@jterrazz/test 7.1.0 → 9.0.0

package/dist/oxlint.cjs

@@ -0,0 +1,2931 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+let node_path = require("node:path");
+let node_fs = require("node:fs");
+//#region src/lint/ast.ts
+/**
+* Shared AST helpers for the rule files. Everything here is pure and
+* structural: rules narrow nodes by `type` and read fields defensively, so the
+* layer stays decoupled from oxlint's internal (alpha) typings.
+*/
+/** Split a path into its non-empty segments (posix or win separators). */
+function segments(path) {
+	return path.split(/[/\\]/).filter(Boolean);
+}
+/** The string value of a plain string literal (or a template with no holes). */
+function stringValue(node) {
+	if (node === void 0) return;
+	if (node.type === "Literal" && typeof node.value === "string") return node.value;
+	if (node.type === "TemplateLiteral") {
+		const expressions = node.expressions;
+		const quasis = node.quasis;
+		if (expressions?.length === 0 && quasis?.length === 1) return quasis[0].value?.cooked;
+	}
+}
+/** The property name of a non-computed member expression, if identifiable. */
+function memberPropertyName(node) {
+	if (node.type !== "MemberExpression" || node.computed === true) return;
+	const property = node.property;
+	return property?.type === "Identifier" ? property.name : void 0;
+}
+/**
+* The root identifier name of a member/call chain:
+* `dockerCli.fixture(x).exec(y)` → `dockerCli`.
+*/
+function chainRootName(node) {
+	let current = node;
+	while (current !== void 0) {
+		if (current.type === "Identifier") return current.name;
+		if (current.type === "MemberExpression") current = current.object;
+		else if (current.type === "CallExpression") current = current.callee;
+		else if (current.type === "AwaitExpression" || current.type === "ChainExpression") current = current.argument ?? current.expression;
+		else return;
+	}
+}
+/**
+* Is this call `specification.<member>(…)`? Returns the member name when the
+* callee is a non-computed member on the `specification` identifier.
+*/
+function specificationMember(callNode) {
+	const callee = callNode.callee;
+	if (callee?.type !== "MemberExpression") return;
+	const object = callee.object;
+	if (object?.type !== "Identifier" || object.name !== "specification") return;
+	return memberPropertyName(callee);
+}
+/** Find a named, non-computed property in an ObjectExpression. */
+function findProperty(objectNode, name) {
+	if (objectNode.type !== "ObjectExpression") return;
+	return (objectNode.properties ?? []).find((property) => propertyKeyName(property) === name);
+}
+/** The name of a property key (Identifier or string literal), if identifiable. */
+function propertyKeyName(property) {
+	if (property.type !== "Property" || property.computed === true) return;
+	const key = property.key;
+	if (key?.type === "Identifier") return key.name;
+	if (key?.type === "Literal") return String(key.value);
+}
+/**
+* Depth-first walk over every node reachable from `root`, calling `visit` on
+* each. Used by rules that need a whole-file view from the `Program` handler
+* (oxlint runs visitors per node type; cross-node analyses walk manually).
+*/
+function walk(root, visit) {
+	visit(root);
+	for (const key of Object.keys(root)) {
+		if (key === "parent") continue;
+		const value = root[key];
+		if (Array.isArray(value)) {
+			for (const item of value) if (isNode(item)) walk(item, visit);
+		} else if (isNode(value)) walk(value, visit);
+	}
+}
+function isNode(value) {
+	return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+/** The source start offset of a node or comment (oxlint `start`, else `range[0]`). */
+function nodeStart(node) {
+	if (node === void 0) return -1;
+	if (typeof node.start === "number") return node.start;
+	const range = node.range;
+	return Array.isArray(range) && typeof range[0] === "number" ? range[0] : -1;
+}
+/** Bare identifiers that introduce a test. */
+const TEST_IDENTIFIERS = /* @__PURE__ */ new Set(["it", "test"]);
+/**
+* Is `callee` a `test` / `it` invocation? Handles the modifier forms used across
+* the specs: bare `test(...)`, member `test.only(...)` / `test.concurrent(...)`,
+* and the call-returning wrappers `test.skipIf(cond)(...)` / `test.each(...)(...)`.
+* Shared by B4 / J3 / J4.
+*/
+function isTestCallee(callee) {
+	if (callee === void 0) return false;
+	if (callee.type === "Identifier") return TEST_IDENTIFIERS.has(callee.name);
+	if (callee.type === "MemberExpression") return isTestCallee(callee.object);
+	if (callee.type === "CallExpression") return isTestCallee(callee.callee);
+	return false;
+}
+/** Does the test callee chain carry a modifier member with the given name? */
+function testCalleeHasModifier(callee, modifier) {
+	if (callee === void 0) return false;
+	if (callee.type === "MemberExpression") return memberPropertyName(callee) === modifier || testCalleeHasModifier(callee.object, modifier);
+	if (callee.type === "CallExpression") return testCalleeHasModifier(callee.callee, modifier);
+	return false;
+}
+/** The callback argument of a test call (arrow or function expression), if any. */
+function findTestCallback(args) {
+	return args.find((arg) => arg.type === "ArrowFunctionExpression" || arg.type === "FunctionExpression");
+}
+/** The static string name of a test call (`test('name', …)`), if a literal. */
+function testName(callNode) {
+	return stringValue((callNode.arguments ?? [])[0]);
+}
+/**
+* Visitor fragment collecting every import-like source: static imports,
+* dynamic `import()`, and re-exports. Rules spread this into their visitor.
+*/
+function importSourceVisitor(onSource) {
+	const fromSourceField = (node) => {
+		const source = node.source ?? void 0;
+		const value = stringValue(source);
+		if (value !== void 0) onSource({
+			node: source ?? node,
+			source: value
+		});
+	};
+	return {
+		ExportAllDeclaration: fromSourceField,
+		ExportNamedDeclaration: fromSourceField,
+		ImportDeclaration: fromSourceField,
+		ImportExpression: fromSourceField
+	};
+}
+//#endregion
+//#region src/lint/manifest.ts
+/**
+* The **statique** channel — one entry per shipped `jterrazz/*` rule. Each rule
+* file attaches its entry as `meta.docs`, so a rule and its normative text can
+* never drift (the completeness meta-test asserts every rule carries one).
+*/
+const RULE_DOCS = {
+	"a1-specification-file": {
+		channel: "statique",
+		convention: "Un runner ne se crée que dans un fichier `*.specification.ts` sous `specs/` : appeler `specification.*` ailleurs est une erreur.",
+		family: "A",
+		id: "A1",
+		rationale: "Ancrer les runners à un nom de fichier reconnaissable rend le point d’entrée détectable et garde les tests déclaratifs."
+	},
+	"a10-duplicate-binding": {
+		channel: "statique",
+		convention: "Dans un même record `services`, deux clés ne peuvent pas se lier au même service compose (même dérivation kebab-case, ou même `composeService`).",
+		family: "A",
+		id: "A10",
+		rationale: "Une seconde liaison masquerait silencieusement la première dans ce qui est une map."
+	},
+	"a2-known-constructors": {
+		channel: "statique",
+		convention: "Trois constructeurs et seulement trois : `specification.api()`, `specification.jobs()`, `specification.cli(bin)` ; tout autre membre (`.app`, `.http`, `.stack`…) est une erreur.",
+		family: "A",
+		id: "A2",
+		rationale: "Une surface fermée empêche l’invention de constructeurs parallèles et garde l’API mémorisable."
+	},
+	"a3-no-destructure-alias": {
+		channel: "statique",
+		convention: "Le retour se destructure avec le nom canonique du constructeur, sans alias (`{ api, cleanup, docker }`) ; renommer (`{ api: monApi }`) est une erreur.",
+		family: "A",
+		id: "A3",
+		rationale: "Un nom d’instance unique par facette rend chaque spec lisible sans contexte local."
+	},
+	"a4-cleanup-afterall": {
+		channel: "statique",
+		convention: "Le fichier de specification passe `cleanup` à `afterAll` ; un `cleanup` destructuré mais jamais transmis est une erreur.",
+		family: "A",
+		id: "A4",
+		rationale: "Garantir le teardown évite les conteneurs et connexions qui fuient entre fichiers."
+	},
+	"a5-mode-with-server": {
+		channel: "statique",
+		convention: "`mode` n’existe que sur `specification.api()` et n’est jamais hardcodé quand `server` est défini — le switch vit dans `vitest.config.ts`.",
+		family: "A",
+		id: "A5",
+		rationale: "Sortir le mode du fichier de spec permet d’exécuter le même test en node et en compose sans le modifier."
+	},
+	"a6w-redundant-compose-service": {
+		channel: "statique",
+		convention: "`composeService:` dérivable de la clé (égal à la clé exacte ou à sa conversion kebab-case) est redondant → warning.",
+		family: "A",
+		id: "A6",
+		rationale: "Signaler la redondance garde les records `services` minimaux et évite le bruit qui masque les vrais overrides."
+	},
+	"a9w-redundant-root": {
+		channel: "statique",
+		convention: "`root` pointant vers le dossier que la remontée automatique aurait trouvé est redondant → warning.",
+		family: "A",
+		id: "A9",
+		rationale: "La détection par convention doit rester le défaut ; un `root` explicite ne se justifie que là où elle échoue."
+	},
+	"b2-known-fixture-marker": {
+		channel: "statique",
+		convention: "Un marqueur `$…` inconnu dans un littéral passé à `.fixture()` est une erreur (seul `$FIXTURES` est connu).",
+		family: "B",
+		id: "B2",
+		rationale: "Attraper un marqueur fautif statiquement évite un chemin de fixture résolu au hasard à l’exécution."
+	},
+	"b4-given-then": {
+		channel: "statique",
+		convention: "Chaque test contient `// Given -` puis `// Then -` (les deux, dans cet ordre) ; Given déclaré après Then est une erreur.",
+		family: "B",
+		id: "B4",
+		rationale: "La narration Given/Then rend l’intention du test lisible sans lire les assertions."
+	},
+	"b5-await-using": {
+		channel: "statique",
+		convention: "Le résultat d’un runner docker-aware se lie avec `await using` ; une assignation nue est une erreur. Canal principal : l’inférence checker (b5-await-using-inference).",
+		family: "B",
+		id: "B5",
+		rationale: "`await using` garantit le nettoyage des conteneurs créés par le binaire testé, même en cas d’échec."
+	},
+	"b6w-redundant-env-url": {
+		channel: "statique",
+		convention: "`.env({ <SERVICE>_URL: ….connectionString })` répète l’injection automatique du framework → warning.",
+		family: "B",
+		id: "B6",
+		rationale: "L’injection couvre déjà les URLs de services ; les réécrire à la main invite au décalage."
+	},
+	"b8-kebab-trigger": {
+		channel: "statique",
+		convention: "`.trigger(name)` prend un identifiant kebab-case stable ; un `name` non kebab-case est une erreur.",
+		family: "B",
+		id: "B8",
+		rationale: "Le nom de job est un contrat entre l’app et les tests — un identifiant stable interdit les traductions divergentes."
+	},
+	"b9w-product-command": {
+		channel: "statique",
+		convention: "Un `specification.cli(bin)` dont le binaire résout dans le `node_modules/.bin` d’une dépendance teste l’outil tiers, pas la commande produit → warning (suppression avec raison admise).",
+		family: "B",
+		id: "B9",
+		rationale: "Une spec doit exercer la vraie commande du produit ; les assertions par outil passent par `result.grep`."
+	},
+	"c1-domain-structure": {
+		channel: "statique",
+		convention: "Un `*.test.ts` vit à la profondeur facet/domain, un `*.specification.ts` au root de la facette ; toute autre profondeur est une erreur.",
+		family: "C",
+		id: "C1",
+		rationale: "Une profondeur fixe rend la place de chaque fichier prévisible et détectable statiquement."
+	},
+	"c2-http-only-requests": {
+		channel: "statique",
+		convention: "`requests/` ne contient que des fichiers `.http` ; toute autre extension est une erreur.",
+		family: "C",
+		id: "C2",
+		rationale: "Une entrée de requête est un `.http` complet — homogénéiser le dossier interdit les formats ad hoc."
+	},
+	"c4-contract-shape": {
+		channel: "statique",
+		convention: "Un fichier de `contracts/` respecte `<nom>.<provider>.ts` (provider ∈ openai|anthropic|http), à plat, `export default defineContract(...)`, imports depuis le point d’entrée public.",
+		family: "C",
+		id: "C4",
+		rationale: "Une forme figée rend les contrats découvrables et typables sans convention locale."
+	},
+	"c6-tomatch-extension": {
+		channel: "statique",
+		convention: "L’argument de `toMatch` porte son extension (`'help.txt'`), sauf pour les snapshots d’arborescence (dossiers) ; un sujet fichier sans extension est une erreur.",
+		family: "C",
+		id: "C6",
+		rationale: "L’extension fait partie du nom du fichier attendu — l’omettre casse la résolution `expected/`."
+	},
+	"c7-seeds-sql-only": {
+		channel: "statique",
+		convention: "`seeds/` ne contient que des `*.sql` ; tout autre fichier est une erreur.",
+		family: "C",
+		id: "C7",
+		rationale: "`.seed()` porte l’état des bases uniquement — pas de seed-handler ni de dispatch par préfixe."
+	},
+	"c8-referenced-fixture-exists": {
+		channel: "statique",
+		convention: "Un littéral de `.request`/`.seed`/`.fixture`/`toMatch` doit exister sur disque sous sa racine conventionnelle ; un chemin absent est une erreur.",
+		family: "C",
+		id: "C8",
+		rationale: "Attraper un typo statiquement évite un échec qui ne surviendrait qu’à l’exécution."
+	},
+	"d2-await-io-matcher": {
+		channel: "statique",
+		convention: "Un matcher IO (`toMatchRows`/`toBeEmpty`/`toBeRunning`) doit être awaité ou retourné ; sinon l’assertion ne s’exécute jamais → erreur.",
+		family: "D",
+		id: "D2",
+		rationale: "Une assertion IO non attendue passe silencieusement — le pire mode d’échec d’un test."
+	},
+	"d2w-await-sync-matcher": {
+		channel: "statique",
+		convention: "`await` sur un matcher toujours synchrone (`toBe`/`toEqual`/`toContain`/`toHaveLength`) est redondant → warning.",
+		family: "D",
+		id: "D2",
+		rationale: "Un await inutile masque le signal qui distingue les vrais matchers IO."
+	},
+	"d6w-transform-token-equivalent": {
+		channel: "statique",
+		convention: "Un `transform` qui ne fait que réécrire vers des équivalents de tokens standard duplique la grammaire → warning.",
+		family: "D",
+		id: "D6",
+		rationale: "`transform` est une échappatoire pour le bruit non couvert par les tokens — pas un doublon des tokens."
+	},
+	"d8w-text-bypass": {
+		channel: "statique",
+		convention: "`expect(x.text).toContain/toMatch` court-circuite le sujet accesseur typé → warning.",
+		family: "D",
+		id: "D8",
+		rationale: "Asserter sur `.text` jette la grammaire de tokens et la résolution `toMatch('fichier')` du sujet."
+	},
+	"d9w-single-use-ref": {
+		channel: "statique",
+		convention: "Une ref de capture (`match.ref`, `{{kind#ref}}`) qui n’apparaît qu’une seule fois dans tout le fichier (code + fixtures `expected/` référencées) porte un nom inutilement → warning.",
+		family: "D",
+		id: "D9",
+		rationale: "Une ref ne se justifie que si elle asserte l’égalité sur au moins deux occurrences."
