@shivaedev/quality 0.27.1 → 0.28.0

package/dist/rules/stories/sqlText.js

@@ -0,0 +1,86 @@
+import ts from "typescript";
+import { parse } from "#rules/syntax.ts";
+import { unwrapped } from "./syntax.js";
+const SQL_START = /^\s*(?:(?:--[^\n]*\n|\/\*[\s\S]*?\*\/)\s*)*(?:select|with|insert|update|delete|truncate|alter|drop|create|grant|revoke|comment)\b/iu;
+const SQL_CALLEE = /^(?:sql|query|execute|exec|raw)(?:\.|$)|\.(?:sql|unsafe|query|execute|exec|raw)$/iu;
+function interpolation(node) {
+    if (ts.isStringLiteralLike(node)) {
+        return node.text;
+    }
+    return ts.isCallExpression(node) && node.arguments.every(ts.isStringLiteralLike)
+        ? node.arguments
+            .filter(ts.isStringLiteralLike)
+            .map((argument) => argument.text)
+            .join(".")
+        : " ? ";
+}
+function templateText(node) {
+    return ts.isNoSubstitutionTemplateLiteral(node)
+        ? node.text
+        : node.head.text + node.templateSpans.map((span) => interpolation(span.expression) + span.literal.text).join("");
+}
+function textOf(expression) {
+    const node = unwrapped(expression);
+    if (ts.isStringLiteralLike(node)) {
+        return node.text;
+    }
+    if (ts.isTemplateExpression(node)) {
+        return templateText(node);
+    }
+    if (ts.isObjectLiteralExpression(node)) {
+        const query = node.properties.find((property) => ts.isPropertyAssignment(property) && property.name.getText() === "text");
+        return query !== undefined && ts.isPropertyAssignment(query) ? textOf(query.initializer) : undefined;
+    }
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+        return `${textOf(node.left) ?? " ? "}${textOf(node.right) ?? " ? "}`;
+    }
+    return undefined;
+}
+function queryAt(node, source) {
+    let text;
+    let explicit = false;
+    if (ts.isTaggedTemplateExpression(node)) {
+        text = templateText(node.template);
+        explicit = SQL_CALLEE.test(node.tag.getText(source));
+    }
+    else if (ts.isCallExpression(node)) {
+        text = node.arguments[0] === undefined ? undefined : textOf(node.arguments[0]);
+        explicit = SQL_CALLEE.test(node.expression.getText(source));
+    }
+    else if (ts.isVariableDeclaration(node) && node.initializer !== undefined) {
+        text = textOf(node.initializer);
+    }
+    return text !== undefined && (explicit || SQL_START.test(text)) ? text : undefined;
+}
+function queriesIn(file, source) {
+    const queries = [];
+    function visit(node) {
+        const text = queryAt(node, source);
+        if (text !== undefined) {
+            queries.push({ file, line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1, text });
+            return;
+        }
+        if (!ts.isTaggedTemplateExpression(node)) {
+            ts.forEachChild(node, visit);
+        }
+    }
+    visit(source);
+    return queries;
+}
+export async function sqlTexts(inputs) {
+    const code = inputs.sources.flatMap((file) => {
+        const source = parse(file);
+        return source === undefined ? [] : queriesIn(file.path, source);
+    });
+    const sql = await Promise.all(inputs.files
+        .filter((file) => file.endsWith(".sql"))
+        .map(async (file) => {
+        const text = inputs.sources.find((source) => source.path === file)?.text ?? (await inputs.readText(file));
+        if (text === undefined) {
+            throw new Error(`Cannot read SQL file ${file}. Restore the file or repair its read permissions.`);
+        }
+        return { file, line: 1, text };
+    }));
+    return [...code, ...sql];
+}
+//# sourceMappingURL=sqlText.js.map

