@shivaedev/quality 0.27.0 → 0.28.0

package/src/hooks/shim.ts

@@ -16,13 +16,23 @@ export function hookShim(directory: string, command: HookCommand): string {
 		OWNER,
 		'top="$(git rev-parse --show-toplevel)" || exit 2',
 		'if [ -n "$GIT_DIR" ] && [ -z "$GIT_WORK_TREE" ]; then export GIT_WORK_TREE="$top"; fi',
+		'cd "$top" || exit 2',
+		"status=0",
+		'global_path="$(git config --global --includes --type=path --get core.hooksPath)"',
+		'if [ -n "$global_path" ]; then',
+		'\tglobal_hook="$global_path/pre-commit"',
+		'\tif [ -x "$global_hook" ] && ! [ "$global_hook" -ef "$0" ]; then',
+		'\t\t"$global_hook" "$@" || status=$?',
+		"\tfi",
+		"fi",
 		`cd "$top"${folder} || exit 2`,
 		`quality=${shellWords([command.launcher])}`,
 		'if [ ! -e "$quality" ]; then',
 		'\tprintf \'quality: cannot check this commit: %s/%s does not exist.\\nhelp: install the dependencies of this worktree, then commit again.\\n\' "$PWD" "$quality" >&2',
 		"\texit 2",
 		"fi",
-		`exec ${exec.join(" ")}`,
+		`${exec.join(" ")} || status=$?`,
+		'exit "$status"',
 		"",
 	].join("\n");
 }

package/src/hooks/status.ts

@@ -0,0 +1,50 @@
+import { constants } from "node:fs";
+import { access, realpath } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { Console, Effect } from "effect";
+import { GateFailed, SetupFailure } from "#failure.ts";
+import { git, gitOrFail } from "#git/command.ts";
+import { readOptionalText } from "#inventory/filesystem.ts";
+import { type HookLocation, hookLocation } from "./location.ts";
+import { isHookShim } from "./shim.ts";
+
+function executable(file: string) {
+	return Effect.promise(async () => {
+		try {
+			await access(file, constants.X_OK);
+			return await realpath(file);
+		} catch {
+			return undefined;
+		}
+	});
+}
+
+export const globalHookStatus = Effect.fn("Hooks.globalHookStatus")(function* (location: HookLocation) {
+	const global = yield* git(location.toplevel, ["config", "--global", "--includes", "--type=path", "--get", "core.hooksPath"]);
+	if (global.code !== 0 && global.code !== 1) {
+		return yield* new SetupFailure({ message: `cannot read global core.hooksPath: ${global.stderr.trim()}` });
+	}
+	const path = global.stdout.trim();
+	const hook = resolve(location.toplevel, path, "pre-commit");
+	const target = path === "" ? undefined : yield* executable(hook);
+	const own = yield* executable(location.file);
+	yield* Console.log(
+		target !== undefined && target !== own
+			? `quality: chaining global pre-commit hook at ${hook}.`
+			: "quality: no executable global pre-commit hook to chain.",
+	);
+});
+
+export const hookStatus = Effect.fn("Hooks.hookStatus")(function* (cwd: string) {
+	const location = yield* hookLocation(cwd);
+	const path = (yield* gitOrFail(cwd, ["rev-parse", "--path-format=absolute", "--git-path", "hooks/pre-commit"])).trim();
+	const text = yield* readOptionalText(path).pipe(Effect.mapError((error) => new SetupFailure({ message: error.message })));
+	if (text === undefined || !isHookShim(text) || (yield* executable(path)) === undefined) {
+		yield* Console.error(
+			`quality: the effective hooks path ${dirname(path)} does not run Quality's pre-commit hook.\nhelp: run \`quality hooks install\` to check commits.`,
+		);
+		return yield* new GateFailed();
+	}
+	yield* Console.log(`quality: git runs Quality's pre-commit hook at ${path}.`);
+	yield* globalHookStatus(location);
+});

