@geonosis/oxlint-plugin-biological-architecture 0.1.2 → 0.2.1

package/README.md

@@ -1,9 +1,9 @@
 # @geonosis/oxlint-plugin-biological-architecture
 
-54 architecture rules as an oxlint JS plugin: which tier a file belongs to, what it may import,
+55 architecture rules as an oxlint JS plugin: which tier a file belongs to, what it may import,
 where state is allowed to live, and the backend invariants that go with them. Nothing is hardcoded
-to a repo — every list of brands, features, tables or paths is an option whose default does nothing
-until it is configured.
+to a repo — every list of brands, features, tables or paths is an option. A rule enabled without the
+options it needs refuses the run rather than passing silently.
 
 ## Install
 
@@ -63,6 +63,7 @@ everything below the organelle is inert. A cell never composes another cell.
 | `backend-d1` | 2 | Cloudflare D1 facts — false on an engine with transactions |
 | `backend-medusa` | 1 | the storefront route surface |
 | `backend-sagaflow-cf` | 1 | durable runs on Cloudflare Workflows — false of an inline saga |
+| `tooling` | 1 | `layer-walls` — a repo's OWN layers, declared as data and walled |
 | `comment-ceiling` | 1 | the comment posture, opt-in (+ oxlint's `capitalized-comments`) |
 
 A rule that is false on another stack gets its own preset rather than riding along in a generic
@@ -72,99 +73,76 @@ one: a preset carrying a repo fact is a repo fact wearing a preset's name.
 
 A repo that already has its own copy of these rules does not delete it because the version numbers
 match. It deletes it when the **findings** match: same tree, same rule ids, two configs, and a diff.
-`geonosis-lint-parity` is that diff.
+[`@geonosis/lint-parity`](https://www.npmjs.com/package/@geonosis/lint-parity) is that diff — a
+separate package, because a parity tool welded to one rule plugin can only ever check that plugin.
+What this package ships towards it is the **evidence**: `corpus/`, the fixture tree its own gates
+run against, one deliberately broken file per rule, plus a `manifest.json` generated from the
+plugin's own rules export naming exactly the rules that corpus speaks for.
 
 ```bash
-geonosis-lint-parity --a <config-a.json> --b <config-b.json> [--oxlint <path>] [--out <dir>] -- <paths…>
+pnpm add -D @geonosis/lint-parity
 ```
 
-**Write both configs inside the workspace being linted** — `<ws>/.oxlintrc.parity-a.json`, deleted
-afterwards — or name the plugin by absolute path in `jsPlugins`. oxlint resolves a `jsPlugins`
-specifier relative to the **config file's** directory, not the working directory, so a config
-written to a temp dir cannot find a plugin installed in the workspace: it fails with
-`Cannot find module '@…/plugin'`, and the tool correctly refuses with
-`config A: oxlint exited 1 without reporting a single finding`.
-
 ### Step 0 — reach, before parity
 
 Parity between two configs that both do nothing is perfect parity. In one source repo 34 of 51
 configured rules fired nowhere in any corpus it had: 34 rules a consumer would inherit as claims
-nothing could check. So this package ships the **reach corpus** — the fixture tree its own gates run
-against, one deliberately broken file per rule — and answers the question directly:
+nothing could check. Point the tool at the corpus this package installed:
 
 ```bash
-geonosis-lint-parity --corpus [<dir>] --a oxlintrc.fork.json --b oxlintrc.published.json [--out <dir>]
+npx geonosis-lint-parity \
+  --corpus node_modules/@geonosis/oxlint-plugin-biological-architecture/corpus \
+  --a oxlintrc.fork.json --b oxlintrc.published.json --out proofs/reach
 ```
 
