@jterrazz/test 11.0.0 → 12.0.1

package/dist/oxlint.js

@@ -1,5 +1,62 @@
 import { basename, dirname, join, resolve } from "node:path";
 import { readFileSync, readdirSync, statSync } from "node:fs";
+//#region src/lint/fs-cache.ts
+/**
+* Cached filesystem probes for the fs-anchored rules (a9w, c2, c6, c7, i2).
+*
+* Rules only ever look at directories NEXT TO files oxlint is already
+* visiting (a feature's `requests/`, `seeds/`, `expected/`, a sibling module
+* file), so the probe set is small — but several rules probe the same feature
+* directory, and oxlint lints many files per process. A module-level cache
+* keeps each `readdir`/`stat` to one syscall per lint run.
+*/
+const dirListings = /* @__PURE__ */ new Map();
+function listDirectory(dir) {
+	const cached = dirListings.get(dir);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = readdirSync(dir);
+	} catch {
+		result = null;
+	}
+	dirListings.set(dir, result);
+	return result;
+}
+const kinds = /* @__PURE__ */ new Map();
+function kindOf(path) {
+	const cached = kinds.get(path);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = statSync(path).isDirectory() ? "dir" : "file";
+	} catch {
+		result = "missing";
+	}
+	kinds.set(path, result);
+	return result;
+}
+function isDirectory(path) {
+	return kindOf(path) === "dir";
+}
+function isFile(path) {
+	return kindOf(path) === "file";
+}
+const fileContents = /* @__PURE__ */ new Map();
+/** Read a file as UTF-8, cached. Returns null when unreadable (missing/binary). */
+function readFileCached(path) {
+	const cached = fileContents.get(path);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = readFileSync(path, "utf8");
+	} catch {
+		result = null;
+	}
+	fileContents.set(path, result);
+	return result;
+}
+//#endregion
 //#region src/lint/ast.ts
 /**
 * Shared AST helpers for the rule files. Everything here is pure and
@@ -10,6 +67,39 @@ import { readFileSync, readdirSync, statSync } from "node:fs";
 function segments(path) {
 	return path.split(/[/\\]/).filter(Boolean);
 }
+/**
+* The `specs/` directory a file belongs to: the NEAREST ancestor named `specs`,
+* searched no higher than the nearest `package.json`. `undefined` when the file
+* is not under one.
+*
+* One anchor for every specs-aware rule. Rules used to hand-roll the search and
+* disagreed with each other — `lastIndexOf('specs')` (C1) took the innermost
+* match, `indexOf('specs')` (F3) the outermost, so one nested tree read as two
+* different facets. And any bare "is `specs` a segment of this path" test
+* matched directories that have nothing to do with the project: a checkout
+* living under `~/specs/` turned the whole repository into a specs tree, which
+* silently disabled F2's protection of production code. The package boundary
+* makes the search stop where the project does.
+*/
+function specsAnchor(filename) {
+	const relative = [basename(filename)];
+	let directory = dirname(filename);
+	for (;;) {
+		if (basename(directory) === "specs") return {
+			directory,
+			relative
+		};
+		if (isFile(join(directory, "package.json"))) return;
+		const parent = dirname(directory);
+		if (parent === directory) return;
+		relative.unshift(basename(directory));
+		directory = parent;
+	}
+}
+/** Is this file inside a `specs/` tree? — the predicate form of {@link specsAnchor}. */
+function isUnderSpecs(filename) {
+	return specsAnchor(filename) !== void 0;
+}
 /** The string value of a plain string literal (or a template with no holes). */
 function stringValue(node) {
 	if (node === void 0) return;
@@ -246,7 +336,7 @@ const RULE_DOCS = {
 	},
 	"c1-domain-structure": {
 		channel: "statique",
-		convention: "Un `*.test.ts` vit à la profondeur facet/domain, un `*.specification.ts` au root de la facette ; toute autre profondeur est une erreur.",
+		convention: "La forme de l’arbre `specs/` se déclare via l’option `depth` : `facet-domain` (défaut — `*.test.ts` à la profondeur facet/domain, `*.specification.ts` au root de la facette), `mirror` (test à toute profondeur ≥ 1, nommé d’après son dossier), `off`.",
 		family: "C",
 		id: "C1",
 		rationale: "Une profondeur fixe rend la place de chaque fichier prévisible et détectable statiquement."
