@geonosis/oxlint-plugin-biological-architecture 2.2.0 → 2.3.0

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   PRESUMED_ENGINES,
   RENAMED_TO,
   rulesOfPreset
-} from "./chunk-LTDP2733.js";
+} from "./chunk-KV7JRNAP.js";
 
 // src/index.ts
 import { createRequire } from "module";
@@ -30,6 +30,11 @@ var isDoor = (filename, door) => {
     return false;
   }
 };
+var isModule = (filename, module) => {
+  const path2 = normalise(filename);
+  const named = module.replace(/^\.?\//, "");
+  return path2 === named || path2.endsWith(`/${named}`);
+};
 
 // src/rules/lib/imports.ts
 var REQUIRE = "require";
@@ -1429,9 +1434,10 @@ var variableOf = (value) => /^var\(\s*(--[A-Za-z0-9_-]+)/.exec(value.trim())?.[1
 var WEIGHT = /^\d+(?:\.\d+)?$/;
 var fontRolesOnly = {
   create(context) {
-    const { allow = [], prefix = "--font-", roles } = context.options?.[0] ?? {};
+    const { allow = [], exemptModules = [], prefix = "--font-", roles } = context.options?.[0] ?? {};
     const declared = requireOption("font-roles-only", roles, "roles");
     const filename = normalise(context.filename);
+    if (exemptModules.some((module) => isModule(filename, module))) return {};
     if (allow.some((path2) => filename.includes(path2))) return {};
     return {
       JSXOpeningElement(node) {
@@ -1462,11 +1468,19 @@ var fontRolesOnly = {
 sans-serif"\` or \`font-[Helvetica]\` with the role variable \u2014 \`var(--font-body)\`, \`var(--font-display)\`
 \u2014 or the utility that reads it. A \`var(--font-\u2026)\` naming a role the contract does not declare is the
 same offence: add the role to the theme, or use one that is there. Declare your role names in
-\`roles\` and, if your variables are spelled differently, set \`prefix\`; put the theme file and any
-\`@font-face\` sheet in \`allow\`. Bare \`font-*\` utility classes are deliberately not policed, because
+\`roles\` and, if your variables are spelled differently, set \`prefix\`; NAME the theme file and any
+\`@font-face\` sheet in \`exemptModules\`, one module per entry \u2014 \`allow\` still takes patterns and still
+grants its exemption to wherever the pattern stops, which is a boundary nobody decided and nobody
+counts. Bare \`font-*\` utility classes are deliberately not policed, because
 Tailwind puts weight and style under the same prefix. Enabled with no \`roles\` the rule refuses the
 run.`,
   meta: {
+    /**
+     * #139: which option grants by PATTERN and which one ENUMERATES. Declared on the rule so the
+     * doctor needs no list of its own — a rule that gains a path grant and forgets to say so is a
+     * grant nothing counts, which is the defect this pair exists to end.
+     */
+    grants: { modules: "exemptModules", paths: "allow" },
     docs: {
       description: "Font families are asked for by role. A family literal in a className or an inline style fires, and so does a var() naming a role outside the declared set. Configure `roles` (and `prefix` when the variables are spelled differently); enabled without `roles` it refuses the run."
     },
@@ -1479,6 +1493,7 @@ run.`,
         additionalProperties: false,
         properties: {
           allow: { items: { type: "string" }, type: "array" },
+          exemptModules: { items: { type: "string" }, type: "array" },
           prefix: { type: "string" },
           roles: { items: { type: "string" }, type: "array" }
         },
@@ -1647,6 +1662,81 @@ export const geonosisProbeWall = geonosisProbe
 };
 var layer_walls_default = layerWalls;
 
+// src/rules/list-take-without-order.ts
+var CALLEES = [String.raw`^(?:\w+\.)?list[A-Z]`, String.raw`^(?:\w+\.)?graph$`];
+var ORDER_KEYS = ["order", "orderBy"];
+var TAKE = "take";
+var keyNameOf = (node) => {
+  const key = node.key;
+  if (key?.type === "Identifier" && typeof key.name === "string") return key.name;
+  return key?.type === "Literal" && typeof key.value === "string" ? key.value : null;
+};
+var spellingOf = (callee) => {
+  if (callee === void 0) return null;
+  if (callee.type === "Identifier") return callee.name ?? null;
+  const property = propertyNameOf(callee);
+  if (property === null) return null;
+  const object = callee.object;
+  return object?.type === "Identifier" ? `${String(object.name)}.${property}` : property;
+};
+var listTakeWithoutOrder = {
+  create(context) {
+    const options = bagOf(context.options);
+    const callees = (options.callees ?? CALLEES).map((pattern) => new RegExp(pattern));
+    const orderKeys = options.orderKeys ?? ORDER_KEYS;
+    return {
+      CallExpression(node) {
+        const callee = spellingOf(node.callee);
+        if (callee === null || !callees.some((pattern) => pattern.test(callee))) return;
+        let takes = false;
+        let orders = false;
+        let unreadable = false;
+        for (const argument of node.arguments ?? []) {
+          walkNode(argument, (inner) => {
+            if (inner.type === "SpreadElement") unreadable = true;
+            if (inner.type !== "Property") return;
+            const key = keyNameOf(inner);
+            if (key === TAKE) takes = true;
+            if (key !== null && orderKeys.includes(key)) orders = true;
+          });
+        }
+        if (!takes || orders || unreadable) return;
+        context.report({
+          data: { callee, order: orderKeys[0] ?? "" },
+          messageId: "unordered",
+          node
+        });
+      }
+    };
+  },
+  fixShape: `A page taken in no order answers a question about the page, not about the table. A \`list*()\`
+or \`query.graph\` call carrying \`take\` names an \`order\` beside it \u2014 the column the page is a page OF \u2014
+so the first row is the first row every time, and the row a previous stage just wrote is where the
+reader expects it. Without one the database returns whatever is cheapest, which is stable in
+development and different under load. A spread the rule cannot read is left alone. Which calls are
+list calls is the \`callees\` option and which key declares the ordering is \`orderKeys\`.`,
+  meta: {
+    docs: {
+      description: "A list or graph call that takes a page without declaring an order. The rows come back in whatever order is cheapest, so `[0]`, `.find()` and `.sort()` over the result answer a question about the page rather than about the table."
+    },
+    messages: {
+      unordered: "`{{callee}}` takes a page with no `{{order}}`: the rows come back in whatever order the database finds cheapest, so the first row is a different row under load. Name the column the page is a page of."