-Both configs run over the corpus (copied to a temp root first, so neither a `.gitignore` nor
-oxlint's `node_modules` skip can quietly turn "every rule fired nowhere" into the answer). It prints
-a fired-under-A / fired-under-B row per in-scope rule and **exits 1 when one fires under neither**.
-`--out` writes `CORPUS.md`.
-
-**A corpus covers the rules its own `manifest.json` names, and only those.** The one this package
-ships names `biological-architecture/*` — one deliberately broken file per rule, the list generated
-from the plugin's own rules export at build time. A configured `eqeqeq`, `unicorn/*` or
-`typescript/*` is listed under **outside this corpus** and gets no verdict: this tree is no evidence
-either way about somebody else's rule, and judging one would fail every real config for saying
-nothing. `--corpus <dir>` points the same run at another plugin's corpus; the scope moves with it.
+It prints a fired-under-A / fired-under-B row per in-scope rule and **exits 1 when one fires under
+neither**. A configured `eqeqeq`, `unicorn/*` or `typescript/*` is listed under **outside this
+corpus** and gets no verdict: this tree is no evidence either way about somebody else's rule.
 
 Every rule this package exports has at least one corpus file that fires it, and a test fails if that
 stops being true — so a rule cannot be added without evidence it reaches anything.
 
 ### Then parity
 
-It runs oxlint twice with `--format=unix` over the same paths, strips the working-directory prefix,
-sorts, and prints the two counts, `only in A`, `only in B` and a per-rule tally. **It exits 1 when
-`only in A` is non-empty** — a finding the old config caught and the new one does not. New findings
-are what an upgrade is for; lost ones stop the adoption. `--out` writes `a.txt`, `b.txt`,
-`only-in-a.txt`, `only-in-b.txt`, `changed.txt` and `SUMMARY.md` for the proof file.
-
-**A finding is identified by where it is and which rule found it — `path:line:col` plus
-`plugin(rule)`.** The message is not part of it, and neither is the severity. A release that only
-rewords a rule's message would otherwise show as one finding lost and one gained, and stop an
-adoption over a sentence. Those pair up instead under **changed**, reported in full and never
-reaching the exit code; a severity change lands there too, because that is a fact about the config
-rather than a rule that stopped firing.
-
 **Fork vs published**, before deleting a vendored copy — two configs identical but for `jsPlugins`:
 
 ```bash
 # oxlintrc.fork.json      → "jsPlugins": ["./packages/eslint-plugin-biological-architecture"]
 # oxlintrc.published.json → "jsPlugins": ["@geonosis/oxlint-plugin-biological-architecture"]
-geonosis-lint-parity \
+npx geonosis-lint-parity \
   --a oxlintrc.fork.json --b oxlintrc.published.json \
   --out proofs/adoption-parity \
   -- apps packages
 ```
 
-**Version vs version**, as the kit's own release check — the same config, pointing first at the
-installed version and then at a local build, by absolute path:
-
-```bash
-geonosis-lint-parity \
-  --a oxlintrc.0.1.0.json --b oxlintrc.0.1.1.json \
-  --out proofs/parity-0.1.0-vs-0.1.1 \
-  -- apps packages
-```
+**Write both configs inside the workspace being linted** — oxlint resolves a `jsPlugins` specifier
+relative to the **config file's** directory, not the working directory. It exits 1 when a finding
+config A reported is missing under config B; a reworded message is reported as **changed** and never
+reaches the exit code. The tool's README has the rest.
 
-`--oxlint` overrides the binary; by default it walks up from the working directory for
-`node_modules/.bin/oxlint`, so the comparison runs under the consumer's own linter rather than one
-`npx` might fetch. Every difference the run reports has to trace to a decision written down in
-`RULES.md`; one that does not is a defect, not a difference.
+Every difference a run reports has to trace to a decision written down in `RULES.md`; one that does
+not is a defect, not a difference.
 
