@intentset/architecture 0.8.0 → 0.9.0

package/src/boundaries.ts

@@ -20,12 +20,24 @@
  *              package first, since that is the surface it should use.
  *   5. AMP006  a policy or model file importing its slice's client seam or
  *              infrastructure, or a backend SDK.
- *   6. VSA006  an edge inside one slice that the layer matrix does not allow.
+ *   6. VSA006  an edge inside one slice that the layer matrix does not allow;
+ *              or, where the edge's own target is allowed or in no layer (an
+ *              entrypoint, a barrel in a permitted layer, another slice's
+ *              entrypoint), a name it takes that is defined in a layer the
+ *              importer's may not import. The file that defines a name
+ *              decides, however many files pass it on, and another slice's
+ *              contract does not widen what a layer may reach (VSA §5,
+ *              profile §3). A name that cannot be followed is listed as not
+ *              checked.
  *
  * Beside those: TS002 (warning) when one slice reaches another's entrypoint
  * by relative path although an alias for it is configured; AMP002 when a
- * slice file outside its client seam imports a backend SDK; TS001 (warning)
- * when an entrypoint re-exports with `export *`.
+ * slice file outside its client seam imports a backend SDK; TS007 when a
+ * slice file imports a package its layer's `forbiddenPackages` names, such as
+ * a UI framework in a policy, a model or the client seam; TS001 (warning)
+ * when an entrypoint re-exports with `export *`. TS008, a slice file outside
+ * presentation that renders JSX, is `checkJsx`: it reads the file, not an
+ * edge.
  *
  * Test files get the separate pass profile §3 asks for: they may import
  * their own slice's internals, and VSA003 and TS003 still apply to anyone
@@ -40,9 +52,10 @@
  */
 import { isAreaSchema } from "./areas.ts";
 import { type Finding, finding, listSome } from "./finding.ts";
-import type { ImportEdge } from "./imports.ts";
-import { inSeam, isPure, knownLayer, layerAllows, layerOf } from "./layers.ts";
-import { matchAny, matchPattern } from "./patterns.ts";
+import { type ImportEdge, takenBy } from "./imports.ts";
+import { fileLayer, inSeam, isPure, knownLayer, layerAllows, layerOf } from "./layers.ts";
+import { NameIndex } from "./names.ts";
+import { compareStrings, matchAny, matchPattern } from "./patterns.ts";
 import { describePackage, type Model, type Region, type SliceInfo } from "./regions.ts";
 import type { Resolver } from "./resolve.ts";
 
@@ -61,6 +74,8 @@ export interface BoundaryResult {
   fileEdges: number;
   /** Those between two different slices. */
   crossSliceEdges: number;
+  /** Names a layered file takes that could not be followed to the file that defines them: not checked, never passed. */
+  untraced: string[];
 }
 
 function how(edge: ImportEdge): string {
@@ -118,9 +133,15 @@ function describeRegion(region: Region): string {
   }
 }
 
-export function checkBoundaries(model: Model, edges: readonly ImportEdge[], resolver: Resolver): BoundaryResult {
+export function checkBoundaries(
+  model: Model,
+  edges: readonly ImportEdge[],
+  resolver: Resolver,
+  names: NameIndex = new NameIndex(edges, new Map()),
+): BoundaryResult {
   const { config } = model;
   const findings: Finding[] = [];
+  const untraced: string[] = [];
   const sliceEdges = new Map<string, SliceEdge>();
   let fileEdges = 0;
   let crossSliceEdges = 0;
@@ -144,7 +165,10 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
       if (source !== undefined && inSeam(source, from) && matchAny(config.responseParserModules, to)) return null;
     }
     const who = test ? `Test file ${from}` : from;
-    const subject = { edges: [{ from, to }, ...(owner !== null ? [{ from: owner, to: target.id }] : [])] };
+    const subject = {
+      edges: [{ from, to }, ...(owner !== null ? [{ from: owner, to: target.id }] : [])],
+      taken: takenBy(edge),
+    };
     const why = "It is a warning because the importer lies outside the declared scope (VSA §9).";
     if (isScreen(to)) {
       if (!test && matchAny(config.routerFiles, from)) return null;
@@ -171,6 +195,76 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
     });
   };
 