@@ -393,10 +483,10 @@ const RULE_DOCS = {
 	},
 	"i1-layer-boundaries": {
 		channel: "statique",
-		convention: "Quatre couches sous `src/` (core/integrations/vitest/lint) ; un import externe depuis `core/`, une integration important une dépendance qui n’est pas la sienne, ou un import hors whitelist entre couches est une erreur.",
+		convention: "Le projet DÉCLARE ses couches sous `src/` via l’option `layers` (paquets autorisés, imports internes, un dossier = une dépendance, seams) ; tout import hors des arêtes déclarées est une erreur. Sans carte de couches, la règle est inerte.",
 		family: "I",
 		id: "I1",
-		rationale: "Des frontières strictes gardent `core/` pur et chaque intégration confinée à sa dépendance."
+		rationale: "Une architecture appartient au projet : des frontières déclarées se vérifient, une architecture supposée se contourne."
 	},
 	"i2-sibling-test-naming": {
 		channel: "statique",
@@ -407,7 +497,7 @@ const RULE_DOCS = {
 	},
 	"i4-no-vi-mock-in-src": {
 		channel: "statique",
-		convention: "Sous `src/`, `vi.mock`, `__mocks__/`, `__fixtures__/` et l’import d’un asset non-`.ts` depuis un `.test.ts` sont interdits.",
+		convention: "Sous `src/`, `vi.mock`, `__mocks__/`, `__fixtures__/` et l’import d’un asset de données (`.json`, `.sql`, `.yaml`, …) depuis un `.test.ts` sont interdits ; un spécifieur pointé (`./dashboard.post`) reste du code.",
 		family: "I",
 		id: "I4",
 		rationale: "Dans les tests de module, mocks et données sont du CODE (`mockOf`, `*.fixtures.ts`) ; un vrai fichier appelle une spec."
@@ -986,79 +1076,43 @@ const a6wRedundantComposeService = {
 	}
 };
 //#endregion
-//#region src/lint/fs-cache.ts
+//#region src/core/specification/shared/resolve.ts
+/** What makes a directory a project root — a manifest, or a test stack. */
+const ROOT_MARKERS = ["package.json", "docker/compose.test.yaml"];
 /**
-* Cached filesystem probes for the fs-anchored rules (a9w, c2, c6, c7, i2).
+* The NEAREST ancestor of `startDir` (itself included) carrying a root marker,
+* `undefined` when none does.
 *
-* Rules only ever look at directories NEXT TO files oxlint is already
-* visiting (a feature's `requests/`, `seeds/`, `expected/`, a sibling module
-* file), so the probe set is small — but several rules probe the same feature
-* directory, and oxlint lints many files per process. A module-level cache
-* keeps each `readdir`/`stat` to one syscall per lint run.
+* Both markers are probed at each ancestor, in ONE walk. Two walks — the
+* compose file all the way up, then `package.json` all the way up — made the
+* further directory win: in a workspace, a `docker/compose.test.yaml` at the
+* repository root outranked the `package.json` of the very package being
+* tested, and every path the runner resolved was measured from the wrong unit.
+* The unit is the nearest thing that declares itself a project.
+*
+* The existence probe is injected so the lint layer can pass its cached one
+* (A9's `a9w-redundant-root` derives the same root, and must derive it the
+* same way).
