@geonosis/oxlint-plugin-biological-architecture 1.3.0 → 2.0.0

package/dist/index.js

@@ -1,7 +1,9 @@
 import {
   PRESETS,
+  PRESUMED_ENGINES,
+  RENAMED_TO,
   rulesOfPreset
-} from "./chunk-UVENNNFM.js";
+} from "./chunk-LTDP2733.js";
 
 // src/index.ts
 import { createRequire } from "module";
@@ -19,6 +21,15 @@ var literalNamedBy = (node, callee) => {
 // src/rules/lib/paths.ts
 var normalise = (filename) => filename.replaceAll("\\", "/");
 var fileOf = (path2) => path2.split("/").pop() || path2;
+var isDoor = (filename, door) => {
+  const path2 = normalise(filename);
+  if (path2 === door || path2.endsWith(`/${door}`)) return true;
+  try {
+    return new RegExp(door).test(path2);
+  } catch {
+    return false;
+  }
+};
 
 // src/rules/lib/imports.ts
 var REQUIRE = "require";
@@ -160,6 +171,252 @@ tier or into a plain \`lib/\` module, never the other way round.`,
 });
 var atom_no_deps_default = atomNoDeps;
 
+// src/rules/lib/nodes.ts
+var walkNode = (node, visit) => {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [node];
+  while (stack.length > 0) {
+    const at = stack.pop();
+    if (at === null || typeof at !== "object" || seen.has(at)) continue;
+    seen.add(at);
+    if (Array.isArray(at)) {
+      stack.push(...at);
+      continue;
+    }
+    const record2 = at;
+    if (typeof record2.type === "string") visit(record2);
+    for (const [key, value] of Object.entries(record2)) {
+      if (key === "parent") continue;
+      if (value !== null && typeof value === "object") stack.push(value);
+    }
+  }
+};
+var propertyNameOf = (node) => {
+  if (node.type !== "MemberExpression" || node.computed === true) return null;
+  const property = node.property;
+  return property?.type === "Identifier" && typeof property.name === "string" ? property.name : null;
+};
+var calleeNameOf = (node) => {
+  const callee = node.callee;
+  return callee?.type === "Identifier" && typeof callee.name === "string" ? callee.name : null;
+};
+
+// src/rules/lib/options.ts
+var NOTHING = "nothing";
+var isMissing = (value) => value === void 0 || value === null || value === "" || Array.isArray(value) && value.length === 0;
+var refusalHeader = (rule, option) => `biological-architecture/${rule} requires option \`${option}\`.`;
+var OptionMissing = class extends Error {
+  option;
+  rule;
+  constructor(rule, option, message) {
+    super(message);
+    this.name = "OptionMissing";
+    this.option = option;
+    this.rule = rule;
+  }
+};
+var requireOption = (rule, value, option, accepts) => {
+  if (isMissing(value)) {
+    throw new OptionMissing(
+      rule,
+      option,
+      `${refusalHeader(rule, option)} It is enabled but its \`${option}\` option is ${NOTHING}, so it can never fire. Configure \`${option}\`, or turn the rule off \u2014 an enabled rule that cannot fire reads exactly like a rule that found nothing.${accepts === void 0 ? "" : ` It accepts ${accepts}.`}`
+    );
+  }
+  return value;
+};
+var requireOptionHere = (rule, value, option, file, accepts) => {
+  if (isMissing(value)) {
+    throw new OptionMissing(
+      rule,
+      option,
+      `${refusalHeader(rule, option)} It is enabled over "${file}", which it would judge, and its \`${option}\` option is ${NOTHING}. Configure \`${option}\`, or turn the rule off for this tree.${accepts === void 0 ? "" : ` It accepts ${accepts}.`}`
+    );
+  }
+  return value;
+};
+var raisedOver = /* @__PURE__ */ new Map();
+var fileOf2 = (context) => {
+  const named = context?.filename;
+  return typeof named === "string" ? named : "";
+};
+var refusingOncePerRun = (create) => (context) => {
+  try {
+    return create(context);
+  } catch (error) {
+    if (!(error instanceof OptionMissing)) throw error;
+    const file = fileOf2(context);
+    if (file === "") throw error;
+    const key = `${error.rule}/${error.option}`;
+    const first = raisedOver.get(key);
+    if (first !== void 0 && first !== file) return {};
+    raisedOver.set(key, file);
+    throw error;
+  }
+};
+
+// src/rules/lib/probe.ts
+var bagOf = (options) => typeof options[0] === "object" && options[0] !== null && !Array.isArray(options[0]) ? options[0] : {};
+var firstOf = (configured, fallback) => {
+  const [first] = configured !== void 0 && configured.length > 0 ? configured : fallback;
+  if (first === void 0) throw new Error("no value and no default to build a probe from");
+  return first;
+};
+var LOOKAHEAD = /\(\?[!=][^)]*\)/g;
+var OPTIONAL_GROUP = /\(\?:[^)]*\)\?/g;
+var FIRST_ALTERNATIVE = /\(\?:([^)|]*)\|[^)]*\)/g;
+var GROUP = /\(\?:([^)]*)\)/g;
+var ANY_SEGMENT = /\[\^\/\]\+|\.\+|\.\*/g;
+var OPTIONAL_CLASS = /\[[^\]]*\]\?/g;
+var CLASS = /\[([^\]])[^\]]*\]/g;
+var OPTIONAL_CHAR = /[^/]\?/g;
+var QUANTIFIER = /[*+]/g;
+var LINTABLE = /\.[cm]?[jt]sx?$/;
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
+var pathMatching = (pattern, leaf) => {
+  const literal = pattern.replaceAll(LOOKAHEAD, "").replaceAll(OPTIONAL_GROUP, "").replaceAll(FIRST_ALTERNATIVE, "$1").replaceAll(GROUP, "$1").replaceAll(ANY_SEGMENT, "probe").replaceAll(OPTIONAL_CLASS, "").replaceAll(CLASS, "$1").replaceAll(String.raw`\.`, ".").replaceAll(String.raw`\/`, "/").replaceAll(OPTIONAL_CHAR, "").replaceAll("^", "").replaceAll("$", "").replaceAll(QUANTIFIER, "");
+  const here = new RegExp(pattern);
+  const candidates = [
+    literal.endsWith("/") ? `${literal}${leaf}` : literal,
+    ...EXTENSIONS.map((extension) => `${literal}${extension}`)
+  ];
+  const found = candidates.find((one) => LINTABLE.test(one) && here.test(one));
+  if (found === void 0) {
+    throw new Error(
+      `no probe path can be built from the pattern ${pattern}: nothing of the shape "${candidates[0] ?? ""}" both matches it and is a file oxlint would parse. Write the file by hand, or narrow the option to a path a probe can be placed at.`
+    );
+  }
+  return found;
+};
+
+// src/rules/boundary-time-is-primitive.ts
+var RULE = "boundary-time-is-primitive";
+var ACCEPTS = "{ types: string[] (type or namespace names), doors: string[] (a path, a specifier, or a regex over the filename; default none) }";
+var asNode = (value) => typeof value === "object" && value !== null ? value : void 0;
+var nameOf = (value) => {
+  const name = asNode(value)?.["name"];
+  return typeof name === "string" ? name : void 0;
+};
+var referencedType = (reference) => {
+  const typeName = asNode(reference["typeName"]);
+  if (typeName === void 0) return void 0;
+  if (typeName.type === "Identifier") return nameOf(typeName);
+  if (typeName.type !== "TSQualifiedName") return void 0;
+  const namespace = nameOf(typeName["left"]);
+  const member = nameOf(typeName["right"]);
+  return namespace === void 0 || member === void 0 ? void 0 : `${namespace}.${member}`;
+};
+var forbids = (types, referenced) => types.includes(referenced) || types.includes(referenced.split(".")[0] ?? referenced);
+var functionSignature = (value) => {
+  const fn = asNode(value);
+  if (fn?.type !== "ArrowFunctionExpression" && fn?.type !== "FunctionExpression") return [];
+  return [fn["params"], fn["returnType"]];
+};
+var signatureOf = (declaration) => {
+  if (declaration.type === "FunctionDeclaration" || declaration.type === "TSDeclareFunction") {
+    return [declaration["params"], declaration["returnType"]];
+  }
+  if (declaration.type === "VariableDeclaration") {
+    const declarators = Array.isArray(declaration["declarations"]) ? declaration["declarations"] : [];
+    return declarators.flatMap((one) => [
+      asNode(one)?.["id"] === void 0 ? void 0 : asNode(asNode(one)?.["id"])?.["typeAnnotation"],
+      ...functionSignature(asNode(one)?.["init"])
+    ]);
+  }
+  if (declaration.type === "TSTypeAliasDeclaration") return [declaration["typeAnnotation"]];
+  if (declaration.type === "TSInterfaceDeclaration") return [declaration["body"]];
+  if (declaration.type === "ClassDeclaration") {
+    const members = asNode(declaration["body"])?.["body"];
+    return (Array.isArray(members) ? members : []).flatMap((member) => [
+      asNode(member)?.["typeAnnotation"],
+      ...functionSignature(asNode(member)?.["value"])
+    ]);
+  }
+  return [];
+};
+var declaredName = (declaration) => {
+  const own = nameOf(declaration["id"]);
+  if (own !== void 0) return own;
+  const declarators = Array.isArray(declaration["declarations"]) ? declaration["declarations"] : [];
+  return nameOf(asNode(declarators[0])?.["id"]) ?? "the export";
+};
+var behindADoor = (filename, doors) => doors.some((door) => isDoor(filename, door));
+var boundaryTimeIsPrimitive = {
+  create(context) {
+    const types = requireOption(RULE, context.options?.[0]?.types, "types", ACCEPTS);
+    const doors = context.options?.[0]?.doors ?? [];
+    if (behindADoor(context.filename, doors)) return {};
+    const behind = doors.length === 0 ? "the module that owns the library" : doors.join(", ");
+    const report = (node) => {
+      const declaration = asNode(node.declaration);
+      if (declaration === void 0) return;
+      for (const root of signatureOf(declaration)) {
+        walkNode(root, (found) => {
+          if (found.type !== "TSTypeReference") return;
+          const referenced = referencedType(found);
+          if (referenced === void 0 || !forbids(types, referenced)) return;
+          context.report({
+            data: { doors: behind, name: declaredName(declaration), type: referenced },
+            messageId: "libraryTypeAtBoundary",
+            node: found
+          });
+        });
+      }
+    };
+    return {
+      ExportNamedDeclaration: report,
+      ExportDefaultDeclaration: report
+    };
+  },
+  fixShape: `An exported signature carries time as a PRIMITIVE: epoch milliseconds for an instant, an ISO date
+string (\`YYYY-MM-DD\`) for a business date. A \`Date\`, a \`Dayjs\` or a \`Temporal\` type in a parameter,
+a return or an exported shape hands every caller the library and its configuration, and no database
+column, wire message or contract can hold one at all \u2014 the boundary is where the conversion belongs.
+Convert at the door the \`doors\` option names; that module is the one place allowed to say the
+library's type out loud, and a display string is produced at the edge from the primitive rather than
+carried across as a formatted value. Only the signature is judged: a \`Date\` a function builds and
+keeps inside its own body is its own business.`,
+  meta: {
+    docs: {
+      description: "A date-library type in an exported signature couples every caller to the library and its configuration. Time crosses a boundary as a primitive \u2014 epoch milliseconds or an ISO date string \u2014 and the library type stays inside the module the `doors` option names. Enabled without `types` it refuses the run."
+    },
+    messages: {
+      libraryTypeAtBoundary: '"{{name}}" puts `{{type}}` in an exported signature. Time crosses a boundary as a primitive \u2014 epoch milliseconds for an instant, an ISO date string for a business date \u2014 and `{{type}}` stays behind {{doors}}.'
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          doors: { items: { type: "string" }, type: "array" },
+          types: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  },
+  /**
+   * A file that is not one of the declared doors, exporting the repo's own first forbidden type.
+   * `String(at)` rather than a second annotation: one finding is the claim, and a probe that fired
+   * twice would pass a count nobody asked for.
+   */
+  probe(options) {
+    const { doors = [], types = [] } = bagOf(options);
+    const type = firstOf(types, []);
+    const path2 = ["geonosis-probe-boundary.ts", "src/geonosis-probe-boundary.ts"].find(
+      (candidate) => !behindADoor(candidate, doors)
+    );
+    if (path2 === void 0) {
+      throw new Error(
+        `biological-architecture/${RULE}: every path a probe could be written at is itself one of the declared \`doors\` (${doors.join(", ")}), so there is nowhere left for this rule to speak.`
+      );
+    }
+    return { path: path2, source: `export const boundary = (at: ${type}): string => String(at)
+` };
+  }
+};
+var boundary_time_is_primitive_default = boundaryTimeIsPrimitive;
+
 // src/rules/cell-must-be-stateful.ts
 import * as fs from "fs";
 var STATE_SIGNATURE = /\buse[A-Z]\w*\s*\(|from\s+['"][^'"]*\/organelles(?:\/|['"])|from\s+['"][^'"]*\/stores?(?:\/|['"])|createContext\s*\(/;
@@ -590,66 +847,44 @@ configs. Everywhere else, use the dialect-free aliases the seam exports (\`Datab
 };
 var dialect_through_the_seam_default = dialectThroughTheSeam;
 
