@jterrazz/test 10.1.0 → 12.0.0

package/dist/oxlint.cjs

@@ -4,6 +4,63 @@ Object.defineProperties(exports, {
 });
 let node_path = require("node:path");
 let node_fs = require("node:fs");
+//#region src/lint/fs-cache.ts
+/**
+* Cached filesystem probes for the fs-anchored rules (a9w, c2, c6, c7, i2).
+*
+* Rules only ever look at directories NEXT TO files oxlint is already
+* visiting (a feature's `requests/`, `seeds/`, `expected/`, a sibling module
+* file), so the probe set is small — but several rules probe the same feature
+* directory, and oxlint lints many files per process. A module-level cache
+* keeps each `readdir`/`stat` to one syscall per lint run.
+*/
+const dirListings = /* @__PURE__ */ new Map();
+function listDirectory(dir) {
+	const cached = dirListings.get(dir);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = (0, node_fs.readdirSync)(dir);
+	} catch {
+		result = null;
+	}
+	dirListings.set(dir, result);
+	return result;
+}
+const kinds = /* @__PURE__ */ new Map();
+function kindOf(path) {
+	const cached = kinds.get(path);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = (0, node_fs.statSync)(path).isDirectory() ? "dir" : "file";
+	} catch {
+		result = "missing";
+	}
+	kinds.set(path, result);
+	return result;
+}
+function isDirectory(path) {
+	return kindOf(path) === "dir";
+}
+function isFile(path) {
+	return kindOf(path) === "file";
+}
+const fileContents = /* @__PURE__ */ new Map();
+/** Read a file as UTF-8, cached. Returns null when unreadable (missing/binary). */
+function readFileCached(path) {
+	const cached = fileContents.get(path);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = (0, node_fs.readFileSync)(path, "utf8");
+	} catch {
+		result = null;
+	}
+	fileContents.set(path, result);
+	return result;
+}
+//#endregion
 //#region src/lint/ast.ts
 /**
 * Shared AST helpers for the rule files. Everything here is pure and
@@ -14,6 +71,39 @@ let node_fs = require("node:fs");
 function segments(path) {
 	return path.split(/[/\\]/).filter(Boolean);
 }
+/**
+* The `specs/` directory a file belongs to: the NEAREST ancestor named `specs`,
+* searched no higher than the nearest `package.json`. `undefined` when the file
+* is not under one.
+*
+* One anchor for every specs-aware rule. Rules used to hand-roll the search and
+* disagreed with each other — `lastIndexOf('specs')` (C1) took the innermost
+* match, `indexOf('specs')` (F3) the outermost, so one nested tree read as two
+* different facets. And any bare "is `specs` a segment of this path" test
+* matched directories that have nothing to do with the project: a checkout
+* living under `~/specs/` turned the whole repository into a specs tree, which
+* silently disabled F2's protection of production code. The package boundary
+* makes the search stop where the project does.
+*/
+function specsAnchor(filename) {
+	const relative = [(0, node_path.basename)(filename)];
+	let directory = (0, node_path.dirname)(filename);
+	for (;;) {
+		if ((0, node_path.basename)(directory) === "specs") return {
+			directory,
+			relative
+		};
+		if (isFile((0, node_path.join)(directory, "package.json"))) return;
+		const parent = (0, node_path.dirname)(directory);
+		if (parent === directory) return;
+		relative.unshift((0, node_path.basename)(directory));
+		directory = parent;
+	}
+}
+/** Is this file inside a `specs/` tree? — the predicate form of {@link specsAnchor}. */
+function isUnderSpecs(filename) {
+	return specsAnchor(filename) !== void 0;
+}
 /** The string value of a plain string literal (or a template with no holes). */
 function stringValue(node) {
 	if (node === void 0) return;
@@ -250,11 +340,25 @@ const RULE_DOCS = {
 	},
 	"c1-domain-structure": {
 		channel: "statique",
-		convention: "Un `*.test.ts` vit à la profondeur facet/domain, un `*.specification.ts` au root de la facette ; toute autre profondeur est une erreur.",
+		convention: "La forme de l’arbre `specs/` se déclare via l’option `depth` : `facet-domain` (défaut — `*.test.ts` à la profondeur facet/domain, `*.specification.ts` au root de la facette), `mirror` (test à toute profondeur ≥ 1, nommé d’après son dossier), `off`.",
 		family: "C",
 		id: "C1",
 		rationale: "Une profondeur fixe rend la place de chaque fichier prévisible et détectable statiquement."
 	},
+	"c10-contracts-boundary": {
+		channel: "statique",
+		convention: "Hors de `specs/**/contracts/`, un import qui résout dans un dossier de provider (`contracts/{http,openai,anthropic}/…`) est une erreur : un test n’importe que les façades `*.contracts.ts`.",
+		family: "C",
+		id: "C10",
+		rationale: "Les contrats unitaires sont des détails de composition ; passer par la façade garde chaque scénario nommé au même endroit que le monde dont il dérive."
+	},
+	"c11-contract-data-pairing": {
+		channel: "statique",
+		convention: "Dans un dossier de provider, tout `*.response.json` et tout `*.request.ts` a un frère `<souche>.ts` — la souche est le nom jusqu’au PREMIER point (`events.fr.response.json` → `events.ts`) ; une donnée orpheline est une erreur.",
+		family: "C",
+		id: "C11",
+		rationale: "Une donnée n’existe que servie par un contrat — un fichier sans propriétaire est du poids mort qu’aucun test ne charge."
+	},
 	"c2-http-only-requests": {
 		channel: "statique",
 		convention: "`requests/` ne contient que des fichiers `.http` ; toute autre extension est une erreur.",
@@ -264,10 +368,10 @@ const RULE_DOCS = {
 	},
 	"c4-contract-shape": {
 		channel: "statique",
-		convention: "Un fichier de `contracts/` respecte `<nom>.<provider>.ts` (provider ∈ openai|anthropic|http), à plat, `export default defineContract(...)`, imports depuis le point d’entrée public.",
+		convention: "Sous `specs/**/contracts/` : la RACINE ne porte que des façades `*.contracts.ts` (export default construit par `defineContracts(...)` ou une re-export de composition ; exports nommés = scénarios) et les dossiers de provider `http` | `openai` | `anthropic`. Un contrat unitaire est `<provider>/<nom-kebab>.ts` avec un `export default defineContract(...)` (ou une factory qui en retourne un), et son builder de `request` doit désigner le provider de son dossier. Un dossier de provider est plat et ne contient que des `*.ts` et des `*.response.json`.",
 		family: "C",
 		id: "C4",
-		rationale: "Une forme figée rend les contrats découvrables et typables sans convention locale."
+		rationale: "Une arborescence figée sépare la façade publique des unités internes et fait porter le provider par le DOSSIER — les noms de fichiers redeviennent du métier, et la donnée volumineuse se range à côté du contrat qui la sert."