 */
-const dirListings = /* @__PURE__ */ new Map();
-function listDirectory(dir) {
-	const cached = dirListings.get(dir);
-	if (cached !== void 0) return cached;
-	let result;
-	try {
-		result = readdirSync(dir);
-	} catch {
-		result = null;
-	}
-	dirListings.set(dir, result);
-	return result;
-}
-const kinds = /* @__PURE__ */ new Map();
-function kindOf(path) {
-	const cached = kinds.get(path);
-	if (cached !== void 0) return cached;
-	let result;
-	try {
-		result = statSync(path).isDirectory() ? "dir" : "file";
-	} catch {
-		result = "missing";
-	}
-	kinds.set(path, result);
-	return result;
-}
-function isDirectory(path) {
-	return kindOf(path) === "dir";
-}
-function isFile(path) {
-	return kindOf(path) === "file";
-}
-const fileContents = /* @__PURE__ */ new Map();
-/** Read a file as UTF-8, cached. Returns null when unreadable (missing/binary). */
-function readFileCached(path) {
-	const cached = fileContents.get(path);
-	if (cached !== void 0) return cached;
-	let result;
-	try {
-		result = readFileSync(path, "utf8");
-	} catch {
-		result = null;
+function findRoot(startDir, exists) {
+	let dir = startDir;
+	for (;;) {
+		if (ROOT_MARKERS.some((marker) => exists(resolve(dir, marker)))) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) return;
+		dir = parent;
 	}
-	fileContents.set(path, result);
-	return result;
 }
 //#endregion
 //#region src/lint/rules/a9w-redundant-root.ts
 /**
-* The root the convention would derive (A9 — see docs/10-linting.md): walk up from the
-* specification file to the first directory containing
-* `docker/compose.test.yaml`, else the first containing `package.json`.
+* The root the convention would derive (A9 — see docs/10-linting.md): the
+* framework's own walk-up, run against this layer's cached fs probe. The rule
+* flags a `root` that the runner would have found by itself, so the two MUST
+* be the same function — a private copy of the walk drifted from it before.
 */
 function derivedRoot(startDir) {
-	for (const probe of ["docker/compose.test.yaml", "package.json"]) {
-		let dir = startDir;
-		for (;;) {
-			if (isFile(join(dir, probe))) return dir;
-			const parent = dirname(dir);
-			if (parent === dir) break;
-			dir = parent;
-		}
-	}
+	return findRoot(startDir, isFile);
 }
 /**
 * CONVENTIONS A9 (warning) — `root` is an override reserved for cases the
@@ -1390,8 +1444,16 @@ const b9wProductCommand = {
 //#region src/lint/rules/c1-domain-structure.ts
 const TEST_SUFFIX = ".test.ts";
 const SPECIFICATION_SUFFIX = ".specification.ts";
+const DEFAULT_DEPTH = "facet-domain";
 /**
-* CONVENTIONS C1' — facet-root specifications, domain-nested tests.
+* CONVENTIONS C1' — the shape of a spec tree, DECLARED by the consumer.
+*
+* A project states which shape its `specs/` tree has; the rule checks that one.
+* Before this option there was a single shape and the only way out was `off`,
+* which took the whole rule with it — a tree with a different, equally
+* deliberate shape had no way to be checked at all.
+*
+* `depth: 'facet-domain'` (the default, and the historical behaviour)
 *
 * A facet (`specs/<facet>/` — api, jobs, cli, integrations, lint, …) is the
 * master folder. It carries its runner(s) at its ROOT
@@ -1399,36 +1461,66 @@ const SPECIFICATION_SUFFIX = ".specification.ts";
 * product command/area with one or more `<aspect>.test.ts` files plus their
 * shared asset dirs.
 *
-* Two placement invariants, checked from the filename:
-* - a `*.test.ts` must sit at facet/domain depth — exactly
+* - a `*.test.ts` sits at facet/domain depth — exactly
 *   `specs/<facet>/<domain>/<file>.test.ts`. A test directly at the facet root
 *   (or nested deeper than a domain) is rejected.
-* - a `*.specification.ts` must sit at the facet root — exactly
+* - a `*.specification.ts` sits at the facet root — exactly
 *   `specs/<facet>/<file>.specification.ts`, never inside a domain.
 *
-* Module tests under `src/` follow the neighbour rule (I2) and are out of scope.