-// src/rules/lib/options.ts
-var NOTHING = "nothing";
-var isMissing = (value) => value === void 0 || value === null || value === "" || Array.isArray(value) && value.length === 0;
-var requireOption = (rule, value, option, accepts) => {
-  if (isMissing(value)) {
-    throw new Error(
-      `biological-architecture/${rule} is enabled but its \`${option}\` option is ${NOTHING}, so it can never fire. Configure \`${option}\`, or turn the rule off \u2014 an enabled rule that cannot fire reads exactly like a rule that found nothing.${accepts === void 0 ? "" : ` It accepts ${accepts}.`}`
-    );
-  }
-  return value;
-};
-
-// src/rules/lib/probe.ts
-var bagOf = (options) => typeof options[0] === "object" && options[0] !== null && !Array.isArray(options[0]) ? options[0] : {};
-var firstOf = (configured, fallback) => {
-  const [first] = configured !== void 0 && configured.length > 0 ? configured : fallback;
-  if (first === void 0) throw new Error("no value and no default to build a probe from");
-  return first;
-};
-var LOOKAHEAD = /\(\?[!=][^)]*\)/g;
-var OPTIONAL_GROUP = /\(\?:[^)]*\)\?/g;
-var FIRST_ALTERNATIVE = /\(\?:([^)|]*)\|[^)]*\)/g;
-var GROUP = /\(\?:([^)]*)\)/g;
-var ANY_SEGMENT = /\[\^\/\]\+|\.\+|\.\*/g;
-var OPTIONAL_CLASS = /\[[^\]]*\]\?/g;
-var CLASS = /\[([^\]])[^\]]*\]/g;
-var OPTIONAL_CHAR = /[^/]\?/g;
-var QUANTIFIER = /[*+]/g;
-var LINTABLE = /\.[cm]?[jt]sx?$/;
-var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
-var pathMatching = (pattern, leaf) => {
-  const literal = pattern.replaceAll(LOOKAHEAD, "").replaceAll(OPTIONAL_GROUP, "").replaceAll(FIRST_ALTERNATIVE, "$1").replaceAll(GROUP, "$1").replaceAll(ANY_SEGMENT, "probe").replaceAll(OPTIONAL_CLASS, "").replaceAll(CLASS, "$1").replaceAll(String.raw`\.`, ".").replaceAll(String.raw`\/`, "/").replaceAll(OPTIONAL_CHAR, "").replaceAll("^", "").replaceAll("$", "").replaceAll(QUANTIFIER, "");
-  const here = new RegExp(pattern);
-  const candidates = [
-    literal.endsWith("/") ? `${literal}${leaf}` : literal,
-    ...EXTENSIONS.map((extension) => `${literal}${extension}`)
-  ];
-  const found = candidates.find((one) => LINTABLE.test(one) && here.test(one));
-  if (found === void 0) {
-    throw new Error(
-      `no probe path can be built from the pattern ${pattern}: nothing of the shape "${candidates[0] ?? ""}" both matches it and is a file oxlint would parse. Write the file by hand, or narrow the option to a path a probe can be placed at.`
-    );
-  }
-  return found;
-};
-
 // src/rules/document-sagas-are-generic.ts
 var escapeForRegex = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var RULE2 = "document-sagas-are-generic";
+var DEFAULT_FACTORIES = ["saga", "createWorkflow"];
+var perEntityNameOf = (node, factories) => {
+  for (const factory of factories) {
+    const name = literalNamedBy(node, factory);
+    if (name !== null) return name;
+  }
+  return null;
+};
+var declaresAFlow = (text, factories) => factories.some((factory) => new RegExp(`\\b${escapeForRegex(factory)}\\s*\\(`).test(text));
 var documentSagasAreGeneric = {
   create(context) {
-    const prefixes = requireOption(
-      "document-sagas-are-generic",
+    const factories = requireOption(
+      RULE2,
+      context.options?.[0]?.factories ?? DEFAULT_FACTORIES,
+      "factories"
+    );
+    const filename = normalise(context.filename);
+    const named = context.options?.[0]?.within;
+    const insideTree = named === void 0 || named === "" ? void 0 : new RegExp(named).test(filename);
+    if (insideTree === false) return {};
+    if (insideTree === void 0 && !declaresAFlow(context.sourceCode?.text ?? "", factories)) {
+      return {};
+    }
+    const prefixes = requireOptionHere(
+      RULE2,
       context.options?.[0]?.perKindPrefixes,
-      "perKindPrefixes"
+      "perKindPrefixes",
+      filename
     );
-    if (!/\/packages\/workflows\/src\//.test(normalise(context.filename))) return {};
+    const within = requireOptionHere(RULE2, named, "within", filename);
+    if (!new RegExp(within).test(filename)) return {};
     const perKindPrefix = new RegExp(`^(?:${prefixes.map(escapeForRegex).join("|")})\\.`);
     return {
       CallExpression(node) {
-        const name = literalNamedBy(node, "saga");
+        const name = perEntityNameOf(node, factories);
         if (name === null || !perKindPrefix.test(name)) return;
         context.report({ data: { name }, messageId: "perKindSaga", node });
       }
@@ -657,34 +892,41 @@ var documentSagasAreGeneric = {
   },
   fixShape: `A saga named for one document kind (\`invoice.issue\`, \`quote.accept\`) is the hand-written fork the
 generic base entity replaced. Mint it from the generic factory \u2014 \`documentSagas(entity, effects)\` \u2014
-and pass the kind as data. Configure the kind vocabulary through the rule's \`perKindPrefixes\` option; enabled without it the
-rule refuses the run.`,
+and pass the kind as data. The same holds for a workflow: \`createWorkflow('invoice.create', \u2026)\` is
+the fork, \`documentWorkflows(entity)\` is the mint. A name assembled from the entity \u2014 a template
+literal \u2014 is what minting looks like and is left alone by construction. Configure the kind vocabulary
+through \`perKindPrefixes\`, the tree that holds the flows through \`within\` (a regex over the
+filename), and \`factories\` if the repo declares them under other names; enabled without
+\`perKindPrefixes\` or \`within\` the rule refuses the run.`,
   meta: {
     docs: {
-      description: "Document sagas are minted, not written: `documentSagas(entity, effects)` gives every entity that extends Document its create/save/setStatus/remove/send/convert/duplicate/share from one body. A saga literally named for one entity is a fork."
+      description: "Document sagas are minted, not written: `documentSagas(entity, effects)` gives every entity that extends Document its create/save/setStatus/remove/send/convert/duplicate/share from one body. A saga or workflow named with a LITERAL for one entity is a fork; a name assembled from the entity is the mint and is unreadable here on purpose. `factories`, `perKindPrefixes` and `within` are options."
     },
     messages: {
-      perKindSaga: '"{{name}}" is a hand-written saga for one entity. Every entity that extends Document gets its sagas from `documentSagas(entity, effects)`; put what this entity decides in its `Document.extend` definition or in its `DocumentEffects`.'
+      perKindSaga: '"{{name}}" is a hand-written flow for one entity. Every entity that extends Document gets its sagas from `documentSagas(entity, effects)` and its workflows from the same mint; put what this entity decides in its `Document.extend` definition or in its `DocumentEffects`.'
     },
     schema: [
       {
         additionalProperties: false,
         properties: {
-          perKindPrefixes: { items: { type: "string" }, type: "array" }
+          factories: { items: { type: "string" }, type: "array" },
+          perKindPrefixes: { items: { type: "string" }, type: "array" },
+          within: { type: "string" }
         },
         type: "object"
       }
     ],
     type: "problem"
   },
-  /** The guarded tree is compiled in, so only the kind vocabulary has to come from the options. */
+  /** Every half comes from the options now: the vocabulary, the tree, and the factory it is minted by. */
   probe(options) {
-    const { perKindPrefixes = [] } = bagOf(options);
+    const { perKindPrefixes = [], within = "" } = bagOf(options);
+    const factory = firstOf(bagOf(options).factories, DEFAULT_FACTORIES);
     return {
-      path: "packages/workflows/src/geonosis-probe-saga.ts",
-      source: `import { saga } from 'sagaflow-js'
+      path: pathMatching(within, "geonosis-probe-saga.ts"),
+      source: `import { ${factory} } from 'sagaflow-js'
 
-export const geonosisProbe = saga('${perKindPrefixes[0] ?? ""}.geonosis-probe', {})
+export const geonosisProbe = ${factory}('${perKindPrefixes[0] ?? ""}.geonosis-probe', {})
 `
     };
   }
@@ -752,6 +994,170 @@ export const geonosisProbe = pgTable('${perKindTables[0] ?? ""}', { id: text('id
 };
 var documents_share_one_table_default = documentsShareOneTable;
 
+// src/rules/lib/objects.ts
+var propertiesOf = (node) => {
+  const object = node;
+  if (object?.type !== "ObjectExpression") return null;
+  const properties = object.properties ?? [];
+  return properties.every((one) => one.type === "Property") ? properties : null;
+};
+var valueOf = (properties, name) => {
+  const found = properties.find((one) => {
+    const key = one.key;
+    return key?.type === "Identifier" && key.name === name || key?.type === "Literal" && key.value === name;
+  });
+  return found?.value;
+};
+var hasProperty = (properties, name) => valueOf(properties, name) !== void 0;
+var stringOf = (node) => {
+  const literal = node;
+  return literal?.type === "Literal" && typeof literal.value === "string" ? literal.value : null;
+};
+
+// src/rules/lib/steps.ts
+var DEFAULT_STEP_FACTORIES = ["createStep"];
+var stepFactoriesOf = (rule, configured) => new Set(requireOption(rule, configured ?? DEFAULT_STEP_FACTORIES, "stepFactories"));
+var isStepCall = (node, factories) => {
+  const callee = calleeNameOf(node);
+  return callee !== null && factories.has(callee);
+};
+var argumentsOf = (node) => node.arguments ?? [];
+var configOf = (node) => {
+  const [first] = argumentsOf(node);
+  if (first === void 0) return { kind: "unreadable" };
+  if (stringOf(first) !== null) return { kind: "bare" };
+  const properties = propertiesOf(first);
+  return properties === null ? { kind: "unreadable" } : { kind: "object", properties };
+};
+var stepNameOf = (node, config) => {
+  const [first] = argumentsOf(node);
+  const bare = stringOf(first);
+  if (bare !== null) return bare;
+  if (config.kind === "object") {
+    const named = config.properties.find((one) => {
+      const key = one.key;
+      return key?.type === "Identifier" && key.name === "name";
+    });
+    const literal = stringOf(named?.value);
+    if (literal !== null) return literal;
+  }
+  return calleeNameOf(node) ?? "a step";
+};
+
+// src/rules/durable-body-reads-through-steps.ts
+var RULE3 = "durable-body-reads-through-steps";
+var ACCEPTS2 = "{ ports: string[] (required), durableKey: string, durableValue: boolean | string, workflowFactories: string[], stepFactories: string[] }";
+var DEFAULT_WORKFLOW_FACTORIES = ["createWorkflow"];
+var DEFAULT_DURABLE_KEY = "execution";
+var DEFAULT_DURABLE_VALUE = "durable";
+var declaresDurable = (node, key, value) => argumentsOf(node).some((argument) => {
+  const properties = propertiesOf(argument);
+  if (properties === null) return false;
+  const declared = valueOf(properties, key);
+  return declared?.type === "Literal" && declared.value === value;
+});
+var portReachedBy = (node, ports) => {
+  const direct = calleeNameOf(node);
+  if (direct !== null) return ports.has(direct) ? direct : null;
+  let at = node.callee ?? {};
+  while (at.type === "MemberExpression") {
+    const named = propertyNameOf(at);
+    if (named !== null && ports.has(named)) return named;
+    at = at.object;
+  }
+  return at.type === "Identifier" && ports.has(at.name) ? at.name : null;
+};
+var insideAStep = (node, factories) => {
+  const memoised = /* @__PURE__ */ new Set();
+  walkNode(node, (inner) => {
+    if (isStepCall(inner, factories)) walkNode(inner, (one) => memoised.add(one));
+  });
+  return memoised;
+};
+var durableBodyReadsThroughSteps = {
+  create(context) {
+    const bag = context.options?.[0] ?? {};
+    const ports = new Set(requireOption(RULE3, bag.ports, "ports", ACCEPTS2));
+    const steps = stepFactoriesOf(RULE3, bag.stepFactories);
+    const workflows = new Set(
+      requireOption(RULE3, bag.workflowFactories ?? DEFAULT_WORKFLOW_FACTORIES, "workflowFactories")
+    );
+    const durableKey = requireOption(RULE3, bag.durableKey ?? DEFAULT_DURABLE_KEY, "durableKey");
+    const durableValue = bag.durableValue ?? DEFAULT_DURABLE_VALUE;
+    return {
+      CallExpression(node) {
+        const factory = calleeNameOf(node);
+        if (factory === null || !workflows.has(factory)) return;
+        if (!declaresDurable(node, durableKey, durableValue)) return;
+        const [name] = argumentsOf(node);
+        const workflow = stringOf(name) ?? factory;
+        const memoised = insideAStep(node, steps);
+        walkNode(node, (inner) => {
+          if (inner.type !== "CallExpression" || memoised.has(inner)) return;
+          const port = portReachedBy(inner, ports);
+          if (port === null) return;
+          context.report({ data: { port, workflow }, messageId: "freeRead", node: inner });
+        });
+      }
+    };
+  },
+  fixShape: `In a DURABLE workflow body every value that gates a branch or feeds a step comes from the workflow
+input or from a step result. A port read written straight into the body \u2014 \`store.read(id)\` \u2014 is
+inline-only: the platform memoises steps by name and does not journal reads, so on a replay the read
+sees what the first invocation wrote, the branch flips, and the run unwinds work it had completed.
+Move the decision into a step (\`const doc = await ensureDraft(id)\`) and it is memoised with the run.
+Name this repo's ports in \`ports\`; enabled without them the rule refuses the run. What it can SEE is a
+call on a name \`ports\` lists: a read moved one function out \u2014 \`readStatus(id)\`, with the port inside
+it \u2014 is invisible here, and no lint rule that reads one file can follow it. Name the helper in
+\`ports\` too when a body reaches the outside world through one; a helper that is really a step is
+better made one. \`durableKey\` /
+\`durableValue\` say how a workflow declares itself durable, and \`workflowFactories\` /
+\`stepFactories\` how it declares its parts.`,
+  meta: {
+    docs: {
+      description: "A durable workflow body reads through its steps. A platform memoises steps by name and journals no reads, so a free port read that gates a branch takes the other branch on a replay and reverses half a completed run. The same read inside a step is memoised with it; an inline body is invoked once and is exempt. `ports` is required."
+    },
+    messages: {
+      freeRead: 'This durable body ("{{workflow}}") reads through `{{port}}` outside a step. A replay is answered from the run record for steps and re-runs everything else, so this read returns what the first invocation wrote and the branch it gates flips \u2014 reversing work the run had already completed. Make the decision a step, or take the value from the workflow input.'
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          durableKey: { type: "string" },
+          durableValue: { type: ["boolean", "string"] },
+          ports: { items: { type: "string" }, type: "array" },
+          stepFactories: { items: { type: "string" }, type: "array" },
+          workflowFactories: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  },
+  /**
+   * A durable body with one free read and no step at all: a step would be the remedy, and a probe
+   * that carried one would be claiming a finding from the shape the rule accepts.
+   */
+  probe(options) {
+    const bag = bagOf(options);
+    const factory = firstOf(bag.workflowFactories, DEFAULT_WORKFLOW_FACTORIES);
+    const port = firstOf(bag.ports, []);
+    const key = bag.durableKey ?? DEFAULT_DURABLE_KEY;
+    const value = bag.durableValue ?? DEFAULT_DURABLE_VALUE;
+    return {
+      path: "geonosis-probe-durable-body.ts",
+      source: `export const geonosisProbe = ${factory}(
+  'geonosis-probe',
+  async (input) => ${port}.read(input),
+  { ${key}: ${typeof value === "string" ? `'${value}'` : value} },
+)
+`
+    };
+  }
+};
+var durable_body_reads_through_steps_default = durableBodyReadsThroughSteps;
+
 // src/rules/effect-hook-naming.ts
 var HOOK_FILE_PATTERN = /(?:features\/[^/]+\/)?organelles\/.*\.ts$/;
 var effectHookNaming = {
@@ -823,22 +1229,22 @@ file and the export together \u2014 half the pair still fires.`,
 var effect_hook_naming_default = effectHookNaming;
 