package/dist/rules/stories/sqlText.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlText.js","sourceRoot":"","sources":["../../../src/rules/stories/sqlText.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQxC,MAAM,SAAS,GACd,qIAAqI,CAAC;AACvI,MAAM,UAAU,GAAG,oFAAoF,CAAC;AAExG,SAAS,aAAa,CAAC,IAAmB;IACzC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC;QAC/E,CAAC,CAAC,IAAI,CAAC,SAAS;aACb,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC;aAC9B,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;aAChC,IAAI,CAAC,GAAG,CAAC;QACZ,CAAC,CAAC,KAAK,CAAC;AACV,CAAC;AAED,SAAS,YAAY,CAAC,IAAwB;IAC7C,OAAO,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC;QAC9C,CAAC,CAAC,IAAI,CAAC,IAAI;QACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,MAAM,CAAC,UAAyB;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,MAAM,CAAC,CAAC;QAC1H,OAAO,KAAK,KAAK,SAAS,IAAI,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtG,CAAC;IACD,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QACxF,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,IAAa,EAAE,MAAqB;IACpD,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC7E,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,IAAI,KAAK,SAAS,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,MAAqB;IACrD,MAAM,OAAO,GAAc,EAAE,CAAC;IAC9B,SAAS,KAAK,CAAC,IAAa;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACzG,OAAO;QACR,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,CAAC;IACd,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAkB;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,MAAM,CAAC,KAAK;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACvC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1G,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,oDAAoD,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC,CACH,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;AAC1B,CAAC"}

package/dist/rules/stories/supportImports.d.ts

@@ -0,0 +1,4 @@
+export declare const supportImports: import("#rule.ts").Rule<"tests/support-imports", {
+    readonly modules?: readonly string[];
+}>;
+//# sourceMappingURL=supportImports.d.ts.map

package/dist/rules/stories/supportImports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supportImports.d.ts","sourceRoot":"","sources":["../../../src/rules/stories/supportImports.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc;;EAoBzB,CAAC"}

package/dist/rules/stories/supportImports.js

@@ -0,0 +1,28 @@
+import { Effect, Schema } from "effect";
+import { importGraph } from "#imports/graph.ts";
+import { isTestSupport } from "#naming/testName.ts";
+import { defineRule } from "#rule.ts";
+import { matchesAny } from "./matchesAny.js";
+const SupportImportsOptions = Schema.Struct({
+    modules: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+});
+export const supportImports = defineRule({
+    check: async ({ options, ...inputs }) => {
+        if (!inputs.sources.some((file) => isTestSupport(file.path))) {
+            return [];
+        }
+        const graph = await importGraph(inputs);
+        return graph.edges
+            .filter((edge) => isTestSupport(edge.from) && edge.to.kind === "file" && !isTestSupport(edge.to.path) && !matchesAny(edge.to.path, options.modules))
+            .map((edge) => ({
+            file: edge.from,
+            line: edge.line,
+            message: `Test-support imports "${edge.specifier}" outside its allowed public surface. Drive the app through its host, schemas or queue definitions; list those public module paths in tests/support-imports.options.modules in the repository's quality config.`,
+            subject: edge.specifier,
+        }));
+    },
+    description: "Test-support reaches repository modules only through the public surface named by the repository's module allowlist.",
+    id: "tests/support-imports",
+    options: Schema.toStandardSchemaV1(SupportImportsOptions, { parseOptions: { errors: "all", onExcessProperty: "error" } }),
+});
+//# sourceMappingURL=supportImports.js.map

package/dist/rules/stories/supportImports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supportImports.js","sourceRoot":"","sources":["../../../src/rules/stories/supportImports.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;CAC5F,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;IACxC,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE;QACvC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9D,OAAO,EAAE,CAAC;QACX,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,KAAK;aAChB,MAAM,CACN,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAC3I;aACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,iNAAiN;YACjQ,OAAO,EAAE,IAAI,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,WAAW,EAAE,qHAAqH;IAClI,EAAE,EAAE,uBAAuB;IAC3B,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;CACzH,CAAC,CAAC"}