+* `depth: 'mirror'`
+*
+* The tree mirrors something outside itself (a command tree, a source tree), so
+* the depth is that structure's and no fixed number can name it. A `*.test.ts`
+* sits at ANY depth of at least one directory under `specs/`, and is NAMED
+* AFTER the directory holding it — `<dir>/<dir>.test.ts`. That naming is what
+* keeps the shape checkable: one test per mirrored node, no test loose at the
+* specs root. Specification files are unconstrained: a mirror has no facet
+* level to anchor them to.
+*
+* `depth: 'off'` — no placement check; the tree's shape is guarded elsewhere.
+*
+* Module tests under `src/` follow the neighbour rule (I2) and are out of scope
+* in every mode.
 */
 const c1DomainStructure = {
 	create(context) {
+		const depth = context.options[0]?.depth ?? DEFAULT_DEPTH;
+		if (depth === "off") return {};
 		return { Program(node) {
-			const parts = segments(context.filename);
-			const base = parts.at(-1) ?? "";
-			const specsIndex = parts.lastIndexOf("specs");
-			if (specsIndex === -1) return;
-			const depth = parts.length - 1 - (specsIndex + 1);
+			const anchor = specsAnchor(context.filename);
+			if (anchor === void 0) return;
+			const base = anchor.relative.at(-1) ?? "";
+			const nesting = anchor.relative.length - 1;
+			if (depth === "mirror") {
+				if (!base.endsWith(TEST_SUFFIX)) return;
+				if (nesting < 1) {
+					context.report({
+						messageId: "testAtSpecsRoot",
+						node
+					});
+					return;
+				}
+				const directory = anchor.relative.at(-2) ?? "";
+				if (base.slice(0, -8) !== directory) context.report({
+					data: { directory },
+					messageId: "testNotMirroringDirectory",
+					node
+				});
+				return;
+			}
 			if (base.endsWith(TEST_SUFFIX)) {
-				if (depth < 2) context.report({
+				if (nesting < 2) context.report({
 					messageId: "testAtFacetRoot",
 					node
 				});
-				else if (depth > 2) context.report({
+				else if (nesting > 2) context.report({
 					messageId: "testTooDeep",
 					node
 				});
 				return;
 			}
 			if (base.endsWith(SPECIFICATION_SUFFIX)) {
-				if (depth !== 1) context.report({
+				if (nesting !== 1) context.report({
 					messageId: "specNotAtFacetRoot",
 					node
 				});
@@ -1436,12 +1528,27 @@ const c1DomainStructure = {
 		} };
 	},
 	meta: {
+		defaultOptions: [{ depth: DEFAULT_DEPTH }],
 		docs: RULE_DOCS["c1-domain-structure"],
 		messages: {
 			specNotAtFacetRoot: "A `*.specification.ts` must sit at the facet root: `specs/<facet>/<name>.specification.ts` (C1 — see docs/10-linting.md).",
 			testAtFacetRoot: "A `*.test.ts` must live in a domain folder: `specs/<facet>/<domain>/<aspect>.test.ts` — tests directly at the facet root are forbidden (C1 — see docs/10-linting.md).",
+			testAtSpecsRoot: "A `*.test.ts` must live in a directory under specs/ — with `depth: \"mirror\"` the tree mirrors a structure, and the specs root mirrors nothing (C1 — see docs/10-linting.md).",
+			testNotMirroringDirectory: "A `*.test.ts` must be named after the directory holding it — `{{directory}}/{{directory}}.test.ts` — with `depth: \"mirror\"` (C1 — see docs/10-linting.md).",
 			testTooDeep: "A `*.test.ts` must sit at facet/domain depth: `specs/<facet>/<domain>/<aspect>.test.ts` — no deeper nesting (C1 — see docs/10-linting.md)."