 // src/rules/emit-declares-attempts.ts
-var RULE = "emit-declares-attempts";
+var RULE4 = "emit-declares-attempts";
 var DEFAULT_EMITTERS = ["emitEventStep"];
 var OPTIONS = "options";
 var ATTEMPTS = "attempts";
 var EVENT_NAME = "eventName";
 var NO_RETRY = 1;
 var objectOf = (node) => node?.type === "ObjectExpression" ? node : null;
-var propertiesOf = (object) => {
+var propertiesOf2 = (object) => {
   const properties = object.properties ?? [];
   return properties.every((one) => one.type === "Property") ? properties : null;
 };
-var valueOf = (properties, name) => properties.find((one) => one.key?.type === "Identifier" && one.key.name === name)?.value;
+var valueOf2 = (properties, name) => properties.find((one) => one.key?.type === "Identifier" && one.key.name === name)?.value;
 var emitDeclaresAttempts = {
   create(context) {
     const emitters = new Set(
-      requireOption(RULE, context.options?.[0]?.emitters ?? DEFAULT_EMITTERS, "emitters")
+      requireOption(RULE4, context.options?.[0]?.emitters ?? DEFAULT_EMITTERS, "emitters")
     );
     const budgetHelpers = new Set(context.options?.[0]?.budgetHelpers ?? []);
     return {
@@ -848,11 +1254,11 @@ var emitDeclaresAttempts = {
         if (!emitters.has(emitter)) return;
         const payload = objectOf(node.arguments?.[0]);
         if (payload === null) return;
-        const properties = propertiesOf(payload);
+        const properties = propertiesOf2(payload);
         if (properties === null) return;
-        const named = valueOf(properties, EVENT_NAME);
+        const named = valueOf2(properties, EVENT_NAME);
         const site = named?.type === "Literal" && typeof named.value === "string" ? named.value : emitter;
-        const options = valueOf(properties, OPTIONS);
+        const options = valueOf2(properties, OPTIONS);
         if (options !== void 0 && objectOf(options) === null) {
           if (budgetHelpers.size === 0) {
             context.report({ data: { emitter, site }, messageId: "undeclaredHelpers", node });
@@ -875,9 +1281,9 @@ var emitDeclaresAttempts = {
           });
           return;
         }
-        const bag = options === void 0 ? [] : propertiesOf(objectOf(options));
+        const bag = options === void 0 ? [] : propertiesOf2(objectOf(options));
         if (bag === null) return;
-        const attempts = valueOf(bag, ATTEMPTS);
+        const attempts = valueOf2(bag, ATTEMPTS);
         if (attempts === void 0) {
           context.report({ data: { emitter, site }, messageId: "noBudget", node });
           return;
@@ -1095,14 +1501,39 @@ var font_roles_only_default = fontRolesOnly;
 
 // src/rules/layer-walls.ts
 var isExternal = (source) => !source.startsWith("./") && !source.startsWith("../") && !source.startsWith("/");
+var PROBE_TARGET = "geonosis-probe-target.ts";
+var PROBE_WALL = "geonosis-probe-wall.ts";
+var inverts = (pattern, leaf) => {
+  try {
+    pathMatching(pattern, leaf);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var placeIn = (paths, tried) => {
+  for (const pattern of paths) {
+    let candidate;
+    try {
+      candidate = pathMatching(pattern, PROBE_WALL);
+    } catch {
+      tried.push(pattern);
+      continue;
+    }
+    if (new RegExp(pattern).test(`/repo-root/${candidate}`)) return candidate;
+    tried.push(pattern);
+  }
+  return void 0;
+};
 var layerWalls = {
   create(context) {
-    const { externals = "allow", layers = [] } = context.options?.[0] ?? {};
+    const { externals = "allow", layers = [], typeOnly = "skip" } = context.options?.[0] ?? {};
     requireOption("layer-walls", layers, "layers");
     const compiled = layers.map((layer) => ({
       mayImport: new Set(layer.mayImport ?? []),
       name: layer.name,
-      paths: layer.paths.map((source) => new RegExp(source))
+      paths: layer.paths.map((source) => new RegExp(source)),
+      typeOnly: layer.typeOnly ?? typeOnly
     }));
     const layerOf = (pathish) => compiled.find((layer) => layer.paths.some((pattern) => pattern.test(pathish)));
     const filename = normalise(context.filename);
@@ -1125,7 +1556,7 @@ var layerWalls = {
         node
       });
     };
-    return onImportSource(check);
+    return onImportSource(check, { typeOnly: here.typeOnly === "count" ? "visit" : "skip" });
   },
   fixShape: `Layers are declared in the rule's \`layers\` option \u2014 \`{ name, paths, mayImport }\` \u2014 and a file may
 import its own layer plus the layers it names, nothing else. When this fires, MOVE something: the
@@ -1134,10 +1565,13 @@ belongs in the layer it keeps reaching for. Widening \`mayImport\` to make the d
 deleting the wall, and the wall is the only reason the layers are worth naming.
 
 A relative source is resolved against the importing file before it is judged, so \`../../shell/boot\`
-is the same breach as naming the layer outright. Type-only imports and re-exports are exempt; a
-package or a \`node:\` builtin is not a wall unless \`externals\` is \`"deny"\`. A file in no declared
-layer is unconstrained, so a repo can wall one corner of its tree and leave the rest alone. Enabled
-with no \`layers\` at all the rule refuses the run: walls nobody declared are not walls held.`,
+is the same breach as naming the layer outright. Type-only imports and re-exports are exempt unless
+\`typeOnly\` is \`"count"\` \u2014 rule-wide, or on the one layer whose wall is about which side may KNOW
+about which, since \`import type\` reaches that far exactly as a value does, while a layer borrowing a
+type to keep a package out of its runtime graph is the reason the default is \`"skip"\`. A package or a \`node:\` builtin
+is not a wall unless \`externals\` is \`"deny"\`. A file in no declared layer is unconstrained, so a
+repo can wall one corner of its tree and leave the rest alone. Enabled with no \`layers\` at all the
+rule refuses the run: walls nobody declared are not walls held.`,
   meta: {
     docs: {
       description: "Import direction between a repo's own declared layers. Each layer names the files it owns (regex sources) and the layers it may import; a file may always import its own layer. Relative sources are resolved against the importing file first. Enabled with no layers configured it refuses the run."
@@ -1157,13 +1591,15 @@ with no \`layers\` at all the rule refuses the run: walls nobody declared are no
               properties: {
                 mayImport: { items: { type: "string" }, type: "array" },
                 name: { type: "string" },
-                paths: { items: { type: "string" }, type: "array" }
+                paths: { items: { type: "string" }, type: "array" },
+                typeOnly: { enum: ["count", "skip"], type: "string" }
               },
               required: ["name", "paths"],
               type: "object"
             },
             type: "array"
-          }
+          },
+          typeOnly: { enum: ["count", "skip"], type: "string" }
         },
         type: "object"
       }
@@ -1181,21 +1617,27 @@ with no \`layers\` at all the rule refuses the run: walls nobody declared are no
    */
   probe(options) {
     const { layers = [] } = bagOf(options);
+    const tried = [];
     for (const here of layers) {
       const mayImport = new Set(here.mayImport ?? []);
       const target = layers.find((other) => other.name !== here.name && !mayImport.has(other.name));
-      const [herePath] = here.paths;
-      const [targetPath] = target?.paths ?? [];
-      if (target === void 0 || herePath === void 0 || targetPath === void 0) continue;
-      const source = pathMatching(targetPath, "geonosis-probe-target.ts");
+      const path2 = placeIn(here.paths, tried);
+      const targetPath = target?.paths.find((one) => inverts(one, PROBE_TARGET));
+      if (target === void 0 || path2 === void 0 || targetPath === void 0) continue;
+      const source = pathMatching(targetPath, PROBE_TARGET);
       return {
-        path: pathMatching(herePath, "geonosis-probe-wall.ts"),
+        path: path2,
         source: `import { geonosisProbe } from '${source}'
 
 export const geonosisProbeWall = geonosisProbe
 `
       };
     }
+    if (tried.length > 0) {
+      throw new Error(
+        `biological-architecture/layer-walls: no layer here names a place a probe file could be put \u2014 tried ${tried.join(", ")}. Each of those matches an import specifier and can never match a filename, so a probe built from one lands outside the layer it is meant to be inside. Give the layer a directory pattern as well (#119).`
+      );
+    }
     throw new Error(
       "biological-architecture/layer-walls: every declared layer may import every other, so no single file can cross a wall \u2014 there is no wall here to probe."
     );
@@ -1377,36 +1819,6 @@ primitives count as composition; a pure \`export \u2026 from\` shim is not a mol
 };
 var molecule_must_compose_default = moleculeMustCompose;
 
-// src/rules/lib/nodes.ts
-var walkNode = (node, visit) => {
-  const seen = /* @__PURE__ */ new Set();
-  const stack = [node];
-  while (stack.length > 0) {
-    const at = stack.pop();
-    if (at === null || typeof at !== "object" || seen.has(at)) continue;
-    seen.add(at);
-    if (Array.isArray(at)) {
-      stack.push(...at);
-      continue;
-    }
-    const record2 = at;
-    if (typeof record2.type === "string") visit(record2);
-    for (const [key, value] of Object.entries(record2)) {
-      if (key === "parent") continue;
-      if (value !== null && typeof value === "object") stack.push(value);
-    }
-  }
-};
-var propertyNameOf = (node) => {
-  if (node.type !== "MemberExpression" || node.computed === true) return null;
-  const property = node.property;
-  return property?.type === "Identifier" && typeof property.name === "string" ? property.name : null;
-};
-var calleeNameOf = (node) => {
-  const callee = node.callee;
-  return callee?.type === "Identifier" && typeof callee.name === "string" ? callee.name : null;
-};
-
 // src/rules/lib/mutations.ts
 var DEFAULT_MUTATION_PREFIXES = [
   "create",
@@ -1427,64 +1839,19 @@ var writesWith = (prefixes) => (node) => {
 };
 var writeNameOf = (node) => propertyNameOf(node.callee ?? {}) ?? "a service write";
 