 	},
 	"c6-tomatch-extension": {
 		channel: "statique",
@@ -383,10 +487,10 @@ const RULE_DOCS = {
 	},
 	"i1-layer-boundaries": {
 		channel: "statique",
-		convention: "Quatre couches sous `src/` (core/integrations/vitest/lint) ; un import externe depuis `core/`, une integration important une dépendance qui n’est pas la sienne, ou un import hors whitelist entre couches est une erreur.",
+		convention: "Le projet DÉCLARE ses couches sous `src/` via l’option `layers` (paquets autorisés, imports internes, un dossier = une dépendance, seams) ; tout import hors des arêtes déclarées est une erreur. Sans carte de couches, la règle est inerte.",
 		family: "I",
 		id: "I1",
-		rationale: "Des frontières strictes gardent `core/` pur et chaque intégration confinée à sa dépendance."
+		rationale: "Une architecture appartient au projet : des frontières déclarées se vérifient, une architecture supposée se contourne."
 	},
 	"i2-sibling-test-naming": {
 		channel: "statique",
@@ -397,7 +501,7 @@ const RULE_DOCS = {
 	},
 	"i4-no-vi-mock-in-src": {
 		channel: "statique",
-		convention: "Sous `src/`, `vi.mock`, `__mocks__/`, `__fixtures__/` et l’import d’un asset non-`.ts` depuis un `.test.ts` sont interdits.",
+		convention: "Sous `src/`, `vi.mock`, `__mocks__/`, `__fixtures__/` et l’import d’un asset de données (`.json`, `.sql`, `.yaml`, …) depuis un `.test.ts` sont interdits ; un spécifieur pointé (`./dashboard.post`) reste du code.",
 		family: "I",
 		id: "I4",
 		rationale: "Dans les tests de module, mocks et données sont du CODE (`mockOf`, `*.fixtures.ts`) ; un vrai fichier appelle une spec."
@@ -494,7 +598,7 @@ const CHECKER_PASSES = [
 	},
 	{
 		channel: "checker",
-		convention: "Aucune fixture morte : tout fichier sous `seeds/`/`requests/`/`intercepts/`/`fixtures/` et toute entrée de premier niveau de `expected/` doit être référencée ; un dossier de feature sans `*.test.ts` est orphelin (warning si argument non littéral).",
+		convention: "Aucune fixture morte : tout fichier sous `seeds/`/`requests/`/`fixtures/` et toute entrée de premier niveau de `expected/` doit être référencée ; un dossier de feature sans `*.test.ts` est orphelin (warning si argument non littéral).",
 		family: "C",
 		id: "C9",
 		name: "c9-dead-fixtures",
@@ -976,79 +1080,43 @@ const a6wRedundantComposeService = {
 	}
 };
 //#endregion
-//#region src/lint/fs-cache.ts
+//#region src/core/specification/shared/resolve.ts
+/** What makes a directory a project root — a manifest, or a test stack. */
+const ROOT_MARKERS = ["package.json", "docker/compose.test.yaml"];
 /**
-* Cached filesystem probes for the fs-anchored rules (a9w, c2, c6, c7, i2).
+* The NEAREST ancestor of `startDir` (itself included) carrying a root marker,
+* `undefined` when none does.
 *
-* Rules only ever look at directories NEXT TO files oxlint is already
-* visiting (a feature's `requests/`, `seeds/`, `expected/`, a sibling module
-* file), so the probe set is small — but several rules probe the same feature
-* directory, and oxlint lints many files per process. A module-level cache
-* keeps each `readdir`/`stat` to one syscall per lint run.
+* Both markers are probed at each ancestor, in ONE walk. Two walks — the
+* compose file all the way up, then `package.json` all the way up — made the
+* further directory win: in a workspace, a `docker/compose.test.yaml` at the
+* repository root outranked the `package.json` of the very package being
+* tested, and every path the runner resolved was measured from the wrong unit.
+* The unit is the nearest thing that declares itself a project.
+*
+* The existence probe is injected so the lint layer can pass its cached one
+* (A9's `a9w-redundant-root` derives the same root, and must derive it the
+* same way).
 */
-const dirListings = /* @__PURE__ */ new Map();
-function listDirectory(dir) {
-	const cached = dirListings.get(dir);
-	if (cached !== void 0) return cached;
-	let result;
-	try {
-		result = (0, node_fs.readdirSync)(dir);
-	} catch {
-		result = null;
-	}
-	dirListings.set(dir, result);
-	return result;
-}
-const kinds = /* @__PURE__ */ new Map();
-function kindOf(path) {
-	const cached = kinds.get(path);
-	if (cached !== void 0) return cached;
-	let result;
-	try {
-		result = (0, node_fs.statSync)(path).isDirectory() ? "dir" : "file";
-	} catch {
-		result = "missing";
-	}
-	kinds.set(path, result);
-	return result;
-}
-function isDirectory(path) {
-	return kindOf(path) === "dir";
-}
-function isFile(path) {
-	return kindOf(path) === "file";
-}
-const fileContents = /* @__PURE__ */ new Map();
-/** Read a file as UTF-8, cached. Returns null when unreadable (missing/binary). */
-function readFileCached(path) {
-	const cached = fileContents.get(path);
-	if (cached !== void 0) return cached;
-	let result;
-	try {
-		result = (0, node_fs.readFileSync)(path, "utf8");
-	} catch {
-		result = null;
+function findRoot(startDir, exists) {
+	let dir = startDir;
+	for (;;) {
+		if (ROOT_MARKERS.some((marker) => exists((0, node_path.resolve)(dir, marker)))) return dir;
+		const parent = (0, node_path.dirname)(dir);
+		if (parent === dir) return;
+		dir = parent;
 	}
-	fileContents.set(path, result);
-	return result;
 }
 //#endregion
 //#region src/lint/rules/a9w-redundant-root.ts
 /**
-* The root the convention would derive (A9 — see docs/10-linting.md): walk up from the
-* specification file to the first directory containing
-* `docker/compose.test.yaml`, else the first containing `package.json`.
+* The root the convention would derive (A9 — see docs/10-linting.md): the
+* framework's own walk-up, run against this layer's cached fs probe. The rule
+* flags a `root` that the runner would have found by itself, so the two MUST
+* be the same function — a private copy of the walk drifted from it before.