 ### What the two configs must say for the findings to match
 
-A fork usually had its repo's vocabulary compiled in. Here it is configuration, and a config that
-omits it turns the rule off — which reads as a lost finding, correctly. Carry these across:
+A fork usually had its repo's vocabulary compiled in. Here it is configuration — and **a rule
+enabled without the options it needs refuses the run**, naming itself and the missing option, rather
+than quietly finding nothing. That is deliberate: a rule enabled at `"error"` with nothing to
+compare against is indistinguishable from a clean tree, and one consumer shipped exactly that for
+months. Carry these across, or turn the rule off:
 
-| Rule | Option | Without it |
+| Rule | Option | Enabled without it |
 | --- | --- | --- |
-| `no-brand-names` | `{ brands, allowedSubstrings }` | does nothing |
+| `no-brand-names` | `{ brands, allowedSubstrings }` | refuses the run |
 | `organelle-dependency` | `{ sharedFeatures }` | only `shared` crosses a feature boundary |
-| `documents-share-one-table` | `{ perKindTables }` | does nothing |
-| `document-sagas-are-generic` | `{ perKindPrefixes }` | does nothing |
-| `step-opens-its-own-cell` | `{ engine, within, wrapper }` | does nothing |
-| `no-raw-html-atoms` | the positional element→atom map | does nothing |
+| `documents-share-one-table` | `{ perKindTables }` | refuses the run |
+| `document-sagas-are-generic` | `{ perKindPrefixes }` | refuses the run |
+| `step-opens-its-own-cell` | `{ engine, within, wrapper }` | refuses the run |
+| `no-raw-html-atoms` | the positional element→atom map | refuses the run |
+| `layer-walls` | `{ layers: [{ name, paths, mayImport }], externals? }` | refuses the run |
+
+An empty list counts as unconfigured. A rule set to `"off"`, or never named, is untouched — "does
+nothing until configured" survives for a rule nobody enabled, which is oxlint's job, not ours.
 
 Two more facts a fork's config will trip on:
 

package/corpus/.oxlintrc.json

@@ -35,6 +35,39 @@
       }
     ],
     "biological-architecture/effect-hook-naming": "error",
+    "biological-architecture/layer-walls": [
+      "error",
+      {
+        "layers": [
+          {
+            "name": "core",
+            "paths": [
+              "(?:^|/)layers/core/"
+            ],
+            "mayImport": []
+          },
+          {
+            "name": "feature",
+            "paths": [
+              "(?:^|/)layers/feature/"
+            ],
+            "mayImport": [
+              "core"
+            ]
+          },
+          {
+            "name": "shell",
+            "paths": [
+              "(?:^|/)layers/shell/"
+            ],
+            "mayImport": [
+              "core",
+              "feature"
+            ]
+          }
+        ]
+      }
+    ],
     "biological-architecture/max-comment-density": "error",
     "biological-architecture/molecule-atoms-only": "error",
     "biological-architecture/molecule-must-compose": "error",

package/corpus/layers/core/bad-reaches-up.ts

@@ -0,0 +1,3 @@
+import { helper } from '../feature/sibling'
+
+export const reachesUp = () => helper()

package/corpus/layers/core/thing.ts

@@ -0,0 +1 @@
+export const thing = () => 'core'

package/corpus/layers/feature/bad-relative.ts

@@ -0,0 +1,3 @@
+import { boot } from '../shell/boot'
+
+export const crosses = () => boot()

package/corpus/layers/feature/good-downward.ts

@@ -0,0 +1,3 @@
+import { thing } from '../core/thing'
+
+export const downward = () => thing()

package/corpus/layers/feature/good-same-layer.ts

@@ -0,0 +1,3 @@
+import { helper } from './sibling'
+
+export const sameLayer = () => helper()

package/corpus/layers/feature/good-type-only.ts

@@ -0,0 +1,3 @@
+import type { Boot } from '../shell/boot'
+
+export const describeBoot = (boot: Boot): string => boot.name

package/corpus/layers/feature/sibling.ts

@@ -0,0 +1 @@
+export const helper = () => 'feature'

package/corpus/layers/shell/boot.ts

@@ -0,0 +1,3 @@
+export type Boot = { name: string }
+
+export const boot = () => 'shell'

package/corpus/manifest.json

@@ -13,6 +13,7 @@
     "biological-architecture/document-sagas-are-generic",
     "biological-architecture/documents-share-one-table",
     "biological-architecture/effect-hook-naming",
+    "biological-architecture/layer-walls",
     "biological-architecture/max-comment-density",
     "biological-architecture/molecule-atoms-only",
     "biological-architecture/molecule-must-compose",