+	},
+	"d12w-response-body-probe": {
+		channel: "statique",
+		convention: "Un test qui accumule un AMAS de sondes brutes sur `.response.body` (≥ `threshold`, défaut 3 ; une variable castée depuis `.response.body` compte ses lectures) → warning : ce cas veut un golden complet (`expect(result.response).toMatch('cas.http')`). Une ou deux sondes restent silencieuses (scalpel légitime).",
+		family: "D",
+		id: "D12",
+		rationale: "Le golden complet capture toute la forme et sa grammaire de tokens ; un amas de sondes brutes le remplace par des checks ad hoc qui dérivent (mécanise la frontière D11 pour les réponses API)."
+	},
+	"d13w-unfrozen-negative-fixture": {
+		channel: "statique",
+		convention: "Un `toMatch` dont l’échec EST le sujet du test (enveloppé dans `expect(() => …).toThrow()` ou `expect(…).rejects.toThrow()`) doit porter `{ frozen: true }` → sinon `TEST_UPDATE=1` réécrit silencieusement la fixture délibérément-fausse au lieu de lever → warning. Le résidu passé par un helper (`catchMessage(() => …toMatch(…))`) échappe à l’analyse statique (voir la note process D13).",
+		family: "D",
+		id: "D13",
+		rationale: "En mode update, un matcher non gelé écrit au lieu de lever : la fixture négative est corrompue par sa propre sortie réelle et l’assertion ne teste plus rien. `frozen` fige la fixture négative."
+	},
+	"d15w-status-only-probe": {
+		channel: "statique",
+		convention: "Un test de spec dont les SEULES assertions sont des sondes de statut HTTP (`expect(X.status).toBe(N)` / `.toEqual(N)`, N littéral numérique 100–599) → warning : ce cas veut un golden complet (`expect(result.response).toMatch('cas.http')`). Une sonde de statut À CÔTÉ d’une vraie assertion (golden, `toMatchRows`, `toContain`…) reste silencieuse (scalpel légitime).",
+		family: "D",
+		id: "D15",
+		rationale: "Un statut isolé ne fige que le code de réponse et jette tout le reste du payload ; le golden complet capture la forme entière et sa grammaire de tokens (complète d12w, qui exige un amas de sondes de corps et manque le cas de la sonde de statut solitaire)."
+	},
+	"f1-no-subpath-import": {
+		channel: "statique",
+		convention: "Tout s’importe depuis `@jterrazz/test` ; un import de `@jterrazz/test/<subpath>` est une erreur, sauf le subpath tool-facing `@jterrazz/test/oxlint` (exempté partout).",
+		family: "F",
+		id: "F1",
+		rationale: "Un point d’entrée unique garde l’API publique explicite et les subpaths internes invisibles."
+	},
+	"f2-no-test-imports-in-prod": {
+		channel: "statique",
+		convention: "Un fichier de prod n’importe jamais `vitest`, `@jterrazz/test`, un `*.test.*`, un `*.fixtures.*` ni `mockOf`/`mockOfDate` (exception : `@jterrazz/test/oxlint`).",
+		family: "F",
+		id: "F2",
+		rationale: "Empêcher les artefacts de test de fuir en prod protège le bundle applicatif du consommateur."
+	},
+	"f3-specs-public-entry": {
+		channel: "statique",
+		convention: "Depuis `specs/`, seul l’import en profondeur des INTERNES du framework est interdit : un chemin relatif résolvant dans `src/{core,integrations,vitest,lint}/` du dépôt du framework, ou tout `@jterrazz/test/<subpath>` autre que `@jterrazz/test/oxlint`. Les imports de la source de SA PROPRE app par un consommateur sont toujours permis (c’est le motif documenté) ; seul `specs/integrations/` peut importer en profondeur `src/integrations/**`.",
+		family: "F",
+		id: "F3",
+		rationale: "Tester par la surface publique garde les specs découplées des chemins internes du framework, sans gêner le consommateur qui importe sa propre app."
+	},
+	"f4-no-test-to-test-import": {
+		channel: "statique",
+		convention: "Un `*.test.ts` n’importe jamais un autre `*.test.ts`.",
+		family: "F",
+		id: "F4",
+		rationale: "Le partage entre tests passe par des `*.fixtures.ts`, pas par des imports test-à-test qui couplent les fichiers."
+	},
+	"f5-fixtures-only-from-tests": {
+		channel: "statique",
+		convention: "Un `*.fixtures.ts` n’est importable que depuis des `*.test.ts`.",
+		family: "F",
+		id: "F5",
+		rationale: "Cantonner les fixtures aux tests empêche la donnée de test de fuir dans le code de prod."
+	},
+	"i1-layer-boundaries": {
+		channel: "statique",
+		convention: "Quatre couches sous `src/` (core/integrations/vitest/lint) ; un import externe depuis `core/`, une integration important une dépendance qui n’est pas la sienne, ou un import hors whitelist entre couches est une erreur.",
+		family: "I",
+		id: "I1",
+		rationale: "Des frontières strictes gardent `core/` pur et chaque intégration confinée à sa dépendance."
+	},
+	"i2-sibling-test-naming": {
+		channel: "statique",
+		convention: "Le test de `<fichier>.ts` est `<fichier>.test.ts` à côté de lui ; un `.test.ts` mal nommé, ou un dossier `__tests__/`, est une erreur.",
+		family: "I",
+		id: "I2",
+		rationale: "Des tests voisins (parité avec le `foo_test.go` de Go) gardent test et code ensemble et découvrables."
+	},
+	"i4-no-vi-mock-in-src": {
+		channel: "statique",
+		convention: "Sous `src/`, `vi.mock`, `__mocks__/`, `__fixtures__/` et l’import d’un asset non-`.ts` depuis un `.test.ts` sont interdits.",
+		family: "I",
+		id: "I4",
+		rationale: "Dans les tests de module, mocks et données sont du CODE (`mockOf`, `*.fixtures.ts`) ; un vrai fichier appelle une spec."
+	},
+	"j1-no-only-skip": {
+		channel: "statique",
+		convention: "Aucun `.only` / `.skip` committé (`describe.only`, `test.only`, `test.skip`).",
+		family: "J",
+		id: "J1",
+		rationale: "Un `.only`/`.skip` oublié désactive silencieusement une partie de la suite."
+	},
+	"j2-no-sleep-in-specs": {
+		channel: "statique",
+		convention: "Aucun sleep arbitraire (`setTimeout`/`setInterval`/`Atomics.wait`) sous `specs/**` — la synchronisation passe par `waitFor`.",
+		family: "J",
+		id: "J2",
+		rationale: "Un sleep fixe rend les tests lents et instables ; attendre une condition est déterministe."
+	},
+	"j3-no-expectless-test": {
+		channel: "statique",
+		convention: "Un `test(...)` avec callback contient au moins un `expect(…)` ; `test.todo` (sans callback) est ignoré.",
+		family: "J",
+		id: "J3",
+		rationale: "Un test sans assertion est mort ou muet — il passe toujours sans rien vérifier."
+	},
+	"j4-unique-test-names": {
+		channel: "statique",
+		convention: "Deux tests d’un même fichier ne partagent pas un nom littéral (`.each` ignoré).",
+		family: "J",
+		id: "J4",
+		rationale: "Le nom du test est son unique description — deux noms identiques rendent un échec ambigu."
+	},
+	"j5-lowercase-title": {
+		channel: "statique",
+		convention: "La première lettre d’un titre `test()`/`describe()`/`it()` littéral est en minuscule. Exemptés : les titres dont le premier MOT est un identifiant tout en majuscules/underscores (`VALID_CATEGORIES`, `HTTP`, `DI`) et ceux démarrant sur un non-lettre — seuls les premiers mots de prose minusculisables sont contraints.",
+		family: "J",
+		id: "J5",
+		rationale: "Un titre est un fragment de prose, pas une phrase — la casse minuscule le garde fragmentaire ; minusculiser un symbole nommé le mal-orthographierait."
+	}
+};
+/**
+* The **checker** channel — the non-oxlint static passes bundled as
+* `dist/checker.js` (token/HTTP grammar + cross-file analyses). Oxlint never
+* visits data fixtures nor reads two files at once, so these ship separately.
+*/
+const CHECKER_PASSES = [
+	{
+		channel: "checker",
+		convention: "Tout `{{token}}` dans une fixture `expected/` appartient au vocabulaire figé ; un token inconnu est une erreur.",
+		family: "D",
+		id: "D4",
+		name: "d4-unknown-token",
+		rationale: "Une grammaire fermée partagée avec le matcher runtime empêche la dérive entre canaux."
+	},
+	{
+		channel: "checker",
+		convention: "Une ref malformée d’un kind connu (`{{iso8601#}}`, `{{uuid #id}}`) dans un fichier texte sous `expected/` est une erreur.",
+		family: "D",
+		id: "D4",
+		name: "d4-malformed-ref",
+		rationale: "Une capture malformée échouerait silencieusement — la signaler la rend visible tôt."
+	},
+	{
+		channel: "checker",
+		convention: "La première ligne d’un `.http` de profondeur 1 suit sa grammaire : requête (`MÉTHODE /path`) sous `requests/`, statut (`HTTP/1.1 <status>`) sous `expected/`.",
+		family: "D",
+		id: "D4b",
+		name: "d4b-http-first-line",
+		rationale: "La ligne d’ouverture distingue une requête d’une réponse — la contraindre attrape les fichiers mal placés."
+	},
+	{
+		channel: "checker",
+		convention: "Un token connu dans un fichier sous `requests/` → warning : les requêtes sont des entrées, jamais matchées.",
+		family: "D",
+		id: "D10",
+		name: "d10w-tokens-in-requests",
+		rationale: "Un token dans une entrée ne sera ni validé ni substitué — c’est presque toujours une erreur."
+	},
+	{
+		channel: "checker",
+		convention: "Aucune fixture morte : tout fichier sous `seeds/`/`requests/`/`intercepts/`/`fixtures/` et toute entrée de premier niveau de `expected/` doit être référencée ; un dossier de feature sans `*.test.ts` est orphelin (warning si argument non littéral).",
+		family: "C",
+		id: "C9",
+		name: "c9-dead-fixtures",
+		rationale: "Le miroir de C8 — une fixture que rien ne référence est du poids mort qui trompe le lecteur."
+	},
+	{
+		channel: "checker",
+		convention: "Canal principal de B5 : les runners docker-aware sont inférés de l’option `docker:` du fichier de specification importé, puis chaque résultat `.exec()` lié sans `await using` est signalé.",
+		family: "B",
+		id: "B5",
+		name: "b5-await-using-inference",
+		rationale: "Inférer les runners supprime la liste à maintenir à la main de la règle oxlint."
+	},
+	{
+		channel: "checker",
+		convention: "Avec ≥ 2 bases, `database:` est obligatoire sur chaque `.seed()`/`.table()` ; avec une seule, il est interdit — vérifié en croisant le record `services:` avec les appels des tests.",
+		family: "A",
+		id: "A7",
+		name: "a7-database-property",
+		rationale: "Le nombre de bases fixe l’API d’appel ; l’analyse cross-fichier attrape l’omission avant le runtime."
+	}
+];
+/**
+* The **runtime** channel — refusals and behaviours the framework enforces at
+* execution time, where static analysis abstains (non-literal arguments) or
+* cannot reach (network, container lifecycle). Several double a static pass.
+*/
+const RUNTIME_RULES = [
+	{
+		channel: "runtime",
+		convention: "Un binding ambigu (le compose déclare à la fois la clé exacte ET sa forme kebab-case) est refusé à l’exécution.",
+		family: "A",
+		id: "A6",
+		name: "a6-ambiguous-binding",
+		rationale: "Le framework ne devine pas — il exige un renommage ou un `composeService` explicite."
+	},
+	{
+		channel: "runtime",
+		convention: "Le framework lève à l’exécution si `database:` est absent avec ≥ 2 bases, ou présent avec une seule (double le canal checker).",
+		family: "A",
+		id: "A7",
+		name: "a7-database-runtime",
+		rationale: "Le runtime garde la garantie même là où l’analyse statique s’abstient."
+	},
+	{
+		channel: "runtime",
+		convention: "Le framework refuse à l’exécution un marqueur `$…` inconnu, ou un `$FIXTURES` sans dossier `specs` ancêtre (message guidant).",
+		family: "B",
+		id: "B2",
+		name: "b2-unknown-marker-runtime",
+		rationale: "Un message runtime guide l’auteur quand la faute échappe au canal statique (argument non littéral)."
+	},
+	{
+		channel: "runtime",
+		convention: "En mode `cli` avec `services`, le framework injecte `<CLÉ>_URL` (CONSTANT_CASE camel-aware) plus les alias non ambigus `DATABASE_URL`/`REDIS_URL` ; `.env()` override (`null` retire).",
+		family: "B",
+		id: "B6",
+		name: "b6-url-injection",
+		rationale: "Injecter les URLs évite le câblage manuel répété et son décalage (voir b6w)."
+	},
+	{
+		channel: "runtime",
+		convention: "Dès qu’une chaîne `api`/`jobs` déclare un intercept, toute requête sortante non matchée (y compris une file épuisée) fait échouer le spec avec une erreur explicite.",
+		family: "D",
+		id: "D7",
+		name: "d7-strict-intercepts",
+		rationale: "Un réseau gardé rend les interactions externes exhaustives et intentionnelles."
+	},
+	{
+		channel: "runtime",
+		convention: "`toMatch` sur un sujet accesseur (`stream`/`json`/`response`/arborescence) attend un NOM de fixture (extension comprise) : passer une `RegExp` (ou tout non-string) lève immédiatement, en nommant le sujet et l’échappatoire `expect(x.text).toMatch(/re/)`.",
+		family: "D",
+		id: "D14",
+		name: "d14-tomatch-fixture-name",
+		rationale: "L’instinct hérité de vitest (`toMatch(/re/)`) tomberait sinon sur l’erreur d’extension ou coercerait la regex en `\"/re/\"`. L’argument accesseur n’est jamais littéral côté valeur, et une heuristique statique confondrait le `expect(chaîne).toMatch(/re/)` légitime (D3/D8) — seul le canal runtime refuse proprement, sans faux positifs."
+	},
+	{
+		channel: "runtime",
+		convention: "`.intercept()` n’existe que sur `api`/`jobs` et lève immédiatement en mode compose (MSW est in-process).",
+		family: "I",
+		id: "I3",
+		name: "i3-intercept-compose",
+		rationale: "Un child process ou un conteneur n’est pas interceptable par MSW — l’erreur oriente vers un projet node-only."
+	}
+];
+/**
+* The **process** channel — rules no channel can fully mechanize: they are a
+* matter of review judgement. Listed here so the catalogue is complete across
+* all four faces; the constitution keeps their full rationale.
+*/
+const PROCESS_RULES = [
+	{
+		channel: "process",
+		convention: "Le dossier suit les assets : un test avec ses propres dossiers d’assets a son propre domaine ; des tests sans assets locaux se regroupent en `<aspect>.test.ts` frères. La règle statique ne vérifie que la profondeur.",
+		family: "C",
+		id: "C1",
+		name: "c1-asset-grouping",
+		rationale: "Ce sont les assets qui tranchent le regroupement — un critère qu’aucun canal ne peut décider seul."
+	},
+	{
+		channel: "process",
+		convention: "La sortie d’un outil s’asserte en snapshot complet par use case scopé, pas en grappe de `grep` ; `.grep()` reste le scalpel pour les sondes ciblées.",
+		family: "D",
+		id: "D11",
+		name: "d11-golden-file",
+		rationale: "Jugement de revue — le canal statique ne distingue pas un grep légitime d’un grep paresseux."
