@intentius/chant-lexicon-fly 0.16.0

package/src/lint/post-synth/fly-helpers.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared helpers for the fly post-synth checks. Not a check itself, so the
+ * generated barrel skips it (the scanner only picks up exported PostSynthChecks).
+ */
+
+/**
+ * Read an entity or property's constructor props. Nested Declarables
+ * (MachineConfig, MachineMount, Volume) stash their args under a non-enumerable
+ * `props`; a plain inline object carries them directly. Handle both so a check
+ * behaves the same whether the user authored `config: { image }` or
+ * `config: new MachineConfig({ image })`.
+ */
+export function readProps(value: unknown): Record<string, unknown> {
+  if (value && typeof value === "object") {
+    const nested = (value as { props?: unknown }).props;
+    if (nested && typeof nested === "object") return nested as Record<string, unknown>;
+    return value as Record<string, unknown>;
+  }
+  return {};
+}
+
+/** The entityType of a declarable, or undefined. */
+export function entityTypeOf(value: unknown): string | undefined {
+  return (value as { entityType?: string } | undefined)?.entityType;
+}

package/src/lint/post-synth/fly010-machine-requires-image.test.ts

@@ -0,0 +1,59 @@
+import { describe, test, expect } from "vitest";
+import type { Declarable } from "@intentius/chant";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { fly010 } from "./fly010-machine-requires-image";
+import { App, Machine, MachineConfig } from "../../generated/index";
+
+function ctx(...entries: Array<[string, unknown]>): PostSynthContext {
+  const entities = new Map(entries as Array<[string, Declarable]>);
+  return {
+    outputs: new Map(),
+    entities,
+    buildResult: { outputs: new Map(), entities, warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("FLY010: machine config requires an image", () => {
+  test("flags a machine whose config sets no image", () => {
+    const diags = fly010.check(
+      ctx(["web", new Machine({ config: new MachineConfig({ env: { PORT: "8080" } }) })]),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("FLY010");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("web");
+  });
+
+  test("passes a machine whose config sets an image (MachineConfig instance)", () => {
+    // The instance form nests its args under `.props`; the check must unwrap it
+    // rather than false-flagging a machine that does have an image.
+    const diags = fly010.check(
+      ctx(["web", new Machine({ config: new MachineConfig({ image: "nginx" }) })]),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("passes a machine whose config sets an image (plain inline object)", () => {
+    const diags = fly010.check(
+      ctx([
+        "web",
+        new Machine({ config: { image: "flyio/hellofly:latest" } as unknown as MachineConfig }),
+      ]),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("ignores non-machine entities and machines with no config", () => {
+    const diags = fly010.check(
+      ctx(
+        ["app", new App({ name: "my-app" })],
+        ["bare", new Machine({ name: "bare" })],
+      ),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("has the expected id", () => {
+    expect(fly010.id).toBe("FLY010");
+  });
+});

package/src/lint/post-synth/fly010-machine-requires-image.ts

@@ -0,0 +1,39 @@
+/**
+ * FLY010: Machine config must specify an image.
+ *
+ * A Machine cannot boot without a container image. The Machines API rejects a
+ * create request whose config omits `image`, so catch it at synth time with a
+ * clearer message.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readProps, entityTypeOf } from "./fly-helpers";
+
+export const fly010: PostSynthCheck = {
+  id: "FLY010",
+  description: "Machine config must specify an image — a Machine cannot boot without one",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (entityTypeOf(entity) !== "Fly::Machines::Machine") continue;
+
+      const config = readProps(entity).config;
+      if (!config) continue; // no config authored — a different concern
+
+      const image = readProps(config).image;
+      if (typeof image !== "string" || image.length === 0) {
+        diagnostics.push({
+          checkId: "FLY010",
+          severity: "error",
+          message: `Machine "${name}" config has no image — set config.image, e.g. image: "flyio/fastify-functions"`,
+          entity: name,
+          lexicon: "fly",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/fly011-mount-references-declared-volume.test.ts