 */
 function derivedRoot(startDir) {
-	for (const probe of ["docker/compose.test.yaml", "package.json"]) {
-		let dir = startDir;
-		for (;;) {
-			if (isFile((0, node_path.join)(dir, probe))) return dir;
-			const parent = (0, node_path.dirname)(dir);
-			if (parent === dir) break;
-			dir = parent;
-		}
-	}
+	return findRoot(startDir, isFile);
 }
 /**
 * CONVENTIONS A9 (warning) — `root` is an override reserved for cases the
@@ -1380,8 +1448,16 @@ const b9wProductCommand = {
 //#region src/lint/rules/c1-domain-structure.ts
 const TEST_SUFFIX = ".test.ts";
 const SPECIFICATION_SUFFIX = ".specification.ts";
+const DEFAULT_DEPTH = "facet-domain";
 /**
-* CONVENTIONS C1' — facet-root specifications, domain-nested tests.
+* CONVENTIONS C1' — the shape of a spec tree, DECLARED by the consumer.
+*
+* A project states which shape its `specs/` tree has; the rule checks that one.
+* Before this option there was a single shape and the only way out was `off`,
+* which took the whole rule with it — a tree with a different, equally
+* deliberate shape had no way to be checked at all.
+*
+* `depth: 'facet-domain'` (the default, and the historical behaviour)
 *
 * A facet (`specs/<facet>/` — api, jobs, cli, integrations, lint, …) is the
 * master folder. It carries its runner(s) at its ROOT
@@ -1389,36 +1465,66 @@ const SPECIFICATION_SUFFIX = ".specification.ts";
 * product command/area with one or more `<aspect>.test.ts` files plus their
 * shared asset dirs.
 *
-* Two placement invariants, checked from the filename:
-* - a `*.test.ts` must sit at facet/domain depth — exactly
+* - a `*.test.ts` sits at facet/domain depth — exactly
 *   `specs/<facet>/<domain>/<file>.test.ts`. A test directly at the facet root
 *   (or nested deeper than a domain) is rejected.
-* - a `*.specification.ts` must sit at the facet root — exactly
+* - a `*.specification.ts` sits at the facet root — exactly
 *   `specs/<facet>/<file>.specification.ts`, never inside a domain.
 *
-* Module tests under `src/` follow the neighbour rule (I2) and are out of scope.
+* `depth: 'mirror'`
+*
+* The tree mirrors something outside itself (a command tree, a source tree), so
+* the depth is that structure's and no fixed number can name it. A `*.test.ts`
+* sits at ANY depth of at least one directory under `specs/`, and is NAMED
+* AFTER the directory holding it — `<dir>/<dir>.test.ts`. That naming is what
+* keeps the shape checkable: one test per mirrored node, no test loose at the
+* specs root. Specification files are unconstrained: a mirror has no facet
+* level to anchor them to.
+*
+* `depth: 'off'` — no placement check; the tree's shape is guarded elsewhere.
+*
+* Module tests under `src/` follow the neighbour rule (I2) and are out of scope
+* in every mode.
 */
 const c1DomainStructure = {
 	create(context) {
+		const depth = context.options[0]?.depth ?? DEFAULT_DEPTH;
+		if (depth === "off") return {};
 		return { Program(node) {
-			const parts = segments(context.filename);
-			const base = parts.at(-1) ?? "";
-			const specsIndex = parts.lastIndexOf("specs");
-			if (specsIndex === -1) return;
-			const depth = parts.length - 1 - (specsIndex + 1);
+			const anchor = specsAnchor(context.filename);
+			if (anchor === void 0) return;
+			const base = anchor.relative.at(-1) ?? "";
+			const nesting = anchor.relative.length - 1;
+			if (depth === "mirror") {
+				if (!base.endsWith(TEST_SUFFIX)) return;
+				if (nesting < 1) {
+					context.report({
+						messageId: "testAtSpecsRoot",
+						node
+					});
+					return;
+				}
+				const directory = anchor.relative.at(-2) ?? "";
+				if (base.slice(0, -8) !== directory) context.report({
+					data: { directory },
+					messageId: "testNotMirroringDirectory",
+					node
+				});
+				return;
+			}
 			if (base.endsWith(TEST_SUFFIX)) {
-				if (depth < 2) context.report({
+				if (nesting < 2) context.report({
 					messageId: "testAtFacetRoot",
 					node
 				});
-				else if (depth > 2) context.report({
+				else if (nesting > 2) context.report({
 					messageId: "testTooDeep",
 					node
 				});
 				return;
 			}
 			if (base.endsWith(SPECIFICATION_SUFFIX)) {
-				if (depth !== 1) context.report({
+				if (nesting !== 1) context.report({
 					messageId: "specNotAtFacetRoot",
 					node
 				});
@@ -1426,18 +1532,119 @@ const c1DomainStructure = {
 		} };
 	},
 	meta: {
+		defaultOptions: [{ depth: DEFAULT_DEPTH }],
 		docs: RULE_DOCS["c1-domain-structure"],
 		messages: {
 			specNotAtFacetRoot: "A `*.specification.ts` must sit at the facet root: `specs/<facet>/<name>.specification.ts` (C1 — see docs/10-linting.md).",
 			testAtFacetRoot: "A `*.test.ts` must live in a domain folder: `specs/<facet>/<domain>/<aspect>.test.ts` — tests directly at the facet root are forbidden (C1 — see docs/10-linting.md).",
+			testAtSpecsRoot: "A `*.test.ts` must live in a directory under specs/ — with `depth: \"mirror\"` the tree mirrors a structure, and the specs root mirrors nothing (C1 — see docs/10-linting.md).",
+			testNotMirroringDirectory: "A `*.test.ts` must be named after the directory holding it — `{{directory}}/{{directory}}.test.ts` — with `depth: \"mirror\"` (C1 — see docs/10-linting.md).",
 			testTooDeep: "A `*.test.ts` must sit at facet/domain depth: `specs/<facet>/<domain>/<aspect>.test.ts` — no deeper nesting (C1 — see docs/10-linting.md)."
 		},
+		schema: [{
+			additionalProperties: false,
+			properties: { depth: {
+				enum: [
+					"facet-domain",
+					"mirror",
+					"off"
+				],
+				type: "string"
+			} },
+			type: "object"
+		}],
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/c10-contracts-boundary.ts
+/** A specifier reaching into a provider folder — the internal half of contracts/. */
+const INTERNAL_UNIT = /(?:^|\/)contracts\/(?:anthropic|http|openai)\//u;
+/**
+* CONVENTIONS C10 — the contracts boundary. A feature's `contracts/` folder has
+* a PUBLIC half (`*.contracts.ts` facades: the default export is the world, the
+* named exports are its scenarios) and an INTERNAL half (the `http/`, `openai/`
+* and `anthropic/` unit contracts the facades compose). Outside `contracts/`,
+* importing a unit is an error — a test routes through the facade, so a
+* scenario is named once, next to the world it derives from.