+	},
+	{
+		channel: "process",
+		convention: "Une fixture délibérément-fausse ou manquante, asservie à un test négatif, porte `{ frozen: true }` sur son `toMatch`. La règle statique d13w couvre les formes enveloppées (`expect(() => …).toThrow()` / `.rejects`) ; le résidu — un `toMatch` routé via un helper qui possède le try/catch (`catchMessage(() => …)`) — relève de la revue, faute d’analyse inter-procédurale.",
+		family: "D",
+		id: "D13",
+		name: "d13-frozen-negative-fixture",
+		rationale: "Le helper masque le point de capture au canal statique ; la revue garde la même invariante que d13w là où l’AST ne suffit pas."
+	},
+	{
+		channel: "process",
+		convention: "Toute classe de défaut découverte produit, dans le même change, la garde qui l’empêche de revenir (règle statique, meta-test ou erreur runtime) — ou documente pourquoi aucun canal n’est possible.",
+		family: "K",
+		id: "K1",
+		name: "k1-retro-propagation",
+		rationale: "C’est la règle qui fait croître les trois autres canaux au lieu de les laisser pourrir."
+	}
+];
+/** Split an id into (family letter, numeric, variant) for natural ordering. */
+function sortKey(entry) {
+	const match = /^(?<letter>[A-Z]+)(?<number>\d+)(?<variant>.*)$/u.exec(entry.id);
+	return [
+		match?.groups?.letter ?? entry.id,
+		Number(match?.groups?.number ?? 0),
+		`${match?.groups?.variant ?? ""}:${entry.name}`
+	];
+}
+[
+	...Object.entries(RULE_DOCS).map(([name, doc]) => ({
+		channel: doc.channel,
+		convention: doc.convention,
+		family: doc.family,
+		id: doc.id,
+		name,
+		rationale: doc.rationale
+	})),
+	...CHECKER_PASSES,
+	...RUNTIME_RULES,
+	...PROCESS_RULES
+].sort((a, b) => {
+	const [al, an, av] = sortKey(a);
+	const [bl, bn, bv] = sortKey(b);
+	if (al !== bl) return al.localeCompare(bl);
+	if (an !== bn) return an - bn;
+	return av.localeCompare(bv);
+});
+//#endregion
+//#region src/lint/rules/a1-specification-file.ts
+const SPECIFICATION_SUFFIX$2 = ".specification.ts";
+/**
+* CONVENTIONS A1 — a runner is created in a `*.specification.ts` file under
+* `specs/`. Any `specification.<member>(…)` call in a file that is not a
+* specification file is flagged.
+*
+* Framework-internal unit tests of the constructors themselves (this repo's
+* `src/**\/*.test.ts`) disable the rule via a config override — for consumers
+* the rule is universal.
+*/
+const a1SpecificationFile = {
+	create(context) {
+		if (context.filename.endsWith(SPECIFICATION_SUFFIX$2)) return {};
+		return { CallExpression(node) {
+			const member = specificationMember(node);
+			if (member !== void 0) context.report({
+				data: { member },
+				messageId: "outsideSpecification",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a1-specification-file"],
+		messages: { outsideSpecification: "specification.{{member}}() must be called from a `*.specification.ts` file under specs/ (CONVENTIONS A1)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/core/specification/shared/binding.ts
+/**
+* Compose-binding resolution and the case conversions it shares with the
+* automatic env injection (CONVENTIONS A6 / B6).
+*
+* A services-record key is written in the natural TypeScript style
+* (`analyticsDb`), while a compose service name is kebab-case
+* (`analytics-db`). These helpers bridge the two vocabularies deterministically
+* so the record key stays the single source of truth and `composeService`
+* remains a rare escape hatch.
+*/
+/**
+* Convert a record key to its kebab-case form: camelCase boundaries become
+* `-`, everything is lowercased. `analyticsDb` → `analytics-db`, `db` → `db`.
+*/
+function toKebabCase(key) {
+	return key.replace(/(?<lower>[a-z0-9])(?<upper>[A-Z])/g, "$<lower>-$<upper>").toLowerCase();
+}
+//#endregion
+//#region src/lint/rules/a10-duplicate-binding.ts
+/** The compose service an entry binds to: explicit `composeService`, else the key's kebab form. */
+function canonicalBinding(entry, key) {
+	const factory = entry.value;
+	if (factory?.type === "CallExpression") {
+		const options = factory.arguments?.[0];
+		if (options?.type === "ObjectExpression") {
+			const explicit = stringValue(findProperty(options, "composeService")?.value);
+			if (explicit !== void 0) return explicit;
+		}
+	}
+	return toKebabCase(key);
+}
+/**
+* CONVENTIONS A10 — within one `services` record, two keys that derive (or
+* pin via `composeService`) the SAME compose service name are a silent
+* collision: the record is a map, and the second binding would shadow the
+* first. Detected on the same kebab derivation the runtime binding uses
+* (`analyticsDb` and `analytics-db` both → `analytics-db`), and across explicit
+* `composeService` values.
+*/
+const a10DuplicateBinding = {
+	create(context) {
+		return { CallExpression(node) {
+			if (specificationMember(node) === void 0) return;
+			for (const argument of node.arguments ?? []) {
+				const record = findProperty(argument, "services")?.value;
+				if (record?.type !== "ObjectExpression") continue;
+				const seen = /* @__PURE__ */ new Map();
+				for (const entry of record.properties ?? []) {
+					const key = propertyKeyName(entry);
+					if (key === void 0) continue;
+					const binding = canonicalBinding(entry, key);
+					const first = seen.get(binding);
+					if (first !== void 0) {
+						context.report({
+							data: {
+								binding,
+								first,
+								key
+							},
+							messageId: "duplicate",
+							node: entry
+						});
+						continue;
+					}
+					seen.set(binding, key);
+				}
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a10-duplicate-binding"],
+		messages: { duplicate: "Service keys \"{{first}}\" and \"{{key}}\" both bind to compose service \"{{binding}}\" — one shadows the other; rename a key or set distinct composeService values (CONVENTIONS A10)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/a2-known-constructors.ts
+/** The three constructors, and only three (CONVENTIONS A2). */
+const KNOWN_CONSTRUCTORS = /* @__PURE__ */ new Set([
+	"api",
+	"cli",
+	"jobs"
+]);
+/**
+* CONVENTIONS A2 — `specification.api()`, `specification.jobs()` and
+* `specification.cli()` are the only members. Any other access
+* (`specification.app`, `.http`, `.stack`, …) is flagged at the member site.
+*/
+const a2KnownConstructors = {
+	create(context) {
+		return { MemberExpression(node) {
+			const object = node.object;
+			if (object?.type !== "Identifier" || object.name !== "specification") return;
+			const member = memberPropertyName(node);
+			if (member !== void 0 && !KNOWN_CONSTRUCTORS.has(member)) context.report({
+				data: { member },
+				messageId: "unknownConstructor",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a2-known-constructors"],
+		messages: { unknownConstructor: "specification.{{member}} does not exist — the only constructors are specification.api(), specification.jobs() and specification.cli() (CONVENTIONS A2)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/a3-no-destructure-alias.ts
+/** Unwrap `await <expr>` down to the call expression, if that is what it is. */
+function unwrapAwaitedCall(node) {
+	let current = node;
+	while (current?.type === "AwaitExpression") current = current.argument;
+	return current?.type === "CallExpression" ? current : void 0;
+}
+/**
+* CONVENTIONS A3 — the constructor's return is destructured with the canonical
+* names, no aliasing: `const { api, cleanup, docker } = await
+* specification.api(…)`. A renamed binding (`{ api: myApi }`) is flagged.
+*
+* Renaming at the IMPORT site (`import { cli as dockerCli } from …`) stays
+* legal — the canonical name is enforced where the record is destructured.
+*/
+const a3NoDestructureAlias = {
+	create(context) {
+		return { VariableDeclarator(node) {
+			const call = unwrapAwaitedCall(node.init);
+			if (call === void 0 || specificationMember(call) === void 0) return;
+			const id = node.id;
+			if (id?.type !== "ObjectPattern") return;
+			for (const property of id.properties ?? []) {
+				const key = propertyKeyName(property);
+				if (key === void 0) continue;
+				let value = property.value;
+				if (value?.type === "AssignmentPattern") value = value.left;
+				if (value?.type === "Identifier" && value.name !== key) context.report({
+					data: {
+						alias: value.name,
+						key
+					},
+					messageId: "aliased",
+					node: property
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a3-no-destructure-alias"],
+		messages: { aliased: "Destructure the specification result with its canonical name: `{{key}}`, not `{{key}}: {{alias}}` (CONVENTIONS A3). Rename at the import site if a different local name is needed." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/a4-cleanup-afterall.ts
+const SPECIFICATION_SUFFIX$1 = ".specification.ts";
+/** Does this declarator destructure `cleanup` out of a specification call? */
+function destructuresCleanup(node) {
+	if (node.type !== "VariableDeclarator") return false;
+	let init = node.init;
+	while (init?.type === "AwaitExpression") init = init.argument;
+	if (init?.type !== "CallExpression" || specificationMember(init) === void 0) return false;
+	const id = node.id;
+	if (id?.type !== "ObjectPattern") return false;
+	return (id.properties ?? []).some((property) => propertyKeyName(property) === "cleanup");
+}
+/** Is this an `afterAll(…)` call whose subtree references `cleanup`? */
+function isAfterAllWithCleanup(node) {
+	if (node.type !== "CallExpression") return false;
+	const callee = node.callee;
+	if (callee?.type !== "Identifier" || callee.name !== "afterAll") return false;
+	let found = false;
+	for (const argument of node.arguments ?? []) walk(argument, (child) => {
+		if (child.type === "Identifier" && child.name === "cleanup") found = true;
+	});
+	return found;
+}
+/**
+* CONVENTIONS A4 — a specification file calls `afterAll(cleanup)`. Flags a
+* `*.specification.ts` file that destructures `cleanup` from a
+* `specification.*` call but never hands it to `afterAll` (directly or inside
+* a callback).
+*/
+const a4CleanupAfterall = {
+	create(context) {
+		if (!context.filename.endsWith(SPECIFICATION_SUFFIX$1)) return {};
+		return { Program(node) {
+			let cleanupDeclarator;
+			let registered = false;
+			walk(node, (child) => {
+				if (cleanupDeclarator === void 0 && destructuresCleanup(child)) cleanupDeclarator = child;
+				if (!registered && isAfterAllWithCleanup(child)) registered = true;
+			});
+			if (cleanupDeclarator !== void 0 && !registered) context.report({
+				messageId: "unregistered",
+				node: cleanupDeclarator
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a4-cleanup-afterall"],
+		messages: { unregistered: "`cleanup` is destructured but never passed to afterAll — add `afterAll(cleanup)` to the specification file (CONVENTIONS A4)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/a5-mode-with-server.ts
+/**
+* CONVENTIONS A5 — `mode` is never hardcoded in a specification file: the
+* node/compose switch lives in `vitest.config.ts` (`env: { TEST_MODE:
+* 'compose' }`). The one sanctioned use is a non-Node app (no `server`), where
+* `mode: 'compose'` is mandatory and permanent — so the rule flags a `mode`
+* property ONLY when `server` is also defined in the same options object.
+*/
+const a5ModeWithServer = {
+	create(context) {
+		return { CallExpression(node) {
+			if (specificationMember(node) !== "api") return;
+			for (const argument of node.arguments ?? []) {
+				if (argument.type !== "ObjectExpression") continue;
+				const mode = findProperty(argument, "mode");
+				const server = findProperty(argument, "server");
+				if (mode !== void 0 && server !== void 0) context.report({
+					messageId: "hardcodedMode",
+					node: mode
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a5-mode-with-server"],
+		messages: { hardcodedMode: "`mode` must not be hardcoded when `server` is defined — the node/compose switch lives in vitest.config.ts via `env: { TEST_MODE: \"compose\" }` (CONVENTIONS A5)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/a6w-redundant-compose-service.ts
+/**
+* CONVENTIONS A6 (warning) — `composeService:` is the escape hatch for
+* non-derivable names. When its literal equals the record key itself or the
+* key's kebab-case conversion (the two names the deterministic binding would
+* try anyway, via the same `toKebabCase` the runtime uses), it is redundant.
+*/
+const a6wRedundantComposeService = {
+	create(context) {
+		return { CallExpression(node) {
+			if (specificationMember(node) === void 0) return;
+			for (const argument of node.arguments ?? []) {
+				const record = findProperty(argument, "services")?.value;
+				if (record?.type !== "ObjectExpression") continue;
+				for (const entry of record.properties ?? []) {
+					const key = propertyKeyName(entry);
+					const factory = entry.value;
+					if (key === void 0 || factory?.type !== "CallExpression") continue;
+					const options = factory.arguments?.[0];
+					if (options?.type !== "ObjectExpression") continue;
+					const composeService = findProperty(options, "composeService");
+					const name = stringValue(composeService?.value);
+					if (name !== void 0 && (name === key || name === toKebabCase(key))) context.report({
+						data: {
+							key,
+							name
+						},
+						messageId: "redundant",
+						node: composeService ?? entry
+					});
+				}
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a6w-redundant-compose-service"],
+		messages: { redundant: "composeService: \"{{name}}\" is redundant — the key \"{{key}}\" already binds to it (exact name or kebab-case derivation, CONVENTIONS A6)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/fs-cache.ts
+/**
+* Cached filesystem probes for the fs-anchored rules (a9w, c2, c6, c7, i2).
+*
+* Rules only ever look at directories NEXT TO files oxlint is already
+* visiting (a feature's `requests/`, `seeds/`, `expected/`, a sibling module
+* file), so the probe set is small — but several rules probe the same feature
+* directory, and oxlint lints many files per process. A module-level cache
+* keeps each `readdir`/`stat` to one syscall per lint run.
+*/
+const dirListings = /* @__PURE__ */ new Map();
+function listDirectory(dir) {
+	const cached = dirListings.get(dir);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = (0, node_fs.readdirSync)(dir);
+	} catch {
+		result = null;
+	}
+	dirListings.set(dir, result);
+	return result;
+}
+const kinds = /* @__PURE__ */ new Map();
+function kindOf(path) {
+	const cached = kinds.get(path);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = (0, node_fs.statSync)(path).isDirectory() ? "dir" : "file";
+	} catch {
+		result = "missing";
+	}
+	kinds.set(path, result);
+	return result;
+}
+function isDirectory(path) {
+	return kindOf(path) === "dir";
+}
+function isFile(path) {
+	return kindOf(path) === "file";
+}
+const fileContents = /* @__PURE__ */ new Map();
+/** Read a file as UTF-8, cached. Returns null when unreadable (missing/binary). */
+function readFileCached(path) {
+	const cached = fileContents.get(path);
+	if (cached !== void 0) return cached;
+	let result;
+	try {
+		result = (0, node_fs.readFileSync)(path, "utf8");
+	} catch {
+		result = null;
+	}
+	fileContents.set(path, result);
+	return result;
+}
+//#endregion
+//#region src/lint/rules/a9w-redundant-root.ts
+/**
+* The root the convention would derive (CONVENTIONS A9): walk up from the
+* specification file to the first directory containing
+* `docker/compose.test.yaml`, else the first containing `package.json`.
+*/
+function derivedRoot(startDir) {
+	for (const probe of ["docker/compose.test.yaml", "package.json"]) {
+		let dir = startDir;
+		for (;;) {
+			if (isFile((0, node_path.join)(dir, probe))) return dir;
+			const parent = (0, node_path.dirname)(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+	}
+}
+/**
+* CONVENTIONS A9 (warning) — `root` is an override reserved for cases the
+* convention cannot resolve. When the literal points at the very directory the
+* walk-up would have found, it is redundant and flagged.