@@ -0,0 +1,92 @@
+import { describe, test, expect } from "vitest";
+import type { Declarable } from "@intentius/chant";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { fly011 } from "./fly011-mount-references-declared-volume";
+import { App, Machine, MachineConfig, MachineMount, Volume } from "../../generated/index";
+
+/**
+ * Build a whole-stack PostSynthContext from entities keyed by logical name.
+ * FLY011 only reads `ctx.entities`, so the rest of the context is minimal.
+ */
+function ctx(...entries: Array<[string, unknown]>): PostSynthContext {
+  const entities = new Map(entries as Array<[string, Declarable]>);
+  return {
+    outputs: new Map(),
+    entities,
+    buildResult: { outputs: new Map(), entities, warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+describe("FLY011: mount references a declared volume", () => {
+  test("flags a machine mounting a volume declared nowhere in the stack", () => {
+    // Volume and machine are separate stack entities — the cross-file case.
+    const diags = fly011.check(
+      ctx(
+        ["app", new App({ name: "my-app" })],
+        ["data", new Volume({ name: "data", region: "iad", size_gb: 10 })],
+        [
+          "web",
+          new Machine({
+            config: new MachineConfig({
+              image: "nginx",
+              mounts: [new MachineMount({ volume: "cache", path: "/data" })],
+            }),
+          }),
+        ],
+      ),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("FLY011");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("web");
+    expect(diags[0].message).toContain("cache");
+  });
+
+  test("passes when the mount names a Volume declared in the stack", () => {
+    const diags = fly011.check(
+      ctx(
+        ["data", new Volume({ name: "data", region: "iad", size_gb: 10 })],
+        [
+          "web",
+          new Machine({
+            config: new MachineConfig({
+              image: "nginx",
+              mounts: [new MachineMount({ volume: "data", path: "/data" })],
+            }),
+          }),
+        ],
+      ),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("resolves a volume by its logical (declaration) name too", () => {
+    const diags = fly011.check(
+      ctx(
+        // No explicit `name` prop; the mount references the logical name.
+        ["cache", new Volume({ region: "iad", size_gb: 3 })],
+        [
+          "web",
+          new Machine({
+            config: new MachineConfig({
+              image: "nginx",
+              mounts: [new MachineMount({ volume: "cache", path: "/data" })],
+            }),
+          }),
+        ],
+      ),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not flag a machine without mounts", () => {
+    const diags = fly011.check(
+      ctx(["web", new Machine({ config: new MachineConfig({ image: "nginx" }) })]),
+    );
+    expect(diags).toHaveLength(0);
+  });
+
+  test("has the expected id", () => {
+    expect(fly011.id).toBe("FLY011");
+  });
+});

package/src/lint/post-synth/fly011-mount-references-declared-volume.ts

@@ -0,0 +1,61 @@
+/**
+ * FLY011: A machine mount must reference a declared volume.
+ *
+ * Every machine `config.mounts[].volume` must resolve to a `Volume` declared in
+ * the stack. A mount pointing at a volume that does not exist is rejected at
+ * apply time, so catch it at synth. This is a whole-stack check: it reads all
+ * entities in the build (`ctx.entities`), so the mount and the Volume can be
+ * declared in different files.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readProps, entityTypeOf } from "./fly-helpers";
+
+const MACHINE_ENTITY_TYPE = "Fly::Machines::Machine";
+const VOLUME_ENTITY_TYPE = "Fly::Machines::Volume";
+
+export const fly011: PostSynthCheck = {
+  id: "FLY011",
+  description: "A machine mount's volume must resolve to a Volume declared in the stack",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    // A mount can name a declared volume by the Volume's `name` or by its
+    // logical (declaration) name — collect both.
+    const declaredVolumes = new Set<string>();
+    for (const [logicalName, entity] of ctx.entities) {
+      if (entityTypeOf(entity) !== VOLUME_ENTITY_TYPE) continue;
+      declaredVolumes.add(logicalName);
+      const name = readProps(entity).name;
+      if (typeof name === "string" && name.length > 0) declaredVolumes.add(name);
+    }
+
+    for (const [machineName, entity] of ctx.entities) {
+      if (entityTypeOf(entity) !== MACHINE_ENTITY_TYPE) continue;
+      const config = readProps(entity).config;
+      if (!config) continue;
+      const mounts = readProps(config).mounts;
+      if (!Array.isArray(mounts)) continue;
+
+      for (const mount of mounts) {
+        const volume = readProps(mount).volume;
+        // Only a string names a volume by value. A Declarable/AttrRef is a live
+        // reference to a Volume that exists in the stack by construction, so it
+        // never dangles — skip it to avoid false positives.
+        if (typeof volume !== "string" || volume.length === 0) continue;
+        if (!declaredVolumes.has(volume)) {
+          diagnostics.push({
+            checkId: "FLY011",
+            severity: "error",
+            message: `Machine "${machineName}" mounts volume "${volume}", which is not declared as a Volume in the stack.`,
+            entity: machineName,
+            lexicon: "fly",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/index.ts