package/src/hooks/uninstall.ts

@@ -1,5 +1,7 @@
+import { dirname } from "node:path";
 import { Console, Effect, FileSystem } from "effect";
 import { SetupFailure } from "#failure.ts";
+import { git, gitOrFail } from "#git/command.ts";
 import { readOptionalText } from "#inventory/filesystem.ts";
 import { hookLocation } from "./location.ts";
 import { isHookShim } from "./shim.ts";
@@ -15,5 +17,9 @@ export const uninstallHook = Effect.fn("Hooks.uninstallHook")(function* (cwd: st
 		return yield* Console.error(`quality: kept ${file}: it is not quality's pre-commit hook.`);
 	}
 	yield* Effect.mapError(fs.remove(file), (error) => new SetupFailure({ message: `cannot remove ${file}: ${error.message}` }));
+	const local = yield* git(cwd, ["config", "--local", "--get", "core.hooksPath"]);
+	if (local.stdout.trim() === dirname(file)) {
+		yield* gitOrFail(cwd, ["config", "--local", "--unset-all", "core.hooksPath"]);
+	}
 	yield* Console.log(`quality: removed the pre-commit hook at ${file}.`);
 });

package/src/inventory/collect.ts

@@ -4,6 +4,7 @@ import ignore from "ignore";
 import type { SourceFile } from "#rule.ts";
 import { FilesystemFailure, orWhenAbsent, readRequiredText } from "./filesystem.ts";
 import { posix } from "./ignoreScope.ts";
+import { shadcnFolders } from "./shadcnFolders.ts";
 import { scopeAbove, walk } from "./walk.ts";
 
 export interface InventoryScope {
@@ -49,10 +50,12 @@ export const collectInventory = Effect.fn("Inventory.collectInventory")(function
 	scope: InventoryScope,
 ): Effect.fn.Return<Inventory, FilesystemFailure, FileSystem.FileSystem> {
 	const excluded = ignore().add([...scope.exclude]);
+	const toolOwned = yield* shadcnFolders(root);
 	const zones = yield* Effect.forEach(scope.sources, (zone) => zoneFiles(root, zone), { concurrency: READ_CONCURRENCY });
 	const relativePaths = zones.flat().map((absolute) => posix(relative(root, absolute)));
 	const files = [...new Set(relativePaths)]
 		.filter((path) => !excluded.ignores(path))
+		.filter((path) => !toolOwned.some((folder) => path.startsWith(`${folder}/`)))
 		.sort((left, right) => {
 			if (left === right) {
 				return 0;

