@dokebi/cli 0.4.1 → 0.4.26

package/dist/check/module-rules.js

@@ -0,0 +1,104 @@
+// D-0130: a module that contributes to a point (`defineModule({ contributes: [mcpTools] })`)
+// needs the plugin that owns the point in the project. At start core drops values that no
+// registered plugin collects (warn POINT_NOT_COLLECTED, so module tests without that plugin
+// keep working); check makes the missing plugin an error before verify reports done.
+//   module-point-not-installed  a point of `contributes` imported from an @dokebi/* plugin
+//                               package that is in node_modules but not installed in this
+//                               project (`dokebi add`), so the generated code never registers it
+// A package missing from node_modules is already missing-package on its import.
+import { field, nodes, property, } from './typescript.js';
+const text = (node) => node ? String(property(node, 'text') ?? '') : '';
+/**
+ * The points of every `defineModule({ contributes: [...] })` of the file whose `defineModule`
+ * comes from @dokebi/module, when the point is a name (or `ns.name`) imported from a package.
+ */
+export function modulePoints(file, kinds) {
+    if (!file.text.includes('defineModule') || !file.text.includes('contributes'))
+        return [];
+    const bindings = new Map();
+    const arrays = new Map();
+    for (const statement of nodes(file, 'statements')) {
+        if (statement.kind === kinds.ImportDeclaration) {
+            const specifier = field(statement, 'moduleSpecifier');
+            const clause = field(statement, 'importClause');
+            if (!specifier || !clause || property(clause, 'isTypeOnly') === true)
+                continue;
+            const from = text(specifier);
+            const named = field(clause, 'namedBindings');
+            const names = [
+                [field(clause, 'name'), undefined],
+                [named?.kind === kinds.NamespaceImport ? field(named, 'name') : undefined, undefined],
+                ...(named && named.kind !== kinds.NamespaceImport
+                    ? nodes(named, 'elements')
+                        .filter((element) => property(element, 'isTypeOnly') !== true)
+                        .map((element) => [
+                        field(element, 'name'),
+                        text(field(element, 'propertyName') ?? field(element, 'name')),
+                    ])
+                    : []),
+            ];
+            for (const [name, imported] of names)
+                if (name?.kind === kinds.Identifier)
+                    bindings.set(text(name), { specifier: from, ...(imported ? { imported } : {}) });
+        }
+        else if (statement.kind === kinds.VariableStatement) {
+            // `const points = [mcpTools]` … `contributes: points` (top-level arrays of the same file).
+            const list = field(statement, 'declarationList');
+            for (const declaration of list ? nodes(list, 'declarations') : []) {
+                const name = field(declaration, 'name');
+                const value = field(declaration, 'initializer');
+                if (name?.kind === kinds.Identifier && value?.kind === kinds.ArrayLiteralExpression)
+                    arrays.set(text(name), value);
+            }
+        }
+    }
+    // The local name of @dokebi/module's defineModule (an alias counts: `as dm`).
+    const define = new Set([...bindings]
+        .filter(([, binding]) => binding.imported === 'defineModule' && binding.specifier === '@dokebi/module')
+        .map(([name]) => name));
+    if (!define.size)
+        return [];
+    const found = [];
+    const origin = (element) => {
+        let root = element;
+        while (root?.kind === kinds.PropertyAccessExpression)
+            root = field(root, 'expression');
+        return root?.kind === kinds.Identifier ? bindings.get(text(root)) : undefined;
+    };
+    const visit = (node) => {
+        const callee = node.kind === kinds.CallExpression ? field(node, 'expression') : undefined;
+        const argument = callee ? nodes(node, 'arguments')[0] : undefined;
+        if (callee?.kind === kinds.Identifier &&
+            define.has(text(callee)) &&
+            argument?.kind === kinds.ObjectLiteralExpression) {
+            const properties = nodes(argument, 'properties');
+            const module = text(field(properties.find((item) => text(field(item, 'name')) === 'name') ?? argument, 'initializer'));
+            for (const item of properties) {
+                if (text(field(item, 'name')) !== 'contributes')
+                    continue;
+                let value = item.kind === kinds.ShorthandPropertyAssignment
+                    ? field(item, 'name')
+                    : field(item, 'initializer');
+                if (value?.kind === kinds.Identifier)
+                    value = arrays.get(text(value));
+                if (value?.kind !== kinds.ArrayLiteralExpression)
+                    continue;
+                for (const element of nodes(value, 'elements')) {
+                    const binding = origin(element);
+                    if (!binding)
+                        continue;
+                    found.push({
+                        node: element,
+                        module,
+                        point: file.text.slice(element.getStart(), element.end),
+                        specifier: binding.specifier,
+                    });
+                }
+            }
+        }
+        node.forEachChild(visit);
+        return undefined;
+    };
+    file.forEachChild(visit);
+    return found;
+}