-// src/rules/lib/objects.ts
-var propertiesOf2 = (node) => {
-  const object = node;
-  if (object?.type !== "ObjectExpression") return null;
-  const properties = object.properties ?? [];
-  return properties.every((one) => one.type === "Property") ? properties : null;
-};
-var valueOf2 = (properties, name) => {
-  const found = properties.find((one) => {
-    const key = one.key;
-    return key?.type === "Identifier" && key.name === name || key?.type === "Literal" && key.value === name;
-  });
-  return found?.value;
-};
-var hasProperty = (properties, name) => valueOf2(properties, name) !== void 0;
-var stringOf = (node) => {
-  const literal = node;
-  return literal?.type === "Literal" && typeof literal.value === "string" ? literal.value : null;
-};
-
-// src/rules/lib/steps.ts
-var DEFAULT_STEP_FACTORIES = ["createStep"];
-var stepFactoriesOf = (rule, configured) => new Set(requireOption(rule, configured ?? DEFAULT_STEP_FACTORIES, "stepFactories"));
-var isStepCall = (node, factories) => {
-  const callee = calleeNameOf(node);
-  return callee !== null && factories.has(callee);
-};
-var argumentsOf = (node) => node.arguments ?? [];
-var configOf = (node) => {
-  const [first] = argumentsOf(node);
-  if (first === void 0) return { kind: "unreadable" };
-  if (stringOf(first) !== null) return { kind: "bare" };
-  const properties = propertiesOf2(first);
-  return properties === null ? { kind: "unreadable" } : { kind: "object", properties };
-};
-var stepNameOf = (node, config) => {
-  const [first] = argumentsOf(node);
-  const bare = stringOf(first);
-  if (bare !== null) return bare;
-  if (config.kind === "object") {
-    const named = config.properties.find((one) => {
-      const key = one.key;
-      return key?.type === "Identifier" && key.name === "name";
-    });
-    const literal = stringOf(named?.value);
-    if (literal !== null) return literal;
-  }
-  return calleeNameOf(node) ?? "a step";
-};
-
 // src/rules/mutating-step-declares-retry.ts
-var RULE2 = "mutating-step-declares-retry";
-var MAX_RETRIES = "maxRetries";
+var RULE5 = "mutating-step-declares-retry";
+var DEFAULT_RETRY_KEY = "maxRetries";
 var NO_RETRY2 = 0;
 var mutatingStepDeclaresRetry = {
   create(context) {
-    const factories = stepFactoriesOf(RULE2, context.options?.[0]?.stepFactories);
-    const isWrite = writesWith(mutationPrefixesOf(RULE2, context.options?.[0]?.mutationPrefixes));
+    const factories = stepFactoriesOf(RULE5, context.options?.[0]?.stepFactories);
+    const isWrite = writesWith(mutationPrefixesOf(RULE5, context.options?.[0]?.mutationPrefixes));
+    const retryKey = requireOption(
+      RULE5,
+      context.options?.[0]?.retryKey ?? DEFAULT_RETRY_KEY,
+      "retryKey"
+    );
     return {
       CallExpression(node) {
         if (!isStepCall(node, factories)) return;
@@ -1499,18 +1866,18 @@ var mutatingStepDeclaresRetry = {
         const step = stepNameOf(node, config);
         if (config.kind === "unreadable") return;
         if (config.kind === "bare") {
-          context.report({ data: { step }, messageId: "noConfig", node });
+          context.report({ data: { key: retryKey, step }, messageId: "noConfig", node });
           return;
         }
-        const budget = valueOf2(config.properties, MAX_RETRIES);
+        const budget = valueOf(config.properties, retryKey);
         if (budget === void 0) {
-          context.report({ data: { step }, messageId: "noRetry", node });
+          context.report({ data: { key: retryKey, step }, messageId: "noRetry", node });
           return;
         }
         if (budget.type !== "Literal" || typeof budget.value !== "number") return;
         if (budget.value > NO_RETRY2) return;
         context.report({
-          data: { budget: String(budget.value), step },
+          data: { budget: String(budget.value), key: retryKey, step },
           messageId: "zeroRetries",
           node
         });
@@ -1518,27 +1885,29 @@ var mutatingStepDeclaresRetry = {
     };
   },
   fixShape: `A step whose invoke body WRITES declares a retry class in its config object:
-\`createStep({ name: 'place-order', ...RETRY_DB }, invoke, compensate)\`. \`maxRetries\` defaults to 0,
-so a step named with a bare string cannot have one \u2014 take the object form and put the budget in it,
-from the repo's shared retry constants rather than as a number at the call site. A budget the rule
-cannot evaluate (a constant, a spread) passes: it says nothing rather than pushing the number back
-inline. Read-only and compute steps are exempt \u2014 there is nothing to revert. Configure
-\`stepFactories\` if the repo wraps \`createStep\`, and \`mutationPrefixes\` if its writes are named
-otherwise.`,
+\`createStep({ name: 'place-order', ...RETRY_DB }, invoke, compensate)\`. A retry budget defaults to
+none, so a step named with a bare string cannot have one \u2014 take the object form and put the budget in
+it, from the repo's shared retry constants rather than as a number at the call site. A budget the
+rule cannot evaluate (a constant, a spread, a nested \`{ limit, backoff }\`) passes: it says nothing
+rather than pushing the number back inline. Read-only and compute steps are exempt \u2014 there is nothing
+to revert. Configure \`retryKey\` to the key this engine writes the budget under (Medusa's
+\`maxRetries\`, the org engine's \`retry\`), \`stepFactories\` if the repo wraps \`createStep\`, and
+\`mutationPrefixes\` if its writes are named otherwise.`,
   meta: {
     docs: {
-      description: "A mutating step declares a retry class. Medusa's `maxRetries` defaults to 0, so a transient failure reverts real state a retry would have absorbed. Read-only steps are exempt; a non-literal budget passes. `stepFactories` and `mutationPrefixes` are options."
+      description: "A mutating step declares a retry class. A budget left unsaid defaults to zero retries, so a transient failure reverts real state a retry would have absorbed. Read-only steps are exempt; a non-literal budget passes. `retryKey`, `stepFactories` and `mutationPrefixes` are options."
     },
     messages: {
-      noConfig: 'Step "{{step}}" writes but is named with a bare string, so it carries no retry class \u2014 and `maxRetries` defaults to 0, which means a transient failure reverts real state. Take the object form and give it a retry class from the shared constants.',
-      noRetry: 'Mutating step "{{step}}" declares no retry class. `maxRetries` defaults to 0, so the first transient failure reverts every write this step made. Add the repo\'s retry constant to its config.',
-      zeroRetries: 'Mutating step "{{step}}" declares `maxRetries: {{budget}}`, which is the default spelled out \u2014 no retries at all. Take the budget from the shared retry constants instead.'
+      noConfig: 'Step "{{step}}" writes but is named with a bare string, so it carries no retry class \u2014 and `{{key}}` defaults to 0, which means a transient failure reverts real state. Take the object form and give it a retry class from the shared constants.',
+      noRetry: 'Mutating step "{{step}}" declares no `{{key}}`. Without one the budget is zero, so the first transient failure reverts every write this step made. Add the repo\'s retry constant to its config.',
+      zeroRetries: 'Mutating step "{{step}}" declares `{{key}}: {{budget}}`, which is the default spelled out \u2014 no retries at all. Take the budget from the shared retry constants instead.'
     },
     schema: [
       {
         additionalProperties: false,
         properties: {
           mutationPrefixes: { items: { type: "string" }, type: "array" },
+          retryKey: { type: "string" },
           stepFactories: { items: { type: "string" }, type: "array" }
         },
         type: "object"
@@ -1550,13 +1919,13 @@ otherwise.`,
 var mutating_step_declares_retry_default = mutatingStepDeclaresRetry;
 
 // src/rules/named-when-block.ts
-var RULE3 = "named-when-block";
+var RULE6 = "named-when-block";
 var DEFAULT_BLOCKS = ["when"];
 var NAMED = 3;
 var namedWhenBlock = {
   create(context) {
     const blocks = new Set(
-      requireOption(RULE3, context.options?.[0]?.blocks ?? DEFAULT_BLOCKS, "blocks")
+      requireOption(RULE6, context.options?.[0]?.blocks ?? DEFAULT_BLOCKS, "blocks")
     );
     return {
       CallExpression(node) {
@@ -2322,26 +2691,26 @@ A component returns UI; a hook returns state.`,
 var no_hook_in_component_disguise_default = noHookInComponentDisguise;
 
 // src/rules/no-index-count-as-exact.ts
-var RULE4 = "no-index-count-as-exact";
+var RULE7 = "no-index-count-as-exact";
 var DEFAULT_ESTIMATE_FIELDS = ["estimate_count", "count_estimate"];
 var DEFAULT_LABEL_KEY = "count_is_estimate";
 var noIndexCountAsExact = {
   create(context) {
     const fields = new Set(
       requireOption(
-        RULE4,
+        RULE7,
         context.options?.[0]?.estimateFields ?? DEFAULT_ESTIMATE_FIELDS,
         "estimateFields"
       )
     );
     const label = requireOption(
-      RULE4,
+      RULE7,
       context.options?.[0]?.labelKey ?? DEFAULT_LABEL_KEY,
       "labelKey"
     );
     return {
       ObjectExpression(node) {
-        const properties = propertiesOf2(node);
+        const properties = propertiesOf(node);
         if (properties === null || hasProperty(properties, label)) return;
         let field = null;
         for (const property of properties) {
@@ -2591,20 +2960,20 @@ logic in \`lib/\`.`,
 var no_invalid_feature_folders_default = noInvalidFeatureFolders;
 
 // src/rules/no-loader-side-effect-in-index-file.ts
-var RULE5 = "no-loader-side-effect-in-index-file";
+var RULE8 = "no-loader-side-effect-in-index-file";
 var DEFAULT_DIRECTORIES = ["(?:^|/)subscribers/", "(?:^|/)jobs/"];
 var DEFAULT_RESOURCE_FACTORIES = ["createWorkflow", "createStep", "createHook"];
 var INDEX = /(?:^|\/)index\.[cm]?[jt]sx?$/;
 var noLoaderSideEffectInIndexFile = {
   create(context) {
     const directories = requireOption(
-      RULE5,
+      RULE8,
       context.options?.[0]?.directories ?? DEFAULT_DIRECTORIES,
       "directories"
     ).map((source) => new RegExp(source));
     const factories = new Set(
       requireOption(
-        RULE5,
+        RULE8,
         context.options?.[0]?.resourceFactories ?? DEFAULT_RESOURCE_FACTORIES,
         "resourceFactories"
       )
@@ -2767,7 +3136,7 @@ the same component. Thin preset wrappers over one imported component do not coun
 var no_logic_in_component_files_default = noLogicInComponentFiles;
 
 // src/rules/no-mock-db-in-integration.ts
-var RULE6 = "no-mock-db-in-integration";
+var RULE9 = "no-mock-db-in-integration";
 var BUN_MOCK = "mock.module";
 var MOCK_CALLS = /* @__PURE__ */ new Set(["jest.mock", BUN_MOCK, "vi.mock"]);
 var calleeOf = (node) => {
@@ -2785,8 +3154,8 @@ var inDirectory = (filename, directory) => {
 var noMockDbInIntegration = {
   create(context) {
     const options = context.options?.[0] ?? {};
-    const dirs = requireOption(RULE6, options.integrationDirs, "integrationDirs");
-    const modules = requireOption(RULE6, options.dbModules, "dbModules");
+    const dirs = requireOption(RULE9, options.integrationDirs, "integrationDirs");
+    const modules = requireOption(RULE9, options.dbModules, "dbModules");
     const mockNames = new Set(options.mockNames ?? []);
     const filename = normalise(context.filename);
     const spans = /* @__PURE__ */ new Set();
@@ -2887,14 +3256,14 @@ below the seam, and a caller that names it has crossed it.`,
 var no_orm_outside_db_default = noOrmOutsideDb;
 
 // src/rules/no-raw-html-atoms.ts
-var RULE7 = "no-raw-html-atoms";
+var RULE10 = "no-raw-html-atoms";
 var WHERE_RAW_HTML_IS_THE_POINT = "atoms";
 var noRawHtmlAtoms = {
   create(context) {
-    const restrictions = requireOption(RULE7, context.options[0], "element\u2192atom map");
+    const restrictions = requireOption(RULE10, context.options[0], "element\u2192atom map");
     const scope = context.options[1]?.scope;
     const filename = context.filename;
-    const inScope = scope === void 0 ? !inTier(filename, WHERE_RAW_HTML_IS_THE_POINT) : requireTiers(RULE7, scope).some((tier) => inTier(filename, tier));
+    const inScope = scope === void 0 ? !inTier(filename, WHERE_RAW_HTML_IS_THE_POINT) : requireTiers(RULE10, scope).some((tier) => inTier(filename, tier));
     if (!inScope) return {};
     const elementMap = /* @__PURE__ */ new Map();
     for (const r of restrictions) {
@@ -3420,8 +3789,8 @@ var no_type_definitions_in_components_default = noTypeDefinitionsInComponents;
 
 // src/rules/no-unregistered-plugin-dir.ts
 import { readFileSync as readFileSync3 } from "fs";
-var RULE8 = "no-unregistered-plugin-dir";
-var ACCEPTS = "{ roots: string[], registry: string | string[], manifests: string[] }";
+var RULE11 = "no-unregistered-plugin-dir";
+var ACCEPTS3 = "{ roots: string[], registry: string | string[], manifests: string[] }";
 var trimSlashes = (path2) => path2.replace(/^\/+/, "").replace(/\/+$/, "");
 var withoutComments = (source) => source.replaceAll(/\/\*[\s\S]*?\*\//g, " ").replaceAll(/\/\/[^\n]*/g, " ");
 var literalsOf = (source) => [...withoutComments(source).matchAll(/['"`]([^'"`\n]+)['"`]/g)].map((match) => match[1] ?? "");
@@ -3438,10 +3807,10 @@ var rootedAt = (filename, root) => {
 var noUnregisteredPluginDir = {
   create(context) {
     const options = context.options?.[0] ?? {};
-    const roots = requireOption(RULE8, options.roots, "roots", ACCEPTS).map(trimSlashes);
-    const declared = requireOption(RULE8, options.registry, "registry", ACCEPTS);
+    const roots = requireOption(RULE11, options.roots, "roots", ACCEPTS3).map(trimSlashes);
+    const declared = requireOption(RULE11, options.registry, "registry", ACCEPTS3);
     const registries = (typeof declared === "string" ? [declared] : declared).map(trimSlashes);
-    const manifests = new Set(requireOption(RULE8, options.manifests, "manifests", ACCEPTS));
+    const manifests = new Set(requireOption(RULE11, options.manifests, "manifests", ACCEPTS3));
     const filename = normalise(context.filename);
     return {
       Program(node) {
@@ -3695,16 +4064,16 @@ source. The CELL is the only level where several sources meet; it derives and pa
 var organelle_single_source_default = organelleSingleSource;
 
