchitectureConvergenceFinding = {
-    id: string;
-    classification: ArchitectureConvergenceClassification;
-    subject: 'file' | 'dependency';
-    message: string;
-    nextAction?: string;
-    path?: string;
-    from?: string;
-    to?: string;
-    expectedOperation?: ArchitectureChangeOperation;
-    actualOperation?: ArchitectureChangeOperation | 'added' | 'removed';
-};
-type ArchitectureConvergenceResult = {
-    schemaVersion: '1.0';
-    readOnly: true;
-    changeMapHash: string;
-    structurallyConverged: boolean;
-    behavioralCompletion: 'not-evaluated';
-    summary: Record<ArchitectureConvergenceClassification, number>;
-    findings: ArchitectureConvergenceFinding[];
-};
-type AnalyzeArchitectureConvergenceInput = {
-    changeMap: ArchitectureChangeMapContract;
-    changes: readonly ArchitectureActualChange[];
-    baseDependencies: readonly ArchitectureDependency[];
-    candidateDependencies: readonly ArchitectureDependency[];
-};
-declare function analyzeArchitectureConvergence(input: AnalyzeArchitectureConvergenceInput): ArchitectureConvergenceResult;
-
-type SemanticDependencyKind = 'import' | 'export' | 'dynamic-import' | 'require';
-type SemanticDependency = {
-    specifier?: string;
-    kind: SemanticDependencyKind;
-    line: number;
-    typeOnly: boolean;
-    unresolved: boolean;
-    node: unknown;
-};
-type ForbiddenCapabilityUse = {
-    name: string;
-    line: number;
-    node: unknown;
-};
-/** Extract every dependency form whose specifier is statically knowable, plus unresolved calls. */
-declare function extractSemanticDependencies(ts: any, sourceFile: any): SemanticDependency[];
-/** Resolve forbidden ambient capabilities through symbols, aliases, globalThis, and static keys. */
-declare function collectForbiddenCapabilityUses(ts: any, sourceFile: any, forbidden: readonly string[]): ForbiddenCapabilityUse[];
+/**
+ * Public type vocabulary of the canonical analysis API (U02 pilot 2).
+ *
+ * Declarations only — the C02 entry point src/kernel/analysis.ts re-exports
+ * everything here, so consumer import paths never change.
+ */
 
 type AnalysisContract = ArkConfigLoadResult & {
     policyHash: string;
@@ -704,21 +956,31 @@ type CollectAnalysisConfigWarningsInput = {
         };
     };
 };
+
+/**
+ * Contract loading, project/change analysis, and policy-delta analysis
+ * (U02 pilot 2). Reached through the src/kernel/analysis.ts facade; consumer
+ * import paths never change.
+ */
+
 declare function loadContract(input: unknown, source?: string): AnalysisContract;
 declare function analyzePolicyDelta(input: AnalyzePolicyDeltaInput): PolicyDeltaAnalysis;
 declare function analyzeProject(input: AnalyzeProjectInput): AnalysisResult;
 declare function analyzeChange(input: AnalyzeChangeInput): AnalysisResult;
 declare function explainViolation(violation: AnalysisViolation): string;
+
 declare function detectArchitectureCycles(graph: ReadonlyMap<string, ReadonlySet<string>>): ArchitectureEngineViolation[];
 /** Canonical graph and layer-policy evaluator shared by library, CLI, and MCP adapters. */
 declare function evaluateArchitectureGraph(input: EvaluateArchitectureGraphInput): ArchitectureEngineResult;
+
 /**
  * Evaluate one create/update/delete set as a single in-memory candidate.
  * The function never writes and returns hashes that bind a later host commit to
  * the exact base, policy, compiler options, and candidate contents it checked.