package/dist/check/packages.d.ts

@@ -12,6 +12,14 @@ export declare function publicPaths(name: string, exports: unknown): string[];
 export declare class DokebiImports {
     #private;
     constructor(catalog: Catalog);
+    /**
+     * D-0130: the plugin of an `@dokebi/*` specifier that resolves from `file` (the catalog's id),
+     * or undefined (not a Dokebi plugin package, or not in node_modules: missing-package says so).
+     */
+    pluginOf(file: string, specifier: string): Promise<{
+        readonly id: string;
+        readonly package: string;
+    } | undefined>;
     /** The problem with one module specifier of `file`, if any. */
     verdict(file: string, specifier: string): Promise<ImportVerdict | undefined>;
 }

package/dist/check/packages.js

@@ -104,6 +104,22 @@ export class DokebiImports {
             this.#found.set(key, result);
         return result;
     }
+    /**
+     * D-0130: the plugin of an `@dokebi/*` specifier that resolves from `file` (the catalog's id),
+     * or undefined (not a Dokebi plugin package, or not in node_modules: missing-package says so).
+     */
+    async pluginOf(file, specifier) {
+        const match = PACKAGE.exec(specifier);
+        if (!match)
+            return undefined;
+        const name = `${SCOPE}${match[1]}`;
+        const known = this.#catalog.packages.find((item) => item.package === name);
+        if (!known?.id || known.kind === 'core' || known.kind === 'cli')
+            return undefined;
+        if (!(await this.#installed(file, name)))
+            return undefined;
+        return { id: known.id, package: name };
+    }
     /** The problem with one module specifier of `file`, if any. */
     async verdict(file, specifier) {
         const viaPath = /(^|\/)node_modules\/(@dokebi\/[^/]+)/.exec(specifier);

package/dist/check/pool-rules.d.ts

@@ -0,0 +1,8 @@
+import { type Kinds, type TsNode, type TsSourceFile } from './typescript.js';
+export type PoolReport = (node: TsNode, rule: 'private-pool' | 'overload-off' | 'readiness-off', message: string, fix: string) => void;
+export declare const PRIVATE_POOL_FIX = "take database connections from @dokebi/db: the configured one (context.getDependency(db).connection(main)), another pool to the same database for one kind of work (await context.getDependency(db).derive('main', { purpose: 'export', overrides: { max: 4 } }) in setup, closed by dokebi-db), or another database as one more connection in dokebi.yaml (dokebi-db.connections.<name>); its size and waitTimeoutMs then come from dokebi.yaml and a caller past the wait gets 503 DB_UNAVAILABLE with Retry-After. A connection that must stay outside (a LISTEN client) takes // dokebi-check: allow private-pool <reason>";
+export declare const OVERLOAD_OFF_FIX = "remove overload: false: under a burst the route then answers 503 OVERLOADED with Retry-After before its handler runs, and the client retries, instead of queueing behind a stalled worker (@dokebi/web AI.md 2.5; raise overload.maxEventLoopDelayMs in dokebi.yaml if it refuses too early). Only a metrics scrape or an operator status page stays served: // dokebi-check: allow overload-off <reason>";
+export declare const READINESS_OFF_FIX = "remove readiness: false: while a required dependency (a database, Redis) is down the route then answers 503 NOT_READY with Retry-After instead of running its handler against it (@dokebi/web AI.md). Only a metrics scrape or an operator status page, which must answer during an outage, keeps it: // dokebi-check: allow readiness-off <reason>";
+/** The adapters of @dokebi/db live here: the one place that makes pools. */
+export declare function isDatabaseInfra(path: string): boolean;
+export declare function poolRules(file: TsSourceFile, path: string, kinds: Kinds, report: PoolReport): void;

