arkgate 4.8.21 → 4.8.23

package/bin/ark-layer-match.mjs

@@ -9,6 +9,11 @@
  * CLI-only layerForFile (Node path resolution) is appended below the pure core.
  */
 
+/**
+ * Last published arkgate that rejects `childSlices`. The rule schema sets
+ * `additionalProperties: false`, so 4.8.22 and older refuse the whole config.
+ */
+export const CHILD_SLICES_REJECTED_THROUGH = '4.8.22';
 const regexpCache = new Map();
 function escapeLiteral(ch) {
     return /[.*+?^${}()|[\]\\]/.test(ch) ? `\\${ch}` : ch;
@@ -598,6 +603,157 @@ export function peerIsolationDecision(input) {
 export function peerIsolationMustDeny(input) {
     return peerIsolationDecision(input).denied;
 }
+export const SLICE_ALIAS_DEBT = 'Aliases are an owed move, not a destination. These files are not finished.';
+function aliasGlobPattern(glob) {
+    return trimTrailingSlashes(glob.trim().replace(/\\/g, '/')).toLowerCase();
+}
+/** Existing path glob matcher. Also accepts a leading src/ or app/. */
+function aliasGlobMatches(glob, relPath) {
+    const pattern = aliasGlobPattern(glob);
+    if (!pattern || pattern === '*' || pattern === '**')
+        return false;
+    const file = String(relPath).replace(/\\/g, '/').replace(/^\/+/, '').toLowerCase();
+    const rooted = stripSrcOrApp(file);
+    const re = globToRegExp(pattern);
+    return re.test(file) || (rooted !== file && re.test(rooted));
+}
+function splitAliasTarget(to) {
+    const parts = aliasGlobPattern(to).split('/').filter(Boolean);
+    if (parts.length < 2 || parts.some((part) => part.includes('*') || part === '.' || part === '..')) {
+        return null;
+    }
+    return { universeId: parts.slice(0, -1).join('/'), childId: parts.join('/') };
+}
+function firstSliceAlias(relPath, rule) {
+    for (const alias of rule.childSlices?.sliceAliases ?? []) {
+        if (!alias || typeof alias.from !== 'string' || typeof alias.to !== 'string')
+            continue;
+        if (!aliasGlobMatches(alias.from, relPath))
+            continue;
+        return splitAliasTarget(alias.to);
+    }
+    return null;
+}
+/**
+ * Universe id and child id for one file. An alias runs only when both walls
+ * leave the path unclassified, so a real slice folder is never overridden.
+ */
+export function resolveGovernedSlice(relPath, rule, sliceFolders) {
+    if (!relPath)
+        return {};
+    const folders = sliceFolders ?? rule.sliceFolders;
+    const universeId = sliceIdForPath(relPath, folders ? [...folders] : undefined, rule.sliceIdentity);
+    const resolved = resolveChildSliceId(relPath, universeId, rule.childSlices);
+    if (universeId || resolved.childId || resolved.mismatched) {
+        return resolved.childId ? { universeId, childId: resolved.childId } : { universeId };
+    }
+    const alias = firstSliceAlias(relPath, rule);
+    return alias ? { universeId: alias.universeId, childId: alias.childId } : {};
+}
+function childPatternDirectory(pattern, childId, identity) {
+    const segments = pattern.split(/[/\\]/).filter(Boolean).map((part) => part.toLowerCase());
+    const idParts = childId.split('/').filter(Boolean).map((part) => part.toLowerCase());
+    if (segments.length === 0 || idParts.length === 0)
+        return null;
+    if (segments.some((part) => part === '**' || (part.includes('*') && part !== '*')))
+        return null;
+    if (identity === 'stars') {
+        let lastLiteral = -1;
+        for (let index = 0; index < segments.length; index += 1) {
+            if (segments[index] !== '*')
+                lastLiteral = index;
+        }
+        if (lastLiteral < 0)
+            return null;
+        const tail = segments.slice(lastLiteral);
+        if (tail.length !== idParts.length)
+            return null;
+        for (let index = 0; index < tail.length; index += 1) {
+            if (tail[index] === '*')
+                continue;
+            if (tail[index] !== idParts[index])
+                return null;
+        }
+        return [...segments.slice(0, lastLiteral), ...idParts].join('/');