 // src/rules/plugin-route-namespaced.ts
-var RULE9 = "plugin-route-namespaced";
+var RULE12 = "plugin-route-namespaced";
 var DEFAULT_SCOPES = ["store", "admin"];
 var ROUTE_FILE = /(?:^|\/)api\/(.+\/)?route\.[cm]?[jt]sx?$/;
 var NAMESPACED_FROM = 2;
 var readPackages = (configured) => {
-  const rules2 = requireOption(RULE9, configured, "packages");
+  const rules2 = requireOption(RULE12, configured, "packages");
   for (const rule of rules2) {
     if (typeof rule.under !== "string" || rule.under === "") {
       throw new Error(
-        `biological-architecture/${RULE9}: every \`packages\` entry needs \`under\` \u2014 the directory whose children are packages. Without it the rule cannot tell which files belong to a plugin.`
+        `biological-architecture/${RULE12}: every \`packages\` entry needs \`under\` \u2014 the directory whose children are packages. Without it the rule cannot tell which files belong to a plugin.`
       );
     }
   }
@@ -3731,7 +4100,7 @@ var pluginRouteNamespaced = {
   create(context) {
     const rules2 = readPackages(context.options?.[0]?.packages);
     const scopes = new Set(
-      requireOption(RULE9, context.options?.[0]?.scopes ?? DEFAULT_SCOPES, "scopes")
+      requireOption(RULE12, context.options?.[0]?.scopes ?? DEFAULT_SCOPES, "scopes")
     );
     const path2 = normalise(context.filename);
     const route = routePathOf(path2);
@@ -3918,7 +4287,7 @@ decides what an event MEANS and throws when it cannot.`,
 var queue_loop_is_the_library_default = queueLoopIsTheLibrary;
 
 // src/rules/route-no-inline-mutation.ts
-var RULE10 = "route-no-inline-mutation";
+var RULE13 = "route-no-inline-mutation";
 var DEFAULT_PATHS = [String.raw`(?:^|/)api/.*/route\.[cm]?[jt]sx?$`];
 var DEFAULT_INLINE_MUTATION_OK = "arch:inline-mutation-ok";
 var commentsOf2 = (sourceCode) => sourceCode?.getAllComments?.() ?? sourceCode?.ast?.comments ?? [];
@@ -3962,15 +4331,15 @@ var annotated = (found, comments, marker) => {
 };
 var routeNoInlineMutation = {
   create(context) {
-    const paths = requireOption(RULE10, context.options?.[0]?.paths ?? DEFAULT_PATHS, "paths").map(
+    const paths = requireOption(RULE13, context.options?.[0]?.paths ?? DEFAULT_PATHS, "paths").map(
       (source) => new RegExp(source)
     );
     const marker = requireOption(
-      RULE10,
+      RULE13,
       context.options?.[0]?.inlineMutationOk ?? DEFAULT_INLINE_MUTATION_OK,
       "inlineMutationOk"
     );
-    const isWrite = writesWith(mutationPrefixesOf(RULE10, context.options?.[0]?.mutationPrefixes));
+    const isWrite = writesWith(mutationPrefixesOf(RULE13, context.options?.[0]?.mutationPrefixes));
     const filename = normalise(context.filename);
     if (!paths.some((pattern) => pattern.test(filename))) return {};
     return {
@@ -4040,7 +4409,7 @@ var route_no_inline_mutation_default = routeNoInlineMutation;
 
 // src/rules/router-schema-parity.ts
 import { existsSync as existsSync2 } from "fs";
-var RULE11 = "router-schema-parity";
+var RULE14 = "router-schema-parity";
 var EXTENSIONS2 = [".ts", ".tsx"];
 var trimSlashes2 = (path2) => path2.replace(/^\/+/, "").replace(/\/+$/, "");
 var baseOf = (file) => file.replace(/\.[cm]?[jt]sx?$/, "");
@@ -4058,8 +4427,8 @@ var directlyUnder = (filename, directory) => {
 var routerSchemaParity = {
   create(context) {
     const options = context.options?.[0] ?? {};
-    const routers = trimSlashes2(requireOption(RULE11, options.routers, "routers"));
-    const schemas = trimSlashes2(requireOption(RULE11, options.schemas, "schemas"));
+    const routers = trimSlashes2(requireOption(RULE14, options.routers, "routers"));
+    const schemas = trimSlashes2(requireOption(RULE14, options.schemas, "schemas"));
     const suffix = options.suffix ?? "";
     const ignored = new Set(options.ignore ?? []);
     const mounts = options.mounts ?? {};
@@ -4131,7 +4500,7 @@ repo-root-relative, because in one consumer they live in different packages.`,
 var router_schema_parity_default = routerSchemaParity;
 
 // src/rules/service-name-not-reserved.ts
-var RULE12 = "service-name-not-reserved";
+var RULE15 = "service-name-not-reserved";
 var DEFAULT_MODULE_FACTORIES = ["Module"];
 var MODULES_2_19 = [
   "analytics",
@@ -4171,13 +4540,13 @@ var serviceNameNotReserved = {
   create(context) {
     const factories = new Set(
       requireOption(
-        RULE12,
+        RULE15,
         context.options?.[0]?.moduleFactories ?? DEFAULT_MODULE_FACTORIES,
         "moduleFactories"
       )
     );
     const reserved = new Set(
-      requireOption(RULE12, context.options?.[0]?.reserved ?? MODULES_2_19, "reserved")
+      requireOption(RULE15, context.options?.[0]?.reserved ?? MODULES_2_19, "reserved")
     );
     const constants = /* @__PURE__ */ new Map();
     const pending = [];
@@ -4369,7 +4738,7 @@ var isFactShaped = (literal) => {
   if (/^[a-z][a-z0-9]*(\.[a-z][a-z0-9]*)+$/.test(literal)) return true;
   return literal.length >= 16 && !/^[a-z0-9:\-[\]/.%#!]+$/.test(literal);
 };
-var nameOf = (node) => {
+var nameOf2 = (node) => {
   if (node === void 0) return void 0;
   if (typeof node === "string") return node;
   if (node.type === "Identifier" || node.type === "JSXIdentifier") return node.name;
@@ -4380,12 +4749,12 @@ var isSpelledAsStyleOrModule = (node) => {
   let current = node.parent;
   let child = node;
   while (current && typeof current.type === "string" && current.type !== "Program") {
-    if (current.type === "JSXAttribute") return styleAttributes.has(nameOf(current.name) ?? "");
+    if (current.type === "JSXAttribute") return styleAttributes.has(nameOf2(current.name) ?? "");
     if (current.type === "Property" && current.key === child) return true;
-    if (current.type === "Property" && styleAttributes.has(nameOf(current.key) ?? "")) return true;
+    if (current.type === "Property" && styleAttributes.has(nameOf2(current.key) ?? "")) return true;
     if (current.type === "CallExpression") {
       const callee = current.callee;
-      const calleeName = callee?.type === "MemberExpression" ? nameOf(callee.property) : nameOf(callee);
+      const calleeName = callee?.type === "MemberExpression" ? nameOf2(callee.property) : nameOf2(callee);
       if (styleCallees.has(calleeName ?? "") || formFieldCallees.has(calleeName ?? "")) return true;
       const firstArgument = current.arguments?.[0];
       if (declarationCallees.has(calleeName ?? "") && firstArgument === child) return true;
@@ -4473,12 +4842,12 @@ can be misspelled and a second default nobody agreed to.`,
 var ssot_no_process_env_default = ssotNoProcessEnv;
 
 // src/rules/step-declares-compensation-or-none.ts
-var RULE13 = "step-declares-compensation-or-none";
+var RULE16 = "step-declares-compensation-or-none";
 var NO_COMPENSATION = "noCompensation";
 var WITH_COMPENSATION = 3;
 var stepDeclaresCompensationOrNone = {
   create(context) {
-    const factories = stepFactoriesOf(RULE13, context.options?.[0]?.stepFactories);
+    const factories = stepFactoriesOf(RULE16, context.options?.[0]?.stepFactories);
     return {
       CallExpression(node) {
         if (!isStepCall(node, factories)) return;
@@ -4486,7 +4855,7 @@ var stepDeclaresCompensationOrNone = {
         const config = configOf(node);
         if (config.kind === "unreadable") return;
         if (config.kind === "object") {
-          const flag = valueOf2(config.properties, NO_COMPENSATION);
+          const flag = valueOf(config.properties, NO_COMPENSATION);
           if (flag?.type === "Literal" && flag.value === true) return;
         }
         context.report({ data: { step: stepNameOf(node, config) }, messageId: "undeclared", node });
@@ -4522,20 +4891,52 @@ variable \u2014 passes, since the flag may be in the base. Configure \`stepFacto
 var step_declares_compensation_or_none_default = stepDeclaresCompensationOrNone;
 
 // src/rules/step-opens-its-own-cell.ts
-var RULE14 = "step-opens-its-own-cell";
+var RULE17 = "step-opens-its-own-cell";
 var STEP = "step";
+var ACCEPTS4 = "{ within: string (required), hosts: string[], scopeKey: string, engine: string, wrapper: string }";
+var DEFAULT_HOSTS = ["createRuntime", "entrypointFor"];
+var DEFAULT_SCOPE_KEY = "perStep";
 var readable = (pattern) => pattern.replaceAll("\\", "").replace(/\$$/, "");
+var isHostCall = (node, hosts) => {
+  const callee = calleeNameOf(node);
+  return callee !== null && hosts.has(callee);
+};
+var configOf2 = (node) => propertiesOf((node.arguments ?? [])[0]);
+var opaque = (call, hosts) => {
+  let unreadable = false;
+  walkNode(call, (inner) => {
+    if (inner.type === "CallExpression" && isHostCall(inner, hosts) && configOf2(inner) === null) {
+      unreadable = true;
+    }
+  });
+  return unreadable;
+};
+var namesKey = (node, key) => {
+  if (node.type !== "Property") return false;
+  const named = node.key;
+  return named?.type === "Identifier" && named.name === key || named?.type === "Literal" && named.value === key;
+};
+var declaresScope = (call, scopeKey) => {
+  let declared = false;
+  walkNode(call, (inner) => {
+    if (namesKey(inner, scopeKey)) declared = true;
+  });
+  return declared;
+};
 var stepOpensItsOwnCell = {
   create(context) {
-    const { wrapper } = context.options?.[0] ?? {};
-    const engine = requireOption(RULE14, context.options?.[0]?.engine, "engine");
-    const within = requireOption(RULE14, context.options?.[0]?.within, "within");
+    const bag = context.options?.[0] ?? {};
+    const within = requireOption(RULE17, bag.within, "within", ACCEPTS4);
+    const hosts = new Set(requireOption(RULE17, bag.hosts ?? DEFAULT_HOSTS, "hosts", ACCEPTS4));
+    const scopeKey = requireOption(RULE17, bag.scopeKey ?? DEFAULT_SCOPE_KEY, "scopeKey", ACCEPTS4);
+    const { engine, wrapper } = bag;
     const filename = normalise(context.filename);
     if (!new RegExp(within).test(filename)) return {};
-    if (wrapper !== void 0 && new RegExp(wrapper).test(filename)) return {};
     const file = filename.split("/").pop() ?? filename;
+    const isWrapper = wrapper !== void 0 && new RegExp(wrapper).test(filename);
     return {
       ImportDeclaration(node) {
+        if (engine === void 0 || isWrapper) return;
         if (node.importKind === "type") return;
         if (node.source.value !== engine) return;
         for (const specifier of node.specifiers ?? []) {
@@ -4552,26 +4953,58 @@ var stepOpensItsOwnCell = {
             node
           });
         }
+      },
+      Program(node) {
+        const found = [];
+        walkNode(node, (one) => {
+          if (one.type === "CallExpression" && isHostCall(one, hosts)) found.push(one);
+        });
+        const nested = /* @__PURE__ */ new Set();
+        for (const call of found) {
+          walkNode(call, (inner) => {
+            if (inner !== call && inner.type === "CallExpression" && isHostCall(inner, hosts)) {
+              nested.add(inner);
+            }
+          });
+        }
+        for (const call of found) {
+          if (nested.has(call)) continue;
+          if (opaque(call, hosts)) continue;
+          if (declaresScope(call, scopeKey)) continue;
+          context.report({
+            data: { file, host: calleeNameOf(call) ?? "a durable host", scopeKey },
+            messageId: "unscopedHost",
+            node: call
+          });
+        }
       }
     };
   },
-  fixShape: `Inside the guarded workflow tree, import \`step\` from the repo's own wrapper, never from the engine
-package. A durable run hibernates and retries between steps, so each step body must open the
-connection it uses rather than share one opened once per run \u2014 the wrapper does that, the engine's
-\`step\` does not. The wrapper file is the one place allowed to reach the engine. Configure
-\`engine\`, \`within\` and \`wrapper\`; enabled without \`engine\` or \`within\` the rule refuses the run.`,
+  fixShape: `Inside the guarded workflow tree, a durable host declares the scope its steps run in:
+\`createRuntime({ journal, scope: { perStep: () => withConnection(env) } })\`, and the adapter's entry
+(\`entrypointFor\`) declares it in the runtime it builds per run. A durable instance hibernates and
+retries between steps, so the connection a step uses has to be opened inside that step rather than
+shared across the run \u2014 \`perStep\` is asked for a scope per unit of work, which is what makes that
+possible. A host whose config cannot be read whole (a spread, a variable) is not judged.
+On \`sagaflow-js\` there is no such seam and the older shape stays reachable: set \`engine\` and
+\`wrapper\`, and import \`step\` from the repo's own wrapper rather than from the engine package.
+Configure \`within\`; \`hosts\`, \`scopeKey\`, \`engine\` and \`wrapper\` have defaults or are off. Enabled
+without \`within\` the rule refuses the run.`,
   meta: {
     docs: {
-      description: "A durable saga takes its `step` from the repo's own wrapper, which opens a connection inside each step body \u2014 a durable run hibernates and retries, so a handle shared across steps is dead by the time a later step uses it. The engine module, the guarded tree and the wrapper file are options; enabled without them it refuses the run."
+      description: "A durable host declares the scope its steps run in \u2014 `scope.perStep` on the runtime it builds \u2014 because a durable run hibernates and retries, so a handle opened once per run is dead by the time a later step uses it. A repo on an engine with no such seam names its `engine` and `wrapper` instead, and a saga importing the engine's `step` around that wrapper is the finding. The guarded tree is required; enabled without it the rule refuses the run."
     },
     messages: {
-      engineStep: '"{{file}}" imports `step` from `{{engine}}`. Import it from {{wrapper}} instead: a durable run spans hibernation and retries, so the connection a step uses has to be opened inside that step rather than shared across steps. The wrapper opens it; the engine\'s `step` does not.'
+      engineStep: '"{{file}}" imports `step` from `{{engine}}`. Import it from {{wrapper}} instead: a durable run spans hibernation and retries, so the connection a step uses has to be opened inside that step rather than shared across steps. The wrapper opens it; the engine\'s `step` does not.',
+      unscopedHost: '"{{file}}" builds a durable host with `{{host}}` and declares no `{{scopeKey}}`. A durable instance hibernates between steps and replays them on retry, so a handle opened once per run is closed by the time the second step reaches for it \u2014 and every step here would share it. Declare `scope: {{ {{scopeKey}}: () => \u2026 }}` on the runtime this host builds, so each step body and each undo opens the one it uses.'
     },
     schema: [
       {
         additionalProperties: false,
         properties: {
           engine: { type: "string" },
+          hosts: { items: { type: "string" }, type: "array" },
+          scopeKey: { type: "string" },
           within: { type: "string" },
           wrapper: { type: "string" }
         },
@@ -4581,18 +5014,23 @@ connection it uses rather than share one opened once per run \u2014 the wrapper
     type: "problem"
   },
   /**
-   * during.day guards `packages/workflows/src/` and the shipped corpus guards
-   * `corpus/workflows/`, so its fixture lands outside the tree this repo asked about and the rule
-   * reads as firing nowhere in a package that enforces it on every file. This is the same fixture
-   * moved to where the option points — and out of the `wrapper`, which is the one file allowed
-   * to reach the engine.
+   * The probe is built for the spelling the OPTIONS select. A repo that named an `engine` is on the
+   * older one and is exercised by a saga reaching past its wrapper — which is also why the path has
+   * to land inside `within` and outside `wrapper`, the one file allowed to make that import.
    */
   probe(options) {
-    const { engine = "", within = "", wrapper } = bagOf(options);
+    const { engine, hosts, within = "", wrapper } = bagOf(options);
+    if (engine === void 0) {
+      return {
+        path: pathMatching(within, "geonosis-probe-durable-host.ts"),
+        source: `export const geonosisProbe = ${firstOf(hosts, DEFAULT_HOSTS)}({ journal: {} })
+`
+      };
+    }
     const path2 = pathMatching(within, "geonosis-probe-engine-step.ts");
     if (wrapper !== void 0 && new RegExp(wrapper).test(path2)) {
       throw new Error(
-        `biological-architecture/${RULE14}: the probe path "${path2}" is also the \`wrapper\`, which is the one file allowed to reach \`${engine}\` \u2014 no single file inside \`within\` can both land where the rule looks and be somewhere it speaks.`
+        `biological-architecture/${RULE17}: the probe path "${path2}" is also the \`wrapper\`, which is the one file allowed to reach \`${engine}\` \u2014 no single file inside \`within\` can both land where the rule looks and be somewhere it speaks.`
       );
     }
     return {
@@ -4661,13 +5099,126 @@ belongs on the admin surface.`,
 };
 var store_route_scopes_tenant_data_default = storeRouteScopesTenantData;
 