+*/
+const a9wRedundantRoot = {
+	create(context) {
+		return { CallExpression(node) {
+			if (specificationMember(node) === void 0) return;
+			for (const argument of node.arguments ?? []) {
+				const root = findProperty(argument, "root");
+				const literal = stringValue(root?.value);
+				if (root === void 0 || literal === void 0) continue;
+				const specDir = (0, node_path.dirname)(context.physicalFilename);
+				if ((0, node_path.resolve)(specDir, literal) === derivedRoot(specDir)) context.report({
+					data: { root: literal },
+					messageId: "redundant",
+					node: root
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["a9w-redundant-root"],
+		messages: { redundant: "root: \"{{root}}\" is redundant — walking up from the specification file already resolves to that directory (CONVENTIONS A9)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/core/specification/shared/fixtures.ts
+/**
+* Fixture path resolution + copy semantics for the `cli` facet's `.fixture()`.
+*
+* A fixture path is one of two shapes:
+*
+*  - `$FIXTURES/<rest>` — the shared pool at `<specs-root>/fixtures/<rest>`,
+*    where `<specs-root>` is the nearest ancestor directory named `specs`.
+*  - `<path>` (no marker) — feature-local, at `<test-dir>/fixtures/<path>`.
+*
+* Any other `$`-prefixed marker is a usage error (listed against the known
+* markers). Copy semantics mirror rsync's trailing-slash rule (see
+* {@link copyPlan}).
+*/
+/**
+* Markers understood in a `.fixture()` path. Extend here + in
+* {@link resolveFixtureSource}. Exported so the lint layer (rule
+* `jterrazz/b2-known-fixture-marker`) validates literals against the same list.
+*/
+const KNOWN_FIXTURE_MARKERS = ["$FIXTURES"];
+//#endregion
+//#region src/lint/rules/b2-known-fixture-marker.ts
+const KNOWN = new Set(KNOWN_FIXTURE_MARKERS);
+/**
+* The leading literal text of a `.fixture()` argument: a plain string, or the
+* first quasi of a template literal (`` `$FIXTURES/${name}` `` → `$FIXTURES/`),
+* so a `$…` marker on an interpolated path is still validated.
+*/
+function leadingText(node) {
+	const literal = stringValue(node);
+	if (literal !== void 0) return literal;
+	if (node?.type === "TemplateLiteral") return ((node.quasis?.[0])?.value)?.cooked;
+}
+/**
+* CONVENTIONS B2 — a `$…` marker in a `.fixture()` path literal must be one of
+* the known markers (`$FIXTURES`). The list is imported from the same core
+* module the runtime resolution uses, so the two channels can never drift.
+*/
+const b2KnownFixtureMarker = {
+	create(context) {
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (callee === void 0 || memberPropertyName(callee) !== "fixture") return;
+			const args = node.arguments ?? [];
+			const path = leadingText(args[0]);
+			if (path === void 0 || !path.startsWith("$")) return;
+			const marker = path.replace(/\/+$/, "").split("/")[0];
+			if (!KNOWN.has(marker)) context.report({
+				data: {
+					known: [...KNOWN_FIXTURE_MARKERS].join(", "),
+					marker
+				},
+				messageId: "unknownMarker",
+				node: args[0]
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["b2-known-fixture-marker"],
+		messages: { unknownMarker: "Unknown fixture marker \"{{marker}}\" — known markers: {{known}}. A path without a marker is feature-local (CONVENTIONS B2)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/b4-given-then.ts
+/** Does any comment start (after leading whitespace) with `<marker> -`? */
+function hasMarker(comments, marker) {
+	const needle = `${marker} -`;
+	return comments.some((comment) => comment.value.trimStart().startsWith(needle));
+}
+/** The source start offset of the first comment opening with `<marker> -`. */
+function firstMarkerOffset(comments, marker) {
+	const needle = `${marker} -`;
+	let best = -1;
+	for (const comment of comments) {
+		if (!comment.value.trimStart().startsWith(needle)) continue;
+		const start = nodeStart(comment);
+		if (start >= 0 && (best === -1 || start < best)) best = start;
+	}
+	return best;
+}
+/**
+* CONVENTIONS B4 — every test carries `// Given -` and `// Then -` (always both),
+* in that order. `// When -` is optional: the spec chain is usually the "when".
+*
+* Presence is the keystone (comments are reachable via
+* `sourceCode.getCommentsInside(callback)`); the position upgrade adds the
+* unambiguous narrative ordering — Given before Then, judged on FIRST
+* occurrences for multi-`Then` bodies. (The stricter "first expect after Then"
+* variant is intentionally NOT enforced: setup-phase assertions — precondition
+* checks, update-mode writes before the Then narrative — are idiomatic here.)
+*/
+const b4GivenThen = {
+	create(context) {
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			const comments = context.sourceCode.getCommentsInside(callback);
+			const hasGiven = hasMarker(comments, "Given");
+			const hasThen = hasMarker(comments, "Then");
+			if (!hasGiven) context.report({
+				data: { marker: "Given" },
+				messageId: "missing",
+				node
+			});
+			if (!hasThen) context.report({
+				data: { marker: "Then" },
+				messageId: "missing",
+				node
+			});
+			if (!hasGiven || !hasThen) return;
+			const givenOffset = firstMarkerOffset(comments, "Given");
+			const thenOffset = firstMarkerOffset(comments, "Then");
+			if (givenOffset < 0 || thenOffset < 0) return;
+			if (givenOffset > thenOffset) context.report({
+				messageId: "givenAfterThen",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["b4-given-then"],
+		messages: {
+			givenAfterThen: "The `// Given -` marker comes after `// Then -` — Given describes the setup and must precede Then (CONVENTIONS B4).",
+			missing: "Test is missing a `// {{marker}} -` comment (CONVENTIONS B4 — every test needs both `// Given -` and `// Then -`)."
+		},
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/b5-await-using.ts
+/**
+* CONVENTIONS B5 — a docker-aware runner's result must be bound with `await
+* using` so tracked containers are disposed deterministically.
+*
+* Which runner identifiers are docker-aware is not statically derivable from a
+* test file (the `docker:` option lives in the specification file), so the
+* rule reads them from its options:
+*
+*     'jterrazz/b5-await-using': ['error', { runners: ['dockerCli'] }]
+*
+* With no configured runners the rule is inert.
+*/
+const b5AwaitUsing = {
+	create(context) {
+		const runners = new Set(context.options[0]?.runners);
+		if (runners.size === 0) return {};
+		return { VariableDeclaration(node) {
+			if (node.kind === "await using") return;
+			for (const declarator of node.declarations ?? []) {
+				let init = declarator.init;
+				while (init?.type === "AwaitExpression") init = init.argument;
+				if (init?.type !== "CallExpression") continue;
+				const root = chainRootName(init);
+				if (root !== void 0 && runners.has(root)) context.report({
+					data: { runner: root },
+					messageId: "requireAwaitUsing",
+					node: declarator
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["b5-await-using"],
+		defaultOptions: [{ runners: [] }],
+		messages: { requireAwaitUsing: "The result of docker-aware runner \"{{runner}}\" must be bound with `await using` so its containers are disposed (CONVENTIONS B5)." },
+		schema: [{
+			additionalProperties: false,
+			properties: { runners: {
+				items: { type: "string" },
+				type: "array"
+			} },
+			type: "object"
+		}],
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/b6w-redundant-env-url.ts
+const URL_KEY = /^[A-Z0-9]+(?:_[A-Z0-9]+)*_URL$/;
+/**
+* CONVENTIONS B6 (warning) — in `cli` mode with services, the framework
+* already injects `<KEY>_URL` for every service (plus the unambiguous
+* `DATABASE_URL` / `REDIS_URL` aliases). A `.env()` entry that assigns a
+* `*_URL` key from a service's `.connectionString` re-does that injection by
+* hand and is flagged as redundant.
+*/
+const b6wRedundantEnvUrl = {
+	create(context) {
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (callee === void 0 || memberPropertyName(callee) !== "env") return;
+			const argument = node.arguments?.[0];
+			if (argument?.type !== "ObjectExpression") return;
+			for (const property of argument.properties ?? []) {
+				const key = propertyKeyName(property);
+				if (key === void 0 || !URL_KEY.test(key)) continue;
+				const value = property.value;
+				if (value?.type === "MemberExpression" && memberPropertyName(value) === "connectionString") context.report({
+					data: { key },
+					messageId: "redundant",
+					node: property
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["b6w-redundant-env-url"],
+		messages: { redundant: ".env({ {{key}}: ….connectionString }) is redundant — the framework already injects <KEY>_URL (and the DATABASE_URL/REDIS_URL aliases) for every service (CONVENTIONS B6)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/b8-kebab-trigger.ts
+/** Stable kebab-case job identifier: `nightly-report`, `send-welcome-emails`. */
+const KEBAB_CASE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/**
+* CONVENTIONS B8 — a job `name` passed to `.trigger()` is a stable kebab-case
+* identifier; it is a contract between the app and its tests. Only string
+* literals are checked — dynamic names are out of static reach.
+*/
+const b8KebabTrigger = {
+	create(context) {
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (callee === void 0 || memberPropertyName(callee) !== "trigger") return;
+			const args = node.arguments ?? [];
+			const name = stringValue(args[0]);
+			if (name !== void 0 && !KEBAB_CASE.test(name)) context.report({
+				data: { name },
+				messageId: "notKebab",
+				node: args[0]
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["b8-kebab-trigger"],
+		messages: { notKebab: "Job name \"{{name}}\" must be a stable kebab-case identifier (e.g. \"nightly-report\") — it is a contract between the app and its tests (CONVENTIONS B8)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/b9w-product-command.ts
+/** A path segment that marks a third-party package's installed binary. */
+const THIRD_PARTY_BIN = /node_modules[/\\]\.bin[/\\]/u;
+/** Does any string literal reachable from `root` resolve into a `.bin` dir? */
+function embedsThirdPartyBin(root) {
+	if (root === null || root === void 0) return false;
+	let found = false;
+	walk(root, (node) => {
+		if (found) return;
+		const value = stringValue(node);
+		if (value !== void 0 && THIRD_PARTY_BIN.test(value)) found = true;
+	});
+	return found;
+}
+/**
+* CONVENTIONS B9 (warning) — a spec exercises the product's REAL commands, not
+* the third-party binaries underneath it.
+*
+* When the binary handed to `specification.cli(<bin>, …)` resolves into a
+* dependency's `node_modules/.bin/`, the spec is testing the tool directly
+* rather than the product command that composes it. Detects the literal both
+* inline (`specification.cli('…/node_modules/.bin/oxlint')`, or wrapped in a
+* `resolve(...)`) and via a local `const BIN = resolve(…, '…/.bin/oxlint')`
+* hoisted out of the call — the idiom real specs use. Advisory: it may be
+* legitimately suppressed with a reason when the product genuinely IS that
+* binary (e.g. a package whose product is a lint plugin driving oxlint).
+*/
+const b9wProductCommand = {
+	create(context) {
+		return { Program(program) {
+			const binVars = /* @__PURE__ */ new Set();
+			walk(program, (node) => {
+				if (node.type !== "VariableDeclarator") return;
+				const id = node.id;
+				const init = node.init;
+				if (id?.type === "Identifier" && embedsThirdPartyBin(init)) binVars.add(id.name);
+			});
+			walk(program, (node) => {
+				if (node.type !== "CallExpression" || specificationMember(node) !== "cli") return;
+				const arg = node.arguments?.[0];
+				if (arg === void 0) return;
+				if (embedsThirdPartyBin(arg) || arg.type === "Identifier" && binVars.has(arg.name)) context.report({
+					messageId: "thirdPartyBinary",
+					node
+				});
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["b9w-product-command"],
+		messages: { thirdPartyBinary: "specification.cli() points at a third-party binary in node_modules/.bin — a spec should exercise your product command (cli.exec(\"check\"), …), not the tool underneath (CONVENTIONS B9). Suppress with a reason if the product genuinely is this binary." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/c1-domain-structure.ts
+const TEST_SUFFIX = ".test.ts";
+const SPECIFICATION_SUFFIX = ".specification.ts";
+/**
+* CONVENTIONS C1' — facet-root specifications, domain-nested tests.
+*
+* A facet (`specs/<facet>/` — api, jobs, cli, integrations, lint, …) is the
+* master folder. It carries its runner(s) at its ROOT
+* (`specs/<facet>/<name>.specification.ts`) and holds DOMAIN folders, each a
+* product command/area with one or more `<aspect>.test.ts` files plus their
+* shared asset dirs.
+*
+* Two placement invariants, checked from the filename:
+* - a `*.test.ts` must sit at facet/domain depth — exactly
+*   `specs/<facet>/<domain>/<file>.test.ts`. A test directly at the facet root
+*   (or nested deeper than a domain) is rejected.
+* - a `*.specification.ts` must sit at the facet root — exactly
+*   `specs/<facet>/<file>.specification.ts`, never inside a domain.
+*
+* Module tests under `src/` follow the neighbour rule (I2) and are out of scope.
+*/
+const c1DomainStructure = {
+	create(context) {
+		return { Program(node) {
+			const parts = segments(context.filename);
+			const base = parts.at(-1) ?? "";
+			const specsIndex = parts.lastIndexOf("specs");
+			if (specsIndex === -1) return;
+			const depth = parts.length - 1 - (specsIndex + 1);
+			if (base.endsWith(TEST_SUFFIX)) {
+				if (depth < 2) context.report({
+					messageId: "testAtFacetRoot",
+					node
+				});
+				else if (depth > 2) context.report({
+					messageId: "testTooDeep",
+					node
+				});
+				return;
+			}
+			if (base.endsWith(SPECIFICATION_SUFFIX)) {
+				if (depth !== 1) context.report({
+					messageId: "specNotAtFacetRoot",
+					node
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["c1-domain-structure"],
+		messages: {
+			specNotAtFacetRoot: "A `*.specification.ts` must sit at the facet root: `specs/<facet>/<name>.specification.ts` (CONVENTIONS C1).",
+			testAtFacetRoot: "A `*.test.ts` must live in a domain folder: `specs/<facet>/<domain>/<aspect>.test.ts` — tests directly at the facet root are forbidden (CONVENTIONS C1).",
+			testTooDeep: "A `*.test.ts` must sit at facet/domain depth: `specs/<facet>/<domain>/<aspect>.test.ts` — no deeper nesting (CONVENTIONS C1)."
+		},
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/c2-http-only-requests.ts
+const TEST_FILE$9 = /\.test\.[cm]?[jt]sx?$/;
+/**
+* CONVENTIONS C2 — `requests/` contains only `.http` files (a request file is
+* a COMPLETE request: method, path, headers, body). Anchored on the feature's
+* visited test file: when `<feature>/<feature>.test.ts` is linted, its sibling
+* `requests/` directory is probed (cached readdir) and any non-`.http` entry
+* is reported on the test file.
+*/
+const c2HttpOnlyRequests = {
+	create(context) {
+		const file = context.physicalFilename;
+		if (!TEST_FILE$9.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const requestsDir = (0, node_path.join)((0, node_path.dirname)(file), "requests");
+			for (const entry of listDirectory(requestsDir) ?? []) if (!entry.endsWith(".http")) context.report({
+				data: { entry },
+				messageId: "notHttp",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["c2-http-only-requests"],
+		messages: { notHttp: "requests/{{entry}} is not a .http file — requests/ contains only complete .http request files (CONVENTIONS C2)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/c4-contract-shape.ts
+/** Providers a contract file may declare (CONVENTIONS C4). */
+const PROVIDERS = /* @__PURE__ */ new Set([
+	"anthropic",
+	"http",
+	"openai"
+]);
+const CONTRACT_NAME = /^[A-Za-z0-9][\w-]*\.(?<provider>[a-z]+)\.[cm]?ts$/;
+/** Is the import source the framework's public entry (`@jterrazz/test` / `src/index`)? */
+function isPublicEntry(source) {
+	return source === "@jterrazz/test" || source.endsWith("/src/index.js") || source.endsWith("/src/index.ts");
+}
+/**
+* CONVENTIONS C4 — a contract file (`contracts/<name>.<provider>.ts`) has a
+* rigid shape: flat under `contracts/` (no subfolders), `provider ∈ { openai,
+* anthropic, http }`, a single `export default defineContract(...)`, no named
+* exports, and imports only from the public entry. The runtime channel (the
+* loader) only catches a bad default export; this rule closes the rest.