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          callees: { items: { type: "string" }, type: "array" },
+          orderKeys: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  }
+};
+var list_take_without_order_default = listTakeWithoutOrder;
+
 // src/rules/max-comment-density.ts
 var exemptFiles2 = [
   /\/__tests__\//,
@@ -2428,6 +2518,79 @@ saga, not the transaction.`,
 };
 var no_d1_transaction_default = noD1Transaction;
 
+// src/rules/no-date-string-compare.ts
+var FIELD_PATTERN = "(?:_at|[a-z]At)$";
+var RELATIONAL = /* @__PURE__ */ new Set(["<", "<=", ">", ">="]);
+var COMPARE = "localeCompare";
+var STRINGIFY = "String";
+var fieldStringified = (node, holdsATime) => {
+  if (node === void 0) return null;
+  const named = (subject) => {
+    if (subject === void 0) return null;
+    const property = propertyNameOf(subject);
+    if (property !== null) return holdsATime.test(property) ? property : null;
+    return subject.type === "Identifier" && typeof subject.name === "string" && holdsATime.test(subject.name) ? subject.name : null;
+  };
+  if (node.type === "CallExpression" && calleeNameOf(node) === STRINGIFY) {
+    const [argument] = node.arguments ?? [];
+    return named(argument);
+  }
+  if (node.type !== "TemplateLiteral") return null;
+  const expressions = node.expressions ?? [];
+  const quasis = node.quasis ?? [];
+  const empty = quasis.every((one) => (one.value?.raw ?? "") === "");
+  return expressions.length === 1 && empty ? named(expressions[0]) : null;
+};
+var noDateStringCompare = {
+  create(context) {
+    const holdsATime = new RegExp(bagOf(context.options).fieldPattern ?? FIELD_PATTERN);
+    const reportFirst = (node, sides, ordering) => {
+      for (const side of sides) {
+        const field = fieldStringified(side, holdsATime);
+        if (field === null) continue;
+        context.report({ data: { field, ordering }, messageId: "textOrder", node });
+        return;
+      }
+    };
+    return {
+      BinaryExpression(node) {
+        if (!RELATIONAL.has(node.operator)) return;
+        reportFirst(node, [node.left, node.right], node.operator);
+      },
+      CallExpression(node) {
+        if (propertyNameOf(node.callee) !== COMPARE) return;
+        const receiver = node.callee.object;
+        const [argument] = node.arguments ?? [];
+        reportFirst(node, [receiver, argument], COMPARE);
+      }
+    };
+  },
+  fixShape: `Order a timestamp by its time, never by its text. \`String(row.created_at)\` on a Date is
+"Fri Aug 30 2026 \u2026", so "newest first" becomes "starts with F" and the sort is stable, plausible and
+wrong. Compare \`new Date(a.created_at).getTime()\` against \`Date.parse(b.created_at)\`, or sort on the
+ISO string the API returned \u2014 an ISO-8601 string does order lexicographically, which is why the
+defect survives review. The rule reports only a field turned INTO text: a raw timestamp under \`<\`
+and a template with copy in it are both left alone. Which names hold a timestamp is the
+\`fieldPattern\` option, defaulting to the \`_at\` / \`\u2026At\` spellings.`,
+  meta: {
+    docs: {
+      description: "A `*_at` / `*At` field turned into a string with `String()` or a bare template, then ordered with `localeCompare` or a relational operator. A stringified Date sorts by its weekday name, not by its time."
+    },
+    messages: {
+      textOrder: 'Ordering "{{field}}" by {{ordering}} on a string compares the TEXT of a timestamp: a Date stringifies to "Fri Aug 30 2026 \u2026", so this sorts by weekday name. Compare `.getTime()` or `Date.parse()`, or order on the ISO string the API returned.'
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: { fieldPattern: { type: "string" } },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  }
+};
+var no_date_string_compare_default = noDateStringCompare;
+
 // src/rules/no-duplicate-jsx-patterns.ts
 var COMPONENT_FILE_PATTERN = /(?:features\/[^/]+\/)?(compounds|organelles|cells|tissues|organs)\/.+\.tsx$/;
 var MIN_CLASS_LENGTH = 30;
@@ -2520,6 +2683,90 @@ their text are one component with a prop.`,
 };
 var no_duplicate_jsx_patterns_default = noDuplicateJsxPatterns;
 
+// src/rules/no-generic-utility-package.ts
+import { readFileSync as readFileSync3 } from "fs";
+var NAMES = ["common", "helpers", "misc", "shared", "utils"];
+var ENTRIES = [
+  "index.ts",
+  "index.tsx",
+  "index.js",
+  "index.jsx",
+  "src/index.ts",
+  "src/index.tsx",
+  "src/index.js",
+  "src/index.jsx"
+];
+var MANIFEST = "package.json";
+var nameOf2 = (root) => {
+  try {
+    const manifest = JSON.parse(readFileSync3(`${root}/${MANIFEST}`, "utf8"));
+    return typeof manifest.name === "string" ? manifest.name : null;
+  } catch {
+    return null;
+  }
+};
+var noGenericUtilityPackage = {
+  create(context) {
+    const options = bagOf(context.options);
+    const names2 = new Set(options.names ?? NAMES);
+    const entries = options.entries ?? ENTRIES;
+    const filename = normalise(context.filename);
+    return {
+      Program(node) {
+        const entry = entries.toSorted((a, b) => b.length - a.length).find((one) => filename.endsWith(`/${one}`));
+        if (entry === void 0) return;
+        const name = nameOf2(filename.slice(0, filename.length - entry.length - 1));
+        if (name === null) return;
+        const last = name.split("/").at(-1) ?? "";
+        if (!names2.has(last)) return;
+        context.report({ data: { generic: last, name }, messageId: "generic", node });
+      }
+    };
+  },
+  fixShape: `A package is named for what it does. \`utils\`, \`common\`, \`helpers\`, \`shared\`, \`misc\` say nothing
+about what is inside, so nothing can be refused entry and everything arrives: web helpers, a constants
+object, a time door. Split it by what each export is FOR and give each half a name that would make a
+wrong import obviously wrong \u2014 the formatting goes to the feature's own lib, the constants go beside
+their owner, a door gets its own package named after the thing it is a door to. Delete the rest. The
+anti-names are the \`names\` option and the default is the universal list, never a repo's vocabulary.`,
+  meta: {
+    docs: {
+      description: "A workspace package named `utils` / `common` / `helpers` / `shared` / `misc` is named for nothing, so it accretes everything. Reported once, at the package entry, from the name in its own manifest."
+    },
+    messages: {
+      generic: 'The package "{{name}}" is named for nothing: "{{generic}}" says what is inside to no one, so nothing can be refused entry and everything arrives. Split it by what each export is for and name each half after the thing it does.'