+    }
+    if (segments.length !== idParts.length)
+        return null;
+    for (let index = 0; index < segments.length; index += 1) {
+        if (segments[index] === '*')
+            continue;
+        if (segments[index] !== idParts[index])
+            return null;
+    }
+    return idParts.join('/');
+}
+function sharedDirectoryPrefix(file, dir) {
+    const left = stripSrcOrApp(file.replace(/\\/g, '/').replace(/^\/+/, '').toLowerCase()).split('/');
+    const right = dir.split('/');
+    let count = 0;
+    while (count < left.length && count < right.length && left[count] === right[count])
+        count += 1;
+    return count;
+}
+function withSourcePrefix(file, dir) {
+    const norm = file.replace(/\\/g, '/').replace(/^\/+/, '').toLowerCase();
+    if (norm.startsWith('src/') && !dir.startsWith('src/'))
+        return `src/${dir}`;
+    if (norm.startsWith('app/') && !dir.startsWith('app/'))
+        return `app/${dir}`;
+    return dir;
+}
+/** Folder the aliased file should move into. Parallel trees pick the closest prefix. */
+export function sliceAliasDestination(file, childId, child) {
+    let best = null;
+    for (const pattern of child.sliceFolders) {
+        if (typeof pattern !== 'string')
+            continue;
+        const dir = childPatternDirectory(pattern, childId, child.sliceIdentity);
+        if (!dir)
+            continue;
+        const score = sharedDirectoryPrefix(file, dir);
+        if (!best || score > best.score || (score === best.score && dir.length < best.dir.length)) {
+            best = { dir, score };
+        }
+    }
+    return best ? withSourcePrefix(file, best.dir) : '';
+}
+export function anySliceAlias(rules) {
+    return (rules ?? []).some((rule) => (rule?.childSlices?.sliceAliases?.length ?? 0) > 0);
+}
+/** Doctor list. Absent when no rule sets sliceAliases, so the key stays off. */
+export function sliceAliasReport(rules, files) {
+    if (!anySliceAlias(rules))
+        return null;
+    const moves = new Map();
+    for (const rule of rules ?? []) {
+        const child = rule?.childSlices;
+        if (!child?.sliceAliases)
+            continue;
+        for (const alias of child.sliceAliases) {
+            if (!alias || typeof alias.from !== 'string' || typeof alias.to !== 'string')
+                continue;
+            const key = `${aliasGlobPattern(alias.from)}\0${aliasGlobPattern(alias.to)}`;
+            let move = moves.get(key);
+            if (!move) {
+                move = { from: alias.from, to: alias.to, destination: '', files: [] };
+                moves.set(key, move);
+            }
+            const seen = new Set(move.files);
+            for (const file of files) {
+                if (typeof file !== 'string' || !aliasGlobMatches(alias.from, file) || seen.has(file))
+                    continue;
+                seen.add(file);
+                move.files.push(file);
+                if (!move.destination)
+                    move.destination = sliceAliasDestination(file, alias.to, child);
+            }
+        }
+    }
+    const listed = [...moves.values()].map((move) => ({ ...move, files: [...move.files].sort() }));
+    listed.sort((left, right) => left.from.localeCompare(right.from) || left.to.localeCompare(right.to));
+    return { notAScore: true, finished: false, debt: SLICE_ALIAS_DEBT, moves: listed };
+}
 /**
  * One human sentence naming which peerIsolation reason fired — so the denial
  * reports a fact about their code (`cross-slice`) or a fact about our evidence
@@ -624,6 +780,433 @@ export function peerIsolationDenyExplanation(reason, context) {
             return 'no path evidence for this edge — peerIsolation needs the importer and importee paths.';
     }
 }
+function crossParentExplanation(fromSlice, toSlice) {
+    return `cross-parent slice ${fromSlice ?? '?'} → ${toSlice ?? '?'}. The child wall cannot allow another universe.`;
+}
+function crossSiblingExplanation(fromChild, toChild, universe) {