+// src/rules/subpath-over-barrel.ts
+var RULE18 = "subpath-over-barrel";
+var ACCEPTS5 = "{ packages: { name: string, subpaths: { [subpath: string]: string[] } }[] (required) }";
+var homesOf = (declared) => {
+  const subpaths = requireOption(RULE18, Object.keys(declared.subpaths ?? {}), "subpaths", ACCEPTS5);
+  return new Map(
+    subpaths.flatMap(
+      (subpath) => (declared.subpaths?.[subpath] ?? []).map((name) => [name, subpath])
+    )
+  );
+};
+var importedNamesOf = (node) => {
+  if (node.importKind === "type") return [];
+  const specifiers = node.specifiers ?? [];
+  if (specifiers.length === 0) return null;
+  const names2 = [];
+  for (const specifier of specifiers) {
+    if (specifier.type !== "ImportSpecifier") return null;
+    if (specifier.importKind === "type") continue;
+    const imported = specifier.imported;
+    if (imported?.type !== "Identifier" || typeof imported.name !== "string") return null;
+    names2.push(imported.name);
+  }
+  return names2;
+};
+var subpathOverBarrel = {
+  create(context) {
+    const declared = requireOption(RULE18, context.options?.[0]?.packages, "packages", ACCEPTS5);
+    const homes = new Map(
+      declared.map((one) => [requireOption(RULE18, one.name, "name", ACCEPTS5), homesOf(one)])
+    );
+    return {
+      ImportDeclaration(node) {
+        const source = node.source?.value;
+        if (typeof source !== "string") return;
+        const home = homes.get(source);
+        if (home === void 0) return;
+        const names2 = importedNamesOf(node);
+        if (names2 === null || names2.length === 0) return;
+        const reached = new Set(names2.map((name) => home.get(name)));
+        if (reached.size !== 1 || reached.has(void 0)) return;
+        const [only] = [...reached];
+        context.report({
+          data: { package: source, subpath: `${source}/${only ?? ""}` },
+          messageId: "rootBarrel",
+          node
+        });
+      }
+    };
+  },
+  fixShape: `Import from the SUBPATH that owns the names, not from the package root:
+\`import { Document } from '@repo/domains/document'\`. A subpath exists because its dependency
+footprint differs from the root's, so the root entry is the union of them all and a file that names
+it to reach one pays for every other \u2014 at install, at bundle and at worker start, with nothing to
+show for it. An import whose names span two subpaths is what the root is for and is left alone, as
+is a type-only import, which erases before any of that happens. Declare the map in \`packages\`
+(\`{ name, subpaths: { document: ['Document', \u2026] } }\`); enabled without it the rule refuses the run.`,
+  meta: {
+    docs: {
+      description: "A root import whose names all live under one of the package's declared subpaths names the subpath instead. The root entry is the union of every subpath's module graph, so reaching one through it pays for all of them. Names spanning two subpaths, and type-only imports, are exempt. The package\u2192subpath map is a required option."
+    },
+    messages: {
+      rootBarrel: "Every name imported here from `{{package}}` lives under `{{subpath}}`. Import from the subpath: the root entry re-exports all of them, so this file takes the union of every subpath\u2019s module graph to reach one of them."
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          packages: {
+            items: {
+              additionalProperties: false,
+              properties: {
+                name: { type: "string" },
+                subpaths: {
+                  additionalProperties: {
+                    items: { type: "string" },
+                    type: "array"
+                  },
+                  type: "object"
+                }
+              },
+              type: "object"
+            },
+            type: "array"
+          }
+        },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  },
+  /** One import of one declared name, at the root — the smallest shape that must fire. */
+  probe(options) {
+    const [first] = bagOf(options).packages ?? [];
+    const name = first?.name ?? "";
+    const [subpath] = Object.keys(first?.subpaths ?? {});
+    const [exported] = first?.subpaths?.[subpath ?? ""] ?? [];
+    if (exported === void 0) {
+      throw new Error(
+        `biological-architecture/${RULE18}: the configured packages declare no subpath with a name in it, so there is nothing a probe could import from the root.`
+      );
+    }
+    return {
+      path: "geonosis-probe-subpath.ts",
+      source: `import { ${exported} } from '${name}'
+
+export const geonosisProbe = ${exported}
+`
+    };
+  }
+};
+var subpath_over_barrel_default = subpathOverBarrel;
+
 // src/rules/subscriber-declares-id.ts
-var RULE15 = "subscriber-declares-id";
+var RULE19 = "subscriber-declares-id";
 var DEFAULT_PATHS2 = ["(?:^|/)subscribers/"];
 var CONFIG = "config";
 var CONTEXT = "context";
 var SUBSCRIBER_ID = "subscriberId";
-var declaredName = (node) => {
+var declaredName2 = (node) => {
   const declaration = node.declaration;
   if (declaration?.type !== "VariableDeclaration") return null;
   const [first] = declaration.declarations ?? [];
@@ -4676,7 +5227,7 @@ var declaredName = (node) => {
 };
 var subscriberDeclaresId = {
   create(context) {
-    const paths = requireOption(RULE15, context.options?.[0]?.paths ?? DEFAULT_PATHS2, "paths").map(
+    const paths = requireOption(RULE19, context.options?.[0]?.paths ?? DEFAULT_PATHS2, "paths").map(
       (source) => new RegExp(source)
     );
     const filename = normalise(context.filename);
@@ -4684,13 +5235,13 @@ var subscriberDeclaresId = {
     const file = filename.split("/").slice(-2).join("/") || fileOf(filename);
     return {
       ExportNamedDeclaration(node) {
-        if (declaredName(node) !== CONFIG) return;
+        if (declaredName2(node) !== CONFIG) return;
         const [first] = node.declaration.declarations ?? [];
-        const properties = propertiesOf2(first?.init);
+        const properties = propertiesOf(first?.init);
         if (properties === null) return;
-        const inner = propertiesOf2(valueOf2(properties, CONTEXT));
-        if (inner !== null && valueOf2(inner, SUBSCRIBER_ID) !== void 0) return;
-        if (valueOf2(properties, CONTEXT) !== void 0 && inner === null) return;
+        const inner = propertiesOf(valueOf(properties, CONTEXT));
+        if (inner !== null && valueOf(inner, SUBSCRIBER_ID) !== void 0) return;
+        if (valueOf(properties, CONTEXT) !== void 0 && inner === null) return;
         context.report({ data: { file }, messageId: "inferred", node });
       }
     };
@@ -4799,8 +5350,10 @@ table to \`schema/control/\`.`,
 var tenant_tables_carry_org_id_default = tenantTablesCarryOrgId;
 