package/dist/rules/stories/syntax.d.ts

@@ -0,0 +1,11 @@
+import ts from "typescript";
+import type { Finding, SourceFile } from "#rule.ts";
+export declare function isSpec(path: string): boolean;
+export declare function unwrapped(node: ts.Expression): ts.Expression;
+export declare function memberName(node: ts.Expression): string | undefined;
+export declare function numericValue(node: ts.Expression): number | undefined;
+export declare function findingAt(source: ts.SourceFile, node: ts.Node, message: string): Finding;
+export declare function nodesWhere(source: ts.SourceFile, accepts: (node: ts.Node) => boolean): readonly ts.Node[];
+export declare function topLevelHelpers(source: ts.SourceFile): readonly ts.Node[];
+export declare function syntaxFindings(file: SourceFile, select: (source: ts.SourceFile) => readonly ts.Node[], message: string): readonly Finding[];
+//# sourceMappingURL=syntax.d.ts.map

package/dist/rules/stories/syntax.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syntax.d.ts","sourceRoot":"","sources":["../../../src/rules/stories/syntax.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGpD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAI5D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAMlE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAUpE;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAExF;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,GAAG,SAAS,EAAE,CAAC,IAAI,EAAE,CAUzG;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC,IAAI,EAAE,CAYzE;AAaD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAG3I"}

package/dist/rules/stories/syntax.js

@@ -0,0 +1,71 @@
+import ts from "typescript";
+import { isTestSupport, testName } from "#naming/testName.ts";
+import { parse } from "#rules/syntax.ts";
+export function isSpec(path) {
+    return testName(path)?.kind === "spec" && !isTestSupport(path);
+}
+export function unwrapped(node) {
+    return ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isNonNullExpression(node)
+        ? unwrapped(node.expression)
+        : node;
+}
+export function memberName(node) {
+    const value = unwrapped(node);
+    if (ts.isPropertyAccessExpression(value)) {
+        return value.name.text;
+    }
+    return ts.isElementAccessExpression(value) && ts.isStringLiteralLike(value.argumentExpression) ? value.argumentExpression.text : undefined;
+}
+export function numericValue(node) {
+    const value = unwrapped(node);
+    if (ts.isNumericLiteral(value)) {
+        return Number(value.text);
+    }
+    if (ts.isPrefixUnaryExpression(value) && (value.operator === ts.SyntaxKind.MinusToken || value.operator === ts.SyntaxKind.PlusToken)) {
+        const operand = numericValue(value.operand);
+        return operand === undefined ? undefined : operand * (value.operator === ts.SyntaxKind.MinusToken ? -1 : 1);
+    }
+    return undefined;
+}
+export function findingAt(source, node, message) {
+    return { file: source.fileName, line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1, message };
+}
+export function nodesWhere(source, accepts) {
+    const found = [];
+    function visit(node) {
+        if (accepts(node)) {
+            found.push(node);
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(source);
+    return found;
+}
+export function topLevelHelpers(source) {
+    return source.statements.flatMap((statement) => {
+        if (ts.isFunctionDeclaration(statement)) {
+            return statement.body === undefined ? [] : [statement.name ?? statement];
+        }
+        return ts.isVariableStatement(statement)
+            ? statement.declarationList.declarations.flatMap((declaration) => {
+                const value = declaration.initializer === undefined ? undefined : unwrapped(declaration.initializer);
+                return value !== undefined && functionValue(value) ? [declaration.name] : [];
+            })
+            : [];
+    });
+}
+function functionValue(value) {
+    const node = unwrapped(value);
+    if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) {
+        return true;
+    }
+    if (!ts.isCallExpression(node)) {
+        return false;
+    }
+    return ["fn", "fnUntraced"].includes(memberName(node.expression) ?? "") || (ts.isCallExpression(node.expression) && functionValue(node.expression));
+}
+export function syntaxFindings(file, select, message) {
+    const source = parse(file);
+    return source === undefined ? [] : select(source).map((node) => findingAt(source, node, message));
+}
+//# sourceMappingURL=syntax.js.map

