arkgate 3.6.1 → 3.8.0

package/bin/lib/safety-diagnostics.mjs

@@ -1,284 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-
-import { globToRegExp } from '../ark-shared.mjs';
-import { extractSemanticDependencies } from './analysis-engine.mjs';
-import { lineOf } from './ast-scan.mjs';
-import { normalize } from './scan-files.mjs';
-
-const IN_MEMORY_STORES = new Set([
-  'InMemoryAuditStore',
-  'InMemoryOutboxStore',
-  'InMemoryReadModelStore',
-  'InMemoryWorkflowStore',
-]);
-
-const IN_MEMORY_DEFAULT_FACTORIES = new Map([
-  ['createArkKernel', ['outbox', 'auditTrail', 'projections']],
-  ['createAuditTrail', ['store']],
-  ['createProjectionRegistry', ['store']],
-  ['createWorkflowEngine', ['store']],
-]);
-
-function matchesAny(relFile, patterns) {
-  return patterns.some((pattern) => {
-    try {
-      return globToRegExp(pattern).test(relFile);
-    } catch {
-      return false;
-    }
-  });
-}
-
-function packageName(root) {
-  try {
-    return JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).name;
-  } catch {
-    return undefined;
-  }
-}
-
-function propertyName(ts, node) {
-  if (ts.isIdentifier(node) || ts.isStringLiteralLike(node)) return node.text;
-  return undefined;
-}
-
-function objectHasProperty(ts, object, name) {
-  return object.properties.some((property) => {
-    if (ts.isShorthandPropertyAssignment(property)) return property.name.text === name;
-    return property.name ? propertyName(ts, property.name) === name : false;
-  });
-}
-
-function tsSuppressionPositions(sourceFile, source) {
-  const positions = new Set();
-  for (const directive of sourceFile.commentDirectives ?? []) {
-    const start = directive.range?.pos;
-    const end = directive.range?.end;
-    if (Number.isInteger(start) && Number.isInteger(end)) {
-      const text = source.slice(start, end);
-      if (/\@ts-ignore\b/.test(text)) positions.add(start);
-    }
-  }
-
-  const noCheck = sourceFile.pragmas?.get?.('ts-nocheck');
-  const entries = Array.isArray(noCheck) ? noCheck : noCheck ? [noCheck] : [];
-  for (const entry of entries) {
-    const start = entry.range?.pos;
-    if (Number.isInteger(start)) positions.add(start);
-  }
-  return [...positions];
-}
-
-export function collectSafetyDiagnostics(ts, root, config, files) {
-  const safety = config.safety ?? {};
-  const dynamicAllowlist = Array.isArray(config.dynamicImportAllowlist)
-    ? config.dynamicImportAllowlist
-    : [];
-  const maxTsSuppressions = Number.isInteger(safety.maxTsSuppressions)
-    ? safety.maxTsSuppressions
-    : 0;
-  const maxAnyCasts = Number.isInteger(safety.maxAnyCasts) ? safety.maxAnyCasts : 0;
-  const allowInMemory = safety.allowInMemory === true;
-  const isProvider = packageName(root) === 'arkgate';
-  const report = {
-    tsSuppressions: [],
-    anyCasts: [],
-    nonLiteralDynamicImports: [],
-    inMemoryProductionStores: [],
-    disabledPeerIsolationRules: [],
-    thresholds: { maxTsSuppressions, maxAnyCasts },
-  };
-
-  if (safety.allowDisabledPeerIsolation !== true) {
-    report.disabledPeerIsolationRules = (config.rules ?? [])
-      .filter(
-        (rule) =>
-          rule?.peerIsolation === false ||
-          (rule?.allowed === false &&
-            rule?.from &&
-            rule.from === rule.to &&
-            rule.peerIsolation !== true)
-      )
-      .map((rule) => ({ from: rule.from, to: rule.to }));
-  }
-
-  for (const file of files) {
-    const source = fs.readFileSync(file, 'utf8');
-    // Most source files cannot contain a safety finding. Avoid parsing a second AST when the
-    // lexical markers for every supported diagnostic are absent; a match only opts into the
-    // existing exact AST analysis, so this cannot suppress a finding.