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          entries: { items: { type: "string" }, type: "array" },
+          names: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  },
+  /** The manifest AND the entry: the name is in the manifest, and the finding lands on the entry. */
+  probe(options) {
+    const bag = bagOf(options);
+    const generic = (bag.names ?? NAMES)[0] ?? "";
+    const entry = (bag.entries ?? ENTRIES)[0] ?? "";
+    return {
+      files: [
+        { path: `packages/${generic}/${entry}`, source: "export const entry = 1\n" },
+        {
+          path: `packages/${generic}/${MANIFEST}`,
+          source: `{ "name": "${generic}", "version": "0.0.0" }
+`
+        }
+      ]
+    };
+  }
+};
+var no_generic_utility_package_default = noGenericUtilityPackage;
+
 // src/rules/no-hook-in-component-disguise.ts
 var EXPLICIT_SIDE_EFFECT_HOOKS = /* @__PURE__ */ new Set([
   "useEffect",
@@ -3567,6 +3814,154 @@ The state goes in an organelle that renders its own JSX; the arrangement goes in
 };
 var no_render_prop_reader_default = noRenderPropReader;
 
+// src/rules/no-runtime-dead-affordance.ts
+var HANDS_IT_ON = /* @__PURE__ */ new Set(["asChild", "disabled", "form", "formAction"]);
+var PRESSED_BY_THE_FORM = /* @__PURE__ */ new Set(["submit", "reset"]);
+var nameOf3 = (attribute) => attribute.name?.type === "JSXIdentifier" ? attribute.name.name ?? "" : "";
+var arms = (attribute) => {
+  if (attribute.type !== "JSXAttribute") return true;
+  const name = nameOf3(attribute);
+  if (name.startsWith("on") && name.length > 2) return true;
+  if (HANDS_IT_ON.has(name)) return true;
+  if (name !== "type") return false;
+  const value = attribute.value;
+  if (value === null || value === void 0) return false;
+  return value.type === "Literal" ? PRESSED_BY_THE_FORM.has(String(value.value)) : (
+    // An expression is a type this rule cannot read.
+    true
+  );
+};
+var noRuntimeDeadAffordance = {
+  create(context) {
+    const controls = new Set((context.options[0] ?? []).map((one) => one.atom));
+    return {
+      JSXOpeningElement(node) {
+        if (node?.name?.type !== "JSXIdentifier") return;
+        const atom = node.name.name ?? "";
+        if (!controls.has(atom)) return;
+        if ((node.attributes ?? []).some(arms)) return;
+        context.report({ data: { atom }, messageId: "dead", node });
+      }
+    };
+  },
+  fixShape: `A control that renders and does nothing is worse than no control: it looks pressable and
+answers nothing. Every control atom the rule's map names carries one of \`onClick\` (or another
+\`on\u2026\` handler), \`asChild\` so the child it wraps carries the behaviour, \`type="submit"\`/\`"reset"\` so
+the form presses it, \`form\`/\`formAction\`, or \`disabled\` when it is inert on purpose. \`type="button"\`
+is the default and presses nothing, so it arms nothing. A spread is a prop bag the rule cannot read
+and is left alone. Configure the same element\u2192atom map \`no-raw-html-atoms\` takes; enabled without
+one the rule refuses the run.`,
+  meta: {
+    docs: {
+      description: "A control atom rendered with no handler, no `asChild`, no submit role and no `disabled` is a dead affordance \u2014 it renders, it looks pressable, and pressing it does nothing. Reads the same element\u2192atom map as `no-raw-html-atoms`."
+    },
+    messages: {
+      dead: '<{{atom}}> has no onClick, no other handler, no asChild and no submit role, so pressing it does nothing. Give it a handler, hand the behaviour to a child with asChild, make it type="submit" inside its form, or mark it disabled if it is meant to be inert.'
+    },
+    schema: [
+      {
+        items: {
+          properties: {
+            atom: { type: "string" },
+            element: { type: "string" },
+            importPath: { type: "string" }
+          },
+          required: ["element", "atom", "importPath"],
+          type: "object"
+        },
+        type: "array"
+      }
+    ],
+    type: "problem"
+  },
+  /** The map is POSITIONAL, so the probe reads `options[0]` rather than a bag. */
+  probe(options) {
+    const map = Array.isArray(options[0]) ? options[0] : [];
+    const atom = map[0]?.atom;
+    if (atom === void 0) {
+      throw new Error(
+        "biological-architecture/no-runtime-dead-affordance has no element\u2192atom map here, so there is no control for a probe to render \u2014 the rule is inert by design until one is configured."
+      );
+    }
+    return {
+      path: "cells/geonosis-probe.tsx",
+      source: `export const GeonosisProbe = () => <${atom} />
+`
+    };
+  }
+};
+var no_runtime_dead_affordance_default = noRuntimeDeadAffordance;
+
+// src/rules/no-swallowed-catch.ts
+var CATCH = "catch";
+var LOGGER = "console";
+var FUNCTIONS = /* @__PURE__ */ new Set(["ArrowFunctionExpression", "FunctionExpression"]);
+var isLogging = (node) => {
+  const callee = node.callee;
+  const object = callee?.object;
+  return object?.type === "Identifier" && object.name === LOGGER;
+};
+var swallows = (body) => {
+  let answers = false;
+  walkNode(body, (node) => {
+    if (node.type === "ThrowStatement") answers = true;
+    if (node.type === "AssignmentExpression" || node.type === "UpdateExpression") answers = true;
+    if (node.type === "CallExpression" && !isLogging(node)) answers = true;
+  });
+  return !answers;
+};
+var noSwallowedCatch = {
+  create(context) {
+    const paths = bagOf(context.options).paths ?? [];
+    const filename = normalise(context.filename);
+    if (!paths.some((pattern) => new RegExp(pattern).test(filename))) return {};
+    const report = (node, shape) => {
+      context.report({ data: { shape }, messageId: "swallowed", node });
+    };
+    return {
+      CallExpression(node) {
+        if (propertyNameOf(node.callee) !== CATCH) return;
+        const [handler] = node.arguments ?? [];
+        if (handler === void 0 || !FUNCTIONS.has(handler.type ?? "")) return;
+        if (swallows(handler.body)) report(handler, ".catch()");
+      },
+      CatchClause(node) {
+        if (swallows(node.body)) report(node, "catch block");
+      }
+    };
+  },
+  fixShape: `A rejection on a fetch or refresh path is answered, never dropped. An empty \`.catch(() => {})\`,
+an empty \`catch {}\` and a handler that only logs all leave the caller reading a failed refresh as a
+successful one. Write the failure somewhere the caller can see it \u2014 set an error flag, put the state
+back, mark the value stale \u2014 or rethrow it and let the boundary above decide. Which modules are the
+fetch/refresh surface is the \`paths\` option; enabled without it the rule refuses the run, because a
+rule with no surface to watch reads exactly like a tree with no swallowed rejection in it.`,
+  meta: {
+    docs: {
+      description: "A `.catch()` handler or a `catch` block on a declared fetch/refresh path must write state or rethrow. An empty handler, or one that only logs, turns a failed refresh into a successful one for everything downstream."