package/dist/rules/stories/syntax.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syntax.js","sourceRoot":"","sources":["../../../src/rules/stories/syntax.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,MAAM,UAAU,MAAM,CAAC,IAAY;IAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC5C,OAAO,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACrI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5B,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC7C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,CAAC,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5I,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtI,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAqB,EAAE,IAAa,EAAE,OAAe;IAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAqB,EAAE,OAAmC;IACpF,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,SAAS,KAAK,CAAC,IAAa;QAC3B,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,CAAC;IACd,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB;IACpD,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAU,CAAC,SAAS,EAAE,EAAE;QACvD,IAAI,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,OAAO,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;gBAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;gBACrG,OAAO,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAoB;IAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACrJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,MAAqD,EAAE,OAAe;IACtH,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACnG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/quality",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "description": "Repository quality gate with typed rules, a baseline of existing debt and a registry of reasoned exceptions",
   "homepage": "https://github.com/ShivaeDev/platform/tree/main/packages/quality#readme",
   "bugs": {

package/src/rules/builtIn.ts

@@ -16,8 +16,16 @@ import { importsManifest } from "#rules/imports/manifest.ts";
 import { noTestCode } from "#rules/imports/noTestCode.ts";
 import { importsResolvable } from "#rules/imports/resolvable.ts";
 import { importsRuntime } from "#rules/imports/runtime.ts";
+import { authSql } from "#rules/stories/authSql.ts";
+import { httpStatus } from "#rules/stories/httpStatus.ts";
+import { namedValues } from "#rules/stories/namedValues.ts";
+import { noExpect } from "#rules/stories/noExpect.ts";
+import { noLimitImports } from "#rules/stories/noLimitImports.ts";
+import { queueSql } from "#rules/stories/queueSql.ts";
 import { storySetup } from "#rules/stories/setup.ts";
+import { specHelpers } from "#rules/stories/specHelpers.ts";
 import { storySpecs } from "#rules/stories/specs.ts";
+import { supportImports } from "#rules/stories/supportImports.ts";
 import { biomeOverrides } from "#rules/suppressions/biomeOverrides.ts";
 import { biomeRecommended } from "#rules/suppressions/biomeRecommended.ts";
 import { noDoubleCast } from "#rules/suppressions/noDoubleCast.ts";
@@ -66,4 +74,12 @@ export const builtInRules = [
 	testsColocated,
 	storySetup,
 	storySpecs,
+	queueSql,
+	authSql,
+	noExpect,
+	specHelpers,
+	supportImports,
+	httpStatus,
+	namedValues,
+	noLimitImports,
 ] as const;