-    if (!/@ts-(?:ignore|nocheck)\b|\bany\b|\b(?:import|require)\s*\(|\barkgate(?:\/runtime)?\b/.test(source)) {
-      continue;
-    }
-    const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true);
-    const relFile = normalize(path.relative(root, file));
-
-    if (!matchesAny(relFile, dynamicAllowlist)) {
-      for (const dependency of extractSemanticDependencies(ts, sourceFile)) {
-        if (!dependency.unresolved) continue;
-        report.nonLiteralDynamicImports.push({
-          file: relFile,
-          line: dependency.line,
-          kind: dependency.kind === 'require' ? 'require' : 'import',
-        });
-      }
-    }
-
-    for (const position of tsSuppressionPositions(sourceFile, source)) {
-      report.tsSuppressions.push({
-        file: relFile,
-        line: lineOf(sourceFile, position),
-      });
-    }
-
-    const importedFactories = new Map();
-    const arkNamespaces = new Set();
-    if (!allowInMemory && !isProvider) {
-      for (const statement of sourceFile.statements) {
-        if (!ts.isImportDeclaration(statement) || !ts.isStringLiteralLike(statement.moduleSpecifier)) {
-          continue;
-        }
-        if (!/^arkgate(?:\/runtime)?$/.test(statement.moduleSpecifier.text)) continue;
-        const bindings = statement.importClause?.namedBindings;
-        if (bindings && ts.isNamespaceImport(bindings)) arkNamespaces.add(bindings.name.text);
-        if (!bindings || !ts.isNamedImports(bindings)) continue;
-        for (const element of bindings.elements) {
-          const imported = element.propertyName?.text ?? element.name.text;
-          const requirements = IN_MEMORY_DEFAULT_FACTORIES.get(imported);
-          if (requirements) {
-            importedFactories.set(element.name.text, { imported, requirements });
-          }
-        }
-      }
-    }
-
-    const visit = (node) => {
-      if (
-        (ts.isAsExpression(node) || ts.isTypeAssertionExpression(node)) &&
-        node.type?.kind === ts.SyntaxKind.AnyKeyword
-      ) {
-        report.anyCasts.push({
-          file: relFile,
-          line: lineOf(sourceFile, node.getStart(sourceFile)),
-        });
-      }
-
-      if (!allowInMemory && !isProvider && ts.isImportDeclaration(node)) {
-        const specifier = node.moduleSpecifier;
-        const fromArk = ts.isStringLiteralLike(specifier) && /^arkgate(?:\/runtime)?$/.test(specifier.text);
-        if (fromArk) {
-          const elements = node.importClause?.namedBindings &&
-            ts.isNamedImports(node.importClause.namedBindings)
-            ? node.importClause.namedBindings.elements
-            : [];
-          for (const element of elements) {
-            const imported = element.propertyName?.text ?? element.name.text;
-            if (IN_MEMORY_STORES.has(imported)) {
-              report.inMemoryProductionStores.push({
-                file: relFile,
-                line: lineOf(sourceFile, element.getStart(sourceFile)),
-                store: imported,
-              });
-            }
-          }
-        }
-      }
-
-      if (!allowInMemory && !isProvider && ts.isCallExpression(node)) {
-        let factory;
-        if (ts.isIdentifier(node.expression)) {
-          factory = importedFactories.get(node.expression.text);
-        } else if (
-          ts.isPropertyAccessExpression(node.expression) &&
-          ts.isIdentifier(node.expression.expression) &&
-          arkNamespaces.has(node.expression.expression.text)
-        ) {
-          const imported = node.expression.name.text;
-          const requirements = IN_MEMORY_DEFAULT_FACTORIES.get(imported);
-          if (requirements) factory = { imported, requirements };
-        }
-
-        if (factory) {
-          const options = node.arguments[0];
-          const definitelyDefaults =
-            !options ||
-            (ts.isIdentifier(options) && options.text === 'undefined') ||
-            (ts.isObjectLiteralExpression(options) &&
-              factory.requirements.some((name) => !objectHasProperty(ts, options, name)));
-          if (definitelyDefaults) {
-            report.inMemoryProductionStores.push({
-              file: relFile,
-              line: lineOf(sourceFile, node.getStart(sourceFile)),
-              store: `${factory.imported} defaults`,
-            });
-          }
-        }
-      }
-
-      ts.forEachChild(node, visit);