package/dist/{chunk-74VWOEPL.js → chunk-HXBZSOIU.js}

@@ -59,6 +59,7 @@ var TENANT_SCOPING = [
   "tables-declare-their-plane",
   "tenant-tables-carry-org-id"
 ];
+var TOOLING = ["layer-walls"];
 var RULE_PREFIX = "biological-architecture";
 var asRules = (names) => Object.fromEntries(names.map((name) => [`${RULE_PREFIX}/${name}`, "error"]));
 var COMMENT_CEILING = {
@@ -75,7 +76,8 @@ var PRESETS = {
   "comment-ceiling": COMMENT_CEILING,
   frontend: { rules: asRules(FRONTEND) },
   recommended: { rules: asRules(FRONTEND) },
-  "tenant-scoping": { rules: asRules(TENANT_SCOPING) }
+  "tenant-scoping": { rules: asRules(TENANT_SCOPING) },
+  tooling: { rules: asRules(TOOLING) }
 };
 var rulesOfPreset = (preset) => Object.keys(PRESETS[preset].rules).filter((id) => id.startsWith(`${RULE_PREFIX}/`)).map((id) => id.slice(RULE_PREFIX.length + 1));
 

package/dist/discover-atoms.d.ts

@@ -0,0 +1,39 @@
+interface AtomMapping {
+    atomFile: string;
+    atomName: string;
+    nativeElement: string;
+}
+interface AtomRestriction {
+    atom: string;
+    element: string;
+    importPath: string;
+}
+interface RestrictedSyntaxEntry {
+    message: string;
+    selector: string;
+}
+/**
+ * Build no-restricted-syntax entries that forbid raw native HTML usage
+ * for every native element wrapped by an atom. Apply these entries to
+ * molecules, compounds, cells, and tissues (NOT atoms themselves).
+ */
+declare function buildAtomRestrictions(atomsDir: string, importPathPrefix?: string): RestrictedSyntaxEntry[];
+/**
+ * Build atom restrictions in the format expected by the no-raw-html-atoms rule.
+ * This replaces no-restricted-syntax for linters that don't support it (e.g. oxlint).
+ */
+declare function buildAtomRuleRestrictions(atomsDir: string, importPathPrefix?: string): AtomRestriction[];
+/**
+ * Scan the atoms directory and build a mapping from native HTML element
+ * to the atom that wraps it. This is used to generate no-restricted-syntax
+ * entries that forbid raw native HTML usage in higher-level components.
+ *
+ * When multiple atoms wrap the same element (e.g. `input.tsx` and
+ * `inline-input.tsx` both wrap `<input>`), the atom whose filename
+ * exactly matches the element name is preferred as the canonical one.
+ * Variants are kept as alternatives in the error message.
+ */
+declare function scanAtomMappings(atomsDir: string): AtomMapping[];
+declare function detectFirstNativeJsxElement(source: string): null | string;
+
+export { buildAtomRestrictions, buildAtomRuleRestrictions, detectFirstNativeJsxElement, scanAtomMappings };

package/dist/index.d.ts

@@ -0,0 +1,54 @@
+import { Preset } from './presets.js';
+export { PRESETS, PresetName, rulesOfPreset } from './presets.js';
+
+type Rule = {
+    create: (context: never) => Record<string, unknown>;
+    fixShape: string;
+    meta: {
+        docs: {
+            description: string;
+        };
+        messages: Record<string, string>;
+        schema: unknown[];
+        type: string;
+    };
+};
+declare const rules: Record<string, Rule>;
+type RuleName = string;
+
+declare const plugin: {
+    configs: {
+        'backend-d1': {
+            rules: Record<string, "error">;
+        };
+        'backend-medusa': {
+            rules: Record<string, "error">;
+        };
+        'backend-sagaflow-cf': {
+            rules: Record<string, "error">;
+        };
+        'backend-workflows': {
+            rules: Record<string, "error">;
+        };
+        'comment-ceiling': Preset;
+        frontend: {
+            rules: Record<string, "error">;
+        };
+        recommended: {
+            rules: Record<string, "error">;
+        };
+        'tenant-scoping': {
+            rules: Record<string, "error">;
+        };
+        tooling: {
+            rules: Record<string, "error">;
+        };
+    };
+    meta: {
+        name: string;
+        version: string;
+    };
+    rules: Record<string, Rule>;
+};
+
+export { Preset, type Rule, type RuleName, plugin as default, rules };

package/dist/index.js

@@ -1,6 +1,7 @@
 import {
-  PRESETS
-} from "./chunk-74VWOEPL.js";
+  PRESETS,
+  rulesOfPreset
+} from "./chunk-HXBZSOIU.js";
 
