@intentius/chant 0.0.1

package/src/lint/rules/evl001-non-literal-expression.test.ts

@@ -0,0 +1,158 @@
+import { describe, test, expect } from "bun:test";
+import * as ts from "typescript";
+import { evl001NonLiteralExpressionRule } from "./evl001-non-literal-expression";
+import type { LintContext } from "../rule";
+
+function createContext(code: string, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined };
+}
+
+describe("EVL001: non-literal-expression", () => {
+  test("rule metadata", () => {
+    expect(evl001NonLiteralExpressionRule.id).toBe("EVL001");
+    expect(evl001NonLiteralExpressionRule.severity).toBe("error");
+    expect(evl001NonLiteralExpressionRule.category).toBe("correctness");
+  });
+
+  test("allows string literal", () => {
+    const ctx = createContext(`new Bucket({ bucketName: "my-bucket" });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows numeric literal", () => {
+    const ctx = createContext(`new Queue({ maxSize: 100 });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows boolean literal", () => {
+    const ctx = createContext(`new Bucket({ versioning: true });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows identifier reference", () => {
+    const ctx = createContext(`new Bucket({ encryption: myEncryption });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows property access", () => {
+    const ctx = createContext(`new Bucket({ role: config.roleArn });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows object literal", () => {
+    const ctx = createContext(`new Bucket({ tags: { env: "prod" } });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows array literal", () => {
+    const ctx = createContext(`new Bucket({ items: [1, 2, 3] });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows template expression", () => {
+    const ctx = createContext("new Bucket({ name: `prefix-${suffix}` });");
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows tagged template", () => {
+    const ctx = createContext("new Bucket({ name: Sub`${AWS.StackName}-data` });");
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows binary expression", () => {
+    const ctx = createContext(`new Queue({ timeout: base + 10 });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows conditional expression", () => {
+    const ctx = createContext(`new Bucket({ versioning: isProd ? true : false });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows as cast", () => {
+    const ctx = createContext(`new Bucket({ name: value as string });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows new expression as value", () => {
+    const ctx = createContext(`new Outer({ inner: new Inner({}) });`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("flags function call", () => {
+    const ctx = createContext(`new Bucket({ name: getName() });`);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("EVL001");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("statically evaluable");
+  });
+
+  test("flags method call", () => {
+    const ctx = createContext(`new Bucket({ name: config.getName() });`);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("EVL001");
+  });
+
+  test("flags await expression", () => {
+    const ctx = createContext(`new Bucket({ data: await fetchData() });`);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("EVL001");
+  });
+
+  test("flags multiple violations", () => {
+    const ctx = createContext(`new Bucket({ a: foo(), b: bar() });`);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(2);
+  });
+
+  test("does not flag constructor with no arguments", () => {
+    const ctx = createContext(`new Bucket();`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("does not flag constructor with non-object argument", () => {
+    const ctx = createContext(`new SomeClass("string");`);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("does not flag inside Composite() factory callback", () => {
+    const ctx = createContext(`
+      const MyComp = Composite((props) => {
+        const role = new Role({
+          policies: props.policyStatements
+            ? props.policyStatements.map(s => ({ Effect: s.effect }))
+            : undefined,
+        });
+        return { role };
+      });
+    `);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("does not flag inside _.Composite() factory callback", () => {
+    const ctx = createContext(`
+      const MyComp = _.Composite((props) => {
+        const func = new _.Function({ name: props.name });
+        return { func };
+      });
+    `);
+    expect(evl001NonLiteralExpressionRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("still flags outside Composite() in same file", () => {
+    const ctx = createContext(`
+      const MyComp = Composite((props) => {
+        const role = new Role({ name: props.name });
+        return { role };
+      });
+      const bucket = new Bucket({ name: getName() });
+    `);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("EVL001");
+  });
+});