 		},
+		schema: [{
+			additionalProperties: false,
+			properties: { depth: {
+				enum: [
+					"facet-domain",
+					"mirror",
+					"off"
+				],
+				type: "string"
+			} },
+			type: "object"
+		}],
 		type: "problem"
 	}
 };
@@ -1891,22 +1998,9 @@ const VERB_ROOTS = {
 function looksLikePath(value) {
 	return value.length > 0 && !/\s/u.test(value);
 }
-/** Nearest ancestor directory named `specs` — the pool root for `$FIXTURES/`. */
-function specsRoot(file) {
-	let dir = dirname(file);
-	for (;;) {
-		if (basename(dir) === "specs") return dir;
-		const parent = dirname(dir);
-		if (parent === dir) return;
-		dir = parent;
-	}
-}
 /** Resolve the on-disk target a `.fixture()` literal points at, if determinable. */
-function resolveFixture(argument, featureDir, file) {
-	if (argument.startsWith("$FIXTURES/")) {
-		const root = specsRoot(file);
-		return root === void 0 ? void 0 : join(root, "fixtures", argument.slice(10));
-	}
+function resolveFixture(argument, featureDir, specsDir) {
+	if (argument.startsWith("$FIXTURES/")) return join(specsDir, "fixtures", argument.slice(10));
 	if (argument.startsWith("$")) return;
 	return join(featureDir, "fixtures", argument);
 }
@@ -1921,7 +2015,8 @@ function resolveFixture(argument, featureDir, file) {
 const c8ReferencedFixtureExists = {
 	create(context) {
 		const file = context.physicalFilename;
-		if (!TEST_FILE$6.test(file) || !segments(file).includes("specs")) return {};
+		const anchor = specsAnchor(file);
+		if (!TEST_FILE$6.test(file) || anchor === void 0) return {};
 		const featureDir = dirname(file);
 		return { CallExpression(node) {
 			const callee = node.callee;
@@ -1931,7 +2026,7 @@ const c8ReferencedFixtureExists = {
 			if (verb === "fixture") {
 				const value = stringValue(args[0]);
 				if (value === void 0 || !looksLikePath(value)) return;
-				const target = resolveFixture(value.replace(/\/+$/, ""), featureDir, file);
+				const target = resolveFixture(value.replace(/\/+$/, ""), featureDir, anchor.directory);
 				if (target !== void 0 && !isFile(target) && !isDirectory(target)) context.report({
 					data: {
 						path: value,
@@ -2544,7 +2639,7 @@ const TOOL_SUBPATH$1 = "@jterrazz/test/oxlint";
 const f2NoTestImportsInProd = {
 	create(context) {
 		const file = context.filename;
-		if (TEST_FILE$4.test(file) || CONFIG_FILE.test(file) || segments(file).includes("specs")) return {};
+		if (TEST_FILE$4.test(file) || CONFIG_FILE.test(file) || isUnderSpecs(file)) return {};
 		return { ...importSourceVisitor(({ node, source }) => {
 			if (source === TOOL_SUBPATH$1) return;
 			if (source === "vitest" || source.startsWith("vitest/")) context.report({
@@ -2602,10 +2697,9 @@ const FRAMEWORK_LAYERS = /* @__PURE__ */ new Set([
 */
 const f3SpecsPublicEntry = {
 	create(context) {
-		const parts = segments(context.filename);
-		const specsIndex = parts.indexOf("specs");
-		if (specsIndex === -1) return {};
-		const underIntegrations = parts[specsIndex + 1] === "integrations";
+		const anchor = specsAnchor(context.filename);
+		if (anchor === void 0) return {};
+		const underIntegrations = anchor.relative[0] === "integrations";
 		return { ...importSourceVisitor(({ node, source }) => {
 			if (source.startsWith(`${PACKAGE}/`)) {
 				if (source === TOOL_SUBPATH) return;
@@ -2688,36 +2782,6 @@ const f5FixturesOnlyFromTests = {
 };
 //#endregion
 //#region src/lint/rules/i1-layer-boundaries.ts
-/**
-* One folder = one external dependency (I1 — see docs/10-linting.md): the packages each
-* `src/integrations/<folder>/` may import.