@@ -0,0 +1,9 @@
+// Code generated by chant generate. DO NOT EDIT.
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { fly010 } from "./fly010-machine-requires-image";
+import { fly011 } from "./fly011-mount-references-declared-volume";
+
+export const postSynthChecks: PostSynthCheck[] = [
+  fly010,
+  fly011,
+];

package/src/lint/rules/guest-sizing.ts

@@ -0,0 +1,100 @@
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import * as ts from "typescript";
+
+/**
+ * Fly guest presets, per `cpu_kind`.
+ *
+ * `cpus` is the set of valid CPU counts; `memory_mb` must be a multiple of 256
+ * within [minPerCpu * cpus, maxPerCpu * cpus]. Values mirror Fly's published
+ * guest presets (shared-cpu-Nx / performance-Nx): shared allows 256–2048 MB per
+ * CPU, performance allows 2048–8192 MB per CPU. The 256 MB step is the loosest
+ * safe multiple, so a valid config is never flagged; only clearly-invalid combos
+ * are. fly-go was not vendored in this tree to cross-check against, so this table
+ * is a documented representative set (a limitation, widen if Fly changes presets).
+ */
+const GUEST_PRESETS: Record<string, { cpus: Set<number>; minPerCpu: number; maxPerCpu: number }> = {
+  shared: { cpus: new Set([1, 2, 4, 8]), minPerCpu: 256, maxPerCpu: 2048 },
+  performance: { cpus: new Set([1, 2, 4, 8, 16]), minPerCpu: 2048, maxPerCpu: 8192 },
+};
+
+const MEMORY_STEP_MB = 256;
+
+/** Read a numeric property from an object literal, if present as a plain number literal. */
+function numberProp(obj: ts.ObjectLiteralExpression, key: string, sf: ts.SourceFile): number | undefined {
+  for (const prop of obj.properties) {
+    if (ts.isPropertyAssignment(prop) && prop.name.getText(sf) === key && ts.isNumericLiteral(prop.initializer)) {
+      return Number(prop.initializer.text);
+    }
+  }
+  return undefined;
+}
+
+/** Read a string property from an object literal, if present as a plain string literal. */
+function stringProp(obj: ts.ObjectLiteralExpression, key: string, sf: ts.SourceFile): string | undefined {
+  for (const prop of obj.properties) {
+    if (ts.isPropertyAssignment(prop) && prop.name.getText(sf) === key && ts.isStringLiteral(prop.initializer)) {
+      return prop.initializer.text;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * FLY002: Sane guest sizing
+ *
+ * A guest's `cpu_kind`, `cpus`, and `memory_mb` must be a valid combination per
+ * Fly's guest presets. An invalid combination is rejected at apply time.
+ */
+export const guestSizingRule: LintRule = {
+  id: "FLY002",
+  severity: "error",
+  category: "correctness",
+  description: "A guest's cpu_kind, cpus and memory_mb must be a valid Fly combination",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const { sourceFile } = context;
+    const diagnostics: LintDiagnostic[] = [];
+
+    function report(node: ts.Node, message: string): void {
+      const { line, character } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+      diagnostics.push({
+        file: sourceFile.fileName,
+        line: line + 1,
+        column: character + 1,
+        ruleId: "FLY002",
+        severity: "error",
+        message,
+      });
+    }
+
+    function visit(node: ts.Node): void {
+      // A guest is any object literal carrying a cpu_kind property (new MachineGuest({...})
+      // or an inline guest object).
+      if (ts.isObjectLiteralExpression(node)) {
+        const cpuKind = stringProp(node, "cpu_kind", sourceFile);
+        if (cpuKind !== undefined) {
+          const preset = GUEST_PRESETS[cpuKind];
+          if (!preset) {
+            report(node, `Invalid guest cpu_kind "${cpuKind}". Use "shared" or "performance".`);
+          } else {
+            const cpus = numberProp(node, "cpus", sourceFile);
+            const memoryMb = numberProp(node, "memory_mb", sourceFile);
+            if (cpus !== undefined && !preset.cpus.has(cpus)) {
+              report(node, `Invalid guest sizing: cpu_kind "${cpuKind}" does not allow ${cpus} cpus (valid: ${[...preset.cpus].join(", ")}).`);
+            } else if (cpus !== undefined && memoryMb !== undefined) {
+              const min = preset.minPerCpu * cpus;
+              const max = preset.maxPerCpu * cpus;
+              if (memoryMb % MEMORY_STEP_MB !== 0 || memoryMb < min || memoryMb > max) {
+                report(node, `Invalid guest sizing: ${cpuKind}/${cpus} cpu requires memory_mb between ${min} and ${max} in steps of ${MEMORY_STEP_MB}, got ${memoryMb}.`);
+              }
+            }
+          }
+        }
+      }
+      ts.forEachChild(node, visit);
+    }
+
+    visit(sourceFile);
+    return diagnostics;
+  },
+};