+    },
+    messages: {
+      swallowed: "This {{shape}} drops the rejection: it neither writes state nor rethrows, so a failed refresh is indistinguishable from a successful one. Set the error where the caller reads it, or rethrow."
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: { paths: { items: { type: "string" }, type: "array" } },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  },
+  probe(options) {
+    return {
+      path: pathMatching(firstOf(bagOf(options).paths, []), "refresh.ts"),
+      source: `export const refresh = (load: () => Promise<void>) => load().catch(() => {})
+`
+    };
+  }
+};
+var no_swallowed_catch_default = noSwallowedCatch;
+
 // src/rules/no-trivial-wrapper-component.ts
 var ROUTE_BASENAMES = /* @__PURE__ */ new Set([
   "default.tsx",
@@ -3802,9 +4197,9 @@ and is imported.`,
 var no_type_definitions_in_components_default = noTypeDefinitionsInComponents;
 
 // src/rules/no-unregistered-plugin-dir.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 var RULE11 = "no-unregistered-plugin-dir";
-var ACCEPTS3 = "{ roots: string[], registry: string | string[], manifests: string[] }";
+var ACCEPTS3 = "{ roots: (string | { path: string, files: boolean })[], registry: string | string[], manifests: string[] }";
 var trimSlashes = (path2) => path2.replace(/^\/+/, "").replace(/\/+$/, "");
 var withoutComments = (source) => source.replaceAll(/\/\*[\s\S]*?\*\//g, " ").replaceAll(/\/\/[^\n]*/g, " ");
 var literalsOf = (source) => [...withoutComments(source).matchAll(/['"`]([^'"`\n]+)['"`]/g)].map((match) => match[1] ?? "");
@@ -3818,10 +4213,22 @@ var rootedAt = (filename, root) => {
   if (at < 0) return null;
   return { after: filename.slice(at + marker.length), repoRoot: filename.slice(0, at) };
 };
+var oneDirectory = (segments, manifests) => {
+  if (segments.length !== 2) return null;
+  const [directory, file] = segments;
+  return directory !== void 0 && file !== void 0 && manifests.has(file) ? directory : null;
+};
+var oneFile = (segments) => {
+  if (segments.length !== 1) return null;
+  const [file] = segments;
+  return file === void 0 ? null : file.replace(/\.[cm]?[jt]sx?$/, "");
+};
 var noUnregisteredPluginDir = {
   create(context) {
     const options = context.options?.[0] ?? {};
-    const roots = requireOption(RULE11, options.roots, "roots", ACCEPTS3).map(trimSlashes);
+    const roots = requireOption(RULE11, options.roots, "roots", ACCEPTS3).map(
+      (one) => typeof one === "string" ? { files: false, path: trimSlashes(one) } : { files: one.files === true, path: trimSlashes(one.path) }
+    );
     const declared = requireOption(RULE11, options.registry, "registry", ACCEPTS3);
     const registries = (typeof declared === "string" ? [declared] : declared).map(trimSlashes);
     const manifests = new Set(requireOption(RULE11, options.manifests, "manifests", ACCEPTS3));
@@ -3829,21 +4236,24 @@ var noUnregisteredPluginDir = {
     return {
       Program(node) {
         for (const root of roots) {
-          const rooted = rootedAt(filename, root);
+          const rooted = rootedAt(filename, root.path);
           if (rooted === null) continue;
           const segments = rooted.after.split("/");
-          if (segments.length !== 2) continue;
-          const [directory, file] = segments;
-          if (directory === void 0 || file === void 0 || !manifests.has(file)) continue;
+          const registrant = root.files ? oneFile(segments) : oneDirectory(segments, manifests);
+          if (registrant === null) continue;
           let source = "";
           try {
-            source = registries.map((half) => readFileSync3(`${rooted.repoRoot}/${half}`, "utf8")).join("\n");
+            source = registries.map((half) => readFileSync4(`${rooted.repoRoot}/${half}`, "utf8")).join("\n");
           } catch {
             return;
           }
-          if (literalsOf(source).some((literal) => names(literal, directory))) return;
+          if (literalsOf(source).some((literal) => names(literal, registrant))) return;
           const registry = registries.join(", ");
-          context.report({ data: { directory, registry, root }, messageId: "unregistered", node });
+          context.report({
+            data: { directory: registrant, registry, root: root.path },
+            messageId: "unregistered",
+            node
+          });
           return;
         }
       }
@@ -3856,7 +4266,9 @@ eight of them. Configure \`roots\`, \`registry\` and \`manifests\` \u2014 all th
 registry is SPLIT across files (a config that imports a second config): name every half, because the
 rule reads source and does not follow imports. \`manifests\` has no default on purpose: dielime's plugin directories hold \`service.ts\` and no index, so a defaulted list
 would match nothing and report a clean tree it never looked at. A seam whose providers are flat files
-rather than directories is out of scope \u2014 nothing under a root matches, so nothing is reported.`,
+rather than directories is judged when its root says \`files: true\` \u2014 \`{ path, files: true }\` makes each
+FILE under that root a registrant named by its own basename \u2014 and is out of scope under a bare root,
+where nothing matches and nothing is reported.`,
   meta: {
     docs: {
       description: "Every directory under a plugin root must be named by the registry file. Midday ships 35 app-store directories and 8 are reachable from nothing. The registry is read as source, so an id or an import path both count, and `registry` takes a LIST when the registry is split across files \u2014 reading only the named half reported two registered carrier directories as dead weight on a real consumer. `roots`, `registry` and `manifests` are all required; `manifests` has no default because a defaulted entry filename matched nothing in a real consumer and reported a clean tree it had never looked at."