+*/
+const c4ContractShape = {
+	create(context) {
+		const parts = segments(context.physicalFilename);
+		const contractsIndex = parts.lastIndexOf("contracts");
+		if (contractsIndex === -1 || contractsIndex >= parts.length - 1 || !parts.includes("specs")) return {};
+		const base = parts.at(-1) ?? "";
+		return { Program(node) {
+			if (contractsIndex !== parts.length - 2) context.report({
+				data: { base },
+				messageId: "subfolder",
+				node
+			});
+			const match = CONTRACT_NAME.exec(base);
+			if (match === null || !PROVIDERS.has(match.groups?.provider ?? "")) context.report({
+				data: { base },
+				messageId: "badName",
+				node
+			});
+			let hasDefault = false;
+			for (const statement of node.body ?? []) if (statement.type === "ImportDeclaration") {
+				const source = stringValue(statement.source);
+				if (source !== void 0 && !isPublicEntry(source)) context.report({
+					data: { source },
+					messageId: "foreignImport",
+					node: statement
+				});
+			} else if (statement.type === "ExportNamedDeclaration" || statement.type === "ExportAllDeclaration") context.report({
+				messageId: "namedExport",
+				node: statement
+			});
+			else if (statement.type === "ExportDefaultDeclaration") {
+				hasDefault = true;
+				const declaration = statement.declaration;
+				const callee = declaration?.type === "CallExpression" ? declaration.callee : void 0;
+				if (callee?.type !== "Identifier" || callee.name !== "defineContract") context.report({
+					messageId: "notDefineContract",
+					node: statement
+				});
+			}
+			if (!hasDefault) context.report({
+				messageId: "missingDefault",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["c4-contract-shape"],
+		messages: {
+			badName: "Contract file \"{{base}}\" must be named <name>.<provider>.ts with provider ∈ openai | anthropic | http (CONVENTIONS C4).",
+			foreignImport: "Contract imports \"{{source}}\" — a contract imports only from the public entry (@jterrazz/test) (CONVENTIONS C4).",
+			missingDefault: "Contract file has no `export default defineContract(...)` (CONVENTIONS C4).",
+			namedExport: "Contract files have no named exports — only `export default defineContract(...)` (CONVENTIONS C4).",
+			notDefineContract: "The default export of a contract file must be `defineContract(...)` syntactically (CONVENTIONS C4).",
+			subfolder: "Contract file \"{{base}}\" is nested — contracts/ is flat, no subfolders (CONVENTIONS C4)."
+		},
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/c6-tomatch-extension.ts
+const TEST_FILE$8 = /\.test\.[cm]?[jt]sx?$/;
+/** Does the expect(…) subject chain contain a `.directory(…)` call? */
+function subjectIsDirectory(toMatchCallee) {
+	const expectCall = toMatchCallee.object;
+	if (expectCall?.type !== "CallExpression") return false;
+	const callee = expectCall.callee;
+	if (callee?.type !== "Identifier" || callee.name !== "expect") return false;
+	let isDirectorySubject = false;
+	for (const argument of expectCall.arguments ?? []) walk(argument, (node) => {
+		if (node.type === "CallExpression" && memberPropertyName(node.callee ?? { type: "" }) === "directory") isDirectorySubject = true;
+	});
+	return isDirectorySubject;
+}
+/**
+* CONVENTIONS C6 — the extension is part of the fixture name and mandatory in
+* `toMatch` (`'help.txt'`, never `'help'`) — except for directory-tree
+* snapshots, which are directories under `expected/`.
+*
+* The directory exception is resolved two ways: statically, when the expect
+* subject visibly chains `.directory(…)`; else on disk, when
+* `expected/<name>/` exists next to the spec (cached stat).
+*/
+const c6ToMatchExtension = {
+	create(context) {
+		const file = context.physicalFilename;
+		if (!TEST_FILE$8.test(file) || !segments(file).includes("specs")) return {};
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
+			const argument = node.arguments?.[0];
+			const name = stringValue(argument);
+			if (name === void 0 || name.length === 0) return;
+			if ((name.split("/").at(-1) ?? "").includes(".")) return;
+			if (subjectIsDirectory(callee)) return;
+			if (isDirectory((0, node_path.join)((0, node_path.dirname)(file), "expected", name))) return;
+			context.report({
+				data: { name },
+				messageId: "missingExtension",
+				node: argument
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["c6-tomatch-extension"],
+		messages: { missingExtension: "toMatch(\"{{name}}\") is missing its extension — the extension is part of the fixture name (\"help.txt\", never \"help\"); only directory-tree snapshots (expected/<name>/) omit it (CONVENTIONS C6)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/c7-seeds-sql-only.ts
+const TEST_FILE$7 = /\.test\.[cm]?[jt]sx?$/;
+/**
+* CONVENTIONS C7 — `.seed()` carries DATABASE state only: `seeds/` contains
+* nothing but `*.sql` fragments. File state goes through `.fixture()`; there
+* is no seed handler and no prefix dispatch. Anchored on the feature's visited
+* test file (cached readdir of the sibling `seeds/`).
+*/
+const c7SeedsSqlOnly = {
+	create(context) {
+		const file = context.physicalFilename;
+		if (!TEST_FILE$7.test(file) || !segments(file).includes("specs")) return {};
+		return { Program(node) {
+			const seedsDir = (0, node_path.join)((0, node_path.dirname)(file), "seeds");
+			for (const entry of listDirectory(seedsDir) ?? []) if (!entry.endsWith(".sql")) context.report({
+				data: { entry },
+				messageId: "notSql",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["c7-seeds-sql-only"],
+		messages: { notSql: "seeds/{{entry}} is not a .sql file — seeds/ carries database state only; file state goes through .fixture() (CONVENTIONS C7)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/c8-referenced-fixture-exists.ts
+const TEST_FILE$6 = /\.test\.[cm]?[jt]sx?$/;
+/** The conventional sibling directory each fixture-referencing verb reads from. */
+const VERB_ROOTS = {
+	request: "requests",
+	seed: "seeds",
+	toMatch: "expected"
+};
+/**
+* A fixture reference is a filename/path, never inline content. `.seed()` also
+* accepts a raw SQL string (integration tests), and any literal with whitespace
+* or a newline is inline content, not a path — out of C8's reach.
+*/
+function looksLikePath(value) {
+	return value.length > 0 && !/\s/u.test(value);
+}
+/** Nearest ancestor directory named `specs` — the pool root for `$FIXTURES/`. */
+function specsRoot(file) {
+	let dir = (0, node_path.dirname)(file);
+	for (;;) {
+		if ((0, node_path.basename)(dir) === "specs") return dir;
+		const parent = (0, node_path.dirname)(dir);
+		if (parent === dir) return;
+		dir = parent;
+	}
+}
+/** Resolve the on-disk target a `.fixture()` literal points at, if determinable. */
+function resolveFixture(argument, featureDir, file) {
+	if (argument.startsWith("$FIXTURES/")) {
+		const root = specsRoot(file);
+		return root === void 0 ? void 0 : (0, node_path.join)(root, "fixtures", argument.slice(10));
+	}
+	if (argument.startsWith("$")) return;
+	return (0, node_path.join)(featureDir, "fixtures", argument);
+}
+/**
+* CONVENTIONS C8 — a fixture referenced by a literal must exist on disk under
+* its conventional root: `.request(x)`→`requests/x`, `.seed(x)`→`seeds/x`,
+* `.fixture(x)`→feature `fixtures/` (or the `$FIXTURES/` pool at the nearest
+* `specs/fixtures/`), `toMatch(x)`→`expected/x` (file or tree snapshot). A typo
+* that would fail only at runtime is caught statically. Non-literal arguments
+* are out of static reach and skipped.
+*/
+const c8ReferencedFixtureExists = {
+	create(context) {
+		const file = context.physicalFilename;
+		if (!TEST_FILE$6.test(file) || !segments(file).includes("specs")) return {};
+		const featureDir = (0, node_path.dirname)(file);
+		return { CallExpression(node) {
+			const callee = node.callee;
+			const verb = callee === void 0 ? void 0 : memberPropertyName(callee);
+			if (verb === void 0) return;
+			const args = node.arguments ?? [];
+			if (verb === "fixture") {
+				const value = stringValue(args[0]);
+				if (value === void 0 || !looksLikePath(value)) return;
+				const target = resolveFixture(value.replace(/\/+$/, ""), featureDir, file);
+				if (target !== void 0 && !isFile(target) && !isDirectory(target)) context.report({
+					data: {
+						path: value,
+						root: "fixtures"
+					},
+					messageId: "missing",
+					node: args[0]
+				});
+				return;
+			}
+			const root = VERB_ROOTS[verb];
+			if (root === void 0) return;
+			const value = stringValue(args[0]);
+			if (value === void 0 || !looksLikePath(value)) return;
+			const target = (0, node_path.join)(featureDir, root, value.replace(/\/+$/, ""));
+			if (!(verb === "toMatch" ? isFile(target) || isDirectory(target) : isFile(target))) context.report({
+				data: {
+					path: `${root}/${value}`,
+					root
+				},
+				messageId: "missing",
+				node: args[0]
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["c8-referenced-fixture-exists"],
+		messages: { missing: "Referenced fixture \"{{path}}\" does not exist on disk under its conventional {{root}}/ root (CONVENTIONS C8). Create it or fix the reference." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/d12w-response-body-probe.ts
+/** A test reading the response body this many times (or more) is a cluster. */
+const DEFAULT_THRESHOLD = 3;
+/** Is `node` the `x.response.body` member access itself? */
+function isResponseBody(node) {
+	if (node.type !== "MemberExpression" || memberPropertyName(node) !== "body") return false;
+	const object = node.object;
+	return object !== void 0 && memberPropertyName(object) === "response";
+}
+/** Peel `await`, `as T`, and `!` off an initializer to reach its core expression. */
+function unwrap(node) {
+	let current = node ?? void 0;
+	while (current != null) if (current.type === "AwaitExpression") current = current.argument ?? void 0;
+	else if (current.type === "TSAsExpression" || current.type === "TSNonNullExpression") current = current.expression ?? void 0;
+	else if (current.type === "ParenthesizedExpression") current = current.expression ?? void 0;
+	else return current;
+}
+/**
+* CONVENTIONS D12 (warning) — a full-response golden is the norm for API
+* assertions (the D11 boundary, mechanized). A test that accumulates a CLUSTER
+* of raw body probes — reading `.response.body` (or a variable cast from it)
+* `threshold`+ times in one test callback — should collapse into one golden:
+* `expect(result.response).toMatch('case.http')`. One or two probes stay silent
+* (a legitimate scalpel: absence, a single-field delta, third-party output).
+*
+* A probe is a body-rooted read: a direct `.response.body` use, or a field
+* access on the local binding a `const body = result.response.body as {…}`
+* introduces. The count is the same threshold the golden transformation applies.
+*/
+const d12wResponseBodyProbe = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		const threshold = context.options[0]?.threshold ?? DEFAULT_THRESHOLD;
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			const aliases = /* @__PURE__ */ new Set();
+			let responseBodyNodes = 0;
+			walk(callback, (inner) => {
+				if (isResponseBody(inner)) responseBodyNodes++;
+				if (inner.type === "VariableDeclarator") {
+					const init = unwrap(inner.init);
+					const id = inner.id;
+					if (init !== void 0 && isResponseBody(init) && id?.type === "Identifier") aliases.add(id.name);
+				}
+			});
+			let aliasReads = 0;
+			walk(callback, (inner) => {
+				if (inner.type !== "MemberExpression") return;
+				const object = inner.object;
+				if (object?.type === "Identifier" && aliases.has(object.name)) aliasReads++;
+			});
+			const probes = responseBodyNodes - aliases.size + aliasReads;
+			if (probes >= threshold) context.report({
+				data: { count: String(probes) },
+				messageId: "bodyProbeCluster",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d12w-response-body-probe"],
+		defaultOptions: [{ threshold: DEFAULT_THRESHOLD }],
+		messages: { bodyProbeCluster: "{{count}} body probes in one test — this wants a full golden: expect(result.response).toMatch('x.http') (CONVENTIONS D12)." },
+		schema: [{
+			additionalProperties: false,
+			properties: { threshold: {
+				minimum: 1,
+				type: "integer"
+			} },
+			type: "object"
+		}],
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d13w-unfrozen-negative-fixture.ts
+/**
+* Does `arguments[1]` of a `toMatch(name, options)` call carry `{ frozen: true }`?
+* A frozen fixture opts out of update-mode rewriting, so it is exempt.
+*/
+function hasFrozenOption(args) {
+	const options = args[1];
+	if (options === void 0 || options.type !== "ObjectExpression") return false;
+	const value = findProperty(options, "frozen")?.value;
+	return value?.type === "Literal" && value.value === true;
+}
+/**
+* Is this `toMatch(…)` call nested inside a WRAPPING `expect(…)` — the shape of a
+* negative assertion (`expect(() => …toMatch(…)).toThrow()` or
+* `expect(…toMatch(…)).rejects.toThrow()`)? The subject's own `expect(x)` is the
+* member OBJECT of `.toMatch` (a descendant), never an ancestor, so a positive
+* `expect(x).toMatch('f')` never trips this. The walk stays inside the current
+* expression: it stops at the first statement boundary or non-`expect` call, so
+* a `toMatch` merely written inside `inUpdateMode(() => …)` is NOT flagged.
+*/
+const TRANSPARENT_ANCESTORS = /* @__PURE__ */ new Set([
+	"ArrowFunctionExpression",
+	"AwaitExpression",
+	"ChainExpression",
+	"MemberExpression",
+	"ParenthesizedExpression",
+	"TSAsExpression",
+	"TSNonNullExpression"
+]);
+function isWrappedInExpect(node) {
+	let current = node.parent;
+	while (current !== void 0) {
+		if (current.type === "CallExpression") {
+			const callee = current.callee;
+			return callee?.type === "Identifier" && callee.name === "expect";
+		}
+		if (!TRANSPARENT_ANCESTORS.has(current.type)) return false;
+		current = current.parent;
+	}
+	return false;
+}
+/**
+* CONVENTIONS D13 (warning) — a `toMatch` whose failure is the behaviour under
+* test (wrapped in `expect(() => …).toThrow()` or `expect(…).rejects.toThrow()`)
+* asserts a DELIBERATELY-WRONG or MISSING fixture. Under `TEST_UPDATE=1` an
+* unfrozen fixture is silently rewritten with the actual output — the matcher
+* writes instead of throwing — which destroys the negative case (the assertion
+* then no longer throws). Pass `{ frozen: true }` so the fixture is never
+* rewritten and the mismatch/error still throws in update mode.
+*
+* The structural signal is precise for the wrapped forms; a `toMatch` routed
+* through a helper that owns the try/catch (`catchMessage(() => …toMatch(…))`)
+* is out of static reach — see the D13 process note for that residue.