package/src/rules/stories/authSql.ts

@@ -0,0 +1,117 @@
+import { Effect, Schema } from "effect";
+import { defineRule } from "#rule.ts";
+import { matchesAny } from "./matchesAny.ts";
+import { sqlTexts } from "./sqlText.ts";
+
+const AuthSqlOptions = Schema.Struct({
+	owners: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+});
+
+const TOKENS = /--[^\n]*|\/\*[\s\S]*?\*\/|'(?:''|[^'])*'|"(?:""|[^"])*"|[\w$]+|[.,;()]/gu;
+const TABLE_START = new Set(["from", "join", "update", "into", "table", "truncate", "references", "using"]);
+const TABLE_END = new Set(["where", "group", "order", "having", "limit", "returning", "set", "values", "on", ";"]);
+const SKIP = new Set(["if", "not", "exists", "only", "table"]);
+const AUTH_TABLES = new Set(["user", "account", "session", "verification"]);
+const EXPRESSION_FROM = new Set(["extract", "overlay", "substring", "trim"]);
+const NON_TABLE_TARGETS = new Set([
+	"all",
+	"database",
+	"domain",
+	"foreign",
+	"function",
+	"language",
+	"large",
+	"parameter",
+	"procedure",
+	"routine",
+	"schema",
+	"sequence",
+	"tablespace",
+	"type",
+]);
+
+function tableAt(tokens: readonly string[], index: number): string {
+	let next = index;
+	while (SKIP.has(tokens[next]?.toLowerCase() ?? "")) {
+		const only = tokens[next]?.toLowerCase() === "only";
+		next += 1;
+		if (only && tokens[next] === "(") {
+			next += 1;
+		}
+	}
+	while (tokens[next + 1] === ".") {
+		next += 2;
+	}
+	return (tokens[next] ?? "").replaceAll('"', "").toLowerCase();
+}
+
+function tableBoundary(tokens: readonly string[], index: number, statementStart: number, fromIsTable: boolean) {
+	const word = tokens[index]?.toLowerCase() ?? "";
+	const permissions = ["grant", "revoke"].includes(tokens[statementStart]?.toLowerCase() ?? "");
+	const roleTarget = permissions && (word === "to" || word === "from");
+	const permissionTarget = permissions && word === "on" && !NON_TABLE_TARGETS.has(tokens[index + 1]?.toLowerCase() ?? "");
+	const indexTarget = word === "on" && tokens.slice(statementStart, index).some((part) => part.toLowerCase() === "index");
+	const tableClause = TABLE_START.has(word) && (word !== "from" || fromIsTable);
+	return {
+		ends: TABLE_END.has(word) || roleTarget,
+		starts: !roleTarget && (tableClause || indexTarget || permissionTarget),
+	};
+}
+
+interface SqlContext {
+	depth: number;
+	readonly expressionFromDepths: Set<number>;
+	statementStart: number;
+	readonly tablesAtDepth: Set<number>;
+}
+
+function advanceContext(context: SqlContext, token: string, index: number, previous: string | undefined): void {
+	if (token === ";") {
+		context.statementStart = index + 1;
+		context.expressionFromDepths.clear();
+	}
+	if (token === "(") {
+		context.depth += 1;
+		if (EXPRESSION_FROM.has(previous?.toLowerCase() ?? "")) {
+			context.expressionFromDepths.add(context.depth);
+		}
+	}
+	if (token === ")") {
+		context.tablesAtDepth.delete(context.depth);
+		context.expressionFromDepths.delete(context.depth);
+		context.depth -= 1;
+	}
+}
+
+function authTableIn(text: string): boolean {
+	const tokens = [...text.matchAll(TOKENS)]
+		.map(([token]) => token)
+		.filter((token) => !(token.startsWith("--") || token.startsWith("/*") || token.startsWith("'")));
+	const context: SqlContext = { depth: 0, expressionFromDepths: new Set(), statementStart: 0, tablesAtDepth: new Set() };
+	return tokens.some((token, index) => {
+		advanceContext(context, token, index, tokens[index - 1]);
+		const boundary = tableBoundary(tokens, index, context.statementStart, !context.expressionFromDepths.has(context.depth));
+		if (boundary.ends) {
+			context.tablesAtDepth.delete(context.depth);
+		}
+		if (boundary.starts) {
+			context.tablesAtDepth.add(context.depth);
+		}
+		return (boundary.starts || (token === "," && context.tablesAtDepth.has(context.depth))) && AUTH_TABLES.has(tableAt(tokens, index + 1));
+	});
+}
+
+export const authSql = defineRule({
+	check: async ({ options, ...inputs }) =>
+		(await sqlTexts(inputs))
+			.filter((query) => !matchesAny(query.file, options.owners) && authTableIn(query.text))
+			.map((query) => ({
+				file: query.file,
+				line: query.line,
+				message:
+					"SQL accesses a Better Auth table (user, account, session or verification). Use platform's auth API; only platform's auth implementation and its migrations, named in the repository's auth-sql owners, own those tables.",
+			})),
+	description: "Apps use platform's auth API instead of querying or modifying Better Auth's tables.",
+	id: "boundaries/auth-sql",
+	options: Schema.toStandardSchemaV1(AuthSqlOptions, { parseOptions: { errors: "all", onExcessProperty: "error" } }),
+});