+  /** What the layer matrix lets `layer` import, itself first. */
+  const allowedFrom = (layer: string): string[] =>
+    [layer, ...(config.layerMatrix[layer] ?? [])].filter((value, i, all) => all.indexOf(value) === i);
+
+  // VSA006 for the names an edge takes through files that pass them on: each is judged by the layer of the file
+  // that defines it, in the importer's slice or in the slice whose entrypoint it came through.
+  const passedOn = (edge: ImportEdge, source: SliceInfo): Finding | null => {
+    const from = edge.from;
+    const a = layerOf(source, from);
+    if (a.layer === null || !knownLayer(config, a.layer)) return null;
+    type Refused = { names: string[]; typed: string[]; through: string[]; layer: string; owner: SliceInfo };
+    const refused = new Map<string, Refused>();
+    for (const definition of names.definitions(edge)) {
+      const { origin } = definition;
+      if (origin.kind === "untraced") {
+        const what = definition.name === "*" ? "the names" : `the name ${definition.name}`;
+        untraced.push(
+          `${from}:${edge.line}: ${what} "${edge.specifier}" passes on could not be followed to the file that defines ${definition.name === "*" ? "them" : "it"} (${origin.why}), so ${definition.name === "*" ? "their layers were" : "its layer was"} not checked`,
+        );
+        continue;
+      }
+      // A name the edge's own target defines is judged with the edge itself; a package's, by the package rules.
+      if (origin.kind === "package" || origin.through.length === 0) continue;
+      const owner = sliceOf(model.regionOf(origin.file));
+      if (owner === undefined) continue;
+      const b = layerOf(owner, origin.file);
+      if (b.layer === null || !knownLayer(config, b.layer) || layerAllows(config, a.layer, b.layer)) continue;
+      const entry = refused.get(origin.file) ?? {
+        names: [],
+        typed: [],
+        through: origin.through,
+        layer: b.layer,
+        owner,
+      };
+      entry.names.push(definition.name);
+      entry.typed.push(`${definition.typeOnly ? "type " : ""}${definition.name} from ${origin.file}`);
+      refused.set(origin.file, entry);
+    }
+    if (refused.size === 0) return null;
+    const files = [...refused.keys()].sort(compareStrings);
+    const foreign = files.some((file) => refused.get(file)?.owner.id !== source.id);
+    const parts = files.map((file) => {
+      const entry = refused.get(file) as Refused;
+      const of = entry.owner.id === source.id ? "" : ` of ${entry.owner.id}`;
+      const via = entry.through.length > 1 ? ` by way of ${entry.through.slice(1).join(", ")}` : "";
+      return `${entry.names.join(", ")} from ${file}, in the ${entry.layer} layer${of}${via}`;
+    });
+    const owners = [...new Set(files.map((file) => refused.get(file)?.owner.id as string))].filter(
+      (id) => id !== source.id,
+    );
+    return finding({
+      code: "VSA006",
+      artifact: source.id,
+      path: from,
+      location: { line: edge.line },
+      message: `${from} is in the ${a.layer} layer of ${source.id} and ${how(edge)}, which passes on ${parts.join("; and ")}.`,
+      remediation: `The ${a.layer} layer may import ${allowedFrom(a.layer).join(", ")}, whichever file passes a name on${foreign ? ", and another slice's contract does not widen that" : ""}; take what it needs from a layer it may import, such as a use-case that makes the call (profile §3).`,
+      edges: [
+        { from, to: edge.to as string },
+        ...files.map((file) => ({ from, to: file })),
+        ...owners.map((id) => ({ from: source.id, to: id })),
+      ],
+      // Each name with the file that defines it, so a name passed on from another file is a new entry.
+      taken: {
+        ...takenBy(edge),
+        names: files.flatMap((file) => (refused.get(file) as Refused).typed).sort(compareStrings),
+      },
+    });
+  };
+
   for (const edge of edges) {
     const from = edge.from;
     if (!model.inScope(from)) {
@@ -195,6 +289,7 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
             message: `Test file ${from} ${how(edge)}, a screen of ${target.id}, and tests must not bypass another slice's contract.`,
             remediation: `Test ${target.id}'s screens from ${target.id}'s own tests, or drive them through the router (profile §3).`,
             edges: [{ from, to: edge.to }],
+            taken: takenBy(edge),
           }),
         );
       } else if (!target.meta.entrypoints.includes(edge.to)) {
@@ -207,6 +302,7 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
             message: `Test file ${from} ${how(edge)}, a private file of ${target.id}; ${describeSurfaces(model, target, from)}.`,
             remediation: `${importInstead(model, target, from)} instead; tests may reach only their own slice's internals (profile §3).`,
             edges: [{ from, to: edge.to }],
+            taken: takenBy(edge),
           }),
         );
       }
@@ -228,16 +324,14 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
           message: `The entrypoint of ${source.id} re-exports everything from "${edge.specifier}" with a wildcard, which can publish private modules as contract.`,
           remediation: "Export the reviewed names explicitly (VSA §4, TS001).",
           edges: [{ from, to: edge.to ?? edge.specifier }],
+          taken: takenBy(edge),
         }),
       );
     }
 