-*/
-const INTEGRATION_DEPS = {
-	anthropic: ["@anthropic-ai/sdk"],
-	appium: ["webdriverio"],
-	compose: ["yaml"],
-	docker: [],
-	hono: ["hono", "@hono/node-server"],
-	msw: ["msw"],
-	openai: ["openai"],
-	playwright: ["playwright"],
-	postgres: ["pg"],
-	redis: ["redis"],
-	sqlite: ["better-sqlite3"],
-	testcontainers: ["testcontainers"]
-};
-/** External packages the vitest layer (ALL runner coupling) may import. */
-const VITEST_DEPS = [
-	"vitest",
-	"vitest-mock-extended",
-	"mockdate"
-];
-/** The pure core helpers the tool-facing lint layer may reach (I1). */
-const LINT_CORE_WHITELIST = /* @__PURE__ */ new Set([
-	"core/matching/match",
-	"core/specification/shared/binding",
-	"core/specification/shared/fixtures"
-]);
 const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/;
 function matchesPackage(source, packages) {
 	return packages.some((name) => source === name || source.startsWith(`${name}/`));
@@ -2728,64 +2792,68 @@ function pathInsideSrc(path) {
 	const srcIndex = parts.lastIndexOf("src");
 	return srcIndex === -1 ? void 0 : parts.slice(srcIndex + 1).join("/");
 }
-/** Strip a `.js`/`.ts`-style extension for whitelist comparison. */
+/** Strip a `.js`/`.ts`-style extension for exact-path comparison. */
 function withoutExtension(path) {
 	return path.replace(/\.[cm]?[jt]sx?$/, "");
 }
+/** Does `target` match one of the declared paths (prefix, or exact module)? */
+function matchesPath(target, patterns) {
+	return patterns.some((pattern) => pattern.endsWith("/") ? target.startsWith(pattern) : withoutExtension(target) === withoutExtension(pattern));
+}
 /**
-* CONVENTIONS I1 — the four layers under `src/` and their sanctioned edges:
+* CONVENTIONS I1 — the layers under `src/` and their sanctioned edges, DECLARED
+* by the project:
+*
+*     'jterrazz/i1-layer-boundaries': ['error', {
+*         layers: {
+*             core: { imports: ['core/', 'integrations/docker/'] },
+*             integrations: { folders: { postgres: ['pg'] }, imports: ['core/'] },
+*         },
+*     }]
+*
+* With no layer map the rule is INERT. It used to ship the framework's own
+* architecture as its law — four layers named `core` / `integrations` / `lint`
+* / `vitest`, and the framework's own dependency table — and applied it to every
+* consumer that enabled the catalogue. A consumer with those directory names
+* was judged against a map describing a different package; a consumer with any
+* other architecture got a rule that could never say anything true. An
+* architecture is the project's to state.
 *
-* - `core/` — zero external imports; may reach `integrations/docker`,
-*   `integrations/hono`, `vitest/matchers`, and (from `builder.ts` only, the
-*   lazy MSW seam) `integrations/msw`.
-* - `integrations/<dep>/` — its own external dependency and `core/` only.
-* - `vitest/` — the runner coupling: `vitest`, `vitest-mock-extended`,
-*   `mockdate`, plus `core/` and `integrations/docker` (the matchers recognise
-*   the zero-dependency ContainerAccessor subject).
-* - `lint/` — zero runtime imports: no external packages, and from `core/`
-*   only the pure helpers (token list, case conversions, fixture markers).
+* Per layer: `packages` are the external dependencies it may import, `imports`
+* the paths inside `src/` it may reach (a `foo/` prefix, or an exact module
+* path), `folders` expresses "one folder = one external dependency" (each child
+* folder may import its own packages and its own files), and `seams` opens a
+* named module to an extra edge — the lazy import a layer allows exactly once.
 *
-* Module tests and fixtures files are exempt (their imports are governed by
-* F2/I4); `src/index.ts` is the composition root and lives above the layers.
+* A file under a layer the map does not name is out of scope, as are module
+* tests and `*.fixtures.ts` files (F2/I4 govern those), and any file outside
+* `src/`.