package/src/rules/stories/httpStatus.ts

@@ -0,0 +1,56 @@
+import { Effect, Schema } from "effect";
+import ts from "typescript";
+import { defineRule } from "#rule.ts";
+import { matchesAny } from "./matchesAny.ts";
+import { memberName, nodesWhere, numericValue, syntaxFindings, unwrapped } from "./syntax.ts";
+
+const MESSAGE =
+	"Branches on an HTTP error status outside the HTTP edge. Handle the typed domain error here and translate it to an HTTP status in the configured edge module.";
+
+const HttpStatusOptions = Schema.Struct({
+	edge: Schema.Array(Schema.String).pipe(Schema.withDecodingDefaultKey(Effect.succeed([]))),
+});
+
+const COMPARISONS = new Set([
+	ts.SyntaxKind.EqualsEqualsToken,
+	ts.SyntaxKind.EqualsEqualsEqualsToken,
+	ts.SyntaxKind.ExclamationEqualsToken,
+	ts.SyntaxKind.ExclamationEqualsEqualsToken,
+	ts.SyntaxKind.LessThanToken,
+	ts.SyntaxKind.LessThanEqualsToken,
+	ts.SyntaxKind.GreaterThanToken,
+	ts.SyntaxKind.GreaterThanEqualsToken,
+]);
+
+function isErrorStatus(node: ts.Expression): boolean {
+	const number = numericValue(node);
+	return number !== undefined && number >= 400 && number <= 599;
+}
+
+function statusBranch(node: ts.Node): boolean {
+	if (ts.isBinaryExpression(node) && COMPARISONS.has(node.operatorToken.kind)) {
+		return (memberName(node.left) === "status" && isErrorStatus(node.right)) || (memberName(node.right) === "status" && isErrorStatus(node.left));
+	}
+	if (ts.isCaseClause(node) && isErrorStatus(node.expression) && ts.isCaseBlock(node.parent) && ts.isSwitchStatement(node.parent.parent)) {
+		return memberName(node.parent.parent.expression) === "status";
+	}
+	if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) && node.expression.name.text === "includes") {
+		const receiver = unwrapped(node.expression.expression);
+		return (
+			ts.isArrayLiteralExpression(receiver)
+			&& receiver.elements.some(isErrorStatus)
+			&& node.arguments.some((argument) => memberName(argument) === "status")
+		);
+	}
+	return false;
+}
+
+export const httpStatus = defineRule({
+	check: ({ sources, options }) =>
+		sources
+			.filter((file) => !matchesAny(file.path, options.edge))
+			.flatMap((file) => syntaxFindings(file, (source) => nodesWhere(source, statusBranch), MESSAGE)),
+	description: "HTTP status numbers belong at the repository's HTTP edge; domain code handles typed errors.",
+	id: "boundaries/http-status",
+	options: Schema.toStandardSchemaV1(HttpStatusOptions, { parseOptions: { errors: "all", onExcessProperty: "error" } }),
+});

package/src/rules/stories/matchesAny.ts

@@ -0,0 +1,5 @@
+import { matchesGlob } from "node:path";
+
+export function matchesAny(path: string, patterns: readonly string[]): boolean {
+	return patterns.some((pattern) => matchesGlob(path, pattern));
+}