+*/
+const c10ContractsBoundary = {
+	create(context) {
+		const parts = segments(context.physicalFilename);
+		if (!parts.includes("specs")) return {};
+		if (parts.slice(0, -1).includes("contracts")) return {};
+		return importSourceVisitor(({ node, source }) => {
+			if (INTERNAL_UNIT.test(source)) context.report({
+				data: { source },
+				messageId: "internal",
+				node
+			});
+		});
+	},
+	meta: {
+		docs: RULE_DOCS["c10-contracts-boundary"],
+		messages: { internal: "Import \"{{source}}\" reaches into a provider folder — only contracts/*.contracts.ts is importable from a test; add a named scenario export there instead (C10 — see docs/10-linting.md)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/c11-contract-data-pairing.ts
+const TEST_FILE$11 = /\.test\.[cm]?[jt]sx?$/;
+/** The provider folders that may carry data files. */
+const PROVIDERS$1 = [
+	"anthropic",
+	"http",
+	"openai"
+];
+/** Data files: served payloads and matched inputs, both owned by a contract. */
+const DATA_SUFFIXES = [".request.ts", ".response.json"];
+/** The owning contract of a data file: its name up to the FIRST dot, `.ts`. */
+function ownerOf(entry) {
+	return `${entry.slice(0, entry.indexOf("."))}.ts`;
+}
+/**
+* CONVENTIONS C11 — data is owned by a contract. Inside a provider folder every
+* `*.response.json` (served payload) and `*.request.ts` (matched prompt/body)
+* pairs with the sibling `<stem>.ts` that serves it, where the stem is the name
+* up to the FIRST dot: `events.fr.response.json` belongs to `events.ts`. A data
+* file with no owner is dead weight no test can reach — reported on the feature's
+* test file, since oxlint never visits a `.json`.
+*/
+const c11ContractDataPairing = {
+	create(context) {
+		const file = context.physicalFilename;
+		if (!TEST_FILE$11.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const contractsDir = (0, node_path.join)((0, node_path.dirname)(file), "contracts");
+			for (const provider of PROVIDERS$1) {
+				const entries = listDirectory((0, node_path.join)(contractsDir, provider));
+				if (entries === null) continue;
+				const present = new Set(entries);
+				for (const entry of entries) {
+					if (!DATA_SUFFIXES.some((suffix) => entry.endsWith(suffix))) continue;
+					const owner = ownerOf(entry);
+					if (!present.has(owner)) context.report({
+						data: {
+							entry,
+							owner,
+							provider
+						},
+						messageId: "orphan",
+						node
+					});
+				}
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["c11-contract-data-pairing"],
+		messages: { orphan: "contracts/{{provider}}/{{entry}} has no owning contract — data pairs with the sibling {{owner}} (stem = name up to the first dot) (C11 — see docs/10-linting.md)." },
 		type: "problem"
 	}
 };
 //#endregion
 //#region src/lint/rules/c2-http-only-requests.ts
-const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_FILE$10 = /\.test\.[cm]?[jt]sx?$/;
 /**
 * CONVENTIONS C2 — `requests/` contains only `.http` files (a request file is
 * a COMPLETE request: method, path, headers, body). Anchored on the feature's
@@ -1448,7 +1655,7 @@ const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/;
 const c2HttpOnlyRequests = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$9.test(file) || !segments(file).includes("specs")) return {};
+		if (!TEST_FILE$10.test(file) || !segments(file).includes("specs")) return {};
 		return { Program(node) {
 			const requestsDir = (0, node_path.join)((0, node_path.dirname)(file), "requests");
 			for (const entry of listDirectory(requestsDir) ?? []) if (!entry.endsWith(".http")) context.report({
@@ -1466,65 +1673,217 @@ const c2HttpOnlyRequests = {
 };
 //#endregion
 //#region src/lint/rules/c4-contract-shape.ts
-/** Providers a contract file may declare (C4 — see docs/10-linting.md). */
+/** The only directories a `contracts/` root may hold — the provider carriers. */
 const PROVIDERS = /* @__PURE__ */ new Set([
 	"anthropic",
 	"http",
 	"openai"
 ]);
-const CONTRACT_NAME = /^[A-Za-z0-9][\w-]*\.(?<provider>[a-z]+)\.[cm]?ts$/;
-/** Is the import source the framework's public entry (`@jterrazz/test` / `src/index`)? */
-function isPublicEntry(source) {
-	return source === "@jterrazz/test" || source.endsWith("/src/index.js") || source.endsWith("/src/index.ts");
+const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/;
+/** A file oxlint itself visits — the AST half of the rule reports on those. */
+const SOURCE_FILE = /\.[cm]?[jt]sx?$/;
+/** The public facade of a feature: `contracts/<kebab>.contracts.ts`. */
+const COMPOSITE_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.contracts\.[cm]?ts$/u;
+/** An internal unit contract: `contracts/<provider>/<kebab>.ts`. */
+const UNIT_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.[cm]?ts$/u;
+/** Matched data next to its contract: `contracts/<provider>/<stem>.request.ts`. */
+const REQUEST_DATA_FILE = /^[a-z0-9]+(?:-[a-z0-9]+)*\.request\.[cm]?ts$/u;
+/** Served data next to its contract: `contracts/<provider>/<stem>[.<qualifier>].response.json`. */
+const RESPONSE_DATA_FILE = /\.response\.json$/;
+/** The name a specifier/declaration exports under, when it is `default`. */
+function exportsDefault(node) {
+	return (node.specifiers ?? []).some((specifier) => {
+		const exported = specifier.exported;
+		return exported?.type === "Identifier" && exported.name === "default" || stringValue(exported) === "default";
+	});
+}
+/** Is this node a `defineContract(...)` call? */
+function isDefineContract(node) {
+	const callee = node.callee;
+	return node.type === "CallExpression" && callee?.type === "Identifier" && callee.name === "defineContract";
+}
+/** A default export that may legitimately produce a contract (value or factory). */
+function producesContract(declaration) {
+	if (declaration === void 0) return false;
+	return isDefineContract(declaration) || declaration.type === "ArrowFunctionExpression" || declaration.type === "FunctionDeclaration" || declaration.type === "FunctionExpression" || declaration.type === "Identifier";
 }
 /**
-* CONVENTIONS C4 — a contract file (`contracts/<name>.<provider>.ts`) has a
-* rigid shape: flat under `contracts/` (no subfolders), `provider ∈ { openai,
-* anthropic, http }`, a single `export default defineContract(...)`, no named
-* exports, and imports only from the public entry. The runtime channel (the
-* loader) only catches a bad default export; this rule closes the rest.
+* The provider a `request:` value implies, when the builder is written as
+* `<provider>.<verb>(…)` — the only statically decidable form.