 // src/index.ts
 import { createRequire } from "module";
@@ -142,7 +143,7 @@ import * as path from "path";
 
 // src/rules/lib/cells-barrel.ts
 var CELLS_BARREL_FILE = /(?:^|\/)cells\/(?:index\.ts|dynamic\.tsx?)$/;
-var isCellsBarrel = (path2) => CELLS_BARREL_FILE.test(path2);
+var isCellsBarrel = (path3) => CELLS_BARREL_FILE.test(path3);
 
 // src/rules/cell-must-not-compose-cell.ts
 function cellStem(filePath) {
@@ -566,12 +567,27 @@ var literalNamedBy = (node, callee) => {
   return name?.type === "Literal" && typeof name.value === "string" ? name.value : null;
 };
 
+// src/rules/lib/options.ts
+var NOTHING = "nothing";
+var isMissing = (value) => value === void 0 || value === null || value === "" || Array.isArray(value) && value.length === 0;
+var requireOption = (rule, value, option) => {
+  if (isMissing(value)) {
+    throw new Error(
+      `biological-architecture/${rule} is enabled but its \`${option}\` option is ${NOTHING}, so it can never fire. Configure \`${option}\`, or turn the rule off \u2014 an enabled rule that cannot fire reads exactly like a rule that found nothing.`
+    );
+  }
+  return value;
+};
+
 // src/rules/document-sagas-are-generic.ts
 var escapeForRegex = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 var documentSagasAreGeneric = {
   create(context) {
-    const prefixes = context.options?.[0]?.perKindPrefixes ?? [];
-    if (prefixes.length === 0) return {};
+    const prefixes = requireOption(
+      "document-sagas-are-generic",
+      context.options?.[0]?.perKindPrefixes,
+      "perKindPrefixes"
+    );
     if (!/\/packages\/workflows\/src\//.test(context.filename.replaceAll("\\", "/"))) return {};
     const perKindPrefix = new RegExp(`^(?:${prefixes.map(escapeForRegex).join("|")})\\.`);
     return {
@@ -584,7 +600,8 @@ var documentSagasAreGeneric = {
   },
   fixShape: `A saga named for one document kind (\`invoice.issue\`, \`quote.accept\`) is the hand-written fork the
 generic base entity replaced. Mint it from the generic factory \u2014 \`documentSagas(entity, effects)\` \u2014
-and pass the kind as data. Configure the kind vocabulary through the rule's \`perKindPrefixes\` option.`,
+and pass the kind as data. Configure the kind vocabulary through the rule's \`perKindPrefixes\` option; enabled without it the
+rule refuses the run.`,
   meta: {
     docs: {
       description: "Document sagas are minted, not written: `documentSagas(entity, effects)` gives every entity that extends Document its create/save/setStatus/remove/send/convert/duplicate/share from one body. A saga literally named for one entity is a fork."
@@ -610,8 +627,13 @@ var document_sagas_are_generic_default = documentSagasAreGeneric;
 var TABLE_CALLEES = ["sqliteTable", "pgTable"];
 var documentsShareOneTable = {
   create(context) {
-    const perKindTables = new Set(context.options?.[0]?.perKindTables ?? []);
-    if (perKindTables.size === 0) return {};
+    const perKindTables = new Set(
+      requireOption(
+        "documents-share-one-table",
+        context.options?.[0]?.perKindTables,
+        "perKindTables"
+      )
+    );
     if (!/\/packages\/db\/src\/schema\//.test(context.filename.replaceAll("\\", "/"))) return {};
     return {
       CallExpression(node) {
@@ -627,8 +649,9 @@ var documentsShareOneTable = {
   fixShape: `Every document kind is a row of the one \`documents\` table with a \`kind\` column, not a table of its
 own. A \`pgTable('invoices', \u2026)\` beside a \`pgTable('quotes', \u2026)\` is the second storage the base entity
 retired: write the row, not the table. Both constructors count \u2014 \`pgTable\` and \`sqliteTable\` \u2014 since
-the dialect is a seam fact, not a reason for a kind to own storage. The forbidden table names are
-the rule's \`perKindTables\` option.`,
+the dialect is a seam fact, not a reason for a kind to own storage. The forbidden table names are the rule's
+\`perKindTables\` option; enabled without it the rule refuses the run rather than passing every
+schema silently.`,
   meta: {
     docs: {
       description: "Documents share ONE table: `documents` holds the head every kind derives and the body its kind declares. A table named for one kind of document is a second storage."
@@ -720,6 +743,109 @@ file and the export together \u2014 half the pair still fires.`,
 };
 var effect_hook_naming_default = effectHookNaming;
 