package/src/inventory/shadcnAlias.ts

@@ -0,0 +1,88 @@
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import ts from "typescript";
+
+const PROBE = "__quality_shadcn__.tsx";
+
+function capture(pattern: string, alias: string): string | undefined {
+	const star = pattern.indexOf("*");
+	if (star === -1) {
+		return pattern === alias ? "" : undefined;
+	}
+	const prefix = pattern.slice(0, star);
+	const suffix = pattern.slice(star + 1);
+	return alias.startsWith(prefix) && alias.endsWith(suffix)
+		? alias.slice(prefix.length, suffix.length === 0 ? undefined : -suffix.length)
+		: undefined;
+}
+
+function pathTarget(alias: string, options: ts.CompilerOptions, directory: string): string | undefined {
+	const pathsBase = Reflect.get(options, "pathsBasePath");
+	const base = options.baseUrl ?? (typeof pathsBase === "string" ? pathsBase : directory);
+	const patterns = Object.entries(options.paths ?? {}).toSorted(([left], [right]) => right.indexOf("*") - left.indexOf("*"));
+	const exact = options.paths?.[alias]?.[0];
+	if (exact !== undefined) {
+		return resolve(base, exact);
+	}
+	for (const [pattern, targets] of patterns) {
+		const captured = capture(pattern, alias);
+		const target = targets[0];
+		if (captured !== undefined && target !== undefined) {
+			return resolve(base, target.replace("*", captured));
+		}
+	}
+	return undefined;
+}
+
+export function shadcnAlias(directory: string, alias: string): string {
+	if (alias.startsWith(".") || isAbsolute(alias)) {
+		return resolve(directory, alias);
+	}
+	const config = ts.findConfigFile(directory, ts.sys.fileExists);
+	const parsed =
+		config === undefined
+			? undefined
+			: ts.getParsedCommandLineOfConfigFile(
+					config,
+					{},
+					{
+						...ts.sys,
+						onUnRecoverableConfigFileDiagnostic: () => undefined,
+					},
+				);
+	if (parsed?.errors.length) {
+		throw new Error(
+			ts.formatDiagnostics(parsed.errors, {
+				getCanonicalFileName: (file) => file,
+				getCurrentDirectory: () => directory,
+				getNewLine: () => "\n",
+			}),
+		);
+	}
+	const options = parsed?.options ?? {};
+	const target = pathTarget(alias, options, config === undefined ? directory : dirname(config));
+	if (target !== undefined) {
+		return target;
+	}
+	if (!alias.startsWith("#")) {
+		throw new Error(`Cannot resolve shadcn UI alias "${alias}" from ${directory}. Check tsconfig paths.`);
+	}
+	// A synthetic child lets TypeScript resolve directory aliases through package imports without requiring a stock component to exist.
+	const resolved = ts.resolveModuleName(
+		`${alias}/${PROBE}`,
+		join(directory, "components.tsx"),
+		{
+			...options,
+			customConditions: ["source", ...(options.customConditions ?? [])],
+			moduleResolution: ts.ModuleResolutionKind.Bundler,
+		},
+		{
+			...ts.sys,
+			directoryExists: () => true,
+			fileExists: (file) => file.endsWith(`/${PROBE}`) || ts.sys.fileExists(file),
+		},
+	).resolvedModule;
+	if (resolved === undefined) {
+		throw new Error(`Cannot resolve shadcn UI alias "${alias}" from ${directory}. Check tsconfig paths or package imports.`);
+	}
+	return dirname(resolved.resolvedFileName);
+}

package/src/inventory/shadcnFolders.ts

@@ -0,0 +1,30 @@
+import { basename, dirname, relative } from "node:path";
+import { Effect, type FileSystem, Schema } from "effect";
+import { FilesystemFailure, readRequiredText } from "./filesystem.ts";
+import { posix } from "./ignoreScope.ts";
+import { shadcnAlias } from "./shadcnAlias.ts";
+import { walk } from "./walk.ts";
+
+const Components = Schema.fromJsonString(Schema.Struct({ aliases: Schema.Struct({ ui: Schema.NonEmptyString }) }));
+
+export const shadcnFolders = Effect.fn("Inventory.shadcnFolders")(function* (
+	root: string,
+): Effect.fn.Return<readonly string[], FilesystemFailure, FileSystem.FileSystem> {
+	const paths = (yield* walk(root)).filter((path) => basename(path) === "components.json");
+	return yield* Effect.forEach(paths, (path) =>
+		Effect.gen(function* () {
+			const text = yield* readRequiredText(path);
+			return yield* Effect.try({
+				catch: (cause) => new FilesystemFailure({ message: `cannot resolve ${path}: ${String(cause)}`, path }),
+				try: () => {
+					const { aliases } = Schema.decodeUnknownSync(Components)(text);
+					const folder = posix(relative(root, shadcnAlias(dirname(path), aliases.ui)));
+					if (folder === "" || folder === ".." || folder.startsWith("../")) {
+						throw new Error("the shadcn UI folder must be inside the repository and cannot be its root");
+					}
+					return folder;
+				},
+			});
+		}),
+	);
+});

package/src/naming/migrationFile.ts

@@ -0,0 +1,9 @@
+import { posix } from "node:path";
+
+export const MIGRATIONS_DIRECTORY = "src/server/migrations";
+export const MIGRATION_FILE_PATTERN = /^[0-9]{4}_[a-z][a-z0-9]*(?:_[a-z0-9]+)*\.ts$/u;
+
+export function isMigrationFile(path: string): boolean {
+	const directory = posix.dirname(path);
+	return (directory === MIGRATIONS_DIRECTORY || directory.endsWith(`/${MIGRATIONS_DIRECTORY}`)) && MIGRATION_FILE_PATTERN.test(posix.basename(path));
+}