package/src/lint/rules/evl001-non-literal-expression.ts

@@ -0,0 +1,149 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic } from "../rule";
+import { isInsideCompositeFactory } from "./composite-scope";
+
+/**
+ * EVL001: Non-Literal Expression in Resource Constructor
+ *
+ * Resource constructor property values must be statically evaluable.
+ * Allowed: literals, identifiers, property access, object/array literals,
+ * template expressions, binary/unary/conditional, as/satisfies casts.
+ * Blocked: function calls, method calls, and other dynamic expressions.
+ */
+
+function isStaticallyEvaluable(node: ts.Node): boolean {
+  // Literals
+  if (
+    ts.isStringLiteral(node) ||
+    ts.isNumericLiteral(node) ||
+    ts.isNoSubstitutionTemplateLiteral(node) ||
+    node.kind === ts.SyntaxKind.TrueKeyword ||
+    node.kind === ts.SyntaxKind.FalseKeyword ||
+    node.kind === ts.SyntaxKind.NullKeyword ||
+    node.kind === ts.SyntaxKind.UndefinedKeyword
+  ) {
+    return true;
+  }
+
+  // Identifiers (variable references)
+  if (ts.isIdentifier(node)) return true;
+
+  // Property access: obj.prop
+  if (ts.isPropertyAccessExpression(node)) {
+    return isStaticallyEvaluable(node.expression);
+  }
+
+  // Element access with static key: obj["key"] or obj[0]
+  if (ts.isElementAccessExpression(node)) {
+    return (
+      isStaticallyEvaluable(node.expression) &&
+      (ts.isStringLiteral(node.argumentExpression) ||
+        ts.isNumericLiteral(node.argumentExpression))
+    );
+  }
+
+  // Object literals — check all property values
+  if (ts.isObjectLiteralExpression(node)) {
+    return node.properties.every((prop) => {
+      if (ts.isPropertyAssignment(prop)) return isStaticallyEvaluable(prop.initializer);
+      if (ts.isShorthandPropertyAssignment(prop)) return true;
+      if (ts.isSpreadAssignment(prop)) return isStaticallyEvaluable(prop.expression);
+      return false;
+    });
+  }
+
+  // Array literals — check all elements
+  if (ts.isArrayLiteralExpression(node)) {
+    return node.elements.every((el) => isStaticallyEvaluable(el));
+  }
+
+  // Template expressions (tagged or untagged)
+  if (ts.isTemplateExpression(node)) return true;
+  if (ts.isTaggedTemplateExpression(node)) return true;
+
+  // Binary expressions: a + b, a ?? b, etc.
+  if (ts.isBinaryExpression(node)) {
+    return isStaticallyEvaluable(node.left) && isStaticallyEvaluable(node.right);
+  }
+
+  // Prefix unary: !x, -x
+  if (ts.isPrefixUnaryExpression(node)) {
+    return isStaticallyEvaluable(node.operand);
+  }
+
+  // Conditional: a ? b : c
+  if (ts.isConditionalExpression(node)) {
+    return (
+      isStaticallyEvaluable(node.condition) &&
+      isStaticallyEvaluable(node.whenTrue) &&
+      isStaticallyEvaluable(node.whenFalse)
+    );
+  }
+
+  // Type assertions: x as T, x satisfies T
+  if (ts.isAsExpression(node) || ts.isSatisfiesExpression(node)) {
+    return isStaticallyEvaluable(node.expression);
+  }
+
+  // Parenthesized expression
+  if (ts.isParenthesizedExpression(node)) {
+    return isStaticallyEvaluable(node.expression);
+  }
+
+  // Non-null assertion: x!
+  if (ts.isNonNullExpression(node)) {
+    return isStaticallyEvaluable(node.expression);
+  }
+
+  // Spread element in arrays
+  if (ts.isSpreadElement(node)) {
+    return isStaticallyEvaluable(node.expression);
+  }
+
+  // new Expression (resource constructors) — allowed as property values
+  if (ts.isNewExpression(node)) return true;
+
+  // Everything else (call expressions, etc.) is not statically evaluable
+  return false;
+}
+
+function checkNode(node: ts.Node, context: LintContext, diagnostics: LintDiagnostic[]): void {
+  // Skip resource constructors inside Composite() factory callbacks
+  if (ts.isNewExpression(node) && !isInsideCompositeFactory(node)) {
+    if (node.arguments && node.arguments.length > 0) {
+      const firstArg = node.arguments[0];
+      if (ts.isObjectLiteralExpression(firstArg)) {
+        for (const prop of firstArg.properties) {
+          if (ts.isPropertyAssignment(prop)) {
+            if (!isStaticallyEvaluable(prop.initializer)) {
+              const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+                prop.initializer.getStart(context.sourceFile),
+              );
+              diagnostics.push({
+                file: context.filePath,
+                line: line + 1,
+                column: character + 1,
+                ruleId: "EVL001",
+                severity: "error",
+                message: `Non-literal expression in resource constructor property — value must be statically evaluable`,
+              });
+            }
+          }
+        }
+      }
+    }
+  }
+
+  ts.forEachChild(node, (child) => checkNode(child, context, diagnostics));
+}
+
+export const evl001NonLiteralExpressionRule: LintRule = {
+  id: "EVL001",
+  severity: "error",
+  category: "correctness",
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    checkNode(context.sourceFile, context, diagnostics);
+    return diagnostics;
+  },
+};