  */
 declare function preflightChange(input: AnalyzeChangeInput): ChangePreflightResult;
+
 /** Canonical config diagnostics over repo-relative file paths. */
 declare function collectAnalysisConfigWarnings(input: CollectAnalysisConfigWarningsInput): ArchitectureEngineViolation[];
 
-export { type AICodeGate, type AICodeGateContext, type AICodeGateOptions, type AICodeGateResult, type AICodeGateViolation, type AIGateExtension, ANALYSIS_IR_SCHEMA_VERSION, ARK_ANALYSIS_RESULT_SCHEMA, ARK_ANALYSIS_RESULT_SCHEMA_VERSION, type AdapterDiagnostic, type AdapterResult, type AdapterSeverity, type AdapterViolationInput, type AnalysisCapabilityUse, type AnalysisCompilerOptions, type AnalysisContract, type AnalysisEvidence, type AnalysisFile, type AnalysisFileChange, type AnalysisFileInput, type AnalysisImportEdge, type AnalysisIr, type AnalysisResult, type AnalysisViolation, type AnalyzeArchitectureConvergenceInput, type AnalyzeChangeInput, type AnalyzePolicyDeltaInput, type AnalyzeProjectInput, type ArchitectureActualChange, type ArchitectureChangeMap, type ArchitectureChangeMapContract, type ArchitectureChangeMapDependency, type ArchitectureChangeMapFile, type ArchitectureChangeOperation, type ArchitectureConvergenceClassification, type ArchitectureConvergenceFinding, type ArchitectureConvergenceResult, type ArchitectureDependency, type ArchitectureEngineEdge, type ArchitectureEngineResult, type ArchitectureEngineViolation, type ArchitectureLayer, type ArchitectureLayerConfig, type ArchitectureProfile, type ArchitectureRule, type ArkCheckConfig, ArkConfig, ArkConfigLoadResult, type ChangePreflightResult, type CollectAnalysisConfigWarningsInput, type CreateArchitectureProfileFromArkConfigOptions, type CreateArchitectureProfileOptions, type CreateElevenLayerArkConfigOptions, type EvaluateArchitectureGraphInput, type ForbiddenCapabilityUse, POLICY_DELTA_SCHEMA_VERSION, type PolicyDelta, type PolicyDeltaAcknowledgement, type PolicyDeltaAnalysis, type PolicyDeltaClassification, type PolicyDeltaFinding, type PreparedChangeFile, type SemanticDependency, type SemanticDependencyKind, analyzeArchitectureConvergence, analyzeChange, analyzePolicyDelta, analyzeProject, classifyArkPolicyDelta, collectAnalysisConfigWarnings, collectForbiddenCapabilityUses, createAICodeGate, createAdapterResult, createArchitectureProfile, createArchitectureProfileFromArkConfig, createElevenLayerArkConfig, detectArchitectureCycles, deterministicHash, elevenLayerProfile, evaluateArchitectureGraph, explainViolation, extractSemanticDependencies, loadContract, policyDeltaAcknowledgementMatches, preflightChange, stableSerialize, toAdapterDiagnostic, version };
+export { type AICodeGate, type AICodeGateContext, type AICodeGateOptions, type AICodeGateResult, type AICodeGateViolation, type AIGateExtension, ANALYSIS_IR_SCHEMA_VERSION, ARK_ANALYSIS_RESULT_SCHEMA, ARK_ANALYSIS_RESULT_SCHEMA_VERSION, ARK_CONFIG_SCHEMA, ARK_CONFIG_SCHEMA_VERSION, type AdapterDiagnostic, type AdapterResult, type AdapterSeverity, type AdapterViolationInput, type AnalysisCapabilityUse, type AnalysisCompilerOptions, type AnalysisContract, type AnalysisEvidence, type AnalysisFile, type AnalysisFileChange, type AnalysisFileInput, type AnalysisImportEdge, type AnalysisIr, type AnalysisResult, type AnalysisViolation, type AnalyzeArchitectureConvergenceInput, type AnalyzeChangeInput, type AnalyzePolicyDeltaInput, type AnalyzeProjectInput, type ArchitectureActualChange, type ArchitectureChangeMap, type ArchitectureChangeMapContract, type ArchitectureChangeMapDependency, type ArchitectureChangeMapFile, type ArchitectureChangeOperation, type ArchitectureConvergenceClassification, type ArchitectureConvergenceFinding, type ArchitectureConvergenceResult, type ArchitectureDependency, type ArchitectureEngineEdge, type ArchitectureEngineResult, type ArchitectureEngineViolation, type ArchitectureLayer, type ArchitectureLayerConfig, type ArchitectureProfile, type ArchitectureRule, type ArkCheckConfig, ArkConfig, ArkConfigLoadResult, type ChangePreflightResult, type CollectAnalysisConfigWarningsInput, type CreateArchitectureProfileFromArkConfigOptions, type CreateArchitectureProfileOptions, type CreateElevenLayerArkConfigOptions, type EvaluateArchitectureGraphInput, type ForbiddenCapabilityUse, POLICY_DELTA_SCHEMA_VERSION, type PolicyDelta, type PolicyDeltaAcknowledgement, type PolicyDeltaAnalysis, type PolicyDeltaClassification, type PolicyDeltaFinding, type PreparedChangeFile, type SemanticDependency, type SemanticDependencyKind, analyzeArchitectureConvergence, analyzeChange, analyzePolicyDelta, analyzeProject, classifyArkPolicyDelta, collectAnalysisConfigWarnings, collectForbiddenCapabilityUses, createAICodeGate, createAdapterResult, createArchitectureProfile, createArchitectureProfileFromArkConfig, createElevenLayerArkConfig, detectArchitectureCycles, deterministicHash, elevenLayerProfile, evaluateArchitectureGraph, explainViolation, extractSemanticDependencies, loadArkConfigContract, loadContract, parseArkConfigJson, policyDeltaAcknowledgementMatches, preflightChange, stableSerialize, toAdapterDiagnostic, version };