package/src/rules/builtIn.ts

@@ -16,8 +16,16 @@ import { importsManifest } from "#rules/imports/manifest.ts";
 import { noTestCode } from "#rules/imports/noTestCode.ts";
 import { importsResolvable } from "#rules/imports/resolvable.ts";
 import { importsRuntime } from "#rules/imports/runtime.ts";
+import { authSql } from "#rules/stories/authSql.ts";
+import { httpStatus } from "#rules/stories/httpStatus.ts";
+import { namedValues } from "#rules/stories/namedValues.ts";
+import { noExpect } from "#rules/stories/noExpect.ts";
+import { noLimitImports } from "#rules/stories/noLimitImports.ts";
+import { queueSql } from "#rules/stories/queueSql.ts";
 import { storySetup } from "#rules/stories/setup.ts";
+import { specHelpers } from "#rules/stories/specHelpers.ts";
 import { storySpecs } from "#rules/stories/specs.ts";
+import { supportImports } from "#rules/stories/supportImports.ts";
 import { biomeOverrides } from "#rules/suppressions/biomeOverrides.ts";
 import { biomeRecommended } from "#rules/suppressions/biomeRecommended.ts";
 import { noDoubleCast } from "#rules/suppressions/noDoubleCast.ts";
@@ -66,4 +74,12 @@ export const builtInRules = [
 	testsColocated,
 	storySetup,
 	storySpecs,
+	queueSql,
+	authSql,
+	noExpect,
+	specHelpers,
+	supportImports,
+	httpStatus,
+	namedValues,
+	noLimitImports,
 ] as const;

package/src/rules/files/folderNames.ts

@@ -5,15 +5,13 @@ import { packageLayout } from "#naming/packageLayout.ts";
 import { KEBAB, PASCAL } from "#naming/words.ts";
 import { defineRule, type Finding } from "#rule.ts";
 
-const DEFAULT_TOOL_OWNED: readonly string[] = ["migrations/"];
-
 const SNAKE = /^[a-z0-9]+(?:_[a-z0-9]+)*$/u;
 
 const CODE = /\.[cm]?[jt]sx?$/u;
 
 const FolderNamesOptions = Schema.Struct({
 	content: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
-	toolOwned: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed(DEFAULT_TOOL_OWNED))),
+	toolOwned: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
 });
 
 function foldersIn(files: readonly string[]): readonly string[] {

package/src/rules/files/namedAfterExport.ts

@@ -3,6 +3,7 @@ import { Effect, Schema } from "effect";
 import ignore from "ignore";
 import { exportFits } from "#naming/exportFits.ts";
 import { mainExport } from "#naming/mainExport.ts";
+import { isMigrationFile } from "#naming/migrationFile.ts";
 import { ownExports } from "#naming/ownExports.ts";
 import { type PackageLayout, packageLayout } from "#naming/packageLayout.ts";
 import { CAMEL, KEBAB, sameWord, wordsOf } from "#naming/words.ts";
@@ -86,7 +87,9 @@ export const namedAfterExport = defineRule({
 	check: async ({ files, options, readText, sources }) => {
 		const layout = await packageLayout({ files, readText });
 		const toolOwned = ignore().add([...options.toolOwned]);
-		return sources.filter((file) => !(TEST.test(file.path) || toolOwned.ignores(file.path))).flatMap((file) => findingsOf(file, layout));
+		return sources
+			.filter((file) => !(TEST.test(file.path) || isMigrationFile(file.path) || toolOwned.ignores(file.path)))
+			.flatMap((file) => findingsOf(file, layout));
 	},
 	description:
 		"A file is named after its main export, with its folders as the prefix; a file of several exports is a camelCase topic file, and a script is kebab-case. Rename the file or the export; nothing renames them for you.",

package/src/rules/files/otherNames.ts

@@ -5,7 +5,7 @@ import { CAMEL, KEBAB } from "#naming/words.ts";
 import { defineRule, type Finding } from "#rule.ts";
 import { stylesheetImporters } from "./stylesheetImporters.ts";
 