package/src/rules/stories/namedValues.ts

@@ -0,0 +1,21 @@
+import ts from "typescript";
+import { defineRule } from "#rule.ts";
+import { isSpec, memberName, nodesWhere, numericValue, syntaxFindings } from "./syntax.ts";
+
+const MESSAGE =
+	"Passes a numeric literal to toBe or toHaveLength. Assert the observed items, or give the expected value a domain name before asserting it.";
+
+function numericAssertion(node: ts.Node): boolean {
+	return (
+		ts.isCallExpression(node)
+		&& ["toBe", "toHaveLength"].includes(memberName(node.expression) ?? "")
+		&& node.arguments.some((argument) => numericValue(argument) !== undefined)
+	);
+}
+
+export const namedValues = defineRule({
+	check: ({ sources }) =>
+		sources.filter((file) => isSpec(file.path)).flatMap((file) => syntaxFindings(file, (source) => nodesWhere(source, numericAssertion), MESSAGE)),
+	description: "Stories assert observed items or named values instead of bare counts and numbers.",
+	id: "tests/named-values",
+});

package/src/rules/stories/noExpect.ts

@@ -0,0 +1,39 @@
+import ts from "typescript";
+import { isTestSupport } from "#naming/testName.ts";
+import { defineRule } from "#rule.ts";
+import { memberName, nodesWhere, syntaxFindings, unwrapped } from "./syntax.ts";
+
+const MESSAGE =
+	"Calls expect in test-support. Return the engine's observed state from the verb and put the expectation in the spec; throw if an action cannot run.";
+
+function assertionReference(expression: ts.Expression, names: ReadonlySet<string>): boolean {
+	const node = unwrapped(expression);
+	if (ts.isIdentifier(node)) {
+		return names.has(node.text);
+	}
+	return (
+		memberName(node) === "expect"
+		|| ((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) && assertionReference(node.expression, names))
+	);
+}
+
+function assertionsIn(source: ts.SourceFile): readonly ts.Node[] {
+	const names = new Set(["expect"]);
+	for (const statement of source.statements) {
+		const bindings = ts.isImportDeclaration(statement) ? statement.importClause?.namedBindings : undefined;
+		if (bindings !== undefined && ts.isNamedImports(bindings)) {
+			for (const element of bindings.elements) {
+				if ((element.propertyName ?? element.name).text === "expect") {
+					names.add(element.name.text);
+				}
+			}
+		}
+	}
+	return nodesWhere(source, (node) => ts.isCallExpression(node) && assertionReference(node.expression, names));
+}
+
+export const noExpect = defineRule({
+	check: ({ sources }) => sources.filter((file) => isTestSupport(file.path)).flatMap((file) => syntaxFindings(file, assertionsIn, MESSAGE)),
+	description: "Test-support performs actions and exposes observations; specs own expectations.",
+	id: "tests/no-expect-in-support",
+});