package/src/lint/rules/index.ts

@@ -0,0 +1,15 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+import { validRegionRule } from "./valid-region";
+import { guestSizingRule } from "./guest-sizing";
+import { noSecretLiteralsRule } from "./no-secret-literals";
+
+export { validRegionRule } from "./valid-region";
+export { guestSizingRule } from "./guest-sizing";
+export { noSecretLiteralsRule } from "./no-secret-literals";
+
+/** All lint rules provided by the fly lexicon. */
+export const rules: LintRule[] = [
+  validRegionRule,
+  guestSizingRule,
+  noSecretLiteralsRule,
+];

package/src/lint/rules/no-secret-literals.ts

@@ -0,0 +1,67 @@
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import * as ts from "typescript";
+
+/**
+ * Property names that carry a credential. Kept conservative on purpose — an
+ * inline value under one of these keys is very likely a real secret.
+ */
+const SECRET_KEY_PATTERN = /(?:^|[_-])(?:password|passwd|secret|token|api[_-]?key|apikey|access[_-]?key|secret[_-]?key|private[_-]?key|client[_-]?secret|credential|auth[_-]?token)(?:$|[_-])/i;
+
+/**
+ * Values that are references or placeholders, not literal secrets:
+ * shell/interpolation references ($FOO, ${FOO}), and secret-manager style
+ * references. These are skipped so a `secrets` reference is never flagged.
+ */
+const REFERENCE_VALUE_PATTERN = /^(?:\$\{?[A-Za-z0-9_]+\}?|(?:secret|ref|env|vault):\S+)$/;
+
+/**
+ * FLY004: No secret literals in machine config
+ *
+ * Flags secret values written inline in config (e.g. an env value under a
+ * credential-looking key). Secrets belong in `secrets` (apply-only) or a
+ * reference. The heuristic is conservative: it fires only when the property
+ * name looks like a credential AND the value is a plain string literal that is
+ * not a reference/placeholder, so a `secrets` reference (an identifier or
+ * `$FOO` placeholder) is not flagged.
+ */
+export const noSecretLiteralsRule: LintRule = {
+  id: "FLY004",
+  severity: "warning",
+  category: "security",
+  description: "Secret values must not be written inline — use secrets or a reference",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const { sourceFile } = context;
+    const diagnostics: LintDiagnostic[] = [];
+
+    function visit(node: ts.Node): void {
+      if (ts.isPropertyAssignment(node)) {
+        const rawName = node.name.getText(sourceFile).replace(/^["']|["']$/g, "");
+        const init = node.initializer;
+        const literal =
+          ts.isStringLiteral(init) || ts.isNoSubstitutionTemplateLiteral(init) ? init.text : undefined;
+
+        if (
+          literal !== undefined &&
+          literal.length >= 4 &&
+          SECRET_KEY_PATTERN.test(rawName) &&
+          !REFERENCE_VALUE_PATTERN.test(literal.trim())
+        ) {
+          const { line, character } = sourceFile.getLineAndCharacterOfPosition(init.getStart(sourceFile));
+          diagnostics.push({
+            file: sourceFile.fileName,
+            line: line + 1,
+            column: character + 1,
+            ruleId: "FLY004",
+            severity: "warning",
+            message: `Possible inline secret under "${rawName}". Move the value to \`secrets\` (apply-only) or use a reference instead of an inline literal.`,
+          });
+        }
+      }
+      ts.forEachChild(node, visit);
+    }
+
+    visit(sourceFile);
+    return diagnostics;
+  },
+};