+// src/rules/layer-walls.ts
+import * as path2 from "path";
+var REQUIRE = "require";
+var isRelative = (source) => source.startsWith("./") || source.startsWith("../");
+var isExternal = (source) => !isRelative(source) && !source.startsWith("/");
+var layerWalls = {
+  create(context) {
+    const { externals = "allow", layers = [] } = context.options?.[0] ?? {};
+    requireOption("layer-walls", layers, "layers");
+    const compiled = layers.map((layer) => ({
+      mayImport: new Set(layer.mayImport ?? []),
+      name: layer.name,
+      paths: layer.paths.map((source) => new RegExp(source))
+    }));
+    const layerOf = (pathish) => compiled.find((layer) => layer.paths.some((pattern) => pattern.test(pathish)));
+    const filename = context.filename.replaceAll(/\\/g, "/");
+    const here = layerOf(filename);
+    if (here === void 0) return {};
+    const dir = path2.posix.dirname(filename);
+    const file = filename.split("/").pop() ?? filename;
+    const allowed = here.mayImport.size === 0 ? "nothing" : [...here.mayImport].toSorted().join(", ");
+    const check = (source, node) => {
+      const target = layerOf(source) ?? (isRelative(source) ? layerOf(path2.posix.normalize(path2.posix.join(dir, source))) : void 0);
+      if (target === void 0) {
+        if (externals === "deny" && isExternal(source)) {
+          context.report({ data: { file, from: here.name, source }, messageId: "external", node });
+        }
+        return;
+      }
+      if (target.name === here.name || here.mayImport.has(target.name)) return;
+      context.report({
+        data: { allowed, file, from: here.name, source, to: target.name },
+        messageId: "crossed",
+        node
+      });
+    };
+    const fromModule = (node) => {
+      if (!node.source) return;
+      if (node.importKind === "type" || node.exportKind === "type") return;
+      check(node.source.value, node);
+    };
+    return {
+      CallExpression(node) {
+        const source = literalNamedBy(node, REQUIRE);
+        if (source !== null) check(source, node);
+      },
+      ExportAllDeclaration: fromModule,
+      ExportNamedDeclaration: fromModule,
+      ImportDeclaration: fromModule,
+      ImportExpression(node) {
+        const source = node.source;
+        if (source?.type === "Literal" && typeof source.value === "string") {
+          check(source.value, node);
+        }
+      }
+    };
+  },
+  fixShape: `Layers are declared in the rule's \`layers\` option \u2014 \`{ name, paths, mayImport }\` \u2014 and a file may
+import its own layer plus the layers it names, nothing else. When this fires, MOVE something: the
+code the wrong side wanted goes down into the layer both sides may import, or the file itself
+belongs in the layer it keeps reaching for. Widening \`mayImport\` to make the diagnostic stop is
+deleting the wall, and the wall is the only reason the layers are worth naming.
+
+A relative source is resolved against the importing file before it is judged, so \`../../shell/boot\`
+is the same breach as naming the layer outright. Type-only imports and re-exports are exempt; a
+package or a \`node:\` builtin is not a wall unless \`externals\` is \`"deny"\`. A file in no declared
+layer is unconstrained, so a repo can wall one corner of its tree and leave the rest alone. Enabled
+with no \`layers\` at all the rule refuses the run: walls nobody declared are not walls held.`,
+  meta: {
+    docs: {
+      description: "Import direction between a repo's own declared layers. Each layer names the files it owns (regex sources) and the layers it may import; a file may always import its own layer. Relative sources are resolved against the importing file first. Enabled with no layers configured it refuses the run."
+    },
+    messages: {
+      crossed: '"{{file}}" is in layer "{{from}}", which may not import layer "{{to}}" \u2014 and "{{source}}" is in it. "{{from}}" may import: {{allowed}}. Move the shared code down into a layer both may import, or move this file into the layer it keeps reaching for; widening the wall deletes the only thing the layers were for.',
+      external: '"{{file}}" is in layer "{{from}}", which declares its externals denied, and "{{source}}" is outside every declared layer. Reach it through a layer that owns it, or allow externals for this configuration.'