@@ -3875,7 +4287,23 @@ rather than directories is out of scope \u2014 nothing under a root matches, so
               { items: { type: "string" }, type: "array" }
             ]
           },
-          roots: { items: { type: "string" }, type: "array" }
+          roots: {
+            items: {
+              anyOf: [
+                { type: "string" },
+                {
+                  additionalProperties: false,
+                  properties: {
+                    files: { type: "boolean" },
+                    path: { type: "string" }
+                  },
+                  required: ["path"],
+                  type: "object"
+                }
+              ]
+            },
+            type: "array"
+          }
         },
         type: "object"
       }
@@ -3896,12 +4324,14 @@ rather than directories is out of scope \u2014 nothing under a root matches, so
    */
   probe(options) {
     const { manifests = [], registry = "", roots = [] } = bagOf(options);
-    const root = trimSlashes(roots[0] ?? "");
+    const first = roots[0] ?? "";
+    const root = typeof first === "string" ? { files: false, path: first } : first;
+    const under = trimSlashes(root.path);
     const half = typeof registry === "string" ? registry : registry[0] ?? "";
     return {
       files: [
         {
-          path: `${root}/geonosis-probe/${manifests[0] ?? ""}`,
+          path: root.files === true ? `${under}/geonosis-probe.ts` : `${under}/geonosis-probe/${manifests[0] ?? ""}`,
           source: "export const geonosisProbe = { id: 'geonosis-probe' }\n"
         },
         { path: trimSlashes(half), source: "export const registry = { providers: [] }\n" }
@@ -4752,7 +5182,7 @@ var isFactShaped = (literal) => {
   if (/^[a-z][a-z0-9]*(\.[a-z][a-z0-9]*)+$/.test(literal)) return true;
   return literal.length >= 16 && !/^[a-z0-9:\-[\]/.%#!]+$/.test(literal);
 };
-var nameOf2 = (node) => {
+var nameOf4 = (node) => {
   if (node === void 0) return void 0;
   if (typeof node === "string") return node;
   if (node.type === "Identifier" || node.type === "JSXIdentifier") return node.name;
@@ -4763,12 +5193,12 @@ var isSpelledAsStyleOrModule = (node) => {
   let current = node.parent;
   let child = node;
   while (current && typeof current.type === "string" && current.type !== "Program") {
-    if (current.type === "JSXAttribute") return styleAttributes.has(nameOf2(current.name) ?? "");
+    if (current.type === "JSXAttribute") return styleAttributes.has(nameOf4(current.name) ?? "");
     if (current.type === "Property" && current.key === child) return true;
-    if (current.type === "Property" && styleAttributes.has(nameOf2(current.key) ?? "")) return true;
+    if (current.type === "Property" && styleAttributes.has(nameOf4(current.key) ?? "")) return true;
     if (current.type === "CallExpression") {
       const callee = current.callee;
-      const calleeName = callee?.type === "MemberExpression" ? nameOf2(callee.property) : nameOf2(callee);
+      const calleeName = callee?.type === "MemberExpression" ? nameOf4(callee.property) : nameOf4(callee);
       if (styleCallees.has(calleeName ?? "") || formFieldCallees.has(calleeName ?? "")) return true;
       const firstArgument = current.arguments?.[0];
       if (declarationCallees.has(calleeName ?? "") && firstArgument === child) return true;
@@ -5060,8 +5490,8 @@ export const probe = step('geonosis-probe', async () => ({ ok: true }))
 var step_opens_its_own_cell_default = stepOpensItsOwnCell;
 
 // src/rules/store-route-scopes-tenant-data.ts
-var STORE_ROUTE_PATTERN = /\/api\/store\/.*\/route\.tsx?$/;
-var TENANT_ENTITIES = /* @__PURE__ */ new Set([
+import { readFileSync as readFileSync5 } from "fs";
+var ENTITIES = [
   "cart",
   "claim",
   "company",
@@ -5071,27 +5501,136 @@ var TENANT_ENTITIES = /* @__PURE__ */ new Set([
   "planned_order",
   "production_order",
   "quote"
+];
+var ROUTES = [String.raw`/api/store/.*/route\.tsx?$`];
+var SCOPING_CALLS = ["auth_context", "actor_id", "customer_id", "company_id"];
+var ENTITY_KEY = "entity";
+var SUFFIXES = ["", ".ts", ".tsx", ".js", ".jsx", "/index.ts", "/index.tsx", "/index.js"];
+var keyNameOf2 = (node) => {
+  const key = node.key;
+  if (key?.type === "Identifier" && typeof key.name === "string") return key.name;
+  return key?.type === "Literal" && typeof key.value === "string" ? key.value : null;
+};
+var stringValueOf = (node) => {
+  const value = node.value;
+  return value?.type === "Literal" && typeof value.value === "string" ? value.value : null;
+};
+var withoutComments2 = (text) => {
+  let out = "";
+  let at = 0;
+  let quote = "";
+  while (at < text.length) {
+    const here = text[at] ?? "";
+    const next = text[at + 1] ?? "";
+    if (quote !== "") {
+      if (here === "\\") {
+        out += "  ";
+        at += 2;
+        continue;
+      }
+      if (here === quote) quote = "";
+      out += here;
+      at += 1;
+      continue;
+    }
+    if (here === '"' || here === "'" || here === "`") {
+      quote = here;
+      out += here;
+      at += 1;
+      continue;
+    }
+    if (here === "/" && next === "/") {
+      while (at < text.length && text[at] !== "\n") {
+        out += " ";
+        at += 1;
+      }
+      continue;
+    }
+    if (here === "/" && next === "*") {
+      const end = text.indexOf("*/", at + 2);
+      const stop = end === -1 ? text.length : end + 2;
+      for (; at < stop; at += 1) out += text[at] === "\n" ? "\n" : " ";
+      continue;
+    }
+    out += here;
+    at += 1;
+  }
+  return out;
+};
+var siblingSourceOf = (importer, source) => {
+  if (!source.startsWith(".")) return null;
+  const landed = resolveRelative(importer, source);
+  for (const suffix of SUFFIXES) {
+    try {
+      return withoutComments2(readFileSync5(`${landed}${suffix}`, "utf8"));
+    } catch {
+      continue;
+    }
+  }
+  return null;
+};
+var MODULE_NODES = /* @__PURE__ */ new Set([
+  "CallExpression",
+  "ExportAllDeclaration",
+  "ExportNamedDeclaration",
+  "ImportDeclaration",
+  "ImportExpression"
 ]);
-var SCOPE_MARKERS = /auth_context|actor_id|customer_id|company_id|\bcustomer\b\s*:/;
+var readIn = (text, entities) => {
+  for (const entity of entities) {
+    if (new RegExp(`${ENTITY_KEY}\\s*:\\s*['"\`]${entity}['"\`]`).test(text)) return entity;
+  }
+  return null;
+};
+var namesAny = (text, names2) => names2.some((name) => new RegExp(`\\b${name}\\b`).test(text));
 var storeRouteScopesTenantData = {
   create(context) {
-    const normalized = normalise(context.filename);
-    if (!STORE_ROUTE_PATTERN.test(normalized)) return {};
-    const shortName = normalized.split("/").slice(-3).join("/");
+    const options = bagOf(context.options);
+    const routes = options.routes ?? ROUTES;
+    const entities = options.entities ?? ENTITIES;
+    const narrowing = [...options.scopingCalls ?? SCOPING_CALLS, ...options.evidenceCalls ?? []];
+    const filename = normalise(context.filename);
+    if (!routes.some((pattern) => new RegExp(pattern).test(filename))) return {};
+    const shortName = filename.split("/").slice(-3).join("/");
     return {
-      Program(node) {
-        const text = context.sourceCode?.text ?? "";
-        if (text === "" || SCOPE_MARKERS.test(text)) return;
-        for (const entity of TENANT_ENTITIES) {
-          const reads = new RegExp(`entity:\\s*['"\`]${entity}['"\`]`).test(text);
-          if (reads) {
-            context.report({
-              data: { entity, file: shortName },
-              messageId: "unscoped",
-              node
-            });
-            return;
+      Program(program) {
+        let read = null;
+        let scoped = false;
+        const sources = [];
+        walkNode(program, (node) => {
+          if (node.type === "Property" && keyNameOf2(node) === ENTITY_KEY) {
+            const entity = stringValueOf(node);
+            if (entity !== null && entities.includes(entity) && read === null) {
+              read = { entity, node };
+            }
+          }
+          if (node.type === "Identifier" && narrowing.includes(node.name)) scoped = true;
+          if (MODULE_NODES.has(node.type ?? "")) {
+            const source = sourceOf(node);
+            if (source !== null) sources.push(source);
           }
+        });
+        if (scoped) return;
+        if (read !== null) {
+          const found = read;
+          context.report({
+            data: { entity: found.entity, file: shortName },
+            messageId: "unscoped",
+            node: found.node
+          });
+          return;
+        }
+        for (const source of sources) {
+          const text = siblingSourceOf(filename, source);
+          if (text === null || namesAny(text, narrowing)) continue;
+          const entity = readIn(text, entities);
+          if (entity === null) continue;
+          context.report({
+            data: { entity, file: shortName, through: source },
+            messageId: "unscopedSibling",
+            node: program
+          });
+          return;
         }
       }
     };
@@ -5099,17 +5638,43 @@ var storeRouteScopesTenantData = {
   fixShape: `A customer-facing store route that reads a customer-owned entity (cart, order, quote, company, \u2026)
 narrows the read to the authenticated caller \u2014 \`auth_context\`, \`actor_id\`, \`customer_id\` or
 \`company_id\` must appear in the handler. Without it a publishable key returns every tenant's rows.