package/src/lint/rules/rules.test.ts

@@ -0,0 +1,127 @@
+import { describe, test, expect } from "vitest";
+import * as ts from "typescript";
+import { validRegionRule } from "./valid-region";
+import { guestSizingRule } from "./guest-sizing";
+import { noSecretLiteralsRule } from "./no-secret-literals";
+import type { LintContext } from "@intentius/chant/lint/rule";
+
+function createContext(code: string, fileName = "infra.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(fileName, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath: fileName };
+}
+
+describe("Fly lint rules", () => {
+  describe("FLY001: valid region", () => {
+    test("flags an unknown region", () => {
+      const ctx = createContext(`new Machine({ region: "narnia", config: new MachineConfig({ image: "nginx" }) });`);
+      const diags = validRegionRule.check(ctx);
+      expect(diags).toHaveLength(1);
+      expect(diags[0].ruleId).toBe("FLY001");
+      expect(diags[0].severity).toBe("error");
+      expect(diags[0].message).toContain("narnia");
+    });
+
+    test("passes a known region", () => {
+      const ctx = createContext(`new Machine({ region: "iad", config: new MachineConfig({ image: "nginx" }) });`);
+      expect(validRegionRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("passes a known region on a Volume", () => {
+      const ctx = createContext(`new Volume({ name: "data", region: "lhr", size_gb: 10 });`);
+      expect(validRegionRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("ignores a non-literal region (reference/expression)", () => {
+      const ctx = createContext(`new Machine({ region: Fly.Region });`);
+      expect(validRegionRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("has correct metadata", () => {
+      expect(validRegionRule.id).toBe("FLY001");
+      expect(validRegionRule.severity).toBe("error");
+      expect(validRegionRule.category).toBe("correctness");
+    });
+  });
+
+  describe("FLY002: sane guest sizing", () => {
+    test("passes a valid shared combo", () => {
+      const ctx = createContext(`new MachineGuest({ cpu_kind: "shared", cpus: 1, memory_mb: 256 });`);
+      expect(guestSizingRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("passes a valid performance combo", () => {
+      const ctx = createContext(`new MachineGuest({ cpu_kind: "performance", cpus: 2, memory_mb: 4096 });`);
+      expect(guestSizingRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("flags an invalid cpu_kind", () => {
+      const ctx = createContext(`new MachineGuest({ cpu_kind: "turbo", cpus: 1, memory_mb: 256 });`);
+      const diags = guestSizingRule.check(ctx);
+      expect(diags).toHaveLength(1);
+      expect(diags[0].ruleId).toBe("FLY002");
+      expect(diags[0].message).toContain("turbo");
+    });
+
+    test("flags an invalid cpu count for the kind", () => {
+      const ctx = createContext(`new MachineGuest({ cpu_kind: "shared", cpus: 3, memory_mb: 512 });`);
+      const diags = guestSizingRule.check(ctx);
+      expect(diags).toHaveLength(1);
+      expect(diags[0].message).toContain("3 cpus");
+    });
+
+    test("flags a memory value out of range for the cpu count", () => {
+      const ctx = createContext(`new MachineGuest({ cpu_kind: "shared", cpus: 1, memory_mb: 8192 });`);
+      const diags = guestSizingRule.check(ctx);
+      expect(diags).toHaveLength(1);
+      expect(diags[0].message).toContain("memory_mb");
+    });
+
+    test("flags a memory value that is not a 256 MB multiple", () => {
+      const ctx = createContext(`new MachineGuest({ cpu_kind: "shared", cpus: 1, memory_mb: 300 });`);
+      expect(guestSizingRule.check(ctx)).toHaveLength(1);
+    });
+
+    test("has correct metadata", () => {
+      expect(guestSizingRule.id).toBe("FLY002");
+      expect(guestSizingRule.severity).toBe("error");
+      expect(guestSizingRule.category).toBe("correctness");
+    });
+  });
+
+  describe("FLY004: no secret literals", () => {
+    test("flags an inline secret literal under a credential key", () => {
+      const ctx = createContext(`new MachineConfig({ image: "nginx", env: { DB_PASSWORD: "s3cr3t-p@ss" } });`);
+      const diags = noSecretLiteralsRule.check(ctx);
+      expect(diags).toHaveLength(1);
+      expect(diags[0].ruleId).toBe("FLY004");
+      expect(diags[0].severity).toBe("warning");
+      expect(diags[0].message).toContain("DB_PASSWORD");
+    });
+
+    test("flags an inline api key", () => {
+      const ctx = createContext(`new MachineConfig({ env: { STRIPE_API_KEY: "sk_live_abcdef123456" } });`);
+      expect(noSecretLiteralsRule.check(ctx)).toHaveLength(1);
+    });
+
+    test("does not flag a reference to a secret", () => {
+      const ctx = createContext(`new MachineConfig({ env: { DB_PASSWORD: dbSecret } });`);
+      expect(noSecretLiteralsRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("does not flag an interpolation/placeholder value", () => {
+      const ctx = createContext(`new MachineConfig({ env: { DB_PASSWORD: "$DB_PASSWORD" } });`);
+      expect(noSecretLiteralsRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("does not flag non-credential keys", () => {
+      const ctx = createContext(`new MachineConfig({ env: { LOG_LEVEL: "info" } });`);
+      expect(noSecretLiteralsRule.check(ctx)).toHaveLength(0);
+    });
+
+    test("has correct metadata", () => {
+      expect(noSecretLiteralsRule.id).toBe("FLY004");
+      expect(noSecretLiteralsRule.severity).toBe("warning");
+      expect(noSecretLiteralsRule.category).toBe("security");
+    });
+  });
+});