+*/
+const d13wUnfrozenNegativeFixture = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (callee === void 0 || memberPropertyName(callee) !== "toMatch") return;
+			if (!isWrappedInExpect(node)) return;
+			if (hasFrozenOption(node.arguments ?? [])) return;
+			context.report({
+				messageId: "unfrozenNegativeFixture",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d13w-unfrozen-negative-fixture"],
+		messages: { unfrozenNegativeFixture: "This toMatch asserts a mismatch (wrapped in expect(…).toThrow/.rejects) — pass { frozen: true } so TEST_UPDATE=1 never overwrites the deliberately-wrong fixture (CONVENTIONS D13)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d15w-status-only-probe.ts
+/** An HTTP status code lives in this range — the numeric-literal gate. */
+const MIN_STATUS = 100;
+const MAX_STATUS = 599;
+/** Matchers that pin a single value — the shape of a status probe. */
+const EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual"]);
+/** Is `node` an `expect(…)` call (bare `expect` identifier callee)? */
+function isExpectCall(node) {
+	if (node?.type !== "CallExpression") return false;
+	const callee = node.callee;
+	return callee?.type === "Identifier" && callee.name === "expect";
+}
+/** Is `node` a numeric literal in the HTTP status range (100–599)? */
+function isStatusLiteral(node) {
+	if (node?.type !== "Literal" || typeof node.value !== "number") return false;
+	const value = node.value;
+	return Number.isInteger(value) && value >= MIN_STATUS && value <= MAX_STATUS;
+}
+/**
+* Is `node` a status probe — `expect(X.status).toBe(N)` / `.toEqual(N)` where
+* `X.status` is any `.status` member access and `N` is a numeric literal in the
+* HTTP status range? The numeric-literal gate keeps container-status STRINGS
+* (`expect(neo.status).toBe('running')`) out.
+*/
+function isStatusProbe(node) {
+	if (node.type !== "CallExpression") return false;
+	const callee = node.callee;
+	if (callee?.type !== "MemberExpression") return false;
+	const matcher = memberPropertyName(callee);
+	if (matcher === void 0 || !EQUALITY_MATCHERS.has(matcher)) return false;
+	const expectCall = callee.object;
+	if (!isExpectCall(expectCall)) return false;
+	const subject = (expectCall?.arguments ?? [])[0];
+	if (subject?.type !== "MemberExpression" || memberPropertyName(subject) !== "status") return false;
+	const expected = (node.arguments ?? [])[0];
+	return isStatusLiteral(expected);
+}
+/**
+* CONVENTIONS D11/D15 (warning) — a spec test whose ONLY assertions are HTTP
+* status probes (`expect(X.status).toBe(N)` / `.toEqual(N)`, N a numeric literal
+* 100–599) throws away the full-response golden. Pin the whole response instead:
+* `expect(result.response).toMatch('case.http')`.
+*
+* This complements d12w (which needs a CLUSTER of ≥3 body probes): the lone
+* `expect(result.status).toBe(422)` as a test's sole assertion falls below that
+* threshold yet still hides everything the response carries. The rule fires only
+* when EVERY `expect(…)` in the callback is a status probe — a status probe
+* sitting NEXT TO a real assertion (a golden, `toMatchRows`, `toContain`, …) is
+* the legitimate scalpel and stays silent.
+*/
+const d15wStatusOnlyProbe = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		return { CallExpression(node) {
+			if (!isTestCallee(node.callee)) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			let expectCalls = 0;
+			let statusProbes = 0;
+			walk(callback, (inner) => {
+				if (isExpectCall(inner)) expectCalls++;
+				if (isStatusProbe(inner)) statusProbes++;
+			});
+			if (expectCalls >= 1 && statusProbes === expectCalls) context.report({
+				messageId: "statusOnlyProbe",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d15w-status-only-probe"],
+		messages: { statusOnlyProbe: "The test's only assertion(s) are status probes — pin the full response: expect(result.response).toMatch('case.http') (CONVENTIONS D11)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d2-await-io-matcher.ts
+/** Matchers backed by IO (SQL query, disk walk, docker) — must be awaited (D2). */
+const IO_MATCHERS = /* @__PURE__ */ new Set([
+	"toBeEmpty",
+	"toBeRunning",
+	"toMatchRows"
+]);
+/** Does the member-call spine root at an `expect(…)` call? */
+function rootsAtExpect(node) {
+	let current = node;
+	while (current !== void 0) if (current.type === "CallExpression") {
+		const callee = current.callee;
+		if (callee?.type === "Identifier" && callee.name === "expect") return true;
+		current = callee;
+	} else if (current.type === "MemberExpression") current = current.object;
+	else return false;
+	return false;
+}
+/**
+* The matcher's promise is dropped only when the call is a bare statement
+* (`expect(rows).toMatchRows([]);`). Any other position uses the value —
+* awaited, returned, an arrow body, assigned, or passed to an outer
+* `expect(promise).rejects.toThrow(…)` — so the promise is handled.
+*/
+function isDropped(node) {
+	return node.parent?.type === "ExpressionStatement";
+}
+/**
+* CONVENTIONS D2 — the IO-backed matchers (`toMatchRows` runs SQL,
+* `toBeEmpty`/`toBeRunning` walk disk / query docker) return a promise and must
+* be `await`ed (or returned). A bare `expect(rows).toMatchRows(...)` silently
+* resolves nothing and the assertion never runs.
+*/
+const d2AwaitIoMatcher = {
+	create(context) {
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (callee === void 0) return;
+			const matcher = memberPropertyName(callee);
+			if (matcher === void 0 || !IO_MATCHERS.has(matcher)) return;
+			if (!rootsAtExpect(callee.object)) return;
+			if (isDropped(node)) context.report({
+				data: { matcher },
+				messageId: "mustAwait",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d2-await-io-matcher"],
+		messages: { mustAwait: "expect(…).{{matcher}}(…) is IO-backed and returns a promise — it must be awaited or returned, else the assertion never runs (CONVENTIONS D2)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/d2w-await-sync-matcher.ts
+/** Always-synchronous matchers — awaiting them is redundant noise (D2). */
+const SYNC_MATCHERS = /* @__PURE__ */ new Set([
+	"toBe",
+	"toContain",
+	"toEqual",
+	"toHaveLength"
+]);
+/**
+* Does the member-call spine root at an `expect(…)` call, WITHOUT a `.resolves`
+* / `.rejects` modifier? Those modifiers make an otherwise-sync matcher async,
+* so `await expect(p).resolves.toEqual(…)` is NOT a redundant await.
+*/
+function rootsAtSyncExpect(node) {
+	let current = node;
+	while (current !== void 0) if (current.type === "CallExpression") {
+		const callee = current.callee;
+		if (callee?.type === "Identifier" && callee.name === "expect") return true;
+		current = callee;
+	} else if (current.type === "MemberExpression") {
+		const property = memberPropertyName(current);
+		if (property === "resolves" || property === "rejects") return false;
+		current = current.object;
+	} else return false;
+	return false;
+}
+/**
+* CONVENTIONS D2 (warning) — the mirror of {@link d2AwaitIoMatcher}: only the
+* IO-backed matchers are async. `await expect(x).toBe(y)` awaits a plain value,
+* which reads as if the assertion were IO and hides the D2 signal. Drop the
+* `await`.
+*/
+const d2wAwaitSyncMatcher = {
+	create(context) {
+		return { CallExpression(node) {
+			if (node.parent?.type !== "AwaitExpression") return;
+			const callee = node.callee;
+			if (callee === void 0) return;
+			const matcher = memberPropertyName(callee);
+			if (matcher === void 0 || !SYNC_MATCHERS.has(matcher)) return;
+			if (rootsAtSyncExpect(callee.object)) context.report({
+				data: { matcher },
+				messageId: "redundantAwait",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d2w-await-sync-matcher"],
+		messages: { redundantAwait: "await on expect(…).{{matcher}}(…) is redundant — that matcher is synchronous; only IO-backed matchers (toMatchRows/toBeEmpty/toBeRunning) are awaited (CONVENTIONS D2)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d6w-transform-token-equivalent.ts
+const KNOWN_TOKEN_LITERAL = new RegExp(`^\\{\\{(?:${[
+	"any",
+	"base64",
+	"date",
+	"duration",
+	"email",
+	"float",
+	"hex",
+	"int",
+	"ip",
+	"iso8601",
+	"number",
+	"path",
+	"port",
+	"semver",
+	"sha",
+	"string",
+	"time",
+	"ulid",
+	"url",
+	"uuid",
+	"workdir"
+].join("|")})(?:#[\\w.-]+)?\\}\\}$`);
+/**
+* Is this function a pure chain of `.replace(…, '{{token}}')` normalisations?
+* Accepts an arrow with an expression body or a single-return body whose
+* expression is nested `.replace()` calls; every replacement must be a string
+* literal that is exactly a known `{{token}}`.
+*/
+function isTokenEquivalentTransform(fn) {
+	if (fn.type !== "ArrowFunctionExpression" && fn.type !== "FunctionExpression") return false;
+	let expression = fn.body;
+	if (expression?.type === "BlockStatement") {
+		const statements = expression.body ?? [];
+		if (statements.length !== 1 || statements[0].type !== "ReturnStatement") return false;
+		expression = statements[0].argument;
+	}
+	let sawReplace = false;
+	while (expression?.type === "CallExpression") {
+		const callee = expression.callee;
+		if (callee === void 0 || memberPropertyName(callee) !== "replace") return false;
+		const replacement = stringValue(expression.arguments?.[1]);
+		if (replacement === void 0 || !KNOWN_TOKEN_LITERAL.test(replacement)) return false;
+		sawReplace = true;
+		expression = callee.object;
+	}
+	return sawReplace && expression?.type === "Identifier";
+}
+/**
+* CONVENTIONS D6 (warning) — `transform` survives only as an escape hatch for
+* applicative noise the tokens do not cover (ANSI is already stripped by
+* default). A transform that only rewrites dynamic segments into known
+* `{{token}}` literals duplicates the token grammar: put the tokens in the
+* fixture instead.
+*/
+const d6wTransformTokenEquivalent = {
+	create(context) {
+		return { CallExpression(node) {
+			if (specificationMember(node) === void 0) return;
+			for (const argument of node.arguments ?? []) {
+				const transform = findProperty(argument, "transform");
+				const fn = transform?.value;
+				if (fn !== void 0 && isTokenEquivalentTransform(fn)) context.report({
+					messageId: "tokenEquivalent",
+					node: transform ?? node
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d6w-transform-token-equivalent"],
+		messages: { tokenEquivalent: "This transform only rewrites output into known token literals — write the tokens in the expected/ fixture instead; transform is an escape hatch for uncovered noise (CONVENTIONS D6)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d8w-text-bypass.ts
+/** Text-oriented matchers that tempt a raw `.text` bypass (D8). */
+const TEXT_MATCHERS = /* @__PURE__ */ new Set(["toContain", "toMatch"]);
+/**
+* CONVENTIONS D8 (warning) — `.text` is the raw stream escape hatch. Asserting
+* `expect(result.text).toContain(…)` throws away the typed subject (its token
+* grammar, its `toMatch('file.txt')` fixture resolution) for a substring check.
+* Prefer asserting on the accessor subject itself.
+*/
+const d8wTextBypass = {
+	create(context) {
+		return { CallExpression(node) {
+			const callee = node.callee;
+			const matcher = callee === void 0 ? void 0 : memberPropertyName(callee);
+			if (matcher === void 0 || !TEXT_MATCHERS.has(matcher)) return;
+			const expectCall = callee?.object;
+			if (expectCall?.type !== "CallExpression") return;
+			const expectCallee = expectCall.callee;
+			if (expectCallee?.type !== "Identifier" || expectCallee.name !== "expect") return;
+			const subject = expectCall.arguments?.[0];
+			if (subject !== void 0 && memberPropertyName(subject) === "text") context.report({
+				data: { matcher },
+				messageId: "textBypass",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d8w-text-bypass"],
+		messages: { textBypass: "expect(x.text).{{matcher}}(…) asserts on the raw stream — prefer the typed accessor subject (expect(x)) so the token grammar and fixture resolution apply (CONVENTIONS D8)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/d9w-single-use-ref.ts
+const TEST_FILE$5 = /\.test\.[cm]?[jt]sx?$/;
+/** A captured-ref token: `{{kind#ref}}`. Captures the ref name. */
+const REF_TOKEN = /\{\{[A-Za-z][A-Za-z0-9]*#(?<ref>[\w.-]+)\}\}/g;
+/** Is this call `match.ref(...)`? */
+function isMatchRef(node) {
+	const callee = node.callee;
+	if (callee?.type !== "MemberExpression" || memberPropertyName(callee) !== "ref") return false;
+	const object = callee.object;
+	return object?.type === "Identifier" && object.name === "match";
+}
+/** Ref names captured in a fixture text (or a directory-tree snapshot's files). */
+function refsInFixture(target) {
+	const refs = [];
+	const collect = (text) => {
+		for (const match of text.matchAll(REF_TOKEN)) refs.push(match.groups?.ref ?? "");
+	};
+	if (isFile(target)) {
+		const text = readFileCached(target);
+		if (text !== null) collect(text);
+		return refs;
+	}
+	if (isDirectory(target)) for (const entry of listDirectory(target) ?? []) refs.push(...refsInFixture((0, node_path.join)(target, entry)));
+	return refs;
+}
+/**
+* CONVENTIONS D9 (warning) — a capture ref (`match.ref('order')`,
+* `{{uuid#order}}`) earns its keep only when it is asserted more than once (the
+* point of a capture is the equality check on later occurrences). Aggregating
+* per file — code `match.ref` literals plus the `{{kind#ref}}` tokens of the
+* `expected/` fixtures the file references — a ref that appears exactly once
+* everywhere is a plain matcher wearing a name.
+*/
+const d9wSingleUseRef = {
+	create(context) {
+		const file = context.physicalFilename;
+		if (!TEST_FILE$5.test(file) || !segments(file).includes("specs")) return {};
+		const featureDir = (0, node_path.dirname)(file);
+		return { Program(program) {
+			const counts = /* @__PURE__ */ new Map();
+			const codeNodes = /* @__PURE__ */ new Map();
+			const fixtureNodes = /* @__PURE__ */ new Map();
+			const bump = (ref) => {
+				counts.set(ref, (counts.get(ref) ?? 0) + 1);
+			};
+			walk(program, (node) => {
+				if (node.type !== "CallExpression") return;
+				if (isMatchRef(node)) {
+					const ref = stringValue(node.arguments?.[0]);
+					if (ref !== void 0) {
+						bump(ref);
+						if (!codeNodes.has(ref)) codeNodes.set(ref, node);
+					}
+					return;
+				}
+				if (memberPropertyName(node.callee) === "toMatch") {
+					const name = stringValue(node.arguments?.[0]);
+					if (name !== void 0) {
+						const target = (0, node_path.join)(featureDir, "expected", name.replace(/\/+$/, ""));
+						for (const ref of refsInFixture(target)) {
+							bump(ref);
+							if (!fixtureNodes.has(ref)) fixtureNodes.set(ref, node);
+						}
+					}
+				}
+			});
+			for (const [ref, count] of counts) {
+				const node = codeNodes.get(ref) ?? fixtureNodes.get(ref);
+				if (count === 1 && node !== void 0) context.report({
+					data: { ref },
+					messageId: "singleUse",
+					node
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["d9w-single-use-ref"],
+		messages: { singleUse: "Capture ref \"{{ref}}\" is used only once in this spec — a ref earns its name by asserting equality across occurrences; use a plain matcher instead (CONVENTIONS D9)." },
+		type: "suggestion"
+	}
+};
+//#endregion
+//#region src/lint/rules/f1-no-subpath-import.ts
+const PACKAGE$1 = "@jterrazz/test";
+const TOOL_SUBPATH$2 = "@jterrazz/test/oxlint";
+/**
+* CONVENTIONS F1 — everything is imported from `@jterrazz/test`; subpaths do
+* not exist. Sanctioned exception: `@jterrazz/test/oxlint`, the tool-facing,
+* zero-runtime plugin entry — exempt from any file (an oxlint config, a shared
+* preset, whatever wires the lint layer).