 // src/rules/time-through-the-door.ts
-var timeDoor = /\/packages\/utils\/src\/time\.ts$/;
-var exemptFiles3 = [timeDoor, /\/__tests__\//, /\/scripts\//, /\/testing\//, /\/seeds\//];
+var RULE20 = "time-through-the-door";
+var ACCEPTS6 = "{ door: string (a regex over the filename), exempt: string[] (regex sources, default the test paths: __tests__/, .test., .spec.), libraries: string[] (default ['dayjs']) }";
+var DEFAULT_LIBRARIES = ["dayjs"];
+var DEFAULT_EXEMPT = ["__tests__/", String.raw`\.test\.`, String.raw`\.spec\.`];
 var dateStatics = /* @__PURE__ */ new Set(["parse", "UTC"]);
 var dateInstanceMethods = /* @__PURE__ */ new Set([
   "toISOString",
@@ -4822,19 +5375,37 @@ var memberName = (callee) => ({
   object: callee.object?.type === "Identifier" ? callee.object.name : void 0,
   property: callee.property?.type === "Identifier" ? callee.property.name : void 0
 });
+var readable2 = (pattern) => pattern.replaceAll("\\", "").replace(/\$$/, "");
 var timeThroughTheDoor = {
   create(context) {
-    const normalized = normalise(context.filename);
-    if (exemptFiles3.some((file) => file.test(normalized))) return {};
+    const door = requireOption(RULE20, context.options?.[0]?.door, "door", ACCEPTS6);
+    const exempt = context.options?.[0]?.exempt ?? DEFAULT_EXEMPT;
+    const libraries = requireOption(
+      RULE20,
+      context.options?.[0]?.libraries ?? DEFAULT_LIBRARIES,
+      "libraries",
+      ACCEPTS6
+    );
+    const filename = normalise(context.filename);
+    if (isDoor(filename, door)) return {};
+    if (exempt.some((pattern) => new RegExp(pattern).test(filename))) return {};
+    const where = readable2(door);
     return {
       ImportDeclaration(node) {
-        if (node.source.value === "dayjs" || node.source.value.startsWith("dayjs/")) {
-          context.report({ messageId: "dayjsOutsideDoor", node });
+        const library = libraries.find(
+          (one) => node.source.value === one || node.source.value.startsWith(`${one}/`)
+        );
+        if (library !== void 0) {
+          context.report({ data: { door: where, library }, messageId: "dayjsOutsideDoor", node });
         }
       },
       NewExpression(node) {
         if (node.callee.type === "Identifier" && node.callee.name === "Date") {
-          context.report({ messageId: "outsideTimeDoor", node, data: { what: "new Date" } });
+          context.report({
+            data: { door: where, what: "new Date" },
+            messageId: "outsideTimeDoor",
+            node
+          });
         }
       },
       CallExpression(node) {
@@ -4844,27 +5415,76 @@ var timeThroughTheDoor = {
         if (object === "Date" && property === "now") return;
         if (object === "Date" && dateStatics.has(property) || dateInstanceMethods.has(property)) {
           context.report({
+            data: { door: where, what: `${object ?? "\u2026"}.${property}` },
             messageId: "outsideTimeDoor",
-            node,
-            data: { what: `${object ?? "\u2026"}.${property}` }
+            node
           });
         }
       }
     };
   },
-  fixShape: `\`new Date(...)\`, \`Date.parse\`, \`toISOString\`, \`toLocaleDateString\`, \`dayjs\` \u2014 every time operation
-goes through the one time module, which owns the plugins, the zone and the formats. Import
-\`isoDate\` / \`today\` / \`addDays\` from it. \`Date.now()\` is allowed anywhere.`,
+  fixShape: `\`new Date(...)\`, \`Date.parse\`, \`toISOString\`, \`toLocaleDateString\` and the repo's date
+library \u2014 every time operation goes through the one time module the \`door\` option names, which owns
+the plugins, the zone and the formats. Import \`isoDate\` / \`today\` / \`addDays\` from it, or add the
+operation there. A second module that imports the library is a second configured library: plugin
+state is global, so the two disagree the moment one of them extends something the other did not.
+Name the library in \`libraries\` (default \`['dayjs']\`) \u2014 a repo on date-fns or luxon says so and
+gets the whole rule rather than its raw-\`Date\` half.
+
+Three kinds of time, never mixed. An INSTANT is epoch milliseconds. A BUSINESS DATE is an ISO date
+string, \`YYYY-MM-DD\`, parsed strictly in UTC \u2014 a calendar day is not an instant and rendering one as
+one moves it by a timezone. DISPLAY is a rendering: a formatter belongs at the edge, in the
+component or the response, never in a query, a saga or a stored value.
+
+The clock is injected, never ambient. Take \`nowMs: number\` as a parameter and let the composition
+root pass \`Date.now()\` in \u2014 \`Date.now()\` is the one call allowed anywhere, and a function that reads
+it internally cannot be tested at a chosen instant.`,
   meta: {
     docs: {
-      description: "Time is handled by dayjs behind the time module (`utils/time`); nothing else constructs, parses or formats a Date. Date.now() is the one call allowed everywhere."
+      description: "Time is handled behind one module \u2014 the `door` option names it \u2014 and nothing else constructs, parses or formats a Date or imports dayjs. Date.now() is the one call allowed everywhere. Enabled without a `door` it refuses the run."
     },
     messages: {
-      outsideTimeDoor: "{{what}} outside the time door. Import the operation from the time module (`utils/time`) (isoDate, today, addDays, addMonths, \u2026) or add it there.",
-      dayjsOutsideDoor: "dayjs is imported outside the time module (`utils/time`). The door owns the plugins and formats; import from it."
+      outsideTimeDoor: "{{what}} outside the time door. Import the operation from `{{door}}` (isoDate, today, addDays, addMonths, \u2026) or add it there.",
+      dayjsOutsideDoor: "`{{library}}` is imported outside the time door. `{{door}}` owns the plugins, the zone and the formats; import from it \u2014 a second configured instance of the library diverges from the first with no symptom."
     },
-    schema: [],
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          door: { type: "string" },
+          exempt: { items: { type: "string" }, type: "array" },
+          libraries: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
     type: "problem"
+  },
+  /**
+   * A file OUTSIDE the door, which is where this rule speaks — the inverse of every other probe
+   * here, whose options say where to look rather than where not to.
+   *
+   * The candidates are tried against the repo's own `door` and `exempt` rather than assumed clear:
+   * a repo whose door pattern is broad enough to swallow all of them has configured a rule that
+   * can never fire, and a probe that reported a plant it had not checked would call that green.
+   */
+  probe(options) {
+    const { door = "", exempt = [], libraries = DEFAULT_LIBRARIES } = bagOf(options);
+    const outside = ["geonosis-probe-clock.ts", "src/geonosis-probe-clock.ts"].find(
+      (path2) => !new RegExp(door).test(path2) && !exempt.some((pattern) => new RegExp(pattern).test(path2))
+    );
+    if (outside === void 0) {
+      throw new Error(
+        `biological-architecture/${RULE20}: every path a probe could be written at is inside the \`door\` (${door}) or one of its \`exempt\` patterns, so there is nowhere left for this rule to speak.`
+      );
+    }
+    return {
+      path: outside,
+      source: `import theClock from '${libraries[0] ?? DEFAULT_LIBRARIES[0]}'
+
+export const clock = (): unknown => theClock
+`
+    };
   }
 };
 var time_through_the_door_default = timeThroughTheDoor;
@@ -5263,6 +5883,83 @@ the tissue arrange that cell.`,
 });
 var tissue_no_stores_default = tissueNoStores;
 
+// src/rules/todo-names-its-plan.ts
+var ID_DEFAULT = String.raw`\d{3,}`;
+var commentsOf3 = (sourceCode) => sourceCode?.getAllComments?.() ?? sourceCode?.ast?.comments ?? [];
+var escapeForRegex3 = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var todoNamesItsPlan = {
+  create(context) {
+    const { id = ID_DEFAULT, markers = [] } = context.options?.[0] ?? {};
+    requireOption("todo-names-its-plan", markers, "markers", "{ markers: string[], id?: string }");
+    const marker = new RegExp(
+      `\\b(${markers.map(escapeForRegex3).join("|")})\\b(?:\\(([^)]*)\\))?`,
+      "g"
+    );
+    const names2 = new RegExp(`^${id}$`);
+    return {
+      Program(node) {
+        for (const comment of commentsOf3(context.sourceCode)) {
+          for (const found of comment.value.matchAll(marker)) {
+            const cited = found[2];
+            if (cited !== void 0 && names2.test(cited)) continue;
+            context.report({
+              data: {
+                line: String(comment.loc.start.line),
+                marker: found[1] ?? ""
+              },
+              loc: comment.loc,
+              messageId: "unplannedTodo",
+              node
+            });
+          }
+        }
+      }
+    };
+  },
+  fixShape: `A debt marker names the plan that owns it: \`// TODO(025): the cache lands with the batteries floor\`.
+Write the plan number of the plan whose acceptance criterion this work belongs to \u2014 \`geonosis-ledger
+plan new <slug>\` makes one, and \`plan ready\` is what reasons over them. A marker with no plan is a
+promise with no owner and no date, and nothing downstream can schedule it. If the work is not worth a
+plan, delete the marker and the code it apologises for. Configure \`markers\` with the words this repo
+treats as debt (TODO, FIXME, HACK\u2026) and \`id\` with the shape of a plan id if it is not \`NNN\`;
+enabled with no \`markers\` the rule refuses the run, because a marker rule that knows no markers
+reads exactly like a clean tree.`,
+  meta: {
+    docs: {
+      description: "A debt marker (TODO, FIXME, \u2026) must name the plan that owns it \u2014 `TODO(025):`. The marker words are an option and the plan-id shape is an option; enabled with no markers the rule refuses the run. Comments come from the parser, so the word in a string literal is not a finding."
+    },
+    messages: {
+      unplannedTodo: "{{marker}} at line {{line}} names no plan. Write `{{marker}}(NNN):` with the plan that owns this work, or delete it \u2014 a marker outside the plan graph is work nobody scheduled."
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          id: { type: "string" },
+          markers: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  },
+  /**
+   * The repo's OWN first marker, in a comment, citing nothing. It has to be the configured word:
+   * a probe hardcoding one spelling would report the rule as unreachable in every repo that spells
+   * its debt with another, which is the whole class of finding probes exist to end.
+   */
+  probe(options) {
+    const { markers } = bagOf(options);
+    return {
+      path: "geonosis-probe-todo.ts",
+      source: `// ${firstOf(markers, ["TODO"])}: a probe that names no plan
+export const geonosisProbeTodo = 1
+`
+    };
+  }
+};
+var todo_names_its_plan_default = todoNamesItsPlan;
+
 // src/rules/lib/colors.ts
 var FUNCTIONS = [
   "color",
@@ -5602,9 +6299,9 @@ var isNamedOnly = (value) => /^[a-z]+$/i.test(value.trim());
 var tokens_only_colors_default = tokensOnlyColors;
 
 // src/rules/unique-query-step-name.ts
-var RULE16 = "unique-query-step-name";
-var DEFAULT_QUERY_STEP_CALLS = ["useQueryGraphStep", "useRemoteQueryStep"];
-var DEFAULT_WORKFLOW_FACTORIES = ["createWorkflow"];
+var RULE21 = "unique-query-step-name";
+var ACCEPTS7 = "{ queryStepCalls: string[] (required), workflowFactories: string[] }";
+var DEFAULT_WORKFLOW_FACTORIES2 = ["createWorkflow"];
 var CONFIG2 = "config";
 var NAME = "name";
 var COLLIDES_FROM = 2;
@@ -5623,9 +6320,9 @@ var chainedName = (node, steps) => {
   const inner = callee.object;
   if (inner === void 0 || !isCallOf(inner, steps)) return null;
   const [first] = node.arguments ?? [];
-  const properties = propertiesOf2(first);
+  const properties = propertiesOf(first);
   if (properties === null) return [inner, UNREADABLE];
-  const value = valueOf2(properties, NAME);
+  const value = valueOf(properties, NAME);
   if (value === void 0) return [inner, ABSENT];
   const literal = stringOf(value);
   return [inner, literal === null ? UNREADABLE : { kind: "named", value: literal }];
@@ -5646,17 +6343,13 @@ var uniqueQueryStepName = {
   create(context) {
     const factories = new Set(
       requireOption(
-        RULE16,
-        context.options?.[0]?.workflowFactories ?? DEFAULT_WORKFLOW_FACTORIES,
+        RULE21,
+        context.options?.[0]?.workflowFactories ?? DEFAULT_WORKFLOW_FACTORIES2,
         "workflowFactories"
       )
     );
     const calls = new Set(
-      requireOption(
-        RULE16,
-        context.options?.[0]?.queryStepCalls ?? DEFAULT_QUERY_STEP_CALLS,
-        "queryStepCalls"
-      )
+      requireOption(RULE21, context.options?.[0]?.queryStepCalls, "queryStepCalls", ACCEPTS7)
     );
     return {
       CallExpression(node) {
@@ -5690,11 +6383,12 @@ var uniqueQueryStepName = {
 \`useQueryGraphStep({ entity: 'order' }).config({ name: 'get-orders' })\`. Without it the step-handler
 map last-wins and one of the two reads silently never happens. A single un-named step is fine \u2014 it
 collides with nothing. A name held in a constant passes, since the rule cannot evaluate it.
-Configure \`workflowFactories\` if the repo wraps \`createWorkflow\`, and \`queryStepCalls\` if it
-wraps the query steps.`,
+Name the repo's query steps in \`queryStepCalls\` \u2014 enabled without it the rule refuses the run,
+because the collision it reports is one framework's step-handler map and not every engine's \u2014 and
+\`workflowFactories\` if the repo wraps \`createWorkflow\`.`,
   meta: {
     docs: {
-      description: "Every query step in a workflow body that holds more than one carries a unique `.config({ name })`. Medusa's step-handler map last-wins, so two un-named or same-named steps silently collide. A single un-named step is exempt. `workflowFactories` and `queryStepCalls` are options."
+      description: "Every query step in a workflow body that holds more than one carries a unique `.config({ name })`. Medusa's step-handler map last-wins, so two un-named or same-named steps silently collide. A single un-named step is exempt. `workflowFactories` is an option; enabled without `queryStepCalls` it refuses the run."
     },
     messages: {
       duplicate: "Two query steps in this workflow both answer to `.config({ name: '{{name}}' })`. The step-handler map last-wins, so one of the two reads silently never happens \u2014 give each its own name.",
@@ -5719,8 +6413,8 @@ wraps the query steps.`,
    */
   probe(options) {
     const bag = bagOf(options);
-    const factory = firstOf(bag.workflowFactories, DEFAULT_WORKFLOW_FACTORIES);
-    const step = firstOf(bag.queryStepCalls, DEFAULT_QUERY_STEP_CALLS);
+    const factory = firstOf(bag.workflowFactories, DEFAULT_WORKFLOW_FACTORIES2);
+    const step = firstOf(bag.queryStepCalls, []);
     return {
       path: "geonosis-probe-query-steps.ts",
       source: `export const geonosisProbe = ${factory}('geonosis-probe', () => {
@@ -5736,7 +6430,8 @@ wraps the query steps.`,
 var unique_query_step_name_default = uniqueQueryStepName;
 