 */
-const c4ContractShape = {
-	create(context) {
-		const parts = segments(context.physicalFilename);
-		const contractsIndex = parts.lastIndexOf("contracts");
-		if (contractsIndex === -1 || contractsIndex >= parts.length - 1 || !parts.includes("specs")) return {};
-		const base = parts.at(-1) ?? "";
-		return { Program(node) {
-			if (contractsIndex !== parts.length - 2) context.report({
-				data: { base },
-				messageId: "subfolder",
+function requestProvider(request) {
+	if (request?.type !== "CallExpression") return;
+	const callee = request.callee;
+	if (callee?.type !== "MemberExpression") return;
+	const object = callee.object;
+	return object?.type === "Identifier" ? object.name : void 0;
+}
+/**
+* The layout half — walks the feature's `contracts/` tree from the test file
+* that owns it. Covers what oxlint never visits: a stray `.json` at the root,
+* a directory that is not a provider, a nested folder or a foreign extension
+* inside a provider folder.
+*/
+function checkLayout(context, node, contractsDir) {
+	const entries = listDirectory(contractsDir);
+	if (entries === null) return;
+	for (const entry of entries) {
+		const path = (0, node_path.join)(contractsDir, entry);
+		if (!isDirectory(path)) {
+			if (!SOURCE_FILE.test(entry)) context.report({
+				data: { entry },
+				messageId: "rootEntry",
 				node
 			});
-			const match = CONTRACT_NAME.exec(base);
-			if (match === null || !PROVIDERS.has(match.groups?.provider ?? "")) context.report({
-				data: { base },
-				messageId: "badName",
+			continue;
+		}
+		if (!PROVIDERS.has(entry)) {
+			context.report({
+				data: { entry },
+				messageId: "badProviderDir",
 				node
 			});
-			let hasDefault = false;
-			for (const statement of node.body ?? []) if (statement.type === "ImportDeclaration") {
-				const source = stringValue(statement.source);
-				if (source !== void 0 && !isPublicEntry(source)) context.report({
-					data: { source },
-					messageId: "foreignImport",
-					node: statement
-				});
-			} else if (statement.type === "ExportNamedDeclaration" || statement.type === "ExportAllDeclaration") context.report({
-				messageId: "namedExport",
-				node: statement
-			});
-			else if (statement.type === "ExportDefaultDeclaration") {
+			continue;
+		}
+		for (const child of listDirectory(path) ?? []) if (isDirectory((0, node_path.join)(path, child))) context.report({
+			data: {
+				child,
+				provider: entry
+			},
+			messageId: "providerSubfolder",
+			node
+		});
+		else if (!/\.[cm]?ts$/u.test(child) && !RESPONSE_DATA_FILE.test(child)) context.report({
+			data: {
+				child,
+				provider: entry
+			},
+			messageId: "providerEntry",
+			node
+		});
+	}
+}
+/** The facade: `<kebab>.contracts.ts`, default-exporting a composition. */
+function checkComposite(context, program, base) {
+	if (!COMPOSITE_FILE.test(base)) {
+		context.report({
+			data: { base },
+			messageId: "rootFile",
+			node: program
+		});
+		return;
+	}
+	let hasDefault = false;
+	let composed = false;
+	walk(program, (node) => {
+		if (node.type === "ExportDefaultDeclaration") hasDefault = true;
+		else if (node.type === "ExportAllDeclaration" || node.type === "ExportNamedDeclaration") {
+			if (exportsDefault(node)) {
 				hasDefault = true;
-				const declaration = statement.declaration;
-				const callee = declaration?.type === "CallExpression" ? declaration.callee : void 0;
-				if (callee?.type !== "Identifier" || callee.name !== "defineContract") context.report({
-					messageId: "notDefineContract",
-					node: statement
-				});
+				composed = stringValue(node.source) !== void 0 || composed;
 			}
-			if (!hasDefault) context.report({
-				messageId: "missingDefault",
+		} else if (node.type === "CallExpression") {
+			const callee = node.callee;
+			if (callee?.type === "Identifier" && callee.name === "defineContracts" || callee !== void 0 && memberPropertyName(callee) === "with") composed = true;
+		}
+	});
+	if (!hasDefault) context.report({
+		data: { base },
+		messageId: "missingComposite",
+		node: program
+	});
+	else if (!composed) context.report({
+		data: { base },
+		messageId: "notDefineContracts",
+		node: program
+	});
+}
+/** A unit contract under its provider folder. */
+function checkUnit(context, program, base, provider) {
+	if (REQUEST_DATA_FILE.test(base)) return;
+	if (!UNIT_FILE.test(base)) {
+		context.report({
+			data: { base },
+			messageId: "badName",
+			node: program
+		});
+		return;
+	}
+	let hasDefault = false;
+	let wellFormed = false;
+	walk(program, (node) => {
+		if (node.type === "ExportDefaultDeclaration") {
+			hasDefault = true;
+			wellFormed = producesContract(node.declaration) || wellFormed;
+		} else if (node.type === "ExportNamedDeclaration" && exportsDefault(node)) {
+			hasDefault = true;
+			wellFormed = true;
+		}
+		if (isDefineContract(node)) {
+			const argument = node.arguments?.[0];
+			const declared = requestProvider(argument === void 0 ? void 0 : findProperty(argument, "request")?.value);
+			if (declared !== void 0 && PROVIDERS.has(declared) && declared !== provider) context.report({
+				data: {
+					declared,
+					provider
+				},
+				messageId: "providerMismatch",
+				node
+			});
+		}
+	});
+	if (!hasDefault) context.report({
+		data: { base },
+		messageId: "missingDefault",
+		node: program
+	});
+	else if (!wellFormed) context.report({
+		data: { base },
+		messageId: "notDefineContract",
+		node: program
+	});
+}
+/**
+* CONVENTIONS C4 — the structure of a feature's `contracts/` tree. The ROOT
+* holds only `*.contracts.ts` facades (default export = a `defineContracts`
+* composition, named exports = scenario factories) and the provider
+* directories `http` / `openai` / `anthropic`. A provider directory holds
+* `<kebab>.ts` unit contracts (default export = `defineContract(...)` or a
+* factory returning one) plus their sibling data (`*.response.json`,
+* `*.request.ts`) — the FOLDER carries the provider, so a unit whose `request`
+* builder names another provider is an error.
+*
+* Two halves: the AST half reports on each contract file it visits, the layout
+* half walks the tree from the feature's test file (oxlint never visits a
+* `.json` fixture or an empty directory).