-const DEFAULT_TOOL_OWNED: readonly string[] = [".*", "package.json", "tsconfig*.json", "biome.json", "biome.jsonc", "*.config.*", "migrations/"];
+const DEFAULT_TOOL_OWNED: readonly string[] = [".*", "package.json", "tsconfig*.json", "biome.json", "biome.jsonc", "*.config.*"];
 
 const CONVENTIONAL: ReadonlySet<string> = new Set(["AGENTS", "CHANGELOG", "CLAUDE", "CONTRIBUTING", "LICENSE", "README", "SECURITY", "SKILL"]);
 

package/src/rules/stories/authSql.ts

@@ -0,0 +1,117 @@
+import { Effect, Schema } from "effect";
+import { defineRule } from "#rule.ts";
+import { matchesAny } from "./matchesAny.ts";
+import { sqlTexts } from "./sqlText.ts";
+
+const AuthSqlOptions = Schema.Struct({
+	owners: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+});
+
+const TOKENS = /--[^\n]*|\/\*[\s\S]*?\*\/|'(?:''|[^'])*'|"(?:""|[^"])*"|[\w$]+|[.,;()]/gu;
+const TABLE_START = new Set(["from", "join", "update", "into", "table", "truncate", "references", "using"]);
+const TABLE_END = new Set(["where", "group", "order", "having", "limit", "returning", "set", "values", "on", ";"]);
+const SKIP = new Set(["if", "not", "exists", "only", "table"]);
+const AUTH_TABLES = new Set(["user", "account", "session", "verification"]);
+const EXPRESSION_FROM = new Set(["extract", "overlay", "substring", "trim"]);
+const NON_TABLE_TARGETS = new Set([
+	"all",
+	"database",
+	"domain",
+	"foreign",
+	"function",
+	"language",
+	"large",
+	"parameter",
+	"procedure",
+	"routine",
+	"schema",
+	"sequence",
+	"tablespace",
+	"type",
+]);
+
+function tableAt(tokens: readonly string[], index: number): string {
+	let next = index;
+	while (SKIP.has(tokens[next]?.toLowerCase() ?? "")) {
+		const only = tokens[next]?.toLowerCase() === "only";
+		next += 1;
+		if (only && tokens[next] === "(") {
+			next += 1;
+		}
+	}
+	while (tokens[next + 1] === ".") {
+		next += 2;
+	}
+	return (tokens[next] ?? "").replaceAll('"', "").toLowerCase();
+}
+
+function tableBoundary(tokens: readonly string[], index: number, statementStart: number, fromIsTable: boolean) {
+	const word = tokens[index]?.toLowerCase() ?? "";
+	const permissions = ["grant", "revoke"].includes(tokens[statementStart]?.toLowerCase() ?? "");
+	const roleTarget = permissions && (word === "to" || word === "from");
+	const permissionTarget = permissions && word === "on" && !NON_TABLE_TARGETS.has(tokens[index + 1]?.toLowerCase() ?? "");
+	const indexTarget = word === "on" && tokens.slice(statementStart, index).some((part) => part.toLowerCase() === "index");
+	const tableClause = TABLE_START.has(word) && (word !== "from" || fromIsTable);
+	return {
+		ends: TABLE_END.has(word) || roleTarget,
+		starts: !roleTarget && (tableClause || indexTarget || permissionTarget),
+	};
+}
+
+interface SqlContext {
+	depth: number;
+	readonly expressionFromDepths: Set<number>;
+	statementStart: number;
+	readonly tablesAtDepth: Set<number>;
+}
+
+function advanceContext(context: SqlContext, token: string, index: number, previous: string | undefined): void {
+	if (token === ";") {
+		context.statementStart = index + 1;
+		context.expressionFromDepths.clear();
+	}
+	if (token === "(") {
+		context.depth += 1;
+		if (EXPRESSION_FROM.has(previous?.toLowerCase() ?? "")) {
+			context.expressionFromDepths.add(context.depth);
+		}
+	}
+	if (token === ")") {
+		context.tablesAtDepth.delete(context.depth);
+		context.expressionFromDepths.delete(context.depth);
+		context.depth -= 1;
+	}
+}
+
+function authTableIn(text: string): boolean {
+	const tokens = [...text.matchAll(TOKENS)]
+		.map(([token]) => token)
+		.filter((token) => !(token.startsWith("--") || token.startsWith("/*") || token.startsWith("'")));
+	const context: SqlContext = { depth: 0, expressionFromDepths: new Set(), statementStart: 0, tablesAtDepth: new Set() };
+	return tokens.some((token, index) => {
+		advanceContext(context, token, index, tokens[index - 1]);
+		const boundary = tableBoundary(tokens, index, context.statementStart, !context.expressionFromDepths.has(context.depth));
+		if (boundary.ends) {
+			context.tablesAtDepth.delete(context.depth);
+		}
+		if (boundary.starts) {
+			context.tablesAtDepth.add(context.depth);
+		}
+		return (boundary.starts || (token === "," && context.tablesAtDepth.has(context.depth))) && AUTH_TABLES.has(tableAt(tokens, index + 1));
+	});
+}
+
+export const authSql = defineRule({
+	check: async ({ options, ...inputs }) =>
+		(await sqlTexts(inputs))
+			.filter((query) => !matchesAny(query.file, options.owners) && authTableIn(query.text))
+			.map((query) => ({
+				file: query.file,
+				line: query.line,
+				message:
+					"SQL accesses a Better Auth table (user, account, session or verification). Use platform's auth API; only platform's auth implementation and its migrations, named in the repository's auth-sql owners, own those tables.",
+			})),
+	description: "Apps use platform's auth API instead of querying or modifying Better Auth's tables.",
+	id: "boundaries/auth-sql",
+	options: Schema.toStandardSchemaV1(AuthSqlOptions, { parseOptions: { errors: "all", onExcessProperty: "error" } }),
+});