+*/
+const f1NoSubpathImport = {
+	create(context) {
+		return { ...importSourceVisitor(({ node, source }) => {
+			if (!source.startsWith(`${PACKAGE$1}/`)) return;
+			if (source === TOOL_SUBPATH$2) return;
+			context.report({
+				data: { source },
+				messageId: "subpath",
+				node
+			});
+		}) };
+	},
+	meta: {
+		docs: RULE_DOCS["f1-no-subpath-import"],
+		messages: { subpath: "Import from \"@jterrazz/test\", not \"{{source}}\" — subpaths do not exist (CONVENTIONS F1; only the tool-facing @jterrazz/test/oxlint is exempt)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/f2-no-test-imports-in-prod.ts
+const TEST_FILE$4 = /\.(?:test|fixtures|specification)\.[cm]?[jt]sx?$/;
+const CONFIG_FILE = /(?:^|[/\\])[\w.-]*\.config\.[cm]?[jt]s$/;
+const TEST_IMPORT$1 = /\.(?:test|fixtures)(?:\.[cm]?[jt]sx?)?$/;
+const TOOL_SUBPATH$1 = "@jterrazz/test/oxlint";
+/**
+* CONVENTIONS F2 — production code never imports a test artefact. In a
+* non-test file (not `*.test.ts` / `*.fixtures.ts` / `*.specification.ts`,
+* not under `specs/`, not a tool config), importing `vitest`,
+* `@jterrazz/test`, a `*.test.*` module or a `*.fixtures.*` module is flagged.
+*
+* Sanctioned exception: `@jterrazz/test/oxlint`, the tool-facing, zero-runtime
+* lint entry (F1) — a shared oxlint preset legitimately imports it from prod
+* code.
+*
+* This repo's `src/vitest/` layer (the framework's own runner coupling, I1)
+* disables the rule via a config override.
+*/
+const f2NoTestImportsInProd = {
+	create(context) {
+		const file = context.filename;
+		if (TEST_FILE$4.test(file) || CONFIG_FILE.test(file) || segments(file).includes("specs")) return {};
+		return { ...importSourceVisitor(({ node, source }) => {
+			if (source === TOOL_SUBPATH$1) return;
+			if (source === "vitest" || source.startsWith("vitest/")) context.report({
+				data: { source },
+				messageId: "testImport",
+				node
+			});
+			else if (source === "@jterrazz/test" || source.startsWith("@jterrazz/test/")) context.report({
+				data: { source },
+				messageId: "testImport",
+				node
+			});
+			else if (TEST_IMPORT$1.test(source)) context.report({
+				data: { source },
+				messageId: "testImport",
+				node
+			});
+		}) };
+	},
+	meta: {
+		docs: RULE_DOCS["f2-no-test-imports-in-prod"],
+		messages: { testImport: "Production code must not import the test artefact \"{{source}}\" — test imports are only legal from specs/, *.test.ts, *.fixtures.ts or *.specification.ts (CONVENTIONS F2)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/f3-specs-public-entry.ts
+const PACKAGE = "@jterrazz/test";
+const TOOL_SUBPATH = "@jterrazz/test/oxlint";
+/**
+* The framework's own top-level `src/` layers. Deep-importing any of these from
+* a spec couples the spec to internals the public entry exists to hide. These
+* segment names are only meaningful inside the framework repo itself — a
+* consumer app that happens to have `src/app.ts` never reaches one, so its own
+* spec-to-app imports stay allowed (that IS the documented pattern:
+* `server: () => createApp()` importing `../../src/app.js`).
+*/
+const FRAMEWORK_LAYERS = /* @__PURE__ */ new Set([
+	"core",
+	"integrations",
+	"lint",
+	"vitest"
+]);
+/**
+* CONVENTIONS F3 — from `specs/`, deep-importing the FRAMEWORK's internals is
+* forbidden: a relative path resolving inside the framework repo's
+* `src/{core,integrations,vitest,lint}/`, or any `@jterrazz/test/<subpath>`
+* other than the sanctioned tool-facing `@jterrazz/test/oxlint`. A consumer's
+* imports of its OWN app source are always allowed — that is the pattern.
+*
+* Distinct from F1 (which bans `@jterrazz/test/<subpath>` from any file): F3 is
+* the specs-specific guard that also reaches relative framework-internal paths.
+* Documented exception: specs under `specs/integrations/` may deep-import the
+* integration module they cover (`src/integrations/**`).
+*/
+const f3SpecsPublicEntry = {
+	create(context) {
+		const parts = segments(context.filename);
+		const specsIndex = parts.indexOf("specs");
+		if (specsIndex === -1) return {};
+		const underIntegrations = parts[specsIndex + 1] === "integrations";
+		return { ...importSourceVisitor(({ node, source }) => {
+			if (source.startsWith(`${PACKAGE}/`)) {
+				if (source === TOOL_SUBPATH) return;
+				context.report({
+					data: { source },
+					messageId: "deepImport",
+					node
+				});
+				return;
+			}
+			const marker = source.indexOf("/src/");
+			if (marker === -1 && !source.startsWith("src/")) return;
+			const layer = (marker === -1 ? source.slice(4) : source.slice(marker + 5)).split("/")[0];
+			if (!FRAMEWORK_LAYERS.has(layer)) return;
+			if (underIntegrations && layer === "integrations") return;
+			context.report({
+				data: { source },
+				messageId: "deepImport",
+				node
+			});
+		}) };
+	},
+	meta: {
+		docs: RULE_DOCS["f3-specs-public-entry"],
+		messages: { deepImport: "specs/ must not deep-import framework internals — reach the framework via its public entry (@jterrazz/test, or src/index.js in this repo), not \"{{source}}\" (CONVENTIONS F3; only @jterrazz/test/oxlint, and src/integrations/** from specs/integrations/, are exempt)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/f4-no-test-to-test-import.ts
+const TEST_FILE$3 = /\.test\.[cm]?[jt]sx?$/;
+const TEST_IMPORT = /\.test(?:\.[cm]?[jt]sx?)?$/;
+/**
+* CONVENTIONS F4 — a `*.test.ts` never imports another `*.test.ts`. Shared
+* test data belongs in a `*.fixtures.ts` neighbour (F5), shared runners in a
+* `*.specification.ts` file (A1).
+*/
+const f4NoTestToTestImport = {
+	create(context) {
+		if (!TEST_FILE$3.test(context.filename)) return {};
+		return { ...importSourceVisitor(({ node, source }) => {
+			if (TEST_IMPORT.test(source)) context.report({
+				data: { source },
+				messageId: "testToTest",
+				node
+			});
+		}) };
+	},
+	meta: {
+		docs: RULE_DOCS["f4-no-test-to-test-import"],
+		messages: { testToTest: "A test file must not import another test file (\"{{source}}\") — share data via a *.fixtures.ts neighbour or a *.specification.ts runner (CONVENTIONS F4)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/f5-fixtures-only-from-tests.ts
+const TEST_FILE$2 = /\.test\.[cm]?[jt]sx?$/;
+const FIXTURES_IMPORT = /\.fixtures(?:\.[cm]?[jt]sx?)?$/;
+/**
+* CONVENTIONS F5 — a `*.fixtures.ts` module is only importable from
+* `*.test.ts` files. Any other importer (prod code, a specification file,
+* another fixtures module) is flagged.
+*/
+const f5FixturesOnlyFromTests = {
+	create(context) {
+		if (TEST_FILE$2.test(context.filename)) return {};
+		return { ...importSourceVisitor(({ node, source }) => {
+			if (FIXTURES_IMPORT.test(source)) context.report({
+				data: { source },
+				messageId: "fixturesImport",
+				node
+			});
+		}) };
+	},
+	meta: {
+		docs: RULE_DOCS["f5-fixtures-only-from-tests"],
+		messages: { fixturesImport: "A *.fixtures.ts module (\"{{source}}\") is only importable from *.test.ts files (CONVENTIONS F5)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/i1-layer-boundaries.ts
+/**
+* One folder = one external dependency (CONVENTIONS I1): the packages each
+* `src/integrations/<folder>/` may import.
+*/
+const INTEGRATION_DEPS = {
+	anthropic: ["@anthropic-ai/sdk"],
+	compose: ["yaml"],
+	docker: [],
+	hono: ["hono", "@hono/node-server"],
+	msw: ["msw"],
+	openai: ["openai"],
+	postgres: ["pg"],
+	redis: ["redis"],
+	sqlite: ["better-sqlite3"],
+	testcontainers: ["testcontainers"]
+};
+/** External packages the vitest layer (ALL runner coupling) may import. */
+const VITEST_DEPS = [
+	"vitest",
+	"vitest-mock-extended",
+	"mockdate"
+];
+/** The pure core helpers the tool-facing lint layer may reach (I1). */
+const LINT_CORE_WHITELIST = /* @__PURE__ */ new Set([
+	"core/matching/match",
+	"core/specification/shared/binding",
+	"core/specification/shared/fixtures"
+]);
+const TEST_OR_FIXTURES = /\.(?:test|fixtures)\.[cm]?[jt]sx?$/;
+function matchesPackage(source, packages) {
+	return packages.some((name) => source === name || source.startsWith(`${name}/`));
+}
+/** Path relative to the (last) `src` segment, `undefined` when outside src. */
+function pathInsideSrc(path) {
+	const parts = segments(path);
+	const srcIndex = parts.lastIndexOf("src");
+	return srcIndex === -1 ? void 0 : parts.slice(srcIndex + 1).join("/");
+}
+/** Strip a `.js`/`.ts`-style extension for whitelist comparison. */
+function withoutExtension(path) {
+	return path.replace(/\.[cm]?[jt]sx?$/, "");
+}
+/**
+* CONVENTIONS I1 — the four layers under `src/` and their sanctioned edges:
+*
+* - `core/` — zero external imports; may reach `integrations/docker`,
+*   `integrations/hono`, `vitest/matchers`, and (from `builder.ts` only, the
+*   lazy MSW seam) `integrations/msw`.
+* - `integrations/<dep>/` — its own external dependency and `core/` only.
+* - `vitest/` — the runner coupling: `vitest`, `vitest-mock-extended`,
+*   `mockdate`, plus `core/` and `integrations/docker` (the matchers recognise
+*   the zero-dependency ContainerAccessor subject).
+* - `lint/` — zero runtime imports: no external packages, and from `core/`
+*   only the pure helpers (token list, case conversions, fixture markers).
+*
+* Module tests and fixtures files are exempt (their imports are governed by
+* F2/I4); `src/index.ts` is the composition root and lives above the layers.
+*/
+const i1LayerBoundaries = {
+	create(context) {
+		const file = context.physicalFilename;
+		if (TEST_OR_FIXTURES.test(file)) return {};
+		const inside = pathInsideSrc(file);
+		const layer = inside?.split("/")[0];
+		if (inside === void 0 || layer === void 0 || ![
+			"core",
+			"integrations",
+			"lint",
+			"vitest"
+		].includes(layer)) return {};
+		const integrationFolder = layer === "integrations" ? inside.split("/")[1] : void 0;
+		const checkExternal = (source) => {
+			if (layer === "core") return "coreExternal";
+			if (layer === "lint") return "lintRuntime";
+			if (layer === "vitest") return matchesPackage(source, VITEST_DEPS) ? null : "foreignDependency";
+			return matchesPackage(source, INTEGRATION_DEPS[integrationFolder ?? ""] ?? []) ? null : "foreignDependency";
+		};
+		const checkInternal = (target) => {
+			if (layer === "core") {
+				if (target.startsWith("core/") || target.startsWith("integrations/docker/") || target.startsWith("integrations/hono/") || withoutExtension(target) === "vitest/matchers") return null;
+				if (target.startsWith("integrations/msw/") && inside === "core/specification/shared/builder.ts") return null;
+				return "crossLayer";
+			}
+			if (layer === "integrations") return target.startsWith("core/") || target.startsWith(`integrations/${integrationFolder}/`) ? null : "crossLayer";
+			if (layer === "vitest") return target.startsWith("core/") || target.startsWith("vitest/") || target.startsWith("integrations/docker/") ? null : "crossLayer";
+			return target.startsWith("lint/") || LINT_CORE_WHITELIST.has(withoutExtension(target)) ? null : "lintRuntime";
+		};
+		return { ...importSourceVisitor(({ node, source }) => {
+			if (source.startsWith("node:")) return;
+			let messageId;
+			if (source.startsWith(".")) {
+				const target = pathInsideSrc((0, node_path.resolve)((0, node_path.dirname)(file), source));
+				messageId = target === void 0 ? "crossLayer" : checkInternal(target);
+			} else messageId = checkExternal(source);
+			if (messageId !== null) context.report({
+				data: {
+					layer,
+					source
+				},
+				messageId,
+				node
+			});
+		}) };
+	},
+	meta: {
+		docs: RULE_DOCS["i1-layer-boundaries"],
+		messages: {
+			coreExternal: "core/ imports nothing external — \"{{source}}\" is not allowed (CONVENTIONS I1).",
+			crossLayer: "Layer \"{{layer}}\" must not import \"{{source}}\" — outside the sanctioned layer edges (CONVENTIONS I1).",
+			foreignDependency: "\"{{source}}\" is not this folder's own dependency — one integrations folder = one external dependency (CONVENTIONS I1).",
+			lintRuntime: "The lint layer imports nothing from the framework runtime — \"{{source}}\" is outside its pure-helper whitelist (CONVENTIONS I1)."
+		},
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/i2-sibling-test-naming.ts
+const TEST_FILE$1 = /\.test\.[cm]?[jt]sx?$/;
+/**
+* CONVENTIONS I2 — module tests are NEIGHBOURS: the test of `<file>.ts` is
+* `<file>.test.ts` next to it (Go's `foo_test.go` parity). Flags, on visited
+* files:
+*
+* - a `src/**` test whose neighbour module `<file>.ts` does not exist;
+* - any file living in a `__tests__/` directory under `src/`;
+* - any file under a root-level `tests/` directory (the only test roots are
+*   sibling module tests under `src/` and product specifications in `specs/`).
+*/
+const i2SiblingTestNaming = {
+	create(context) {
+		const file = context.physicalFilename;
+		const parts = segments(file);
+		return { Program(node) {
+			if (parts.includes("src")) {
+				if (parts.includes("__tests__")) context.report({
+					messageId: "testsDir",
+					node
+				});
+				else if (TEST_FILE$1.test(file)) {
+					const neighbours = [
+						".ts",
+						".tsx",
+						".js"
+					].map((extension) => file.replace(TEST_FILE$1, extension));
+					if (!neighbours.some(isFile)) context.report({
+						data: { expected: neighbours[0].split(/[/\\]/).at(-1) ?? "" },
+						messageId: "orphanTest",
+						node
+					});
+				}
+			}
+			const testsIndex = parts.indexOf("tests");
+			if (testsIndex > 0) {
+				if (isFile(`${`/${parts.slice(0, testsIndex).join("/")}`}/package.json`)) context.report({
+					messageId: "rootTests",
+					node
+				});
+			}
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["i2-sibling-test-naming"],
+		messages: {
+			orphanTest: "A src/ module test must sit NEXT to the module it tests — no neighbour \"{{expected}}\" found (CONVENTIONS I2). A test needing more than its module is a specification: move it to specs/.",
+			rootTests: "A root-level tests/ directory is banned — module tests are siblings under src/, product specifications live in specs/ (CONVENTIONS I2).",
+			testsDir: "__tests__/ directories are banned under src/ — the test of <file>.ts is its neighbour <file>.test.ts (CONVENTIONS I2)."