+*/
+const c4ContractShape = {
+	create(context) {
+		const file = context.physicalFilename;
+		const parts = segments(file);
+		if (!parts.includes("specs")) return {};
+		const contractsIndex = parts.lastIndexOf("contracts");
+		if (contractsIndex === -1) {
+			if (!TEST_FILE$9.test(file)) return {};
+			return { Program(node) {
+				checkLayout(context, node, (0, node_path.join)((0, node_path.dirname)(file), "contracts"));
+			} };
+		}
+		const base = parts.at(-1) ?? "";
+		const depth = parts.length - 1 - contractsIndex;
+		if (depth === 1) return { Program(node) {
+			checkComposite(context, node, base);
+		} };
+		if (depth === 2) {
+			const provider = parts[contractsIndex + 1];
+			return PROVIDERS.has(provider) ? { Program(node) {
+				checkUnit(context, node, base, provider);
+			} } : {};
+		}
+		return { Program(node) {
+			context.report({
+				data: { base },
+				messageId: "tooDeep",
 				node
 			});
 		} };
@@ -1532,12 +1891,18 @@ const c4ContractShape = {
 	meta: {
 		docs: RULE_DOCS["c4-contract-shape"],
 		messages: {
-			badName: "Contract file \"{{base}}\" must be named <name>.<provider>.ts with provider ∈ openai | anthropic | http (C4 — see docs/10-linting.md).",
-			foreignImport: "Contract imports \"{{source}}\" — a contract imports only from the public entry (@jterrazz/test) (C4 — see docs/10-linting.md).",
-			missingDefault: "Contract file has no `export default defineContract(...)` (C4 — see docs/10-linting.md).",
-			namedExport: "Contract files have no named exports — only `export default defineContract(...)` (C4 — see docs/10-linting.md).",
-			notDefineContract: "The default export of a contract file must be `defineContract(...)` syntactically (C4 — see docs/10-linting.md).",
-			subfolder: "Contract file \"{{base}}\" is nested — contracts/ is flat, no subfolders (C4 — see docs/10-linting.md)."
+			badName: "Contract unit \"{{base}}\" must be named <kebab-name>.ts — the folder already carries the provider (C4 — see docs/10-linting.md).",
+			badProviderDir: "contracts/{{entry}}/ is not a provider directory — a contracts/ root holds only http/, openai/, anthropic/ and *.contracts.ts files (C4 — see docs/10-linting.md).",
+			missingComposite: "Contract facade \"{{base}}\" has no default export — it must default-export the composed world (C4 — see docs/10-linting.md).",
+			missingDefault: "Contract unit \"{{base}}\" has no default export — a unit default-exports `defineContract(...)` or a factory returning one (C4 — see docs/10-linting.md).",
+			notDefineContract: "The default export of a contract unit must be `defineContract(...)` or a factory returning a contract (C4 — see docs/10-linting.md).",
+			notDefineContracts: "The default export of \"{{base}}\" must be built from `defineContracts(...)` (or a composition re-export) (C4 — see docs/10-linting.md).",
+			providerEntry: "contracts/{{provider}}/{{child}} is neither a *.ts contract nor a *.response.json payload (C4 — see docs/10-linting.md).",
+			providerMismatch: "This contract lives in contracts/{{provider}}/ but its request is a `{{declared}}.*` builder — the folder carries the provider (C4 — see docs/10-linting.md).",
+			providerSubfolder: "contracts/{{provider}}/{{child}}/ is nested — a provider folder is flat (C4 — see docs/10-linting.md).",
+			rootEntry: "contracts/{{entry}} is not a *.contracts.ts facade — data files live in a provider folder next to their contract (C4 — see docs/10-linting.md).",
+			rootFile: "Contract file \"{{base}}\" sits at the contracts/ root, which holds only *.contracts.ts facades — a unit contract belongs in http/, openai/ or anthropic/ (C4 — see docs/10-linting.md).",
+			tooDeep: "Contract file \"{{base}}\" is nested deeper than contracts/<provider>/ (C4 — see docs/10-linting.md)."
 		},
 		type: "problem"
 	}
@@ -1637,22 +2002,9 @@ const VERB_ROOTS = {
 function looksLikePath(value) {
 	return value.length > 0 && !/\s/u.test(value);
 }
-/** Nearest ancestor directory named `specs` — the pool root for `$FIXTURES/`. */
-function specsRoot(file) {
-	let dir = (0, node_path.dirname)(file);
-	for (;;) {
-		if ((0, node_path.basename)(dir) === "specs") return dir;
-		const parent = (0, node_path.dirname)(dir);
-		if (parent === dir) return;
-		dir = parent;
-	}
-}
 /** Resolve the on-disk target a `.fixture()` literal points at, if determinable. */
-function resolveFixture(argument, featureDir, file) {
-	if (argument.startsWith("$FIXTURES/")) {
-		const root = specsRoot(file);
-		return root === void 0 ? void 0 : (0, node_path.join)(root, "fixtures", argument.slice(10));
-	}
+function resolveFixture(argument, featureDir, specsDir) {
+	if (argument.startsWith("$FIXTURES/")) return (0, node_path.join)(specsDir, "fixtures", argument.slice(10));
 	if (argument.startsWith("$")) return;
 	return (0, node_path.join)(featureDir, "fixtures", argument);
 }
@@ -1667,7 +2019,8 @@ function resolveFixture(argument, featureDir, file) {
 const c8ReferencedFixtureExists = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$6.test(file) || !segments(file).includes("specs")) return {};
+		const anchor = specsAnchor(file);
+		if (!TEST_FILE$6.test(file) || anchor === void 0) return {};
 		const featureDir = (0, node_path.dirname)(file);
 		return { CallExpression(node) {
 			const callee = node.callee;
@@ -1677,7 +2030,7 @@ const c8ReferencedFixtureExists = {
 			if (verb === "fixture") {
 				const value = stringValue(args[0]);
 				if (value === void 0 || !looksLikePath(value)) return;
-				const target = resolveFixture(value.replace(/\/+$/, ""), featureDir, file);
+				const target = resolveFixture(value.replace(/\/+$/, ""), featureDir, anchor.directory);
 				if (target !== void 0 && !isFile(target) && !isDirectory(target)) context.report({
 					data: {
 						path: value,
@@ -2290,7 +2643,7 @@ const TOOL_SUBPATH$1 = "@jterrazz/test/oxlint";
 const f2NoTestImportsInProd = {
 	create(context) {
 		const file = context.filename;
-		if (TEST_FILE$4.test(file) || CONFIG_FILE.test(file) || segments(file).includes("specs")) return {};
+		if (TEST_FILE$4.test(file) || CONFIG_FILE.test(file) || isUnderSpecs(file)) return {};
 		return { ...importSourceVisitor(({ node, source }) => {
 			if (source === TOOL_SUBPATH$1) return;
 			if (source === "vitest" || source.startsWith("vitest/")) context.report({
@@ -2348,10 +2701,9 @@ const FRAMEWORK_LAYERS = /* @__PURE__ */ new Set([
 */
 const f3SpecsPublicEntry = {
 	create(context) {
-		const parts = segments(context.filename);
-		const specsIndex = parts.indexOf("specs");
-		if (specsIndex === -1) return {};
-		const underIntegrations = parts[specsIndex + 1] === "integrations";
+		const anchor = specsAnchor(context.filename);
+		if (anchor === void 0) return {};
+		const underIntegrations = anchor.relative[0] === "integrations";
 		return { ...importSourceVisitor(({ node, source }) => {
 			if (source.startsWith(`${PACKAGE}/`)) {
 				if (source === TOOL_SUBPATH) return;
@@ -2434,36 +2786,6 @@ const f5FixturesOnlyFromTests = {
 };
 //#endregion
 //#region src/lint/rules/i1-layer-boundaries.ts
-/**
-* One folder = one external dependency (I1 — see docs/10-linting.md): the packages each
-* `src/integrations/<folder>/` may import.