-Global catalog entities are deliberately exempt; if the data is genuinely not customer data, it
-belongs on the admin surface.`,
+A route the caller proves entitlement to with EVIDENCE instead of a session \u2014 an order reference
+plus the email it was placed with \u2014 calls a predicate the config names in \`evidenceCalls\`; the rule
+trusts no predicate it was not given. Moving the read into the module beside the route does not
+answer the question: the rule follows a relative import one hop and reads the scoping there. Which
+files are the route surface, which entities are customer-owned and which names count as scoping are
+all options. Global catalog entities are deliberately exempt; if the data is genuinely not customer
+data, it belongs on the admin surface.`,
   meta: {
     docs: {
-      description: "A /store/** route that reads a customer-owned entity must narrow the read to the authenticated caller. Without it the handler returns every tenant\u2019s rows to anyone holding a publishable key. Global catalog entities are exempt."
+      description: "A /store/** route that reads a customer-owned entity must narrow the read to the authenticated caller, or verify caller-supplied evidence with a predicate the config names. Without either, the handler returns every tenant\u2019s rows to anyone holding a publishable key. The read is followed one hop into a relative sibling; global catalog entities are exempt."
     },
     messages: {
-      unscoped: 'Store route "{{file}}" reads the customer-owned entity "{{entity}}" without any caller scoping (no auth_context / actor_id / customer_id / company_id in the file). Narrow the read to the authenticated caller, or move it to /admin if it is genuinely not customer data.'
+      unscoped: 'Store route "{{file}}" reads the customer-owned entity "{{entity}}" without any caller scoping (no auth_context / actor_id / customer_id / company_id in the file, and no evidence check the config names). Narrow the read to the authenticated caller, name your evidence predicate in `evidenceCalls`, or move it to /admin if it is genuinely not customer data.',
+      unscopedSibling: 'Store route "{{file}}" reads the customer-owned entity "{{entity}}" through "{{through}}", and neither file narrows it to a caller. Scope the read where it happens, or name the predicate that checks the caller\u2019s evidence in `evidenceCalls`.'
     },
-    schema: [],
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          entities: { items: { type: "string" }, type: "array" },
+          evidenceCalls: { items: { type: "string" }, type: "array" },
+          routes: { items: { type: "string" }, type: "array" },
+          scopingCalls: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
     type: "problem"
+  },
+  probe(options) {
+    const bag = bagOf(options);
+    return {
+      path: pathMatching(firstOf(bag.routes, ROUTES), "route.ts"),
+      source: `export const GET = async (query: { graph: (c: unknown) => Promise<unknown> }) =>
+  query.graph({ entity: '${firstOf(bag.entities, ENTITIES)}' })
+`
+    };
   }
 };
 var store_route_scopes_tenant_data_default = storeRouteScopesTenantData;
@@ -5364,6 +5929,146 @@ table to \`schema/control/\`.`,
 };
 var tenant_tables_carry_org_id_default = tenantTablesCarryOrgId;
 
+// src/rules/test-no-clock-polling-for-promise-flips.ts
+var POLLERS = ["waitFor"];
+var TEST_GLOBS = [String.raw`\.(?:test|spec)\.[cm]?[jt]sx?$`, "/__tests__/"];
+var ASSERT = "expect";
+var FUNCTIONS2 = /* @__PURE__ */ new Set(["ArrowFunctionExpression", "FunctionDeclaration", "FunctionExpression"]);
+var walkWithin = (root, visit) => {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [root];
+  while (stack.length > 0) {
+    const at = stack.pop();
+    if (at === null || typeof at !== "object" || seen.has(at)) continue;
+    seen.add(at);
+    if (Array.isArray(at)) {
+      stack.push(...at);
+      continue;
+    }
+    const node = at;
+    if (typeof node.type === "string") {
+      if (at !== root && FUNCTIONS2.has(node.type)) continue;
+      visit(node);
+    }
+    for (const [key, value] of Object.entries(node)) {
+      if (key === "parent") continue;
+      if (value !== null && typeof value === "object") stack.push(value);
+    }
+  }
+};
+var rootCallOf = (node) => {
+  let at = node;
+  for (; ; ) {
+    const callee = at.callee;
+    if (callee?.type !== "MemberExpression") return at;
+    const object = callee.object;
+    if (object?.type !== "CallExpression") return at;
+    at = object;
+  }
+};
+var onlyAsserts = (body) => {
+  let calls = 0;
+  let asserts = 0;
+  walkWithin(body, (node) => {
+    if (node.type !== "CallExpression") return;
+    calls += 1;
+    if (calleeNameOf(rootCallOf(node)) === ASSERT) asserts += 1;
+  });
+  return calls > 0 && calls === asserts;
+};
+var promisesIn = (scope) => {
+  const created = /* @__PURE__ */ new Map();
+  const proven = /* @__PURE__ */ new Set();
+  walkWithin(scope, (node) => {
+    if (node.type === "VariableDeclarator") {
+      const id = node.id;
+      const init = node.init;
+      if (id?.type === "Identifier" && init?.type === "CallExpression") {
+        created.set(id.name, init);
+      }
+    }
+    if (node.type === "AwaitExpression") {
+      const argument = node.argument;
+      if (argument?.type === "Identifier") proven.add(argument.name);
+    }
+    if (node.type === "MemberExpression") {
+      const object = node.object;
+      const property = propertyNameOf(node);
+      if (object?.type === "Identifier" && (property === "then" || property === "catch" || property === "finally")) {
+        proven.add(object.name);
+      }
+    }
+    if (node.type === "CallExpression") {
+      const object = node.callee?.object;
+      if (object?.type === "Identifier" && object.name === "Promise") {
+        for (const argument of node.arguments ?? []) {