+		},
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/i4-no-vi-mock-in-src.ts
+const TEST_FILE = /\.test\.[cm]?[jt]sx?$/;
+/** Module-ish sources a src test may import; anything else with an extension is a data asset. */
+const CODE_IMPORT = /\.[cm]?[jt]sx?$/;
+/** Does this import path even carry an extension? Bare/extension-less ones are code. */
+const HAS_EXTENSION = /\.[a-z0-9]+$/i;
+/**
+* CONVENTIONS I4 — in module tests under `src/`, mocks and data are CODE:
+* `mockOf`/`mockOfDate` inline, large payloads in a `*.fixtures.ts` neighbour.
+* Flags, under `src/`:
+*
+* - `vi.mock(…)` calls (module mocking) in any file;
+* - files living in a `__mocks__/` or `__fixtures__/` directory;
+* - a `*.test.ts` importing a non-code asset (`.json`, `.txt`, `.sql`, …) —
+*   a test needing a real file is a specification and belongs in `specs/`.
+*/
+const i4NoViMockInSrc = {
+	create(context) {
+		const parts = segments(context.filename);
+		if (!parts.includes("src")) return {};
+		const banned = parts.find((part) => part === "__mocks__" || part === "__fixtures__");
+		const isTest = TEST_FILE.test(context.filename);
+		const visitor = {
+			CallExpression(node) {
+				const callee = node.callee;
+				if (callee?.type !== "MemberExpression" || callee.computed === true) return;
+				const object = callee.object;
+				const property = callee.property;
+				if (object?.type === "Identifier" && object.name === "vi" && property?.type === "Identifier" && (property.name === "mock" || property.name === "doMock")) context.report({
+					messageId: "viMock",
+					node
+				});
+			},
+			Program(node) {
+				if (banned !== void 0) context.report({
+					data: { dir: banned },
+					messageId: "bannedDir",
+					node
+				});
+			}
+		};
+		if (isTest) Object.assign(visitor, importSourceVisitor(({ node, source }) => {
+			if (HAS_EXTENSION.test(source) && !CODE_IMPORT.test(source)) context.report({
+				data: { source },
+				messageId: "assetImport",
+				node
+			});
+		}));
+		return visitor;
+	},
+	meta: {
+		docs: RULE_DOCS["i4-no-vi-mock-in-src"],
+		messages: {
+			assetImport: "A src/ module test must not import the data asset \"{{source}}\" — inline it as code or move the test to specs/ (CONVENTIONS I4).",
+			bannedDir: "`{{dir}}/` directories are banned under src/ — mocks and data are code: mockOf/mockOfDate inline, payloads in a *.fixtures.ts neighbour (CONVENTIONS I4).",
+			viMock: "`vi.mock` is banned under src/ — use mockOf/mockOfDate (CONVENTIONS I4)."
+		},
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/j1-no-only-skip.ts
+/** Test runners whose `.only` / `.skip` modifiers must never be committed. */
+const RUNNERS = /* @__PURE__ */ new Set([
+	"describe",
+	"it",
+	"test"
+]);
+/** The focus/skip modifiers CONVENTIONS J1 forbids. */
+const FORBIDDEN = /* @__PURE__ */ new Set(["only", "skip"]);
+/**
+* CONVENTIONS J1 — no committed `.only` / `.skip`.
+*
+* Flags the member form used across the specs: `describe.only`, `test.only`,
+* `it.only` and their `.skip` counterparts. Modifiers that legitimately gate a
+* test (`test.skipIf`, `test.runIf`) are untouched — only the bare `only`/`skip`
+* that pin or disable a test in a commit are reported.
+*/
+const j1NoOnlySkip = {
+	create(context) {
+		return { MemberExpression(node) {
+			if (node.computed === true) return;
+			const object = node.object;
+			const property = node.property;
+			if (object?.type !== "Identifier" || property?.type !== "Identifier") return;
+			const runner = object.name;
+			const modifier = property.name;
+			if (RUNNERS.has(runner) && FORBIDDEN.has(modifier)) context.report({
+				data: {
+					modifier,
+					runner
+				},
+				messageId: "forbidden",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["j1-no-only-skip"],
+		messages: { forbidden: "Committed `{{runner}}.{{modifier}}` is not allowed (CONVENTIONS J1). Remove it before committing." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/j2-no-sleep-in-specs.ts
+/**
+* CONVENTIONS J2 — spec files (`specs/**`) contain no arbitrary sleeps:
+* synchronisation goes through `waitFor` / the framework's own mechanisms.
+* Flags `setTimeout(…)` calls (bare or as a member, e.g.
+* `globalThis.setTimeout`) and imports of `node:timers/promises`.
+*/
+const j2NoSleepInSpecs = {
+	create(context) {
+		if (!segments(context.filename).includes("specs")) return {};
+		return {
+			CallExpression(node) {
+				const callee = node.callee;
+				if (callee === void 0) return;
+				const name = callee.type === "Identifier" ? callee.name : memberPropertyName(callee);
+				if (name === "setTimeout" || name === "setInterval") {
+					context.report({
+						messageId: "sleep",
+						node
+					});
+					return;
+				}
+				if (name === "wait" && callee.type === "MemberExpression" && callee.object?.type === "Identifier" && callee.object.name === "Atomics") context.report({
+					messageId: "sleep",
+					node
+				});
+			},
+			...importSourceVisitor(({ node, source }) => {
+				if (source === "node:timers/promises" || source === "timers/promises") context.report({
+					messageId: "timersImport",
+					node
+				});
+			})
+		};
+	},
+	meta: {
+		docs: RULE_DOCS["j2-no-sleep-in-specs"],
+		messages: {
+			sleep: "No arbitrary sleeps in specs — synchronise via `waitFor` or the framework (CONVENTIONS J2).",
+			timersImport: "No timer-based sleeps in specs — synchronise via `waitFor` or the framework (CONVENTIONS J2)."
+		},
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/j3-no-expectless-test.ts
+/** Does `callback` contain at least one `expect(…)` call? */
+function hasExpect(callback) {
+	let found = false;
+	walk(callback, (node) => {
+		if (found || node.type !== "CallExpression") return;
+		const callee = node.callee;
+		if (callee?.type === "Identifier" && callee.name === "expect") found = true;
+	});
+	return found;
+}
+/**
+* CONVENTIONS J3 — a test asserts something. A `test('…', () => { … })` whose
+* body contains no `expect(…)` is either dead or a silent no-op.
+*
+* Reuses the shared B4 test-shape helpers. `test.todo(...)` (and any other
+* callback-less form) is skipped — there is nothing to assert yet.
+*/
+const j3NoExpectlessTest = {
+	create(context) {
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (!isTestCallee(callee)) return;
+			if (testCalleeHasModifier(callee, "todo")) return;
+			const callback = findTestCallback(node.arguments ?? []);
+			if (callback === void 0) return;
+			if (!hasExpect(callback)) context.report({
+				messageId: "noExpect",
+				node
+			});
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["j3-no-expectless-test"],
+		messages: { noExpect: "Test has no `expect(…)` — a test must assert something (CONVENTIONS J3). Use `test.todo` for a pending test." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/j4-unique-test-names.ts
+/**
+* CONVENTIONS J4 — test names are the sole description of behaviour (B3), so two
+* tests sharing a literal name in one file are a copy-paste smell: one shadows
+* the other in the reporter. Flags the second (and later) occurrence.
+*
+* `.each` / parametrized tests are skipped — their name is a template expanded
+* per row, collisions there are by construction.
+*/
+const j4UniqueTestNames = {
+	create(context) {
+		const seen = /* @__PURE__ */ new Set();
+		return { CallExpression(node) {
+			const callee = node.callee;
+			if (!isTestCallee(callee)) return;
+			if (testCalleeHasModifier(callee, "each")) return;
+			const name = testName(node);
+			if (name === void 0) return;
+			if (seen.has(name)) {
+				context.report({
+					data: { name },
+					messageId: "duplicate",
+					node
+				});
+				return;
+			}
+			seen.add(name);
+		} };
+	},
+	meta: {
+		docs: RULE_DOCS["j4-unique-test-names"],
+		messages: { duplicate: "Duplicate test name \"{{name}}\" in this file — the test name is the sole description of behaviour, so it must be unique (CONVENTIONS J4)." },
+		type: "problem"
+	}
+};
+//#endregion
+//#region src/lint/rules/j5-lowercase-title.ts
+/** The block/test introducers whose title literal C1' constrains. */
+const TITLED = /* @__PURE__ */ new Set([
+	"describe",
+	"it",
+	"test"
+]);
+/** An identifier-shaped, all-caps/underscored first word: `VALID_CATEGORIES`,
+* `HTTP`, `DI`. Such a word names a symbol verbatim — lowercasing it would
+* misspell it — so it is exempt. A prose word (`Rejects`, `Builds`) is not. */
+const ALL_CAPS_IDENTIFIER = /^[A-Z][A-Z0-9_]*$/u;
+//#endregion
+//#region src/lint/plugin.ts
+/**
+* The `@jterrazz/test` oxlint plugin — the tool-facing lint layer that enforces
+* the statically-checkable CONVENTIONS rules (the `Lint(statique)` catalogue).
+*
+* Registered in a consumer's (or this repo's own) `oxlint.config.ts` via
+* `jsPlugins: ['@jterrazz/test/oxlint']` and referenced as `jterrazz/<rule>` in
+* the `rules` map, e.g. `'jterrazz/j1-no-only-skip': 'error'` — or enabled
+* wholesale by spreading {@link recommendedRules}.
+*
+* This entry is bundled by tsdown (`dist/oxlint.js`); rules import nothing from
+* the framework runtime (only pure core helpers: the token list, the case
+* conversions, the fixture-marker list), so the bundle stays free of the heavy
+* adapters (msw, pg, testcontainers, …) that the main entry pulls in.
+*/
+const plugin = {
+	meta: { name: "jterrazz" },
+	rules: {
+		"a1-specification-file": a1SpecificationFile,
+		"a10-duplicate-binding": a10DuplicateBinding,
+		"a2-known-constructors": a2KnownConstructors,
+		"a3-no-destructure-alias": a3NoDestructureAlias,
+		"a4-cleanup-afterall": a4CleanupAfterall,
+		"a5-mode-with-server": a5ModeWithServer,
+		"a6w-redundant-compose-service": a6wRedundantComposeService,
+		"a9w-redundant-root": a9wRedundantRoot,
+		"b2-known-fixture-marker": b2KnownFixtureMarker,
+		"b4-given-then": b4GivenThen,
+		"b5-await-using": b5AwaitUsing,
+		"b6w-redundant-env-url": b6wRedundantEnvUrl,
+		"b8-kebab-trigger": b8KebabTrigger,
+		"b9w-product-command": b9wProductCommand,
+		"c1-domain-structure": c1DomainStructure,
+		"c2-http-only-requests": c2HttpOnlyRequests,
+		"c4-contract-shape": c4ContractShape,
+		"c6-tomatch-extension": c6ToMatchExtension,
+		"c7-seeds-sql-only": c7SeedsSqlOnly,
+		"c8-referenced-fixture-exists": c8ReferencedFixtureExists,
+		"d2-await-io-matcher": d2AwaitIoMatcher,
+		"d2w-await-sync-matcher": d2wAwaitSyncMatcher,
+		"d6w-transform-token-equivalent": d6wTransformTokenEquivalent,
+		"d8w-text-bypass": d8wTextBypass,
+		"d9w-single-use-ref": d9wSingleUseRef,
+		"d12w-response-body-probe": d12wResponseBodyProbe,
+		"d13w-unfrozen-negative-fixture": d13wUnfrozenNegativeFixture,
+		"d15w-status-only-probe": d15wStatusOnlyProbe,
+		"f1-no-subpath-import": f1NoSubpathImport,
+		"f2-no-test-imports-in-prod": f2NoTestImportsInProd,
+		"f3-specs-public-entry": f3SpecsPublicEntry,
+		"f4-no-test-to-test-import": f4NoTestToTestImport,
+		"f5-fixtures-only-from-tests": f5FixturesOnlyFromTests,
+		"i1-layer-boundaries": i1LayerBoundaries,
+		"i2-sibling-test-naming": i2SiblingTestNaming,
+		"i4-no-vi-mock-in-src": i4NoViMockInSrc,
+		"j1-no-only-skip": j1NoOnlySkip,
+		"j2-no-sleep-in-specs": j2NoSleepInSpecs,
+		"j3-no-expectless-test": j3NoExpectlessTest,
+		"j4-unique-test-names": j4UniqueTestNames,
+		"j5-lowercase-title": {
+			create(context) {
+				return { CallExpression(node) {
+					const callee = node.callee;
+					const root = chainRootName(callee);
+					if (root === void 0 || !TITLED.has(root)) return;
+					const title = stringValue(node.arguments?.[0]);
+					if (title === void 0) return;
+					const first = [...title][0];
+					if (first === void 0 || !/\p{L}/u.test(first)) return;
+					const firstWord = title.split(/\s+/u)[0];
+					if (ALL_CAPS_IDENTIFIER.test(firstWord)) return;
+					if (first !== first.toLocaleLowerCase()) context.report({
+						data: { runner: root },
+						messageId: "uppercase",
+						node
+					});
+				} };
+			},
+			meta: {
+				docs: RULE_DOCS["j5-lowercase-title"],
+				messages: { uppercase: "A {{runner}}() title must start lowercase — the test name is a prose fragment, not a sentence (CONVENTIONS J5)." },
+				type: "problem"
+			}
+		}
+	}
+};
+/**
+* The full catalogue at its intended severities — spread into an oxlint
+* `rules` map to enable everything in one line:
+*
+*     rules: { ...recommendedRules }
+*
+* Hard conventions are errors; redundancy heuristics (`<id>w-*` rule ids) are
+* warnings. `b5-await-using` is enabled but inert until re-declared with the
+* project's docker-aware runner names:
+*
+*     'jterrazz/b5-await-using': ['error', { runners: ['dockerCli'] }]
+*/
+const recommendedRules = Object.fromEntries(Object.keys(plugin.rules).map((rule) => [`jterrazz/${rule}`, /^\w+w-/.test(rule) ? "warn" : "error"]));
+/**
+* The composable testing fragment — wire the plugin, enable the whole
+* catalogue, and ship the one override every strict consumer needs. Designed
+* to be composed with a base preset (e.g. `@jterrazz/typescript/oxlint`):
+*
+*     import { compose, node } from '@jterrazz/typescript/oxlint';
+*     import { testing } from '@jterrazz/test/oxlint';
+*     export default compose(node, testing);
+*
+* `jsPlugins` registers the tool-facing entry; `rules` is {@link recommendedRules};
+* `overrides` relaxes `import/exports-last` for `*.specification.ts` — the A4 idiom
+* (`export const { cli, cleanup } … ; afterAll(cleanup)`) legitimately ends a spec
+* file on a non-export statement, so the relaxation ships here rather than being
+* hand-rolled in every consumer.
+*/
+const testing = {
+	jsPlugins: ["@jterrazz/test/oxlint"],
+	overrides: [{
+		files: ["**/*.specification.ts"],
+		rules: { "import/exports-last": "off" }
+	}],
+	rules: recommendedRules
+};
+//#endregion
+exports.default = plugin;
+exports.recommendedRules = recommendedRules;
+exports.testing = testing;