+    return `cross-sibling slice ${fromChild} → ${toChild} inside ${universe}.`;
+}
+function parentImportsChildExplanation(toChild) {
+    return `universe common imports child ${toChild}. parentMayImportChild is off.`;
+}
+/** Last path segment of a universe slice id (`features/projects` → `projects`). */
+export function universePairLabel(sliceId) {
+    if (!sliceId)
+        return undefined;
+    const parts = sliceId.split('/').filter(Boolean);
+    return parts.length > 0 ? parts[parts.length - 1] : undefined;
+}
+function directorySegments(relPath) {
+    const parts = String(relPath).split(/[/\\]/).filter(Boolean);
+    return parts.slice(0, -1);
+}
+function pathHasCommonFolder(relPath, commonFolders) {
+    if (!commonFolders?.length)
+        return false;
+    const names = new Set();
+    for (const raw of commonFolders) {
+        if (typeof raw === 'string' && raw.length > 0)
+            names.add(raw.toLowerCase());
+    }
+    if (names.size === 0)
+        return false;
+    return directorySegments(relPath).some((part) => names.has(part.toLowerCase()));
+}
+/**
+ * Child id for one path. A common folder and a flat file (the starred id does
+ * not grow past the universe id) are universe common. A child id that does not
+ * extend the universe id is not used; the caller warns.
+ */
+export function resolveChildSliceId(relPath, universeId, child) {
+    if (!relPath || !child?.sliceFolders?.length)
+        return {};
+    if (pathHasCommonFolder(relPath, child.commonFolders))
+        return {};
+    const raw = sliceIdForPath(relPath, child.sliceFolders, child.sliceIdentity);
+    if (!raw || !universeId)
+        return {};
+    const childKey = raw.toLowerCase();
+    const universeKey = universeId.toLowerCase();
+    if (childKey === universeKey)
+        return {};
+    if (childKey.startsWith(`${universeKey}/`))
+        return { childId: raw };
+    return { mismatched: { childId: raw, universeId } };
+}
+function siblingEntryKey(entry) {
+    return trimTrailingSlashes(entry.trim().replace(/\\/g, '/')).toLowerCase();
+}
+function stripSrcOrApp(value) {
+    return value.replace(/^(?:src|app)\//, '');
+}
+/** True when the importer file sits in this directory, with or without src/ or app/. */
+function pathUnderSubtree(filePath, entry) {
+    const file = filePath.replace(/\\/g, '/').replace(/^\/+/, '').toLowerCase();
+    const prefix = stripSrcOrApp(entry);
+    if (!prefix)
+        return false;
+    const rooted = stripSrcOrApp(file);
+    return (file === prefix ||
+        file.startsWith(`${prefix}/`) ||
+        rooted === prefix ||
+        rooted.startsWith(`${prefix}/`));
+}
+/**
+ * Child slice id matches exactly. A path matches the importer file's directory.
+ * Bare names do not match. `*` is not a wildcard.
+ */
+export function importerInEnforcedSubtree(fromPath, fromChild, entries) {
+    if (!fromChild || !entries?.length)
+        return false;
+    const child = fromChild.toLowerCase();
+    for (const raw of entries) {
+        if (typeof raw !== 'string')
+            continue;
+        const entry = siblingEntryKey(raw);
+        if (!entry || entry.includes('*'))
+            continue;
+        if (child === entry)
+            return true;
+        if (fromPath && pathUnderSubtree(fromPath, entry))
+            return true;
+    }
+    return false;
+}
+/**
+ * String `advisory` warns every sibling crossing. String `deny` and an absent
+ * value deny every one. An object denies the importer only when it is listed,
+ * unless `default` is already `deny`.
+ */
+export function siblingCrossingAdvisory(siblings, fromPath, fromChild) {
+    if (siblings == null || siblings === 'deny')
+        return false;
+    if (siblings === 'advisory')
+        return true;
+    if (siblings.default === 'deny')
+        return false;
+    return !importerInEnforcedSubtree(fromPath, fromChild, siblings.enforce);
+}
+/**
+ * Segments of a child-slice pattern. `*` is one whole segment.
+ * A bare name, `**`, or a partial segment does not match.