-    };
-    visit(sourceFile);
-  }
-
-  const warnings = [];
-  const nonLiteralImports = report.nonLiteralDynamicImports.filter(
-    (entry) => entry.kind !== 'require'
-  );
-  if (nonLiteralImports.length > 0) {
-    const first = nonLiteralImports[0];
-    warnings.push({
-      ruleId: 'DYNAMIC_IMPORT_NOT_ALLOWLISTED',
-      file: first.file,
-      line: first.line,
-      message: `${nonLiteralImports.length} non-literal dynamic import(s) cannot be resolved statically. Add only reviewed files to dynamicImportAllowlist.`,
-    });
-  }
-  const nonLiteralRequires = report.nonLiteralDynamicImports.filter(
-    (entry) => entry.kind === 'require'
-  );
-  if (nonLiteralRequires.length > 0) {
-    const first = nonLiteralRequires[0];
-    warnings.push({
-      ruleId: 'DYNAMIC_REQUIRE_NOT_ALLOWLISTED',
-      file: first.file,
-      line: first.line,
-      message: `${nonLiteralRequires.length} non-literal require call(s) cannot be resolved statically. Add only reviewed files to dynamicImportAllowlist.`,
-    });
-  }
-  if (report.tsSuppressions.length > maxTsSuppressions) {
-    const first = report.tsSuppressions[0];
-    warnings.push({
-      ruleId: 'TS_SUPPRESSION_THRESHOLD_EXCEEDED',
-      file: first.file,
-      line: first.line,
-      message: `${report.tsSuppressions.length} @ts-ignore/@ts-nocheck directive(s) exceed safety.maxTsSuppressions (${maxTsSuppressions}).`,
-    });
-  }
-  if (report.anyCasts.length > maxAnyCasts) {
-    const first = report.anyCasts[0];
-    warnings.push({
-      ruleId: 'ANY_CAST_THRESHOLD_EXCEEDED',
-      file: first.file,
-      line: first.line,
-      message: `${report.anyCasts.length} explicit any cast(s) exceed safety.maxAnyCasts (${maxAnyCasts}).`,
-    });
-  }
-  if (report.inMemoryProductionStores.length > 0) {
-    const first = report.inMemoryProductionStores[0];
-    warnings.push({
-      ruleId: 'IN_MEMORY_STORE_IN_PRODUCTION_SOURCE',
-      file: first.file,
-      line: first.line,
-      message: `${report.inMemoryProductionStores.length} ArkGate InMemory store risk(s) appear in governed production source. Provide durable stores or set safety.allowInMemory only for an explicitly ephemeral service.`,
-    });
-  }
-  if (report.disabledPeerIsolationRules.length > 0) {
-    warnings.push({
-      ruleId: 'PEER_ISOLATION_DISABLED',
-      message: `${report.disabledPeerIsolationRules.length} rule(s) disable or omit required peerIsolation. Restore peerIsolation: true or set safety.allowDisabledPeerIsolation only with a documented production exception.`,
-    });
-  }
-
-  return { report, warnings };
-}

package/bin/lib/ts-resolve.mjs

@@ -1,227 +0,0 @@
-/**
- * TypeScript module resolution + per-file scan cache for ark-check.
- * Extracted from ark-check entry (R3).
- */
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-
-export function createModuleResolutionHost(ts) {
-  const sys = ts?.sys;
-  const fileExists = (f) => {
-    if (sys?.fileExists) return sys.fileExists(f);
-    return fs.existsSync(f);
-  };
-  const readFile = (f) => {
-    if (sys?.readFile) return sys.readFile(f);
-    try {
-      return fs.readFileSync(f, 'utf8');
-    } catch {
-      return undefined;
-    }
-  };
-  const directoryExists = (d) => {
-    if (sys?.directoryExists) return sys.directoryExists(d);
-    try {
-      return fs.statSync(d).isDirectory();
-    } catch {
-      return false;
-    }
-  };
-  return {
-    fileExists,
-    readFile,
-    directoryExists,
-    getCurrentDirectory: () =>
-      sys?.getCurrentDirectory ? sys.getCurrentDirectory() : process.cwd(),
-    getDirectories: (d) => {
-      if (sys?.getDirectories) return sys.getDirectories(d);
-      try {
-        return fs
-          .readdirSync(d, { withFileTypes: true })
-          .filter((e) => e.isDirectory())
-          .map((e) => e.name);
-      } catch {
-        return [];
-      }
-    },
-    realpath: sys?.realpath ? (p) => sys.realpath(p) : undefined,
-    useCaseSensitiveFileNames: sys?.useCaseSensitiveFileNames ?? true,
-  };
-}
-
-export function parseTsconfig(ts, configPath) {
-  const host = createModuleResolutionHost(ts);
-  const read = ts.readConfigFile(configPath, host.readFile);
-  if (read.error) return {};
-  // parseJsonConfigFileContent wants a ParseConfigHost-like object; our resolution host
-  // is enough for option extraction.