package/src/rules/stories/httpStatus.ts

@@ -0,0 +1,56 @@
+import { Effect, Schema } from "effect";
+import ts from "typescript";
+import { defineRule } from "#rule.ts";
+import { matchesAny } from "./matchesAny.ts";
+import { memberName, nodesWhere, numericValue, syntaxFindings, unwrapped } from "./syntax.ts";
+
+const MESSAGE =
+	"Branches on an HTTP error status outside the HTTP edge. Handle the typed domain error here and translate it to an HTTP status in the configured edge module.";
+
+const HttpStatusOptions = Schema.Struct({
+	edge: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+});
+
+const COMPARISONS = new Set([
+	ts.SyntaxKind.EqualsEqualsToken,
+	ts.SyntaxKind.EqualsEqualsEqualsToken,
+	ts.SyntaxKind.ExclamationEqualsToken,
+	ts.SyntaxKind.ExclamationEqualsEqualsToken,
+	ts.SyntaxKind.LessThanToken,
+	ts.SyntaxKind.LessThanEqualsToken,
+	ts.SyntaxKind.GreaterThanToken,
+	ts.SyntaxKind.GreaterThanEqualsToken,
+]);
+
+function isErrorStatus(node: ts.Expression): boolean {
+	const number = numericValue(node);
+	return number !== undefined && number >= 400 && number <= 599;
+}
+
+function statusBranch(node: ts.Node): boolean {
+	if (ts.isBinaryExpression(node) && COMPARISONS.has(node.operatorToken.kind)) {
+		return (memberName(node.left) === "status" && isErrorStatus(node.right)) || (memberName(node.right) === "status" && isErrorStatus(node.left));
+	}
+	if (ts.isCaseClause(node) && isErrorStatus(node.expression) && ts.isCaseBlock(node.parent) && ts.isSwitchStatement(node.parent.parent)) {
+		return memberName(node.parent.parent.expression) === "status";
+	}
+	if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && node.expression.name.text === "includes") {
+		const receiver = unwrapped(node.expression.expression);
+		return (
+			ts.isArrayLiteralExpression(receiver)
+			&& receiver.elements.some(isErrorStatus)
+			&& node.arguments.some((argument) => memberName(argument) === "status")
+		);
+	}
+	return false;
+}
+
+export const httpStatus = defineRule({
+	check: ({ sources, options }) =>
+		sources
+			.filter((file) => !matchesAny(file.path, options.edge))
+			.flatMap((file) => syntaxFindings(file, (source) => nodesWhere(source, statusBranch), MESSAGE)),
+	description: "HTTP status numbers belong at the repository's HTTP edge; domain code handles typed errors.",
+	id: "boundaries/http-status",
+	options: Schema.toStandardSchemaV1(HttpStatusOptions, { parseOptions: { errors: "all", onExcessProperty: "error" } }),
+});