+          for (const element of argument.elements ?? [argument]) {
+            if (element?.type === "Identifier") proven.add(element.name);
+          }
+        }
+      }
+    }
+  });
+  return new Set([...created.keys()].filter((name) => proven.has(name)));
+};
+var testNoClockPollingForPromiseFlips = {
+  create(context) {
+    const options = bagOf(context.options);
+    const pollers = options.pollers ?? POLLERS;
+    const globs = options.testGlobs ?? TEST_GLOBS;
+    const filename = normalise(context.filename);
+    if (!globs.some((pattern) => new RegExp(pattern).test(filename))) return {};
+    const inScope = (node) => {
+      const held = promisesIn(node);
+      if (held.size === 0) return;
+      const [promise] = [...held].toSorted();
+      walkWithin(node, (inner) => {
+        if (inner.type !== "CallExpression") return;
+        if (!pollers.includes(calleeNameOf(inner) ?? "")) return;
+        const [callback] = inner.arguments ?? [];
+        if (callback === void 0 || !FUNCTIONS2.has(callback.type ?? "")) return;
+        if (!onlyAsserts(callback.body)) return;
+        context.report({
+          data: { poller: calleeNameOf(inner) ?? "", promise: promise ?? "" },
+          messageId: "clockPoll",
+          node: inner
+        });
+      });
+    };
+    return {
+      ArrowFunctionExpression: inScope,
+      FunctionDeclaration: inScope,
+      FunctionExpression: inScope
+    };
+  },
+  fixShape: `A test that already holds a promise awaits it; it does not poll a clock for the flip. A
+\`waitFor\` whose body is nothing but \`expect\` assertions, in a test that created a promise and proves
+it is one by awaiting or chaining it, is asking the scheduler a question the promise answers exactly:
+move the \`await\` above the assertions, or drain microtasks, and assert once. Keep \`waitFor\` for state
+nothing in the test can await \u2014 an element a click will render, a timer the runtime owns. Which files
+are tests is \`testGlobs\` and which calls poll is \`pollers\`, both defaulted.`,
+  meta: {
+    docs: {
+      description: "In a test file, a `waitFor` whose callback only asserts, in a scope that already holds a promise, is a clock poll for a flip the promise decides. Await the promise instead."
+    },
+    messages: {
+      clockPoll: 'This {{poller}} only asserts, and the test already holds the promise "{{promise}}". Await "{{promise}}" before asserting rather than polling the clock for the flip it decides \u2014 a poll that passes is a poll that was slower than the microtask, and a poll that fails is a timeout with no cause.'
+    },
+    schema: [
+      {
+        additionalProperties: false,
+        properties: {
+          pollers: { items: { type: "string" }, type: "array" },
+          testGlobs: { items: { type: "string" }, type: "array" }
+        },
+        type: "object"
+      }
+    ],
+    type: "problem"
+  }
+};
+var test_no_clock_polling_for_promise_flips_default = testNoClockPollingForPromiseFlips;
+
 // src/rules/time-through-the-door.ts
 var RULE20 = "time-through-the-door";
 var ACCEPTS6 = "{ door: string (a regex over the filename), exempt: string[] (regex sources, default the test paths: __tests__/, .test., .spec.), libraries: string[] (default ['dayjs']) }";
@@ -5395,6 +6100,7 @@ var timeThroughTheDoor = {
   create(context) {
     const door = requireOption(RULE20, context.options?.[0]?.door, "door", ACCEPTS6);
     const exempt = context.options?.[0]?.exempt ?? DEFAULT_EXEMPT;
+    const exemptModules = context.options?.[0]?.exemptModules ?? [];
     const libraries = requireOption(
       RULE20,
       context.options?.[0]?.libraries ?? DEFAULT_LIBRARIES,
@@ -5403,6 +6109,7 @@ var timeThroughTheDoor = {
     );
     const filename = normalise(context.filename);
     if (isDoor(filename, door)) return {};
+    if (exemptModules.some((module) => isModule(filename, module))) return {};
     if (exempt.some((pattern) => new RegExp(pattern).test(filename))) return {};
     const where = readable2(door);
     return {
@@ -5444,7 +6151,9 @@ the plugins, the zone and the formats. Import \`isoDate\` / \`today\` / \`addDay
 operation there. A second module that imports the library is a second configured library: plugin
 state is global, so the two disagree the moment one of them extends something the other did not.
 Name the library in \`libraries\` (default \`['dayjs']\`) \u2014 a repo on date-fns or luxon says so and
-gets the whole rule rather than its raw-\`Date\` half.
+gets the whole rule rather than its raw-\`Date\` half. Name the modules that are outside the door in
+\`exemptModules\`, one per entry: \`exempt\` still takes patterns and still grants its exemption to
+wherever the pattern stops, which is a boundary nobody decided and nobody counts.
 
 Three kinds of time, never mixed. An INSTANT is epoch milliseconds. A BUSINESS DATE is an ISO date
 string, \`YYYY-MM-DD\`, parsed strictly in UTC \u2014 a calendar day is not an instant and rendering one as
@@ -5455,6 +6164,12 @@ The clock is injected, never ambient. Take \`nowMs: number\` as a parameter and
 root pass \`Date.now()\` in \u2014 \`Date.now()\` is the one call allowed anywhere, and a function that reads
 it internally cannot be tested at a chosen instant.`,
   meta: {
+    /**
+     * #139: which option grants by PATTERN and which one ENUMERATES. Declared on the rule so the
+     * doctor needs no list of its own — a rule that gains a path grant and forgets to say so is a
+     * grant nothing counts, which is the defect this pair exists to end.
+     */
+    grants: { modules: "exemptModules", paths: "exempt" },
     docs: {
       description: "Time is handled behind one module \u2014 the `door` option names it \u2014 and nothing else constructs, parses or formats a Date or imports dayjs. Date.now() is the one call allowed everywhere. Enabled without a `door` it refuses the run."