-*/
-const INTEGRATION_DEPS = {
-	anthropic: ["@anthropic-ai/sdk"],
-	appium: ["webdriverio"],
-	compose: ["yaml"],
-	docker: [],
-	hono: ["hono", "@hono/node-server"],
-	msw: ["msw"],
-	openai: ["openai"],
-	playwright: ["playwright"],
-	postgres: ["pg"],
-	redis: ["redis"],
-	sqlite: ["better-sqlite3"],
-	testcontainers: ["testcontainers"]
-};
-/** External packages the vitest layer (ALL runner coupling) may import. */
-const VITEST_DEPS = [
-	"vitest",
-	"vitest-mock-extended",
-	"mockdate"
-];
-/** The pure core helpers the tool-facing lint layer may reach (I1). */
-const LINT_CORE_WHITELIST = /* @__PURE__ */ new Set([
-	"core/matching/match",
-	"core/specification/shared/binding",
-	"core/specification/shared/fixtures"
-]);
 const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/;
 function matchesPackage(source, packages) {
 	return packages.some((name) => source === name || source.startsWith(`${name}/`));
@@ -2474,64 +2796,68 @@ function pathInsideSrc(path) {
 	const srcIndex = parts.lastIndexOf("src");
 	return srcIndex === -1 ? void 0 : parts.slice(srcIndex + 1).join("/");
 }
-/** Strip a `.js`/`.ts`-style extension for whitelist comparison. */
+/** Strip a `.js`/`.ts`-style extension for exact-path comparison. */
 function withoutExtension(path) {
 	return path.replace(/\.[cm]?[jt]sx?$/, "");
 }
+/** Does `target` match one of the declared paths (prefix, or exact module)? */
+function matchesPath(target, patterns) {
+	return patterns.some((pattern) => pattern.endsWith("/") ? target.startsWith(pattern) : withoutExtension(target) === withoutExtension(pattern));
+}
 /**
-* CONVENTIONS I1 — the four layers under `src/` and their sanctioned edges:
+* CONVENTIONS I1 — the layers under `src/` and their sanctioned edges, DECLARED
+* by the project:
+*
+*     'jterrazz/i1-layer-boundaries': ['error', {
+*         layers: {
+*             core: { imports: ['core/', 'integrations/docker/'] },
+*             integrations: { folders: { postgres: ['pg'] }, imports: ['core/'] },
+*         },
+*     }]
 *
-* - `core/` — zero external imports; may reach `integrations/docker`,
-*   `integrations/hono`, `vitest/matchers`, and (from `builder.ts` only, the
-*   lazy MSW seam) `integrations/msw`.
-* - `integrations/<dep>/` — its own external dependency and `core/` only.
-* - `vitest/` — the runner coupling: `vitest`, `vitest-mock-extended`,
-*   `mockdate`, plus `core/` and `integrations/docker` (the matchers recognise
-*   the zero-dependency ContainerAccessor subject).
-* - `lint/` — zero runtime imports: no external packages, and from `core/`
-*   only the pure helpers (token list, case conversions, fixture markers).
+* With no layer map the rule is INERT. It used to ship the framework's own
+* architecture as its law — four layers named `core` / `integrations` / `lint`
+* / `vitest`, and the framework's own dependency table — and applied it to every
+* consumer that enabled the catalogue. A consumer with those directory names
+* was judged against a map describing a different package; a consumer with any
+* other architecture got a rule that could never say anything true. An
+* architecture is the project's to state.
 *
-* Module tests and fixtures files are exempt (their imports are governed by
-* F2/I4); `src/index.ts` is the composition root and lives above the layers.
+* Per layer: `packages` are the external dependencies it may import, `imports`
+* the paths inside `src/` it may reach (a `foo/` prefix, or an exact module
+* path), `folders` expresses "one folder = one external dependency" (each child
+* folder may import its own packages and its own files), and `seams` opens a
+* named module to an extra edge — the lazy import a layer allows exactly once.
+*
+* A file under a layer the map does not name is out of scope, as are module
+* tests and `*.fixtures.ts` files (F2/I4 govern those), and any file outside
+* `src/`.
 */
 const i1LayerBoundaries = {
 	create(context) {
+		const layers = context.options[0]?.layers;
+		if (layers === void 0 || Object.keys(layers).length === 0) return {};
 		const file = context.physicalFilename;
 		if (TEST_OR_FIXTURES.test(file)) return {};
 		const inside = pathInsideSrc(file);
 		const layer = inside?.split("/")[0];
-		if (inside === void 0 || layer === void 0 || ![
-			"core",
-			"integrations",
-			"lint",
-			"vitest"
-		].includes(layer)) return {};
-		const integrationFolder = layer === "integrations" ? inside.split("/")[1] : void 0;
-		const checkExternal = (source) => {
-			if (layer === "core") return "coreExternal";
-			if (layer === "lint") return "lintRuntime";
-			if (layer === "vitest") return matchesPackage(source, VITEST_DEPS) ? null : "foreignDependency";
-			return matchesPackage(source, INTEGRATION_DEPS[integrationFolder ?? ""] ?? []) ? null : "foreignDependency";
-		};
-		const checkInternal = (target) => {
-			if (layer === "core") {
-				if (target.startsWith("core/") || target.startsWith("integrations/docker/") || target.startsWith("integrations/hono/") || withoutExtension(target) === "vitest/matchers") return null;
-				if (target.startsWith("integrations/msw/") && inside === "core/specification/shared/builder.ts") return null;
-				if (target.startsWith("integrations/playwright/") && inside === "core/specification/website/start-website.ts") return null;
-				if (target.startsWith("integrations/appium/") && inside === "core/specification/mobile/start-mobile.ts") return null;
-				return "crossLayer";
-			}
-			if (layer === "integrations") return target.startsWith("core/") || target.startsWith(`integrations/${integrationFolder}/`) ? null : "crossLayer";
-			if (layer === "vitest") return target.startsWith("core/") || target.startsWith("vitest/") || target.startsWith("integrations/docker/") ? null : "crossLayer";
-			return target.startsWith("lint/") || LINT_CORE_WHITELIST.has(withoutExtension(target)) ? null : "lintRuntime";