package/src/rules/stories/matchesAny.ts

@@ -0,0 +1,5 @@
+import { matchesGlob } from "node:path";
+
+export function matchesAny(path: string, patterns: readonly string[]): boolean {
+	return patterns.some((pattern) => matchesGlob(path, pattern));
+}

package/src/rules/stories/namedValues.ts

@@ -0,0 +1,21 @@
+import ts from "typescript";
+import { defineRule } from "#rule.ts";
+import { isSpec, memberName, nodesWhere, numericValue, syntaxFindings } from "./syntax.ts";
+
+const MESSAGE =
+	"Passes a numeric literal to toBe or toHaveLength. Assert the observed items, or give the expected value a domain name before asserting it.";
+
+function numericAssertion(node: ts.Node): boolean {
+	return (
+		ts.isCallExpression(node)
+		&& ["toBe", "toHaveLength"].includes(memberName(node.expression) ?? "")
+		&& node.arguments.some((argument) => numericValue(argument) !== undefined)
+	);
+}
+
+export const namedValues = defineRule({
+	check: ({ sources }) =>
+		sources.filter((file) => isSpec(file.path)).flatMap((file) => syntaxFindings(file, (source) => nodesWhere(source, numericAssertion), MESSAGE)),
+	description: "Stories assert observed items or named values instead of bare counts and numbers.",
+	id: "tests/named-values",
+});

package/src/rules/stories/noExpect.ts

@@ -0,0 +1,39 @@
+import ts from "typescript";
+import { isTestSupport } from "#naming/testName.ts";
+import { defineRule } from "#rule.ts";
+import { memberName, nodesWhere, syntaxFindings, unwrapped } from "./syntax.ts";
+
+const MESSAGE =
+	"Calls expect in test-support. Return the engine's observed state from the verb and put the expectation in the spec; throw if an action cannot run.";
+
+function assertionReference(expression: ts.Expression, names: ReadonlySet<string>): boolean {
+	const node = unwrapped(expression);
+	if (ts.isIdentifier(node)) {
+		return names.has(node.text);
+	}
+	return (
+		memberName(node) === "expect"
+		|| ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && assertionReference(node.expression, names))
+	);
+}
+
+function assertionsIn(source: ts.SourceFile): readonly ts.Node[] {
+	const names = new Set(["expect"]);
+	for (const statement of source.statements) {
+		const bindings = ts.isImportDeclaration(statement) ? statement.importClause?.namedBindings : undefined;
+		if (bindings !== undefined && ts.isNamedImports(bindings)) {
+			for (const element of bindings.elements) {
+				if ((element.propertyName ?? element.name).text === "expect") {
+					names.add(element.name.text);
+				}
+			}
+		}
+	}
+	return nodesWhere(source, (node) => ts.isCallExpression(node) && assertionReference(node.expression, names));
+}
+
+export const noExpect = defineRule({
+	check: ({ sources }) => sources.filter((file) => isTestSupport(file.path)).flatMap((file) => syntaxFindings(file, assertionsIn, MESSAGE)),
+	description: "Test-support performs actions and exposes observations; specs own expectations.",
+	id: "tests/no-expect-in-support",
+});