package/src/lint/rules/valid-region.ts

@@ -0,0 +1,58 @@
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+import * as ts from "typescript";
+
+/**
+ * Known Fly.io region codes.
+ *
+ * Sourced from the representative region list mudflaps serves at
+ * `GET /v1/platform/regions` (mudflaps `internal/server/regions.go`), which
+ * mirrors fly-go's `GetRegions` wire shape. The generated Fly types (#737)
+ * type `region` as a plain `string`, so there is no generated enum to import;
+ * this static set is the closest stable list a unit test can check without a
+ * live platform. It is representative, not exhaustive — add codes as Fly adds
+ * regions.
+ */
+const KNOWN_REGIONS = new Set<string>([
+  "ams", "atl", "bog", "bos", "cdg", "den", "dfw", "ewr", "fra", "gru",
+  "hkg", "iad", "jnb", "lax", "lhr", "mad", "mia", "nrt", "ord", "scl",
+  "sea", "sin", "sjc", "syd", "yyz",
+]);
+
+/**
+ * FLY001: Valid Fly region
+ *
+ * A machine (or volume/IP) `region` must be a known Fly region code. An unknown
+ * region is rejected at apply time; catch it at build with a clearer message.
+ */
+export const validRegionRule: LintRule = {
+  id: "FLY001",
+  severity: "error",
+  category: "correctness",
+  description: "A region must be a known Fly region code",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const { sourceFile } = context;
+    const diagnostics: LintDiagnostic[] = [];
+
+    function visit(node: ts.Node): void {
+      if (ts.isPropertyAssignment(node) && node.name.getText(sourceFile) === "region") {
+        const init = node.initializer;
+        if (ts.isStringLiteral(init) && init.text.length > 0 && !KNOWN_REGIONS.has(init.text)) {
+          const { line, character } = sourceFile.getLineAndCharacterOfPosition(init.getStart(sourceFile));
+          diagnostics.push({
+            file: sourceFile.fileName,
+            line: line + 1,
+            column: character + 1,
+            ruleId: "FLY001",
+            severity: "error",
+            message: `Unknown Fly region "${init.text}". Use a known region code, e.g. iad, lhr, sjc, fra, syd.`,
+          });
+        }
+      }
+      ts.forEachChild(node, visit);
+    }
+
+    visit(sourceFile);
+    return diagnostics;
+  },
+};

package/src/lsp/completions.test.ts

@@ -0,0 +1,10 @@
+import { describe, expect, it } from "vitest";
+import { completions } from "./completions";
+
+describe("LSP completions", () => {
+  it("returns an array", () => {
+    // TODO: Replace with a real CompletionContext
+    const result = completions({} as any);
+    expect(Array.isArray(result)).toBe(true);
+  });
+});