     if (edge.to === null) {
-      if (
-        source !== undefined &&
-        !model.underBackend(from) &&
-        matchAny(config.backendSdks, edge.specifier.replace(/^node:/, ""))
-      ) {
+      const specifier = edge.specifier.replace(/^node:/, "");
+      if (source !== undefined && !model.underBackend(from) && matchAny(config.backendSdks, specifier)) {
         if (isPure(source, from)) {
           findings.push(
             finding({
@@ -249,6 +343,7 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
               remediation:
                 "Keep SDK and generated client types out of policies and models; adapt them in the client seam (AMP006).",
               edges: [{ from, to: edge.specifier }],
+              taken: takenBy(edge),
             }),
           );
         } else if (!inSeam(source, from)) {
@@ -261,9 +356,28 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
               message: `${from} ${how(edge)}, a backend SDK, outside the client seam of ${source.id}.`,
               remediation: `Move the backend call into ${source.id}'s client seam and call that from here (AMP002, VSA010).`,
               edges: [{ from, to: edge.specifier }],
+              taken: takenBy(edge),
             }),
           );
         }
+        continue;
+      }
+      const layer = source !== undefined && !model.underBackend(from) ? fileLayer(source, from) : null;
+      const pattern =
+        layer === null ? undefined : (config.forbiddenPackages[layer] ?? []).find((p) => matchPattern(p, specifier));
+      if (source !== undefined && layer !== null && pattern !== undefined) {
+        findings.push(
+          finding({
+            code: "TS007",
+            artifact,
+            path: from,
+            location,
+            message: `${from} is in the ${layer} layer of ${source.id} and ${how(edge)}, a package the ${layer} layer may not import (forbiddenPackages: ${pattern}).`,
+            remediation: forbiddenRemediation(layer, specifier),
+            edges: [{ from, to: edge.specifier }],
+            taken: takenBy(edge),
+          }),
+        );
       }
       continue;
     }
@@ -280,7 +394,10 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
       sliceEdges.set(key, entry);
     }
     if (!model.inScope(to) && target === undefined) continue;
-    const subject = { edges: [{ from, to }, ...(source && target ? [{ from: source.id, to: target.id }] : [])] };
+    const subject = {
+      edges: [{ from, to }, ...(source && target ? [{ from: source.id, to: target.id }] : [])],
+      taken: takenBy(edge),
+    };
 
     // 1. AMP001, and AMP011 for an area repository's schema bridge (profile §9). The shared backend
     // package is backend code: what it may import is AMP008's question.
@@ -415,6 +532,10 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
           );
         }
       }
+      if (source !== undefined) {
+        const passed = passedOn(edge, source);
+        if (passed !== null) findings.push(passed);
+      }
       continue;
     }
 