package/dist/check/pool-rules.js

@@ -0,0 +1,164 @@
+// The pool and overload rules of `dokebi check` (AI-M37), over the TypeScript AST:
+//   private-pool  (error) server code under src/ outside src/infra/db/ that makes a database
+//                 pool or client of its own with the driver: `new Pool`/`new Client` of pg,
+//                 `createPool`/`createConnection`/`createPoolCluster` of mysql2 and mariadb,
+//                 `new MongoClient` of mongodb. Such a pool escapes dokebi.yaml (its size, its
+//                 wait deadline waitTimeoutMs and the 503 with Retry-After past it), the
+//                 connection sum of @dokebi/db AI.md 1.2 and the cleanup at stop (M37: five pools
+//                 per worker with a 30 s wait held callers for 22-51 s instead of refusing).
+//                 Another pool to the same database is `derive(name, { purpose, overrides })`
+//                 of @dokebi/db; another database is one more connection in dokebi.yaml.
+//   overload-off  (error) a route config with `overload: false`: the route is served while the
+//                 server sheds load, so under a burst its callers queue behind a stalled event
+//                 loop instead of getting 503 OVERLOADED with Retry-After (@dokebi/web AI.md
+//                 2.5; M37 turned it off on public ticket intake). It is meant for a metrics
+//                 scrape or an operator's status page, which keep it with a marker.
+//   readiness-off (error) a route config with `readiness: false` (M51): the route is served
+//                 while a required dependency is down and while the app drains, so an API route
+//                 with it runs its handler against a missing database or Redis. Meant for the
+//                 same metrics or status routes, with a marker.
+// A `// dokebi-check: allow private-pool <reason>` (or `overload-off`, `readiness-off`) comment keeps a deliberate
+// one (a LISTEN/NOTIFY client that holds one connection, a metrics route).
+import { field } from './typescript.js';
+export const PRIVATE_POOL_FIX = "take database connections from @dokebi/db: the configured one (context.getDependency(db).connection(main)), another pool to the same database for one kind of work (await context.getDependency(db).derive('main', { purpose: 'export', overrides: { max: 4 } }) in setup, closed by dokebi-db), or another database as one more connection in dokebi.yaml (dokebi-db.connections.<name>); its size and waitTimeoutMs then come from dokebi.yaml and a caller past the wait gets 503 DB_UNAVAILABLE with Retry-After. A connection that must stay outside (a LISTEN client) takes // dokebi-check: allow private-pool <reason>";
+export const OVERLOAD_OFF_FIX = 'remove overload: false: under a burst the route then answers 503 OVERLOADED with Retry-After before its handler runs, and the client retries, instead of queueing behind a stalled worker (@dokebi/web AI.md 2.5; raise overload.maxEventLoopDelayMs in dokebi.yaml if it refuses too early). Only a metrics scrape or an operator status page stays served: // dokebi-check: allow overload-off <reason>';
+export const READINESS_OFF_FIX = 'remove readiness: false: while a required dependency (a database, Redis) is down the route then answers 503 NOT_READY with Retry-After instead of running its handler against it (@dokebi/web AI.md). Only a metrics scrape or an operator status page, which must answer during an outage, keeps it: // dokebi-check: allow readiness-off <reason>';
+/** Driver modules and the members that make a pool or a client. */
+const DRIVERS = new Map([
+    ['pg', { constructors: new Set(['Pool', 'Client']), factories: new Set() }],
+    ['pg-pool', { constructors: new Set(['default', 'Pool']), factories: new Set() }],
+    [
+        'mysql2',
+        {
+            constructors: new Set(),
+            factories: new Set(['createPool', 'createConnection', 'createPoolCluster']),
+        },
+    ],
+    [
+        'mysql2/promise',
+        {
+            constructors: new Set(),
+            factories: new Set(['createPool', 'createConnection', 'createPoolCluster']),
+        },
+    ],
+    [
+        'mariadb',
+        {
+            constructors: new Set(),
+            factories: new Set(['createPool', 'createConnection', 'createPoolCluster']),
+        },
+    ],
+    ['mongodb', { constructors: new Set(['MongoClient']), factories: new Set() }],
+]);
+/** The adapters of @dokebi/db live here: the one place that makes pools. */
+export function isDatabaseInfra(path) {
+    return path.startsWith('src/infra/db/');
+}
+export function poolRules(file, path, kinds, report) {
+    const text = (node) => file.text.slice(node.getStart(), node.end);
+    if (!isDatabaseInfra(path))
+        privatePools(file, kinds, text, report);
+    if (/\b(?:overload|readiness)\s*:\s*false\b/.test(file.text))
+        routeOffSwitches(file, kinds, text, report);
+}
+function privatePools(file, kinds, text, report) {
+    // Most files import no driver: skip the walk.
+    if (!/['"](?:pg|pg-pool|mysql2|mysql2\/promise|mariadb|mongodb)['"]/.test(file.text))
+        return;