+ */
+function childSlicePatternSegments(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const trimmed = trimTrailingSlashes(raw.trim().replace(/\\/g, '/')).toLowerCase();
+    if (!trimmed.includes('/'))
+        return null;
+    const parts = trimmed.split('/');
+    for (const part of parts) {
+        if (part.length === 0 || part === '.' || part === '..')
+            return null;
+        if (part.includes('*') && part !== '*')
+            return null;
+    }
+    return parts;
+}
+/** Whole-segment match. The universe list does not call this. */
+export function childSlicePatternMatches(pattern, sliceId) {
+    const want = childSlicePatternSegments(pattern);
+    const have = childSlicePatternSegments(sliceId);
+    if (!want || !have || want.length !== have.length)
+        return false;
+    for (let index = 0; index < want.length; index += 1) {
+        const segment = want[index];
+        if (segment === '*')
+            continue;
+        if (segment !== have[index])
+            return false;
+    }
+    return true;
+}
+function childCrossSliceAllowed(edges, fromChild, toChild) {
+    if (!edges?.length)
+        return false;
+    for (const edge of edges) {
+        if (!edge || typeof edge.from !== 'string' || typeof edge.to !== 'string')
+            continue;
+        if (childSlicePatternMatches(edge.from, fromChild) && childSlicePatternMatches(edge.to, toChild)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * True when the two patterns can name child ids in different universes.
+ * The universe is every segment but the last. A `*` there, or two different
+ * literals, means the entry cannot be a same-universe sibling allowance.
+ */
+function childAllowanceSpansUniverses(from, to) {
+    const fromParts = childSlicePatternSegments(from);
+    const toParts = childSlicePatternSegments(to);
+    if (!fromParts || !toParts)
+        return false;
+    const fromPrefix = fromParts.slice(0, -1);
+    const toPrefix = toParts.slice(0, -1);
+    if (fromPrefix.length !== toPrefix.length)
+        return true;
+    for (let index = 0; index < fromPrefix.length; index += 1) {
+        const left = fromPrefix[index];
+        const right = toPrefix[index];
+        if (left === '*' || right === '*')
+            return true;
+        if (left !== right)
+            return true;
+    }
+    return false;
+}
+/**
+ * Universe wall, then the child wall. An allow from the child wall never
+ * overturns a universe deny: that deny returns before the child wall runs.
+ */
+export function evaluateNestedSliceWall(input) {
+    const universe = peerIsolationDecision({
+        fromPath: input.fromPath,
+        toPath: input.toPath,
+        folderCount: input.folderCount,
+        fromSlice: input.fromSlice,
+        toSlice: input.toSlice,
+        fromShared: input.fromShared,
+        toShared: input.toShared,
+        crossSliceAllowed: input.crossSliceAllowed,
+        sharedImportsSlice: input.rule.sharedImportsSlice,
+    });
+    if (universe.denied) {
+        const crossParent = Boolean(input.rule.childSlices) && universe.reason === 'cross-slice';
+        return {
+            crossing: universe.reason === 'cross-slice' ? 'cross-parent' : 'fail-closed',
+            decision: 'deny',
+            ...(crossParent ? { reasonId: 'CROSS_PARENT_SLICE' } : {}),
+            explanation: crossParent
+                ? crossParentExplanation(input.fromSlice, input.toSlice)
+                : peerIsolationDenyExplanation(universe.reason ?? 'missing-path', {
+                    fromPath: input.fromPath,
+                    toPath: input.toPath,
+                    fromSlice: input.fromSlice,
+                    toSlice: input.toSlice,
+                }),
+            peerIsolationReason: universe.reason,
+            fromUniverse: input.fromSlice,
+            toUniverse: input.toSlice,
+        };
+    }
+    const child = input.rule.childSlices;
+    if (!child || !input.fromSlice || !input.toSlice || input.fromSlice !== input.toSlice || !input.toPath) {
+        return {
+            crossing: 'none',
+            decision: 'allow',
+            fromUniverse: input.fromSlice,
+            toUniverse: input.toSlice,
+        };
+    }
+    const fromChild = input.fromChild ?? resolveChildSliceId(input.fromPath, input.fromSlice, child).childId;
+    const toChild = input.toChild ?? resolveChildSliceId(input.toPath, input.toSlice, child).childId;
+    const allowSameUniverse = {
+        crossing: 'none',
+        decision: 'allow',
+        fromUniverse: input.fromSlice,
+        toUniverse: input.toSlice,
+    };
+    if (fromChild && toChild && fromChild !== toChild) {
+        if (childCrossSliceAllowed(child.allowedCrossSlice, fromChild, toChild)) {