 */
 const i1LayerBoundaries = {
 	create(context) {
+		const layers = context.options[0]?.layers;
+		if (layers === void 0 || Object.keys(layers).length === 0) return {};
 		const file = context.physicalFilename;
 		if (TEST_OR_FIXTURES.test(file)) return {};
 		const inside = pathInsideSrc(file);
 		const layer = inside?.split("/")[0];
-		if (inside === void 0 || layer === void 0 || ![
-			"core",
-			"integrations",
-			"lint",
-			"vitest"
-		].includes(layer)) return {};
-		const integrationFolder = layer === "integrations" ? inside.split("/")[1] : void 0;
-		const checkExternal = (source) => {
-			if (layer === "core") return "coreExternal";
-			if (layer === "lint") return "lintRuntime";
-			if (layer === "vitest") return matchesPackage(source, VITEST_DEPS) ? null : "foreignDependency";
-			return matchesPackage(source, INTEGRATION_DEPS[integrationFolder ?? ""] ?? []) ? null : "foreignDependency";
-		};
-		const checkInternal = (target) => {
-			if (layer === "core") {
-				if (target.startsWith("core/") || target.startsWith("integrations/docker/") || target.startsWith("integrations/hono/") || withoutExtension(target) === "vitest/matchers") return null;
-				if (target.startsWith("integrations/msw/") && inside === "core/specification/shared/builder.ts") return null;
-				if (target.startsWith("integrations/playwright/") && inside === "core/specification/website/start-website.ts") return null;
-				if (target.startsWith("integrations/appium/") && inside === "core/specification/mobile/start-mobile.ts") return null;
-				return "crossLayer";
-			}
-			if (layer === "integrations") return target.startsWith("core/") || target.startsWith(`integrations/${integrationFolder}/`) ? null : "crossLayer";
-			if (layer === "vitest") return target.startsWith("core/") || target.startsWith("vitest/") || target.startsWith("integrations/docker/") ? null : "crossLayer";
-			return target.startsWith("lint/") || LINT_CORE_WHITELIST.has(withoutExtension(target)) ? null : "lintRuntime";
+		const rules = layer === void 0 ? void 0 : layers[layer];
+		if (inside === void 0 || layer === void 0 || rules === void 0) return {};
+		const folder = rules.folders === void 0 ? void 0 : inside.split("/")[1];
+		const ownPackages = [...rules.packages ?? [], ...rules.folders?.[folder ?? ""] ?? []];
+		const ownImports = [...rules.imports ?? [], ...rules.seams?.[inside] ?? []];
+		const allowsExternal = (source) => matchesPackage(source, ownPackages);
+		const allowsInternal = (target) => {
+			if (matchesPath(target, ownImports)) return true;
+			return folder !== void 0 && target.startsWith(`${layer}/${folder}/`);
 		};
 		return { ...importSourceVisitor(({ node, source }) => {
 			if (source.startsWith("node:")) return;
 			let messageId;
 			if (source.startsWith(".")) {
 				const target = pathInsideSrc(resolve(dirname(file), source));
-				messageId = target === void 0 ? "crossLayer" : checkInternal(target);
-			} else messageId = checkExternal(source);
+				messageId = target === void 0 || !allowsInternal(target) ? "crossLayer" : null;
+			} else messageId = allowsExternal(source) ? null : "foreignDependency";
 			if (messageId !== null) context.report({
 				data: {
 					layer,
@@ -2797,13 +2865,47 @@ const i1LayerBoundaries = {
 		}) };
 	},
 	meta: {
+		defaultOptions: [{ layers: {} }],
 		docs: RULE_DOCS["i1-layer-boundaries"],
 		messages: {
-			coreExternal: "core/ imports nothing external — \"{{source}}\" is not allowed (I1 — see docs/10-linting.md).",
-			crossLayer: "Layer \"{{layer}}\" must not import \"{{source}}\" — outside the sanctioned layer edges (I1 — see docs/10-linting.md).",
-			foreignDependency: "\"{{source}}\" is not this folder's own dependency — one integrations folder = one external dependency (I1 — see docs/10-linting.md).",
-			lintRuntime: "The lint layer imports nothing from the framework runtime — \"{{source}}\" is outside its pure-helper whitelist (I1 — see docs/10-linting.md)."
+			crossLayer: "Layer \"{{layer}}\" must not import \"{{source}}\" — outside the edges its layer map declares (I1 — see docs/10-linting.md).",
+			foreignDependency: "\"{{source}}\" is not a dependency layer \"{{layer}}\" declares — one layer states the packages it may import (I1 — see docs/10-linting.md)."