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          externals: { enum: ["allow", "deny"], type: "string" },
+          layers: {
+            items: {
+              additionalProperties: false,
+              properties: {
+                mayImport: { items: { type: "string" }, type: "array" },
+                name: { type: "string" },
+                paths: { items: { type: "string" }, type: "array" }
+              },
+              required: ["name", "paths"],
+              type: "object"
+            },
+            type: "array"
+          }
+        },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  }
+};
+var layer_walls_default = layerWalls;
+
 // src/rules/max-comment-density.ts
 var exemptFiles2 = [
   /\/__tests__\//,
@@ -1117,7 +1243,7 @@ var escapeForRegex2 = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&")
 var noBrandNames = {
   create(context) {
     const { allowedSubstrings = [], brands = [] } = context.options?.[0] ?? {};
-    if (brands.length === 0) return {};
+    requireOption("no-brand-names", brands, "brands");
     const filename = context.filename.replaceAll(/\\/g, "/");
     if (EXEMPT_PATH.test(filename)) return {};
     const brandPattern = new RegExp(`\\b(?:${brands.map(escapeForRegex2).join("|")})\\b`, "i");
@@ -1158,12 +1284,13 @@ var noBrandNames = {
     };
   },
   fixShape: `The kit is brand-agnostic: no brand identity in its source \u2014 not in identifiers, strings, copy or
-comments. Brand names live in the demo/example layer. Configure the rule's \`brands\` list (it does
-nothing with an empty list) and put real demo-asset hosts in \`allowedSubstrings\` so a CDN URL never
-trips it.`,
+comments. Brand names live in the demo/example layer. Configure the rule's \`brands\` list and put real
+demo-asset hosts in \`allowedSubstrings\` so a CDN URL never trips it. Enabled with no \`brands\`, the
+rule refuses the run \u2014 configure it or turn it off, because a brand rule that knows no brands reads
+exactly like a clean tree.`,
   meta: {
     docs: {
-      description: "No brand identity in a brand-agnostic kit. Brand names (in code, copy, or comments) belong in the examples/demo layer, not the kit source. Configure the brand list and any allowed demo-asset substrings through the rule options; with no brands the rule does nothing."
+      description: "No brand identity in a brand-agnostic kit. Brand names (in code, copy, or comments) belong in the examples/demo layer, not the kit source. Configure the brand list and any allowed demo-asset substrings through the rule options; enabled with no brands it refuses the run."
     },
     messages: {
       brandLeak: 'Brand name "{{brand}}" leaked into the kit at line {{line}}. The kit is brand-agnostic \u2014 move brand identity to the examples/demo layer.'
@@ -1988,8 +2115,11 @@ var no_orm_outside_db_default = noOrmOutsideDb;
 // src/rules/no-raw-html-atoms.ts
 var noRawHtmlAtoms = {
   create(context) {
-    const restrictions = context.options[0];
-    if (!restrictions || restrictions.length === 0) return {};
+    const restrictions = requireOption(
+      "no-raw-html-atoms",
+      context.options[0],
+      "element\u2192atom map"
+    );
     const elementMap = /* @__PURE__ */ new Map();
     for (const r of restrictions) {
       elementMap.set(r.element, r);
@@ -2014,8 +2144,9 @@ var noRawHtmlAtoms = {
     };
   },
   fixShape: `A native element that already has an atom wrapper (\`<button>\`, \`<input>\`, \`<td>\`, \`<header>\`, \u2026) is
-written as the atom in levels 2-6. Import the atom named in the rule's options and use it. Configure
-the element\u2192atom map per repo; with no map the rule does nothing.`,
+written as the atom in levels 2-6. Import the atom named in the rule's options and use it. Configure the element\u2192atom map per repo;
+enabled without one the rule refuses the run, because a rule with no map to check reads exactly like
+a tree with no raw elements in it.`,
   meta: {
     docs: {
       description: "Forbid raw native HTML elements when an atom wrapper exists. Use the atom the options name instead."
@@ -3001,12 +3132,14 @@ can be misspelled and a second default nobody agreed to.`,
 var ssot_no_process_env_default = ssotNoProcessEnv;
 