     },
@@ -5468,6 +6183,7 @@ it internally cannot be tested at a chosen instant.`,
         properties: {
           door: { type: "string" },
           exempt: { items: { type: "string" }, type: "array" },
+          exemptModules: { items: { type: "string" }, type: "array" },
           libraries: { items: { type: "string" }, type: "array" }
         },
         type: "object"
@@ -5976,7 +6692,7 @@ export const geonosisProbeTodo = 1
 var todo_names_its_plan_default = todoNamesItsPlan;
 
 // src/rules/lib/colors.ts
-var FUNCTIONS = [
+var FUNCTIONS3 = [
   "color",
   "color-mix",
   "hsl",
@@ -5990,7 +6706,7 @@ var FUNCTIONS = [
   "rgba"
 ];
 var HEX = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/i;
-var FUNCTION_CALL = new RegExp(`\\b(?:${FUNCTIONS.join("|")})\\(`, "i");
+var FUNCTION_CALL = new RegExp(`\\b(?:${FUNCTIONS3.join("|")})\\(`, "i");
 var HEX_ANYWHERE = /(?:^|[\s(,])#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})\b/i;
 var NAMED2 = /* @__PURE__ */ new Set([
   "aliceblue",
@@ -6147,7 +6863,7 @@ var isColorLiteral = (value) => {
   if (trimmed === "") return false;
   if (HEX.test(trimmed)) return true;
   if (NAMED2.has(trimmed.toLowerCase())) return true;
-  return new RegExp(`^(?:${FUNCTIONS.join("|")})\\(`, "i").test(trimmed);
+  return new RegExp(`^(?:${FUNCTIONS3.join("|")})\\(`, "i").test(trimmed);
 };
 var containsColorLiteral = (value) => HEX_ANYWHERE.test(value) || FUNCTION_CALL.test(value);
 var COLOR_PROPERTIES = /* @__PURE__ */ new Set([
@@ -6232,10 +6948,11 @@ var tokenOffence = (value, prefixes, local) => {
 };
 var tokensOnlyColors = {
   create(context) {
-    const { allow = [], tokenPrefix } = context.options?.[0] ?? {};
+    const { allow = [], exemptModules = [], tokenPrefix } = context.options?.[0] ?? {};
     const prefixes = [requireOption("tokens-only-colors", tokenPrefix, "tokenPrefix")].flat();
     requireOption("tokens-only-colors", prefixes, "tokenPrefix");
     const filename = normalise(context.filename);
+    if (exemptModules.some((module) => isModule(filename, module))) return {};
     if (allow.some((path2) => filename.includes(path2))) return {};
     return {
       JSXOpeningElement(node) {
@@ -6269,11 +6986,19 @@ var tokensOnlyColors = {
 \`style={{ color: 'var(--mc-primary)' }}\`, \`className="bg-brand-primary"\`. A \`var()\` that is NOT a
 token (\`var(--legacy-blue)\`) is the same offence spelled differently: it reaches around the theme, so
 the brand switches and the component does not \u2014 add the value to the theme and point at it there.
-Configure \`tokenPrefix\` with the prefixes your themed properties use, and put the token layer itself
-in \`allow\`, because that is the one place a literal belongs. Enabled with no \`tokenPrefix\` the rule
+Configure \`tokenPrefix\` with the prefixes your themed properties use, and NAME the token layer's
+modules in \`exemptModules\`, one per entry, because that is the one place a literal belongs \u2014
+\`allow\` still takes patterns and still grants its exemption to wherever the pattern stops, which is
+a boundary nobody decided and nobody counts. Enabled with no \`tokenPrefix\` the rule
 refuses the run: it cannot tell a token from a foreign variable, and a rule that cannot tell reads
 exactly like a clean tree.`,
   meta: {
+    /**
+     * #139: which option grants by PATTERN and which one ENUMERATES. Declared on the rule so the
+     * doctor needs no list of its own — a rule that gains a path grant and forgets to say so is a
+     * grant nothing counts, which is the defect this pair exists to end.
+     */
+    grants: { modules: "exemptModules", paths: "allow" },
     docs: {
       description: "Colours in a component come from the token layer. A colour literal in a className or an inline style fires, and so does a var() naming a custom property outside the configured token prefixes. Configure `tokenPrefix`; put the token layer in `allow`. Enabled without `tokenPrefix` it refuses the run."
     },
@@ -6286,6 +7011,7 @@ exactly like a clean tree.`,
         additionalProperties: false,
         properties: {
           allow: { items: { type: "string" }, type: "array" },
+          exemptModules: { items: { type: "string" }, type: "array" },
           tokenPrefix: {
             anyOf: [
               { type: "string" },
@@ -6666,6 +7392,7 @@ var rules = refusingOnce(
     "emit-declares-attempts": emit_declares_attempts_default,
     "font-roles-only": font_roles_only_default,
     "layer-walls": layer_walls_default,
+    "list-take-without-order": list_take_without_order_default,
     "max-comment-density": max_comment_density_default,
     "molecule-atoms-only": molecule_atoms_only_default,
     "molecule-must-compose": molecule_must_compose_default,
@@ -6679,7 +7406,9 @@ var rules = refusingOnce(
     "no-card-shaped-div": no_card_shaped_div_default,
     "no-cross-feature-stores": no_cross_feature_stores_default,
     "no-d1-transaction": no_d1_transaction_default,
+    "no-date-string-compare": no_date_string_compare_default,
     "no-duplicate-jsx-patterns": no_duplicate_jsx_patterns_default,
+    "no-generic-utility-package": no_generic_utility_package_default,
     "no-hook-in-component-disguise": no_hook_in_component_disguise_default,
     "no-index-count-as-exact": no_index_count_as_exact_default,
     "no-inert-hidden-jsx": no_inert_hidden_jsx_default,
@@ -6694,6 +7423,8 @@ var rules = refusingOnce(
     "no-react-namespace": no_react_namespace_default,
     "no-renamed-html-props": no_renamed_html_props_default,
     "no-render-prop-reader": no_render_prop_reader_default,
+    "no-swallowed-catch": no_swallowed_catch_default,
+    "no-runtime-dead-affordance": no_runtime_dead_affordance_default,
     "no-trivial-wrapper-component": no_trivial_wrapper_component_default,
     "no-ts-in-bio-folders": no_ts_in_bio_folders_default,
     "no-type-definitions-in-components": no_type_definitions_in_components_default,
@@ -6714,6 +7445,7 @@ var rules = refusingOnce(
     "subscriber-declares-id": subscriber_declares_id_default,
     "tables-declare-their-plane": tables_declare_their_plane_default,
     "tenant-tables-carry-org-id": tenant_tables_carry_org_id_default,
+    "test-no-clock-polling-for-promise-flips": test_no_clock_polling_for_promise_flips_default,
     "time-through-the-door": time_through_the_door_default,
     "tokens-only-colors": tokens_only_colors_default,
     "tissue-must-compose": tissue_must_compose_default,