@@ -455,12 +576,13 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
     if (target !== undefined) {
       const a = layerOf(source, from);
       const b = layerOf(source, to);
-      if (a.layer === null || b.layer === null || !knownLayer(config, a.layer) || !knownLayer(config, b.layer))
-        continue;
-      if (!layerAllows(config, a.layer, b.layer)) {
-        const allowed = [a.layer, ...(config.layerMatrix[a.layer] ?? [])].filter(
-          (value, i, all) => all.indexOf(value) === i,
-        );
+      if (
+        a.layer !== null &&
+        b.layer !== null &&
+        knownLayer(config, a.layer) &&
+        knownLayer(config, b.layer) &&
+        !layerAllows(config, a.layer, b.layer)
+      ) {
         findings.push(
           finding({
             code: "VSA006",
@@ -468,15 +590,62 @@ export function checkBoundaries(model: Model, edges: readonly ImportEdge[], reso
             path: from,
             location,
             message: `${from} is in the ${a.layer} layer of ${source.id} and ${how(edge)}, which is in the ${b.layer} layer.`,
-            remediation: `The ${a.layer} layer may import ${allowed.join(", ")}; move the dependency so it flows downward (profile §3).`,
+            remediation: `The ${a.layer} layer may import ${allowedFrom(a.layer).join(", ")}; move the dependency so it flows downward (profile §3).`,
             ...subject,
           }),
         );
+        continue;
       }
+      const passed = passedOn(edge, source);
+      if (passed !== null) findings.push(passed);
     }
   }
 
-  return { findings, sliceEdges, fileEdges, crossSliceEdges };
+  return { findings, sliceEdges, fileEdges, crossSliceEdges, untraced: [...new Set(untraced)].sort(compareStrings) };
+}
+
+function forbiddenRemediation(layer: string, specifier: string): string {
+  if (layer === "policy" || layer === "model") {
+    return `Policies and models stay free of UI and transport: keep what needs "${specifier}" in the presentation layer and pass plain values in (profile §3, TS007).`;
+  }
+  if (layer === "external") {
+    return `The client seam is transport: return plain values from it, and let a hook in the presentation layer hold the state "${specifier}" provides (profile §3, TS007).`;
+  }
+  return `Move what needs "${specifier}" to a layer that may import it, or change forbiddenPackages in .intentset/architecture.yaml if the policy is wrong (TS007).`;
+}
+
+/** The profile's layers other than presentation, which render no JSX (TS008). A layer of the repository's own naming is not judged. */
+const NO_JSX_LAYERS = ["application", "policy", "model", "external"];
+
+/**
+ * TS008: a slice file outside the presentation layer that renders JSX. The automatic runtime needs no import for it,
+ * so this reads the file rather than an edge. Composition, shared code and tests may render; a file in no layer is
+ * VSA006's warning already.
+ */
+export function checkJsx(model: Model, jsx: ReadonlyMap<string, number>): Finding[] {
+  const findings: Finding[] = [];
+  for (const path of [...jsx.keys()].sort(compareStrings)) {
+    if (!model.inScope(path) || model.isTest(path) || model.underBackend(path)) continue;
+    const region = model.regionOf(path);
+    const slice = region.kind === "slice" ? model.sliceById.get(region.owner as string) : undefined;
+    if (slice === undefined || slice.meta.entrypoints.includes(path)) continue;
+    const layer = fileLayer(slice, path);
+    if (layer === null || !NO_JSX_LAYERS.includes(layer)) continue;
+    findings.push(
+      finding({
+        code: "TS008",
+        artifact: slice.id,
+        path,
+        location: { line: jsx.get(path) as number },
+        message: `${path} is in the ${layer} layer of ${slice.id} and renders JSX, which only the presentation layer may.`,
+        remediation:
+          layer === "external"
+            ? "The client seam is transport: return data from it and render it in a component under the presentation layer (profile §3, TS008)."
+            : "Move the markup into a component in the presentation layer, and pass it the values this file computes (profile §3, TS008).",
+      }),
+    );
+  }
+  return findings;
 }
 
 /** One warning per slice whose code files are in no declared layer, or in a layer the matrix does not know (VSA006). */