+		const rules = layer === void 0 ? void 0 : layers[layer];
+		if (inside === void 0 || layer === void 0 || rules === void 0) return {};
+		const folder = rules.folders === void 0 ? void 0 : inside.split("/")[1];
+		const ownPackages = [...rules.packages ?? [], ...rules.folders?.[folder ?? ""] ?? []];
+		const ownImports = [...rules.imports ?? [], ...rules.seams?.[inside] ?? []];
+		const allowsExternal = (source) => matchesPackage(source, ownPackages);
+		const allowsInternal = (target) => {
+			if (matchesPath(target, ownImports)) return true;
+			return folder !== void 0 && target.startsWith(`${layer}/${folder}/`);
 		};
 		return { ...importSourceVisitor(({ node, source }) => {
 			if (source.startsWith("node:")) return;
 			let messageId;
 			if (source.startsWith(".")) {
 				const target = pathInsideSrc((0, node_path.resolve)((0, node_path.dirname)(file), source));
-				messageId = target === void 0 ? "crossLayer" : checkInternal(target);
-			} else messageId = checkExternal(source);
+				messageId = target === void 0 || !allowsInternal(target) ? "crossLayer" : null;
+			} else messageId = allowsExternal(source) ? null : "foreignDependency";
 			if (messageId !== null) context.report({
 				data: {
 					layer,
@@ -2543,13 +2869,47 @@ const i1LayerBoundaries = {
 		}) };
 	},
 	meta: {
+		defaultOptions: [{ layers: {} }],
 		docs: RULE_DOCS["i1-layer-boundaries"],
 		messages: {
-			coreExternal: "core/ imports nothing external — \"{{source}}\" is not allowed (I1 — see docs/10-linting.md).",
-			crossLayer: "Layer \"{{layer}}\" must not import \"{{source}}\" — outside the sanctioned layer edges (I1 — see docs/10-linting.md).",
-			foreignDependency: "\"{{source}}\" is not this folder's own dependency — one integrations folder = one external dependency (I1 — see docs/10-linting.md).",
-			lintRuntime: "The lint layer imports nothing from the framework runtime — \"{{source}}\" is outside its pure-helper whitelist (I1 — see docs/10-linting.md)."
+			crossLayer: "Layer \"{{layer}}\" must not import \"{{source}}\" — outside the edges its layer map declares (I1 — see docs/10-linting.md).",
+			foreignDependency: "\"{{source}}\" is not a dependency layer \"{{layer}}\" declares — one layer states the packages it may import (I1 — see docs/10-linting.md)."
 		},
+		schema: [{
+			additionalProperties: false,
+			properties: { layers: {
+				additionalProperties: {
+					additionalProperties: false,
+					properties: {
+						folders: {
+							additionalProperties: {
+								items: { type: "string" },
+								type: "array"
+							},
+							type: "object"
+						},
+						imports: {
+							items: { type: "string" },
+							type: "array"
+						},
+						packages: {
+							items: { type: "string" },
+							type: "array"
+						},
+						seams: {
+							additionalProperties: {
+								items: { type: "string" },
+								type: "array"
+							},
+							type: "object"
+						}
+					},
+					type: "object"
+				},
+				type: "object"
+			} },
+			type: "object"
+		}],
 		type: "problem"
 	}
 };
@@ -2611,10 +2971,48 @@ const i2SiblingTestNaming = {
 //#endregion
 //#region src/lint/rules/i4-no-vi-mock-in-src.ts
 const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
-/** Module-ish sources a src test may import; anything else with an extension is a data asset. */
-const CODE_IMPORT = /\.[cm]?[jt]sx?$/;
-/** Does this import path even carry an extension? Bare/extension-less ones are code. */
-const HAS_EXTENSION = /\.[a-z0-9]+$/i;
+const DATA_ASSET = new RegExp(`\\.(?:${[
+	"avif",
+	"bin",
+	"bmp",
+	"csv",
+	"gif",
+	"graphql",
+	"gql",
+	"gz",
+	"htm",
+	"html",
+	"ico",
+	"ini",
+	"jpeg",
+	"jpg",
+	"json",
+	"json5",
+	"jsonc",
+	"jsonl",
+	"md",
+	"mdx",
+	"ndjson",
+	"pdf",
+	"png",
+	"proto",
+	"sql",
+	"svg",
+	"tar",
+	"toml",
+	"tsv",
+	"txt",
+	"wasm",
+	"webp",
+	"xml",
+	"yaml",
+	"yml",
+	"zip"
+].join("|")})$`, "i");
+/** A bundler suffix (`./payload.json?raw`, `./doc.md#frag`) is not part of the extension. */
+function withoutSuffix(source) {
+	return source.replace(/[?#].*$/, "");
+}
 /**
 * CONVENTIONS I4 — in module tests under `src/`, mocks and data are CODE:
 * `mockOf`/`mockOfDate` inline, large payloads in a `*.fixtures.ts` neighbour.
@@ -2622,8 +3020,11 @@ const HAS_EXTENSION = /\.[a-z0-9]+$/i;
 *
 * - `vi.mock(…)` calls (module mocking) in any file;
 * - files living in a `__mocks__/` or `__fixtures__/` directory;
-* - a `*.test.ts` importing a non-code asset (`.json`, `.txt`, `.sql`, …) —
+* - a `*.test.ts` importing a known data asset (`.json`, `.txt`, `.sql`, …) —
 *   a test needing a real file is a specification and belongs in `specs/`.
+*
+* A specifier whose extension is not on the data list is CODE, dotted or not:
+* `<subject>.<role>` module names are a naming convention, not a file type.
 */
 const i4NoViMockInSrc = {
 	create(context) {
@@ -2651,7 +3052,7 @@ const i4NoViMockInSrc = {
 			}
 		};
 		if (isTest) Object.assign(visitor, importSourceVisitor(({ node, source }) => {
-			if (HAS_EXTENSION.test(source) && !CODE_IMPORT.test(source)) context.report({
+			if (DATA_ASSET.test(withoutSuffix(source))) context.report({
 				data: { source },
 				messageId: "assetImport",
 				node
@@ -2722,7 +3123,7 @@ const j1NoOnlySkip = {
 */
 const j2NoSleepInSpecs = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
+		if (!isUnderSpecs(context.filename)) return {};
 		return {
 			CallExpression(node) {
 				const callee = node.callee;
@@ -2954,6 +3355,8 @@ const plugin = {
 		"b8-kebab-trigger": b8KebabTrigger,
 		"b9w-product-command": b9wProductCommand,
 		"c1-domain-structure": c1DomainStructure,
+		"c10-contracts-boundary": c10ContractsBoundary,
+		"c11-contract-data-pairing": c11ContractDataPairing,
 		"c2-http-only-requests": c2HttpOnlyRequests,
 		"c4-contract-shape": c4ContractShape,
 		"c6-tomatch-extension": c6ToMatchExtension,