-  const parsed = ts.parseJsonConfigFileContent(
-    read.config,
-    {
-      useCaseSensitiveFileNames: host.useCaseSensitiveFileNames,
-      readDirectory: ts.sys?.readDirectory
-        ? (...args) => ts.sys.readDirectory(...args)
-        : () => [],
-      fileExists: host.fileExists,
-      readFile: host.readFile,
-    },
-    path.dirname(configPath)
-  );
-  return parsed.options;
-}
-
-/**
- * Compiler options for a given source file. With --tsconfig every file uses that one
- * config; otherwise each file uses the NEAREST tsconfig.json above it (like tsc does),
- * so monorepo packages with per-package path aliases resolve correctly under one --root.
- */
-export function createCompilerOptionsLookup(ts, root, tsconfigArg) {
-  if (tsconfigArg) {
-    const configPath = path.isAbsolute(tsconfigArg) ? tsconfigArg : path.join(root, tsconfigArg);
-    const options = fs.existsSync(configPath) ? parseTsconfig(ts, configPath) : {};
-    return () => options;
-  }
-  const byDir = new Map();
-  const byConfig = new Map();
-  return (file) => {
-    const dir = path.dirname(file);
-    if (byDir.has(dir)) return byDir.get(dir);
-    const configPath = ts.findConfigFile(dir, ts.sys.fileExists, 'tsconfig.json');
-    let options = {};
-    if (configPath) {
-      if (!byConfig.has(configPath)) byConfig.set(configPath, parseTsconfig(ts, configPath));
-      options = byConfig.get(configPath);
-    }
-    byDir.set(dir, options);
-    return options;
-  };
-}
-
-/**
- * Per-file scan cache. A cache entry stores the parsed file's content-derived results:
- * content violations (forbidden globals, publish checks, intent references) and the list
- * of module-edge specifiers. Edges are NEVER cached as violations — they are re-resolved
- * against the live filesystem every run, because resolution depends on files and tsconfigs
- * outside the cached file. The whole cache is keyed by the config+manifest contents, so
- * any rule change invalidates everything.
- */
-export function scanCachePath(root) {
-  return path.join(root, 'node_modules', '.cache', 'ark-check.json');
-}
-
-export function scanCacheKey(root, args) {
-  const read = (p) => {
-    try {
-      return fs.readFileSync(p, 'utf8');
-    } catch {
-      return '';
-    }
-  };
-  const configPath = path.isAbsolute(args.config) ? args.config : path.join(root, args.config);
-  const manifestPath = args.manifest
-    ? path.isAbsolute(args.manifest)
-      ? args.manifest
-      : path.join(root, args.manifest)
-    : undefined;
-  // Bump this schema tag whenever the cached scan shape or detection semantics change, so a
-  // warm cache from an older Ark can't feed stale entries to new logic. v2: typeOnly on edges.
-  // v3: per-file exportsOnlyTypes. v4: typeOnlyExportNames + namedBindings.
-  // v5: hasTopLevelSideEffects. v6: non-exported impure inits + non-export class statics.
-  // v7: scope-aware forbidden globals + import-equals dependency edges.
-  // v8: opted-in capability walls (U04) — stale caches must not miss wall verdicts.
-  return crypto
-    .createHash('sha1')
-    .update(`ark-check-cache-v8\0${read(configPath)}\0${manifestPath ? read(manifestPath) : ''}`)
-    .digest('hex');
-}
-
-export function loadScanCache(root, key) {
-  try {
-    const data = JSON.parse(fs.readFileSync(scanCachePath(root), 'utf8'));
-    return data.key === key && data.files && typeof data.files === 'object' ? data.files : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-export function saveScanCache(root, key, files) {
-  try {
-    const target = scanCachePath(root);
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    fs.writeFileSync(target, JSON.stringify({ key, files }));
-  } catch {
-    // cache is best-effort: read-only filesystems just re-parse every run
-  }
-}
-
-/**
- * Fallback resolver for extensionless relative imports whose on-disk target uses an
- * extension `ts.resolveModuleName` won't resolve without a matching tsconfig
- * (notably `.mts`/`.cts`). Mirrors the classic candidate list.
- */
-export function isFile(candidate) {
-  try {
-    return fs.statSync(candidate).isFile();
-  } catch {
-    return false;
-  }
-}
-
-export function resolveRelativeFallback(fromFile, specifier) {
-  const base = path.resolve(path.dirname(fromFile), specifier);
-  const candidates = [
-    base, // only used when the specifier already carries an extension (isFile filters dirs)
-    `${base}.ts`,
-    `${base}.tsx`,
-    `${base}.mts`,
-    `${base}.cts`,
-    `${base}.js`,
-    `${base}.jsx`,
-    `${base}.mjs`,
-    `${base}.cjs`,
-    path.join(base, 'index.ts'),
-    path.join(base, 'index.tsx'),
-    path.join(base, 'index.mts'),
-    path.join(base, 'index.cts'),
-  ];
-  // isFile (not existsSync) so a directory named like the specifier never shadows the
-  // real module file — e.g. `./foo` must not resolve to a `foo/` directory before `foo.mts`.