+            return allowSameUniverse;
+        }
+        const advisory = siblingCrossingAdvisory(child.siblings, input.fromPath, fromChild);
+        return {
+            crossing: 'cross-sibling',
+            decision: advisory ? 'advisory' : 'deny',
+            reasonId: 'CROSS_SIBLING_SLICE',
+            explanation: crossSiblingExplanation(fromChild, toChild, input.fromSlice),
+            fromUniverse: input.fromSlice,
+            toUniverse: input.toSlice,
+        };
+    }
+    if (!fromChild && toChild && child.parentMayImportChild !== true) {
+        return {
+            crossing: 'parent-imports-child',
+            decision: 'deny',
+            explanation: parentImportsChildExplanation(toChild),
+            fromUniverse: input.fromSlice,
+            toUniverse: input.toSlice,
+        };
+    }
+    return allowSameUniverse;
+}
+/**
+ * Finding message. Import sites always append the explanation. Intent sites
+ * keep today's wording when there is no reasonId: a plain cross-slice deny
+ * does not gain a clause, and any other universe-wall reason does.
+ */
+export function composeSliceDenialMessage(input) {
+    const explanation = input.verdict.explanation;
+    if (input.surface === 'intent') {
+        const defaultMessage = input.defaultMessage ?? `${input.fromLayer} must not reference ${input.toLayer} intent.`;
+        if (input.verdict.reasonId && explanation)
+            return `${defaultMessage} ${explanation}`;
+        if (explanation && input.verdict.peerIsolationReason !== 'cross-slice') {
+            return `${defaultMessage} ${explanation}`;
+        }
+        if (input.ruleMessage) {
+            return explanation ? `${input.ruleMessage} (${explanation})` : input.ruleMessage;
+        }
+        return defaultMessage;
+    }
+    if (input.ruleMessage) {
+        return explanation ? `${input.ruleMessage} (${explanation})` : input.ruleMessage;
+    }
+    if (explanation) {
+        const kind = input.kind ?? 'import';
+        return `${input.fromLayer} must not ${kind} another slice of ${input.toLayer} (${input.fromPath} → ${input.toPath}): ${explanation}`;
+    }
+    return `${input.fromLayer} must not ${input.kind ?? 'import'} ${input.toLayer}.`;
+}
+/** Fields a reporting site copies onto a finding. Absent when the verdict allows. */
+export function sliceFindingExtras(verdict) {
+    if (!verdict || verdict.decision === 'allow')
+        return {};
+    const from = universePairLabel(verdict.fromUniverse);
+    const to = universePairLabel(verdict.toUniverse);
+    return {
+        ...(verdict.reasonId ? { reasonId: verdict.reasonId } : {}),
+        ...(verdict.reasonId && from && to ? { universeFrom: from, universeTo: to } : {}),
+        ...(verdict.decision === 'advisory'
+            ? { failsStrict: false, severity: 'warning' }
+            : {}),
+    };
+}
+/** True when this siblings value still leaves some crossings advisory. An enforce list does not finish the house. */
+export function childWallSiblingsAdvisory(siblings) {
+    if (siblings === 'advisory')
+        return true;
+    if (siblings !== null && typeof siblings === 'object') {
+        return siblings.default !== 'deny';
+    }
+    return false;
+}
+export function anyChildWallAdvisory(rules) {
+    return (rules ?? []).some((rule) => rule?.childSlices != null && childWallSiblingsAdvisory(rule.childSlices.siblings));
+}
+/** Doctor counts. Null when this scan has no nested-wall reason, so the key stays absent. */
+export function sliceCountReport(violations) {
+    let crossParent = 0;
+    let crossSibling = 0;
+    const pairs = new Map();
+    for (const row of violations ?? []) {
+        if (row.reasonId === 'CROSS_PARENT_SLICE') {
+            crossParent += 1;
+            if (typeof row.universeFrom === 'string' && typeof row.universeTo === 'string') {
+                const key = `${row.universeFrom}\0${row.universeTo}`;
+                const prev = pairs.get(key);
+                if (prev)
+                    prev.count += 1;
+                else
+                    pairs.set(key, { from: row.universeFrom, to: row.universeTo, count: 1 });
+            }
+        }
+        else if (row.reasonId === 'CROSS_SIBLING_SLICE') {
+            crossSibling += 1;
+        }
+    }
+    if (crossParent === 0 && crossSibling === 0)
+        return null;
+    return {
+        crossParent,
+        crossSibling,
+        pairs: [...pairs.values()].sort((left, right) => left.from.localeCompare(right.from) || left.to.localeCompare(right.to)),
+    };
+}
+/**
+ * One version warning when any rule sets childSlices, plus one warning per
+ * directed rule when a path's child id does not extend its universe id.