+    // Local names bound to a driver: a namespace or default import (`pg.Pool`), or a named member.
+    const modules = new Map();
+    const members = new Map();
+    for (const statement of file.statements) {
+        if (statement.kind !== kinds.ImportDeclaration)
+            continue;
+        const specifier = field(statement, 'moduleSpecifier');
+        if (specifier?.kind !== kinds.StringLiteral)
+            continue;
+        const module = specifier.text;
+        if (!DRIVERS.has(module))
+            continue;
+        const clause = field(statement, 'importClause');
+        if (!clause)
+            continue;
+        const own = field(clause, 'name');
+        if (own) {
+            // `import Pool from 'pg-pool'` is the class; `import pg from 'pg'` is the namespace.
+            if (module === 'pg-pool')
+                members.set(text(own), { module, member: 'default' });
+            else
+                modules.set(text(own), module);
+        }
+        const bindings = field(clause, 'namedBindings');
+        if (bindings?.kind === kinds.NamespaceImport) {
+            const name = field(bindings, 'name');
+            if (name)
+                modules.set(text(name), module);
+        }
+        else if (bindings?.kind === kinds.NamedImports) {
+            for (const element of bindings.elements) {
+                const local = field(element, 'name');
+                const imported = field(element, 'propertyName') ?? local;
+                if (local && imported)
+                    members.set(text(local), { module, member: text(imported) });
+            }
+        }
+    }
+    if (modules.size === 0 && members.size === 0)
+        return;
+    /** The driver member this expression names, through an import binding. */
+    const resolveMember = (node) => {
+        if (!node)
+            return undefined;
+        if (node.kind === kinds.Identifier)
+            return members.get(text(node));
+        if (node.kind === kinds.PropertyAccessExpression) {
+            const object = field(node, 'expression');
+            const name = field(node, 'name');
+            const module = object?.kind === kinds.Identifier ? modules.get(text(object)) : undefined;
+            if (module && name)
+                return { module, member: text(name) };
+        }
+        return undefined;
+    };
+    const visit = (node) => {
+        const isNew = node.kind === kinds.NewExpression;
+        if (isNew || node.kind === kinds.CallExpression) {
+            const found = resolveMember(field(node, 'expression'));
+            const driver = found ? DRIVERS.get(found.module) : undefined;
+            if (found && driver && (isNew ? driver.constructors : driver.factories).has(found.member)) {
+                const made = found.member === 'default' ? 'Pool' : found.member;
+                report(node, 'private-pool', `${isNew ? 'new ' : ''}${made}${isNew ? '' : '()'} of ${found.module} outside src/infra/db: a pool of its own escapes dokebi.yaml (its size and the wait deadline waitTimeoutMs that ends in 503 with Retry-After), the connection sum and the cleanup at stop (@dokebi/db AI.md 1.2; M37)`, PRIVATE_POOL_FIX);
+            }
+        }
+        node.forEachChild(visit);
+        return undefined;
+    };
+    file.forEachChild(visit);
+}
+/** `config: { overload: false }` and `config: { readiness: false }` of a route. */
+function routeOffSwitches(file, kinds, text, report) {
+    const named = (node, name) => {
+        const key = node ? field(node, 'name') : undefined;
+        return (key !== undefined &&
+            (key.kind === kinds.Identifier || key.kind === kinds.StringLiteral) &&
+            text(key).replace(/^['"]|['"]$/g, '') === name);
+    };
+    const visit = (node) => {
+        // `config: { overload: false }` of a route: an object literal under a `config` key.
+        const value = node.kind === kinds.PropertyAssignment ? field(node, 'initializer') : undefined;
+        if (named(node, 'config') && value?.kind === kinds.ObjectLiteralExpression) {
+            for (const property of value.properties) {
+                if (property.kind !== kinds.PropertyAssignment ||
+                    field(property, 'initializer')?.kind !== kinds.FalseKeyword)
+                    continue;
+                if (named(property, 'overload'))
+                    report(property, 'overload-off', 'overload: false serves this route while the server sheds load: under a burst its callers queue behind a stalled worker instead of getting 503 OVERLOADED with Retry-After (@dokebi/web AI.md 2.5; M37)', OVERLOAD_OFF_FIX);
+                else if (named(property, 'readiness'))
+                    report(property, 'readiness-off', 'readiness: false serves this route while a required dependency is down and while the app drains: its handler then runs against a missing database or Redis instead of the client getting 503 NOT_READY with Retry-After (M51)', READINESS_OFF_FIX);
+            }
+        }
+        node.forEachChild(visit);
+        return undefined;
+    };
+    file.forEachChild(visit);
+}