-  return candidates.find(isFile);
-}
-
-/**
- * Resolve any import specifier (relative, tsconfig path-alias, or package) to a source
- * file using TypeScript's module resolver, returning the resolved file (or undefined for
- * unresolved / declaration-only targets).
- *
- * ark-check governs one project rooted at --root. A resolved target is skipped when its
- * path RELATIVE TO ROOT either escapes the root (leading `..`) or contains a `node_modules`
- * segment. Using the root-relative path (not an absolute substring) means a project that
- * itself lives under a node_modules segment is still governed, while a broad catch-all
- * pattern (`**`) can't false-flag vendored deps or files outside the project. Monorepos can
- * run under a single --root (per-package tsconfigs are honored via the nearest-tsconfig
- * lookup); edges that resolve outside the root are still skipped.
- */
-export function resolveImport(ts, specifier, containingFile, options, host, root) {
-  let file;
-  // Explicit relative extensions are already unambiguous on disk. Avoid a full TypeScript
-  // resolver walk for the common ESM/CJS form; retain TypeScript as the fallback for aliases,
-  // packages, extensionless imports, and any explicit path that is not an existing file.
-  if (specifier.startsWith('.') && path.extname(specifier)) {
-    file = resolveRelativeFallback(containingFile, specifier);
-  }
-  if (!file) {
-    const res = ts.resolveModuleName(specifier, containingFile, options, host);
-    file = res.resolvedModule?.resolvedFileName;
-  }
-  if (!file && specifier.startsWith('.')) {
-    file = resolveRelativeFallback(containingFile, specifier);
-  }
-  if (!file) return undefined;
-  if (file.endsWith('.d.ts')) return undefined;
-  const abs = path.resolve(file);
-  const segments = path.relative(root, abs).split(path.sep);
-  if (segments[0] === '..' || segments.includes('node_modules')) return undefined;
-  return abs;
-}

package/dist/configTypes-DAPvBqK6.d.cts

@@ -1,61 +0,0 @@
-/**
- * Type vocabulary for the ark.config.json contract (U02 pilot 1).
- *
- * Pure declarations only — no runtime values. The loader/validator logic and the
- * published JSON Schema live in ./configContract.ts, whose generated CLI artifact
- * must stay self-contained: type-only imports/exports are erased on transpile, so
- * this split never reaches bin/lib/config-contract.mjs.
- */
-type ArkConfigSchemaVersion = '1.0';
-type ArkConfigCyclePolicy = 'strict' | 'soft' | 'framework-soft' | 'off';
-type ArkConfigLayerCapabilities = {
-    deny?: string[];
-};
-type ArkConfigLayer = {
-    name: string;
-    patterns: string[];
-    exclude?: string[];
-    intentPrefixes?: string[];
-    description?: string;
-    forbiddenGlobals?: string[];
-    /** ADR 0009 D2 — opt-in effect-capability walls; absence changes no verdict. */
-    capabilities?: ArkConfigLayerCapabilities;
-    /** Dual-depth sugar: `pure: true` denies all seven capabilities. */
-    pure?: boolean;
-    mayImportInfrastructure?: boolean;
-    optional?: boolean;
-};
-type ArkConfigRule = {
-    from: string;
-    to: string;
-    allowed: boolean;
-    message?: string;
-    peerIsolation?: boolean;
-    sliceFolders?: string[];
-};
-type ArkConfigSafety = {
-    maxTsSuppressions?: number;
-    maxAnyCasts?: number;
-    allowInMemory?: boolean;
-    allowDisabledPeerIsolation?: boolean;
-};
-type ArkConfig = {
-    $schema: string;
-    schemaVersion: ArkConfigSchemaVersion;
-    name?: string;
-    include: string[];
-    exclude?: string[];
-    excludeGenerated?: boolean;
-    frameworkOverlay?: string;
-    layers: ArkConfigLayer[];
-    rules: ArkConfigRule[];
-    cyclePolicy?: ArkConfigCyclePolicy;
-    dynamicImportAllowlist?: string[];
-    safety?: ArkConfigSafety;
-};
-type ArkConfigLoadResult = {
-    config: ArkConfig;
-    migratedFrom: 'unversioned' | null;
-};
-
-export type { ArkConfig as A, ArkConfigRule as a, ArkConfigSchemaVersion as b, ArkConfigLoadResult as c, ArkConfigLayer as d };