 // src/rules/step-opens-its-own-cell.ts
+var RULE = "step-opens-its-own-cell";
 var STEP = "step";
 var readable = (pattern) => pattern.replaceAll("\\", "").replace(/\$$/, "");
 var stepOpensItsOwnCell = {
   create(context) {
-    const { engine, within, wrapper } = context.options?.[0] ?? {};
-    if (engine === void 0 || within === void 0) return {};
+    const { wrapper } = context.options?.[0] ?? {};
+    const engine = requireOption(RULE, context.options?.[0]?.engine, "engine");
+    const within = requireOption(RULE, context.options?.[0]?.within, "within");
     const filename = context.filename.replaceAll("\\", "/");
     if (!new RegExp(within).test(filename)) return {};
     if (wrapper !== void 0 && new RegExp(wrapper).test(filename)) return {};
@@ -3036,10 +3169,10 @@ var stepOpensItsOwnCell = {
 package. A durable run hibernates and retries between steps, so each step body must open the
 connection it uses rather than share one opened once per run \u2014 the wrapper does that, the engine's
 \`step\` does not. The wrapper file is the one place allowed to reach the engine. Configure
-\`engine\`, \`within\` and \`wrapper\`; unconfigured, the rule does nothing.`,
+\`engine\`, \`within\` and \`wrapper\`; enabled without \`engine\` or \`within\` the rule refuses the run.`,
   meta: {
     docs: {
-      description: "A durable saga takes its `step` from the repo's own wrapper, which opens a connection inside each step body \u2014 a durable run hibernates and retries, so a handle shared across steps is dead by the time a later step uses it. The engine module, the guarded tree and the wrapper file are options; with none the rule does nothing."
+      description: "A durable saga takes its `step` from the repo's own wrapper, which opens a connection inside each step body \u2014 a durable run hibernates and retries, so a handle shared across steps is dead by the time a later step uses it. The engine module, the guarded tree and the wrapper file are options; enabled without them it refuses the run."
     },
     messages: {
       engineStep: '"{{file}}" imports `step` from `{{engine}}`. Import it from {{wrapper}} instead: a durable run spans hibernation and retries, so the connection a step uses has to be opened inside that step rather than shared across steps. The wrapper opens it; the engine\'s `step` does not.'
@@ -3869,6 +4002,7 @@ var rules = {
   "document-sagas-are-generic": document_sagas_are_generic_default,
   "documents-share-one-table": documents_share_one_table_default,
   "effect-hook-naming": effect_hook_naming_default,
+  "layer-walls": layer_walls_default,
   "max-comment-density": max_comment_density_default,
   "molecule-atoms-only": molecule_atoms_only_default,
   "molecule-must-compose": molecule_must_compose_default,
@@ -3925,5 +4059,6 @@ var index_default = plugin;
 export {
   PRESETS,
   index_default as default,
-  rules
+  rules,
+  rulesOfPreset
 };