package/dist/check/problems.d.ts

@@ -1,9 +1,14 @@
-export declare const RULES: readonly ['empty-catch', 'floating-promise', 'non-erasable-syntax', 'private-import', 'generated-file', 'secret-in-config', 'missing-package', 'inertia-form-only'];
+export declare const RULES: readonly ['empty-catch', 'missing-cause', 'floating-promise', 'non-erasable-syntax', 'private-import', 'generated-file', 'secret-in-config', 'missing-package', 'inertia-form-only', 'form-without-csrf', 'csrf-exempt-unverified', 'plain-password-compare', 'unknown-error-code', 'mail-send-in-request', 'mail-secret-in-data', 'background-timer', 'polling-loop', 'responsibility-size', 'memory-filtered-page', 'untyped-browser-import', 'vite-dev-files', 'module-point-not-installed', 'formatter-migrations', 'formatter-generated', 'shared-state-memory', 'asset-in-views', 'asset-route', 'seal-head-copied', 'i18n-missing-key', 'i18n-layer-override', 'i18n-layer-missing', 'console-output', 'undeclared-section', 'template-fix-missing', 'wait-count-refusal', 'in-process-queue', 'private-pool', 'overload-off', 'readiness-off', 'fixed-owner-cap'];
 export type RuleName = (typeof RULES)[number];
 /** Rules a `// dokebi-check: allow <rule> <reason>` comment may silence (D-0072 §4, markers). */
 export declare const MARKABLE: ReadonlySet<RuleName>;
 /** Rules that warn: reported with `severity: 'warning'`, they do not fail check or verify. */
 export declare const WARNING_RULES: ReadonlySet<RuleName>;
+/**
+ * The rules that read browser code outside the program — .vue scripts and the .js under views/
+ * (browser-sources.ts, D-0120): the catch rules and floating promises.
+ */
+export declare const BROWSER_RULES: ReadonlySet<RuleName>;
 export interface Problem {
     readonly rule: RuleName;
     /** `warning` for a rule of WARNING_RULES (absent: an error that fails check). */