package/src/check.ts

@@ -21,14 +21,21 @@ import {
   sortDiagnostics,
 } from "@intentset/core";
 import { AREA_REVIEW_REQUIRED, checkAreas } from "./areas.ts";
-import { applyBaseline, type BaselineEntry, type Mode } from "./baseline.ts";
-import { checkBoundaries, checkUnclassified } from "./boundaries.ts";
+import {
+  applyBaseline,
+  type BaselineEntry,
+  type BaselineSubject,
+  type Mode,
+  staleEntryDiagnostics,
+} from "./baseline.ts";
+import { checkBoundaries, checkJsx, checkUnclassified } from "./boundaries.ts";
 import { checkClaims } from "./claims.ts";
 import { ARCHITECTURE_CONFIG_PATH, type ArchitectureConfig, readArchitectureConfig, resolveConfig } from "./config.ts";
 import { checkDependencies } from "./dependencies.ts";
 import { applyExceptions, type ExceptionRecord, readExceptionRecord, readExceptions } from "./exceptions.ts";
 import { type Finding, finding } from "./finding.ts";
 import { buildImportGraph, type ImportEdge } from "./imports.ts";
+import { NameIndex } from "./names.ts";
 import { checkOwnership } from "./ownership.ts";
 import { isCode } from "./paths.ts";
 import { compareStrings } from "./patterns.ts";
@@ -43,6 +50,8 @@ export interface CheckOptions {
   /** Exception records handed in, in addition to architecture/exceptions/*.yaml in the tree. */
   exceptions?: readonly (ExceptionRecord | Record<string, unknown>)[];
   baseline?: readonly BaselineEntry[];
+  /** The baseline file's repository-relative path, which a stale entry's VSA014 names. Default none. */
+  baselinePath?: string;
   /** "migration" applies the baseline; "strict" ignores it. Default migration. */
   mode?: Mode;
   /** The date exceptions expire against, YYYY-MM-DD. Default today, UTC. */
@@ -72,7 +81,7 @@ export interface ArchitectureSummary {
   excepted: number;
   /** Diagnostics the baseline turned into warnings (migration mode only). */
   baselined: number;
-  /** Baseline entries that matched nothing and can be retired. */
+  /** Baseline entries that matched nothing: each is a VSA014 error until the baseline is written without it. */
   baselineStale: number;
   /** What could not be checked: never a pass (invariant 6). */
   unresolved: string[];
@@ -85,6 +94,11 @@ export interface ArchitectureResult {
   summary: ArchitectureSummary;
   /** The resolved import graph, for reports and impact views. */
   edges: ImportEdge[];
+  /**
+   * What each diagnostic that came from a finding is about, keyed by the diagnostic objects in `diagnostics`: what
+   * `writeBaseline` needs to write entries a later run matches (VSA §9).
+   */
+  subjects: ReadonlyMap<Diagnostic, BaselineSubject>;
   /**
    * Where every file falls, sorted by path: each production file's region and
    * owner, every test file with the slice its claims match, and nothing for a
@@ -163,8 +177,10 @@ export function checkArchitecture(
 
   findings.push(...checkClaims(model, graph, registriesPath));
   findings.push(...checkOwnership(model, graph, level));
-  const boundaries = checkBoundaries(model, imports.edges, resolver);
+  const boundaries = checkBoundaries(model, imports.edges, resolver, new NameIndex(imports.edges, imports.exports));
   findings.push(...boundaries.findings);
+  unresolved.push(...boundaries.untraced);
+  findings.push(...checkJsx(model, imports.jsx));
   findings.push(...checkUnclassified(model));
   const areaCheck = checkAreas(model, imports.edges);
   findings.push(...areaCheck.findings);
@@ -190,8 +206,19 @@ export function checkArchitecture(
     ...recordProblems.map((item) => item.diagnostic),
     ...excepted.recordFindings.map((item) => item.diagnostic),
   ];
-  const baseline = applyBaseline(diagnostics, options.baseline ?? [], mode);
-  diagnostics = sortDiagnostics(baseline.diagnostics);
+  const about = new Map<Diagnostic, BaselineSubject>();
+  for (const item of [...excepted.findings, ...recordProblems, ...excepted.recordFindings]) {
+    about.set(item.diagnostic, { edges: item.edges, ...(item.taken !== undefined ? { taken: item.taken } : {}) });
+  }
+  const baseline = applyBaseline(diagnostics, options.baseline ?? [], mode, (diagnostic) => about.get(diagnostic));
+  // applyBaseline maps one for one, so the subjects follow the diagnostics it returns.
+  const subjects = new Map<Diagnostic, BaselineSubject>();
+  baseline.diagnostics.forEach((diagnostic, i) => {
+    const subject = about.get(diagnostics[i]);
+    if (subject !== undefined) subjects.set(diagnostic, subject);
+  });
+  const stale = staleEntryDiagnostics(baseline.stale, options.baseline ?? [], options.baselinePath ?? null);
+  diagnostics = sortDiagnostics([...baseline.diagnostics, ...stale]);
 
   const owned = (path: string) => {
     const kind = model.regionOf(path).kind;
@@ -224,7 +251,7 @@ export function checkArchitecture(
     ownership.push({ path, region: region.kind, owner: region.owner ?? null });
   }
   ownership.sort((a, b) => compareStrings(a.path, b.path));
-  return { diagnostics, summary, edges: imports.edges, ownership };
+  return { diagnostics, summary, edges: imports.edges, ownership, subjects };
 }
 