+ */
+export function childSliceConfigFindings(rules, files) {
+    const out = [];
+    let versionWarned = false;
+    const seenMismatch = new Set();
+    const seenSpan = new Set();
+    for (const rule of rules ?? []) {
+        if (!rule?.childSlices)
+            continue;
+        if (!versionWarned) {
+            versionWarned = true;
+            out.push({
+                ruleId: 'CONFIG_CHILD_SLICES_VERSION',
+                failsStrict: false,
+                message: `childSlices needs an arkgate newer than ${CHILD_SLICES_REJECTED_THROUGH}. Version ${CHILD_SLICES_REJECTED_THROUGH} and older reject the key because the rule schema sets additionalProperties: false.`,
+            });
+        }
+        if (!rule.peerIsolation)
+            continue;
+        for (const file of files) {
+            const universeId = sliceIdForPath(file, rule.sliceFolders, rule.sliceIdentity);
+            const resolved = resolveChildSliceId(file, universeId, rule.childSlices);
+            if (!resolved.mismatched)
+                continue;
+            const key = `${rule.from}\0${rule.to}\0${resolved.mismatched.universeId}\0${resolved.mismatched.childId}`;
+            if (seenMismatch.has(key))
+                continue;
+            seenMismatch.add(key);
+            out.push({
+                ruleId: 'CONFIG_CHILD_SLICE_EXTENDS',
+                failsStrict: false,
+                fromLayer: rule.from,
+                toLayer: rule.to,
+                path: file,
+                message: `${rule.from} → ${rule.to}: child id ${resolved.mismatched.childId} does not extend universe id ${resolved.mismatched.universeId} (${file}).`,
+            });
+        }
+        for (const edge of rule.childSlices.allowedCrossSlice ?? []) {
+            if (!edge || typeof edge.from !== 'string' || typeof edge.to !== 'string')
+                continue;
+            if (!childAllowanceSpansUniverses(edge.from, edge.to))
+                continue;
+            const key = `${edge.from.trim().toLowerCase()}\0${edge.to.trim().toLowerCase()}`;
+            if (seenSpan.has(key))
+                continue;
+            seenSpan.add(key);
+            out.push({
+                ruleId: 'CONFIG_CHILD_SLICE_CROSS_UNIVERSE',
+                failsStrict: false,
+                fromLayer: rule.from,
+                toLayer: rule.to,
+                message: `childSlices.allowedCrossSlice ${edge.from} → ${edge.to} cannot cross the universe wall. The universe wall still denies that edge.`,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Advisory sibling crossings above the recorded baseline count become blocking.
+ * The key is the existing baseline identity (ruleId, file, layers, target) —
+ * reasonId is not part of it. No baseline means there is no recorded count,
+ * so advisory stays non-blocking. Recorded crossings stay advisory.