 		},
+		schema: [{
+			additionalProperties: false,
+			properties: { layers: {
+				additionalProperties: {
+					additionalProperties: false,
+					properties: {
+						folders: {
+							additionalProperties: {
+								items: { type: "string" },
+								type: "array"
+							},
+							type: "object"
+						},
+						imports: {
+							items: { type: "string" },
+							type: "array"
+						},
+						packages: {
+							items: { type: "string" },
+							type: "array"
+						},
+						seams: {
+							additionalProperties: {
+								items: { type: "string" },
+								type: "array"
+							},
+							type: "object"
+						}
+					},
+					type: "object"
+				},
+				type: "object"
+			} },
+			type: "object"
+		}],
 		type: "problem"
 	}
 };
@@ -2865,10 +2967,48 @@ const i2SiblingTestNaming = {
 //#endregion
 //#region src/lint/rules/i4-no-vi-mock-in-src.ts
 const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
-/** Module-ish sources a src test may import; anything else with an extension is a data asset. */
-const CODE_IMPORT = /\.[cm]?[jt]sx?$/;
-/** Does this import path even carry an extension? Bare/extension-less ones are code. */
-const HAS_EXTENSION = /\.[a-z0-9]+$/i;
+const DATA_ASSET = new RegExp(`\\.(?:${[
+	"avif",
+	"bin",
+	"bmp",
+	"csv",
+	"gif",
+	"graphql",
+	"gql",
+	"gz",
+	"htm",
+	"html",
+	"ico",
+	"ini",
+	"jpeg",
+	"jpg",
+	"json",
+	"json5",
+	"jsonc",
+	"jsonl",
+	"md",
+	"mdx",
+	"ndjson",
+	"pdf",
+	"png",
+	"proto",
+	"sql",
+	"svg",
+	"tar",
+	"toml",
+	"tsv",
+	"txt",
+	"wasm",
+	"webp",
+	"xml",
+	"yaml",
+	"yml",
+	"zip"
+].join("|")})$`, "i");
+/** A bundler suffix (`./payload.json?raw`, `./doc.md#frag`) is not part of the extension. */
+function withoutSuffix(source) {
+	return source.replace(/[?#].*$/, "");
+}
 /**
 * CONVENTIONS I4 — in module tests under `src/`, mocks and data are CODE:
 * `mockOf`/`mockOfDate` inline, large payloads in a `*.fixtures.ts` neighbour.
@@ -2876,8 +3016,11 @@ const HAS_EXTENSION = /\.[a-z0-9]+$/i;
 *
 * - `vi.mock(…)` calls (module mocking) in any file;
 * - files living in a `__mocks__/` or `__fixtures__/` directory;
-* - a `*.test.ts` importing a non-code asset (`.json`, `.txt`, `.sql`, …) —
+* - a `*.test.ts` importing a known data asset (`.json`, `.txt`, `.sql`, …) —
 *   a test needing a real file is a specification and belongs in `specs/`.
+*
+* A specifier whose extension is not on the data list is CODE, dotted or not:
+* `<subject>.<role>` module names are a naming convention, not a file type.
 */
 const i4NoViMockInSrc = {
 	create(context) {
@@ -2905,7 +3048,7 @@ const i4NoViMockInSrc = {
 			}
 		};
 		if (isTest) Object.assign(visitor, importSourceVisitor(({ node, source }) => {
-			if (HAS_EXTENSION.test(source) && !CODE_IMPORT.test(source)) context.report({
+			if (DATA_ASSET.test(withoutSuffix(source))) context.report({
 				data: { source },
 				messageId: "assetImport",
 				node
@@ -2976,7 +3119,7 @@ const j1NoOnlySkip = {
 */
 const j2NoSleepInSpecs = {
 	create(context) {
-		if (!segments(context.filename).includes("specs")) return {};
+		if (!isUnderSpecs(context.filename)) return {};
 		return {
 			CallExpression(node) {
 				const callee = node.callee;