 /**

package/src/config.ts

@@ -53,6 +53,11 @@ export interface ArchitectureConfig {
   backendSdks: string[];
   /** The internal layer matrix (profile §3): each layer may import itself and the layers listed. */
   layerMatrix: Record<string, string[]>;
+  /**
+   * Packages a layer may not import, by layer name: specifier patterns matched, as backendSdks are, against the
+   * specifier as written with `node:` removed (TS007). A layer not named may import any package.
+   */
+  forbiddenPackages: Record<string, string[]>;
   /** Export conditions tried first when resolving a workspace package's entry, before types, import and default. */
   conditions: string[];
   /** Areas (profile §9). Empty for a repository with one backend, which none of AMP007 to AMP013 concern. */
@@ -63,6 +68,21 @@ export interface ArchitectureConfig {
   schemaBridge: string | null;
 }
 
+/**
+ * The UI frameworks profile §3 keeps out of policies, models and the client seam by default. A repository adds its
+ * UI kit and data-fetching hooks (`@mui/**`, `@tanstack/react-query/**`) in `forbiddenPackages`.
+ */
+export const UI_FRAMEWORKS = [
+  "react/**",
+  "react-dom/**",
+  "react-native/**",
+  "preact/**",
+  "vue/**",
+  "svelte/**",
+  "solid-js/**",
+  "@angular/**",
+];
+
 export const DEFAULT_ARCHITECTURE_CONFIG: ArchitectureConfig = {
   scope: ["**"],
   sourceRoots: ["src/**"],
@@ -83,6 +103,7 @@ export const DEFAULT_ARCHITECTURE_CONFIG: ArchitectureConfig = {
     model: ["model"],
     external: ["external", "model"],
   },
+  forbiddenPackages: { policy: UI_FRAMEWORKS, model: UI_FRAMEWORKS, external: UI_FRAMEWORKS },
   conditions: [],
   areas: [],
   sharedBackend: [],
@@ -121,7 +142,9 @@ const PATTERN_KEYS = new Set<string>([
   "sharedBackend",
 ]);
 
-const KNOWN_KEYS = [...LIST_KEYS, "screensGlob", "layerMatrix", "areas", "schemaBridge"].sort(compareStrings);
+const KNOWN_KEYS = [...LIST_KEYS, "screensGlob", "layerMatrix", "forbiddenPackages", "areas", "schemaBridge"].sort(
+  compareStrings,
+);
 
 /** The defaults with a partial configuration laid over them; a key given replaces the default whole. */
 export function resolveConfig(...layers: (Partial<ArchitectureConfig> | undefined)[]): ArchitectureConfig {
@@ -223,6 +246,26 @@ export function readArchitectureConfig(
       } else config.layerMatrix = matrix;
       continue;
     }
+    if (key === "forbiddenPackages") {
+      const lists = readMatrix(value);
+      const bad =
+        lists === null
+          ? undefined
+          : Object.values(lists)
+              .flat()
+              .find((pattern) => pattern === "" || validatePattern(pattern) !== null);
+      if (lists === null || bad !== undefined) {
+        report(
+          field,
+          at(field),
+          lists === null
+            ? "forbiddenPackages must map each layer name to a list of package patterns."
+            : `Pattern ${bad} in \`forbiddenPackages\` ${bad === "" ? "is empty" : validatePattern(bad as string)}.`,
+          'Write each layer as `policy: [react/**, "@mui/**"]`.',
+        );
+      } else config.forbiddenPackages = lists;
+      continue;
+    }
     if (!Array.isArray(value) || !value.every((item) => typeof item === "string" && item !== "")) {
       report(field, at(field), `\`${key}\` must be a list of non-empty strings.`, `Write ${key} as a sequence.`);
       continue;