+ */
+export function applyAdvisorySiblingRatchet(violations, occurrenceKeys, recordedKeys) {
+    const indexes = [];
+    for (let index = 0; index < violations.length; index += 1) {
+        if (violations[index]?.reasonId === 'CROSS_SIBLING_SLICE')
+            indexes.push(index);
+    }
+    if (indexes.length === 0)
+        return [...violations];
+    let recorded = 0;
+    for (const index of indexes) {
+        if (recordedKeys.has(occurrenceKeys[index] ?? ''))
+            recorded += 1;
+    }
+    if (indexes.length <= recorded)
+        return [...violations];
+    return violations.map((violation, index) => {
+        if (violation.reasonId !== 'CROSS_SIBLING_SLICE')
+            return violation;
+        if (recordedKeys.has(occurrenceKeys[index] ?? ''))
+            return violation;
+        if (violation.failsStrict !== false)
+            return violation;
+        return { ...violation, failsStrict: true, severity: 'error' };
+    });
+}
 /**
  * Find the first denying rule for a layer edge.
  *
@@ -656,25 +1239,33 @@ export function findDeniedEdgeDecision(rules, from, to, options) {
             const fromPath = options?.fromPath;
             const toPath = options?.toPath;
             const folders = resolveSliceFolders(rule, from, options?.layers);
-            const fromSlice = fromPath
-                ? sliceIdForPath(fromPath, folders, rule.sliceIdentity)
-                : undefined;
-            const toSlice = toPath ? sliceIdForPath(toPath, folders, rule.sliceIdentity) : undefined;
-            const decision = peerIsolationDecision({
+            const fromPlace = resolveGovernedSlice(fromPath, rule, folders);
+            const toPlace = resolveGovernedSlice(toPath, rule, folders);
+            const fromSlice = fromPlace.universeId;
+            const toSlice = toPlace.universeId;
+            const verdict = evaluateNestedSliceWall({
+                rule,
                 fromPath,
                 toPath,
                 folderCount: folders.length,
                 fromSlice,
                 toSlice,
+                fromChild: fromPlace.childId,
+                toChild: toPlace.childId,
                 fromShared: !fromSlice && pathUnderSharedRoot(fromPath, rule.sharedRoots),
                 toShared: !toSlice && pathUnderSharedRoot(toPath, rule.sharedRoots),
                 crossSliceAllowed: crossSliceEdgeAllowed(rule.allowedCrossSlice, fromSlice, toSlice),
-                sharedImportsSlice: rule.sharedImportsSlice,
             });
-            if (decision.denied) {
-                return { rule, peerIsolationReason: decision.reason, fromSlice, toSlice };
+            if (verdict.decision !== 'allow') {
+                return {
+                    rule,
+                    peerIsolationReason: verdict.peerIsolationReason,
+                    fromSlice,
+                    toSlice,
+                    sliceVerdict: verdict,
+                };
             }
-            continue; // same slice, declared shared, or declared cross edge: no denial
+            continue; // same slice, declared shared, declared cross edge, or child wall allow
         }
         // Classic deny — same-layer always allowed without peerIsolation
         if (from === to)
@@ -701,8 +1292,8 @@ export function findSharedImportsSliceBridge(rules, from, to, options) {
         if (rule.sharedImportsSlice === 'deny')
             continue;
         const folders = resolveSliceFolders(rule, from, options?.layers);
-        const fromSlice = sliceIdForPath(fromPath, folders, rule.sliceIdentity);
-        const toSlice = sliceIdForPath(toPath, folders, rule.sliceIdentity);
+        const fromSlice = resolveGovernedSlice(fromPath, rule, folders).universeId;
+        const toSlice = resolveGovernedSlice(toPath, rule, folders).universeId;
         if (fromSlice || !toSlice)
             continue;
         if (!pathUnderSharedRoot(fromPath, rule.sharedRoots))
@@ -732,6 +1323,10 @@ export function isScanExcludedRelative(relPath, config) {
     const rel = String(relPath).split(/[/\\]/).join('/');
     return scanExcludePatterns(config).some((pattern) => globToRegExp(pattern).test(rel));
 }
+/** Slice folders the universe wall uses: the rule's list, or the from-layer patterns. */
+export function peerSliceFolders(rule, layerName, layers) {
+    return resolveSliceFolders(rule, layerName, layers);
+}
 
 
 import path from 'node:path';