 // src/rules/worker-handles-are-scoped.ts
-var cellWorkerPattern = /\/apps\/api\/src\//;
+var RULE22 = "worker-handles-are-scoped";
+var ACCEPTS8 = "{ within: string (a regex over the filename), wrapper: string[] }";
 var handlerKeys = /* @__PURE__ */ new Set(["fetch", "queue", "scheduled", "email"]);
 var entrypointMakers = /* @__PURE__ */ new Set([
   "WorkflowEntrypoint",
@@ -5745,8 +6440,10 @@ var entrypointMakers = /* @__PURE__ */ new Set([
 ]);
 var cellHandlesAreScoped = {
   create(context) {
-    const normalized = normalise(context.filename);
-    if (!cellWorkerPattern.test(normalized)) return {};
+    const within = requireOption(RULE22, context.options?.[0]?.within, "within", ACCEPTS8);
+    const wrappers = requireOption(RULE22, context.options?.[0]?.wrapper, "wrapper", ACCEPTS8);
+    if (!new RegExp(within).test(normalise(context.filename))) return {};
+    const scopedBy = new Set(wrappers);
     let handler = null;
     let handlerNode = null;
     let scoped = false;
@@ -5760,7 +6457,7 @@ var cellHandlesAreScoped = {
       },
       CallExpression(node) {
         if (node.callee?.type !== "Identifier") return;
-        if (node.callee.name === "withCells") scoped = true;
+        if (node.callee.name !== void 0 && scopedBy.has(node.callee.name)) scoped = true;
         if (node.callee.name === "createWorkflowEntrypoint") {
           handler = "the workflow entrypoint";
           handlerNode = node;
@@ -5777,26 +6474,48 @@ var cellHandlesAreScoped = {
       "Program:exit"(node) {
         if (handler === null || scoped) return;
         context.report({
-          data: { handler },
+          data: { handler, wrapper: wrappers[0] ?? "" },
           messageId: "handlerOutsideWithCells",
           node: handlerNode ?? node
         });
       }
     };
   },
-  fixShape: `A worker that opens a database-cell handle wraps every invocation in \`withCells\` \u2014 the module
-handlers (\`fetch\`, \`queue\`, \`scheduled\`, \`email\`) and the workflow entrypoint alike \u2014 so the handle
-is closed when the invocation ends: \`withCells(() => \u2026, (closing) => ctx.waitUntil(closing))\`. A
-handler that declares itself and never calls it opens a pool per call and never closes one.`,
+  fixShape: `A worker that opens a database-cell handle wraps every invocation in the repo's scope wrapper \u2014 the
+module handlers (\`fetch\`, \`queue\`, \`scheduled\`, \`email\`) and the workflow entrypoint alike \u2014 so the
+handle is closed when the invocation ends: \`withCells(() => \u2026, (closing) => ctx.waitUntil(closing))\`.
+A handler that declares itself and never calls it opens a pool per call and never closes one. Name
+the wrapper in \`wrapper\` and the tree the cell workers live in in \`within\`; enabled without either
+the rule refuses the run.`,
   meta: {
     docs: {
-      description: "Every invocation of a cell worker \u2014 the module handlers and the Workflow entrypoint \u2014 runs inside `withCells`, which shares one cell handle per invocation and closes it when the invocation ends. A file that declares such an invocation and never calls `withCells` opens a pool it never closes."
+      description: "Every invocation of a cell worker \u2014 the module handlers and the Workflow entrypoint \u2014 runs inside the scope wrapper the `wrapper` option names, which shares one cell handle per invocation and closes it when the invocation ends. A file that declares such an invocation and never calls it opens a pool it never closes. The wrapper and the guarded tree are options; enabled without them it refuses the run."
     },
     messages: {
-      handlerOutsideWithCells: "This file declares {{handler}} and never calls `withCells`. Wrap the invocation \u2014 `withCells(() => \u2026, (closing) => ctx.waitUntil(closing))` \u2014 so the cell handle it opens is closed when it ends."
+      handlerOutsideWithCells: "This file declares {{handler}} and never calls `{{wrapper}}`. Wrap the invocation \u2014 `{{wrapper}}(() => \u2026, (closing) => ctx.waitUntil(closing))` \u2014 so the cell handle it opens is closed when it ends."
     },
-    schema: [],
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          within: { type: "string" },
+          wrapper: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
     type: "problem"
+  },
+  /** A module handler inside the configured tree that never opens a scope — the smallest breach. */
+  probe(options) {
+    const { within = "" } = bagOf(options);
+    return {
+      path: pathMatching(within, "geonosis-probe-worker.ts"),
+      source: `export default {
+  queue: async (): Promise<void> => undefined,
+}
+`
+    };
   }
 };
 var worker_handles_are_scoped_default = cellHandlesAreScoped;
@@ -5893,80 +6612,105 @@ change. One field: \`useStore((s) => s.field)\`. Several fields: ONE call with
 var zustand_v5_best_practices_default = zustandV5BestPractices;
 
 // src/index.ts
-var rules = {
-  "atom-no-deps": atom_no_deps_default,
-  "cell-must-be-stateful": cell_must_be_stateful_default,
-  "cell-must-not-compose-cell": cell_must_not_compose_cell_default,
-  "cell-no-cross-feature-organelles": cell_no_cross_feature_organelles_default,
-  "cell-no-tissues": cell_no_tissues_default,
-  "cells-folder-index-is-barrel": cells_folder_index_is_barrel_default,
-  "compound-must-be-stateless": compound_must_be_stateless_default,
-  "compound-no-stores": compound_no_stores_default,
-  "constants-in-constants-file": constants_in_constants_file_default,
-  "dialect-through-the-seam": dialect_through_the_seam_default,
-  "document-sagas-are-generic": document_sagas_are_generic_default,
-  "documents-share-one-table": documents_share_one_table_default,
-  "effect-hook-naming": effect_hook_naming_default,
-  "emit-declares-attempts": emit_declares_attempts_default,
-  "font-roles-only": font_roles_only_default,
-  "layer-walls": layer_walls_default,
-  "max-comment-density": max_comment_density_default,
-  "molecule-atoms-only": molecule_atoms_only_default,
-  "molecule-must-compose": molecule_must_compose_default,
-  "mutating-step-declares-retry": mutating_step_declares_retry_default,
-  "plugin-route-namespaced": plugin_route_namespaced_default,
-  "route-no-inline-mutation": route_no_inline_mutation_default,
-  "unique-query-step-name": unique_query_step_name_default,
-  "named-when-block": named_when_block_default,
-  "next-route-segment-is-thin-delegate": next_route_segment_is_thin_delegate_default,
-  "no-brand-names": no_brand_names_default,
-  "no-card-shaped-div": no_card_shaped_div_default,
-  "no-cross-feature-stores": no_cross_feature_stores_default,
-  "no-d1-transaction": no_d1_transaction_default,
-  "no-duplicate-jsx-patterns": no_duplicate_jsx_patterns_default,
-  "no-hook-in-component-disguise": no_hook_in_component_disguise_default,
-  "no-index-count-as-exact": no_index_count_as_exact_default,
-  "no-inert-hidden-jsx": no_inert_hidden_jsx_default,
-  "no-inline-data-in-jsx": no_inline_data_in_jsx_default,
-  "no-invalid-feature-folders": no_invalid_feature_folders_default,
-  "no-loader-side-effect-in-index-file": no_loader_side_effect_in_index_file_default,
-  "no-logic-in-component-files": no_logic_in_component_files_default,
-  "no-mock-db-in-integration": no_mock_db_in_integration_default,
-  "no-orm-outside-db": no_orm_outside_db_default,
-  "no-raw-html-atoms": no_raw_html_atoms_default,
-  "no-raw-sql-outside-allowed": no_raw_sql_outside_allowed_default,
-  "no-react-namespace": no_react_namespace_default,
-  "no-renamed-html-props": no_renamed_html_props_default,
-  "no-render-prop-reader": no_render_prop_reader_default,
-  "no-trivial-wrapper-component": no_trivial_wrapper_component_default,
-  "no-ts-in-bio-folders": no_ts_in_bio_folders_default,
-  "no-type-definitions-in-components": no_type_definitions_in_components_default,
-  "no-unregistered-plugin-dir": no_unregistered_plugin_dir_default,
-  "no-void-port": no_void_port_default,
-  "organelle-dependency": organelle_dependency_default,
-  "organelle-single-source": organelle_single_source_default,
-  "queries-require-org-scope": queries_require_org_scope_default,
-  "queue-loop-is-the-library": queue_loop_is_the_library_default,
-  "router-schema-parity": router_schema_parity_default,
-  "service-name-not-reserved": service_name_not_reserved_default,
-  "ssot-no-inline-facts": ssot_no_inline_facts_default,
-  "ssot-no-process-env": ssot_no_process_env_default,
-  "step-declares-compensation-or-none": step_declares_compensation_or_none_default,
-  "step-opens-its-own-cell": step_opens_its_own_cell_default,
-  "store-route-scopes-tenant-data": store_route_scopes_tenant_data_default,
-  "subscriber-declares-id": subscriber_declares_id_default,
-  "tables-declare-their-plane": tables_declare_their_plane_default,
-  "tenant-tables-carry-org-id": tenant_tables_carry_org_id_default,
-  "time-through-the-door": time_through_the_door_default,
-  "tokens-only-colors": tokens_only_colors_default,
-  "tissue-must-compose": tissue_must_compose_default,
-  "tissue-no-data-props": tissue_no_data_props_default,
-  "tissue-no-hooks": tissue_no_hooks_default,
-  "tissue-no-organelles": tissue_no_organelles_default,
-  "tissue-no-stores": tissue_no_stores_default,
-  "worker-handles-are-scoped": worker_handles_are_scoped_default,
-  "zustand-v5-best-practices": zustand_v5_best_practices_default
+var refusingOnce = (declared) => Object.fromEntries(
+  Object.entries(declared).map(([name, rule]) => [
+    name,
+    { ...rule, create: refusingOncePerRun(rule.create) }
+  ])
+);
+var withEngines = (declared) => {
+  const presumed = new Map(
+    PRESUMED_ENGINES.flatMap(
+      (one) => one.rules.map((name) => [name, { engine: one.engine, packages: one.packages }])
+    )
+  );
+  return Object.fromEntries(
+    Object.entries(declared).map(([name, rule]) => {
+      const engine = presumed.get(name);
+      return [name, engine === void 0 ? rule : { ...rule, presumes: engine }];
+    })
+  );
 };
+var rules = refusingOnce(
+  withEngines({
+    "atom-no-deps": atom_no_deps_default,
+    "boundary-time-is-primitive": boundary_time_is_primitive_default,
+    "cell-must-be-stateful": cell_must_be_stateful_default,
+    "cell-must-not-compose-cell": cell_must_not_compose_cell_default,
+    "cell-no-cross-feature-organelles": cell_no_cross_feature_organelles_default,
+    "cell-no-tissues": cell_no_tissues_default,
+    "cells-folder-index-is-barrel": cells_folder_index_is_barrel_default,
+    "compound-must-be-stateless": compound_must_be_stateless_default,
+    "compound-no-stores": compound_no_stores_default,
+    "constants-in-constants-file": constants_in_constants_file_default,
+    "dialect-through-the-seam": dialect_through_the_seam_default,
+    "document-sagas-are-generic": document_sagas_are_generic_default,
+    "documents-share-one-table": documents_share_one_table_default,
+    "durable-body-reads-through-steps": durable_body_reads_through_steps_default,
+    "effect-hook-naming": effect_hook_naming_default,
+    "emit-declares-attempts": emit_declares_attempts_default,
+    "font-roles-only": font_roles_only_default,
+    "layer-walls": layer_walls_default,
+    "max-comment-density": max_comment_density_default,
+    "molecule-atoms-only": molecule_atoms_only_default,
+    "molecule-must-compose": molecule_must_compose_default,
+    "mutating-step-declares-retry": mutating_step_declares_retry_default,
+    "plugin-route-namespaced": plugin_route_namespaced_default,
+    "route-no-inline-mutation": route_no_inline_mutation_default,
+    "unique-query-step-name": unique_query_step_name_default,
+    "named-when-block": named_when_block_default,
+    "next-route-segment-is-thin-delegate": next_route_segment_is_thin_delegate_default,
+    "no-brand-names": no_brand_names_default,
+    "no-card-shaped-div": no_card_shaped_div_default,
+    "no-cross-feature-stores": no_cross_feature_stores_default,
+    "no-d1-transaction": no_d1_transaction_default,
+    "no-duplicate-jsx-patterns": no_duplicate_jsx_patterns_default,
+    "no-hook-in-component-disguise": no_hook_in_component_disguise_default,
+    "no-index-count-as-exact": no_index_count_as_exact_default,
+    "no-inert-hidden-jsx": no_inert_hidden_jsx_default,
+    "no-inline-data-in-jsx": no_inline_data_in_jsx_default,
+    "no-invalid-feature-folders": no_invalid_feature_folders_default,
+    "no-loader-side-effect-in-index-file": no_loader_side_effect_in_index_file_default,
+    "no-logic-in-component-files": no_logic_in_component_files_default,
+    "no-mock-db-in-integration": no_mock_db_in_integration_default,
+    "no-orm-outside-db": no_orm_outside_db_default,
+    "no-raw-html-atoms": no_raw_html_atoms_default,
+    "no-raw-sql-outside-allowed": no_raw_sql_outside_allowed_default,
+    "no-react-namespace": no_react_namespace_default,
+    "no-renamed-html-props": no_renamed_html_props_default,
+    "no-render-prop-reader": no_render_prop_reader_default,
+    "no-trivial-wrapper-component": no_trivial_wrapper_component_default,
+    "no-ts-in-bio-folders": no_ts_in_bio_folders_default,
+    "no-type-definitions-in-components": no_type_definitions_in_components_default,
+    "no-unregistered-plugin-dir": no_unregistered_plugin_dir_default,
+    "no-void-port": no_void_port_default,
+    "organelle-dependency": organelle_dependency_default,
+    "organelle-single-source": organelle_single_source_default,
+    "queries-require-org-scope": queries_require_org_scope_default,
+    "queue-loop-is-the-library": queue_loop_is_the_library_default,
+    "router-schema-parity": router_schema_parity_default,
+    "service-name-not-reserved": service_name_not_reserved_default,
+    "ssot-no-inline-facts": ssot_no_inline_facts_default,
+    "ssot-no-process-env": ssot_no_process_env_default,
+    "step-declares-compensation-or-none": step_declares_compensation_or_none_default,
+    "step-opens-its-own-cell": step_opens_its_own_cell_default,
+    "store-route-scopes-tenant-data": store_route_scopes_tenant_data_default,
+    "subpath-over-barrel": subpath_over_barrel_default,
+    "subscriber-declares-id": subscriber_declares_id_default,
+    "tables-declare-their-plane": tables_declare_their_plane_default,
+    "tenant-tables-carry-org-id": tenant_tables_carry_org_id_default,
+    "time-through-the-door": time_through_the_door_default,
+    "tokens-only-colors": tokens_only_colors_default,
+    "tissue-must-compose": tissue_must_compose_default,
+    "tissue-no-data-props": tissue_no_data_props_default,
+    "tissue-no-hooks": tissue_no_hooks_default,
+    "tissue-no-organelles": tissue_no_organelles_default,
+    "tissue-no-stores": tissue_no_stores_default,
+    "todo-names-its-plan": todo_names_its_plan_default,
+    "worker-handles-are-scoped": worker_handles_are_scoped_default,
+    "zustand-v5-best-practices": zustand_v5_best_practices_default
+  })
+);
 var { version } = createRequire(import.meta.url)("../package.json");
 var plugin = {
   configs: PRESETS,
@@ -5979,6 +6723,7 @@ var plugin = {
 var index_default = plugin;
 export {
   PRESETS,
+  RENAMED_TO,
   index_default as default,
   rules,
   rulesOfPreset