package/src/rules/stories/noLimitImports.ts

@@ -0,0 +1,80 @@
+import ts from "typescript";
+import { defineRule } from "#rule.ts";
+import { isSpec, memberName, nodesWhere, syntaxFindings, unwrapped } from "./syntax.ts";
+
+const MESSAGE =
+	"Imports a MAX_* constant from a limits module. Tell a story about the observed behavior instead of asserting a copy of the implementation's cap.";
+
+const LIMITS_MODULE = /(?:^|[/#])limits(?:\.[cm]?[jt]s)?(?:\/|$)/u;
+const MAX_CONSTANT = /^MAX_/u;
+
+function literalLimitsImport(expression: ts.Expression): boolean {
+	const node = unwrapped(expression);
+	if (ts.isAwaitExpression(node)) {
+		return literalLimitsImport(node.expression);
+	}
+	return (
+		ts.isCallExpression(node)
+		&& node.expression.kind === ts.SyntaxKind.ImportKeyword
+		&& node.arguments[0] !== undefined
+		&& ts.isStringLiteralLike(node.arguments[0])
+		&& LIMITS_MODULE.test(node.arguments[0].text)
+	);
+}
+
+function capBinding(binding: ts.BindingElement): boolean {
+	if (binding.dotDotDotToken !== undefined) {
+		return false;
+	}
+	const name = binding.propertyName ?? binding.name;
+	if (ts.isComputedPropertyName(name)) {
+		return ts.isStringLiteralLike(name.expression) && MAX_CONSTANT.test(name.expression.text);
+	}
+	return (ts.isIdentifier(name) || ts.isStringLiteralLike(name)) && MAX_CONSTANT.test(name.text);
+}
+
+function capImports(source: ts.SourceFile): readonly ts.Node[] {
+	const namespaces = new Set<string>();
+	const imports = source.statements.flatMap((statement) => {
+		if (
+			!(ts.isImportDeclaration(statement) && ts.isStringLiteralLike(statement.moduleSpecifier) && LIMITS_MODULE.test(statement.moduleSpecifier.text))
+		) {
+			return [];
+		}
+		const bindings = statement.importClause?.namedBindings;
+		if (bindings !== undefined && ts.isNamespaceImport(bindings)) {
+			namespaces.add(bindings.name.text);
+		}
+		return bindings !== undefined && ts.isNamedImports(bindings)
+			? bindings.elements.filter((element) => MAX_CONSTANT.test((element.propertyName ?? element.name).text))
+			: [];
+	});
+	const dynamic = nodesWhere(source, ts.isVariableDeclaration).flatMap<ts.Node>((node) => {
+		if (!ts.isVariableDeclaration(node) || node.initializer === undefined || !literalLimitsImport(node.initializer)) {
+			return [];
+		}
+		if (ts.isIdentifier(node.name)) {
+			namespaces.add(node.name.text);
+			return [];
+		}
+		return ts.isObjectBindingPattern(node.name) ? node.name.elements.filter(capBinding) : [];
+	});
+	return [
+		...imports,
+		...dynamic,
+		...nodesWhere(
+			source,
+			(node) =>
+				(ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))
+				&& ts.isIdentifier(node.expression)
+				&& namespaces.has(node.expression.text)
+				&& MAX_CONSTANT.test(memberName(node) ?? ""),
+		),
+	];
+}
+
+export const noLimitImports = defineRule({
+	check: ({ sources }) => sources.filter((file) => isSpec(file.path)).flatMap((file) => syntaxFindings(file, capImports, MESSAGE)),
+	description: "Stories prove behavior instead of importing implementation caps from limits modules.",
+	id: "tests/no-limit-imports",
+});

package/src/rules/stories/queueSql.ts

@@ -0,0 +1,18 @@
+import { defineRule } from "#rule.ts";
+import { sqlTexts } from "./sqlText.ts";
+
+const QUEUE_SCHEMA = /\bpgboss\b"?\s*\./iu;
+
+export const queueSql = defineRule({
+	check: async (inputs) =>
+		(await sqlTexts(inputs))
+			.filter((query) => QUEUE_SCHEMA.test(query.text))
+			.map((query) => ({
+				file: query.file,
+				line: query.line,
+				message:
+					"SQL mentions pgboss. Use the app's public queue definitions and let workers process jobs; apps never edit or purge queue tables, and there is no queue-purge API by design.",
+			})),
+	description: "Apps never read, edit or purge pg-boss's private queue schema.",
+	id: "boundaries/queue-sql",
+});

package/src/rules/stories/specHelpers.ts

@@ -0,0 +1,10 @@
+import { defineRule } from "#rule.ts";
+import { isSpec, syntaxFindings, topLevelHelpers } from "./syntax.ts";
+
+const MESSAGE = "Declares a top-level helper in a spec. Move the action into the story kit's verbs or the setup into its traits in test-support/.";
+
+export const specHelpers = defineRule({
+	check: ({ sources }) => sources.filter((file) => isSpec(file.path)).flatMap((file) => syntaxFindings(file, topLevelHelpers, MESSAGE)),
+	description: "Specs state expectations; story-kit traits and verbs in test-support own helpers.",
+	id: "tests/spec-helpers",
+});