package/dist/check/problems.js

@@ -1,6 +1,15 @@
-// `dokebi check` problem shape and rule names (D-0072; inertia-form-only D-0074).
+// `dokebi check` problem shape and rule names (D-0072; inertia-form-only D-0074; the security
+// rules form-without-csrf, csrf-exempt-unverified and plain-password-compare D-0076 §6;
+// unknown-error-code D-0077 D; background-timer, responsibility-size and memory-filtered-page
+// D-0105; missing-cause D-0118; untyped-browser-import D-0120 §1.4; vite-dev-files D-0129;
+// module-point-not-installed D-0130; formatter-migrations D-0145 (formatter-generated R1); console-output D-0151;
+// undeclared-section D-0155; wait-count-refusal AI-M34, @dokebi/db AI.md 1.2 and 6.4; polling-loop
+// AI-M35, not markable; in-process-queue AI-M35; private-pool, overload-off and fixed-owner-cap AI-M37; readiness-off M51;
+// shared-state-memory D-0161; asset-in-views R1; asset-route R6; seal-head-copied R7;
+// i18n-missing-key community request A2; i18n-layer-override and i18n-layer-missing D-0181).
 export const RULES = [
     'empty-catch',
+    'missing-cause',
     'floating-promise',
     'non-erasable-syntax',
     'private-import',
@@ -8,15 +17,104 @@ export const RULES = [
     'secret-in-config',
     'missing-package',
     'inertia-form-only',
+    'form-without-csrf',
+    'csrf-exempt-unverified',
+    'plain-password-compare',
+    'unknown-error-code',
+    'mail-send-in-request',
+    'mail-secret-in-data',
+    'background-timer',
+    'polling-loop',
+    'responsibility-size',
+    'memory-filtered-page',
+    'untyped-browser-import',
+    'vite-dev-files',
+    'module-point-not-installed',
+    'formatter-migrations',
+    'formatter-generated',
+    'shared-state-memory',
+    'asset-in-views',
+    'asset-route',
+    'seal-head-copied',
+    'i18n-missing-key',
+    'i18n-layer-override',
+    'i18n-layer-missing',
+    'console-output',
+    'undeclared-section',
+    'template-fix-missing',
+    'wait-count-refusal',
+    'in-process-queue',
+    'private-pool',
+    'overload-off',
+    'readiness-off',
+    'fixed-owner-cap',
 ];
 /** Rules a `// dokebi-check: allow <rule> <reason>` comment may silence (D-0072 §4, markers). */
 export const MARKABLE = new Set([
     'empty-catch',
+    'missing-cause',
     'floating-promise',
     'inertia-form-only',
+    'form-without-csrf',
+    'csrf-exempt-unverified',
+    'plain-password-compare',
+    'unknown-error-code',
+    'mail-send-in-request',
+    'mail-secret-in-data',
+    'background-timer',
+    'responsibility-size',
+    'memory-filtered-page',
+    'untyped-browser-import',
+    'vite-dev-files',
+    'module-point-not-installed',
+    'asset-route',
+    'seal-head-copied',
+    'i18n-missing-key',
+    'console-output',
+    'wait-count-refusal',
+    'in-process-queue',
+    'private-pool',
+    'overload-off',
+    'readiness-off',
+    'fixed-owner-cap',
 ]);
 /** Rules that warn: reported with `severity: 'warning'`, they do not fail check or verify. */
-export const WARNING_RULES = new Set(['inertia-form-only']);
+export const WARNING_RULES = new Set([
+    'inertia-form-only',
+    'form-without-csrf',
+    'csrf-exempt-unverified',
+    'unknown-error-code',
+    'mail-send-in-request',
+    'mail-secret-in-data',
+    'responsibility-size',
+    'memory-filtered-page',
+    'untyped-browser-import',
+    'vite-dev-files',
+    'formatter-migrations',
+    'formatter-generated',
+    'asset-in-views',
+    'asset-route',
+    'seal-head-copied',
+    'i18n-missing-key',
+    'i18n-layer-override',
+    'i18n-layer-missing',
+    'console-output',
+    'undeclared-section',
+    'template-fix-missing',
+    'wait-count-refusal',
+    'in-process-queue',
+    'fixed-owner-cap',
+]);
+/**
+ * The rules that read browser code outside the program — .vue scripts and the .js under views/
+ * (browser-sources.ts, D-0120): the catch rules and floating promises.
+ */
+export const BROWSER_RULES = new Set([
+    'empty-catch',
+    'missing-cause',
+    'floating-promise',
+    'untyped-browser-import',
+]);
 export function byPlace(a, b) {
     return a.file.localeCompare(b.file) || a.line - b.line || a.rule.localeCompare(b.rule);
 }

package/dist/check/project-rules.d.ts

@@ -1,10 +1,30 @@
+import { type ConfigTarget } from '../configuration.js';
 import type { Inspection } from '../project-inspector.js';
 import type { Problem } from './problems.js';
 /**
- * Whether dokebi.yaml can end up in version control: git tracks it, or git does not ignore it.
- * Without git (or outside a repository) the project's .gitignore must list it.
+ * Whether the settings file (dokebi.yaml, or the one DOKEBI_CONFIG names) can end up in version
+ * control: git tracks it, or git does not ignore it. Without git (or outside a repository) the
+ * project's .gitignore must list it. A file outside the project is not in its repository.
  */
-export declare function configReachesGit(root: string): Promise<boolean>;
+export declare function configReachesGit(root: string, settings?: ConfigTarget): Promise<boolean>;
 /** 1-based line of `options.<plugin>.<path…>` in dokebi.yaml: its deepest existing key (0: none). */
 export declare function optionLine(source: string, path: readonly string[]): number;
+/**
+ * Values of dokebi.yaml that are URLs with a password (AI-M04 F9): the option path and its line.
+ * Plugins read connection URLs from dokebi.yaml (it has no environment references), so the URL is
+ * fine there while the file stays out of git; only the path is returned, never the value.
+ */
+export declare function passwordUrls(source: string): {
+    path: string[];
+    line: number;
+}[];
+/**
+ * Option paths (`[pluginId, …]`) whose schema marks the value secret (`writeOnly`, from
+ * `o.string({ secret: true })`) and that hold a value. A list of secrets is one path. Unions are
+ * followed branch by branch; only the paths are returned, never the values.
+ */
+export declare function schemaSecrets(options: unknown, plugins: readonly {
+    id: string;
+    schema: unknown;
+}[]): string[][];
 export declare function projectProblems(root: string, inspection: Inspection): Promise<Problem[]>;