package/src/rules/stories/noLimitImports.ts

@@ -0,0 +1,80 @@
+import ts from "typescript";
+import { defineRule } from "#rule.ts";
+import { isSpec, memberName, nodesWhere, syntaxFindings, unwrapped } from "./syntax.ts";
+
+const MESSAGE =
+	"Imports a MAX_* constant from a limits module. Tell a story about the observed behavior instead of asserting a copy of the implementation's cap.";
+
+const LIMITS_MODULE = /(?:^|[/#])limits(?:\.[cm]?[jt]s)?(?:\/|$)/u;
+const MAX_CONSTANT = /^MAX_/u;
+
+function literalLimitsImport(expression: ts.Expression): boolean {
+	const node = unwrapped(expression);
+	if (ts.isAwaitExpression(node)) {
+		return literalLimitsImport(node.expression);
+	}
+	return (
+		ts.isCallExpression(node)
+		&& node.expression.kind === ts.SyntaxKind.ImportKeyword
+		&& node.arguments[0] !== undefined
+		&& ts.isStringLiteralLike(node.arguments[0])
+		&& LIMITS_MODULE.test(node.arguments[0].text)
+	);
+}
+
+function capBinding(binding: ts.BindingElement): boolean {
+	if (binding.dotDotDotToken !== undefined) {
+		return false;
+	}
+	const name = binding.propertyName ?? binding.name;
+	if (ts.isComputedPropertyName(name)) {
+		return ts.isStringLiteralLike(name.expression) && MAX_CONSTANT.test(name.expression.text);
+	}
+	return (ts.isIdentifier(name) || ts.isStringLiteralLike(name)) && MAX_CONSTANT.test(name.text);
+}
+
+function capImports(source: ts.SourceFile): readonly ts.Node[] {
+	const namespaces = new Set<string>();
+	const imports = source.statements.flatMap((statement) => {
+		if (
+			!(ts.isImportDeclaration(statement) && ts.isStringLiteralLike(statement.moduleSpecifier) && LIMITS_MODULE.test(statement.moduleSpecifier.text))
+		) {
+			return [];
+		}
+		const bindings = statement.importClause?.namedBindings;
+		if (bindings !== undefined && ts.isNamespaceImport(bindings)) {
+			namespaces.add(bindings.name.text);
+		}
+		return bindings !== undefined && ts.isNamedImports(bindings)
+			? bindings.elements.filter((element) => MAX_CONSTANT.test((element.propertyName ?? element.name).text))
+			: [];
+	});
+	const dynamic = nodesWhere(source, ts.isVariableDeclaration).flatMap<ts.Node>((node) => {
+		if (!ts.isVariableDeclaration(node) || node.initializer === undefined || !literalLimitsImport(node.initializer)) {
+			return [];
+		}
+		if (ts.isIdentifier(node.name)) {
+			namespaces.add(node.name.text);
+			return [];
+		}
+		return ts.isObjectBindingPattern(node.name) ? node.name.elements.filter(capBinding) : [];
+	});
+	return [
+		...imports,
+		...dynamic,
+		...nodesWhere(
+			source,
+			(node) =>
+				(ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))
+				&& ts.isIdentifier(node.expression)
+				&& namespaces.has(node.expression.text)
+				&& MAX_CONSTANT.test(memberName(node) ?? ""),
+		),
+	];
+}
+
+export const noLimitImports = defineRule({
+	check: ({ sources }) => sources.filter((file) => isSpec(file.path)).flatMap((file) => syntaxFindings(file, capImports, MESSAGE)),
+	description: "Stories prove behavior instead of importing implementation caps from limits modules.",
+	id: "tests/no-limit-imports",
+});