package/src/lint/rules/evl002-control-flow-resource.test.ts

@@ -0,0 +1,110 @@
+import { describe, test, expect } from "bun:test";
+import * as ts from "typescript";
+import { evl002ControlFlowResourceRule } from "./evl002-control-flow-resource";
+import type { LintContext } from "../rule";
+
+function createContext(code: string, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined };
+}
+
+describe("EVL002: control-flow-resource", () => {
+  test("rule metadata", () => {
+    expect(evl002ControlFlowResourceRule.id).toBe("EVL002");
+    expect(evl002ControlFlowResourceRule.severity).toBe("error");
+    expect(evl002ControlFlowResourceRule.category).toBe("correctness");
+  });
+
+  test("allows top-level resource constructor", () => {
+    const ctx = createContext(`export const bucket = new Bucket({ name: "x" });`);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("flags resource inside if statement", () => {
+    const ctx = createContext(`
+      if (isProd) {
+        const bucket = new Bucket({ name: "x" });
+      }
+    `);
+    const diags = evl002ControlFlowResourceRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("EVL002");
+    expect(diags[0].message).toContain("control flow");
+  });
+
+  test("flags resource inside for loop", () => {
+    const ctx = createContext(`
+      for (let i = 0; i < 3; i++) {
+        const bucket = new Bucket({ name: "x" });
+      }
+    `);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags resource inside for-of loop", () => {
+    const ctx = createContext(`
+      for (const x of items) {
+        const bucket = new Bucket({ name: x });
+      }
+    `);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags resource inside for-in loop", () => {
+    const ctx = createContext(`
+      for (const k in obj) {
+        const bucket = new Bucket({ name: k });
+      }
+    `);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags resource inside while loop", () => {
+    const ctx = createContext(`
+      while (true) {
+        const bucket = new Bucket({ name: "x" });
+      }
+    `);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags resource inside do-while loop", () => {
+    const ctx = createContext(`
+      do {
+        const bucket = new Bucket({ name: "x" });
+      } while (false);
+    `);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags resource inside switch statement", () => {
+    const ctx = createContext(`
+      switch (env) {
+        case "prod":
+          const bucket = new Bucket({ name: "x" });
+          break;
+      }
+    `);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags resource inside try block", () => {
+    const ctx = createContext(`
+      try {
+        const bucket = new Bucket({ name: "x" });
+      } catch (e) {}
+    `);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags nested control flow", () => {
+    const ctx = createContext(`
+      if (isProd) {
+        for (const x of items) {
+          const bucket = new Bucket({ name: "x" });
+        }
+      }
+    `);
+    expect(evl002ControlFlowResourceRule.check(ctx)).toHaveLength(1);
+  });
+});

package/src/lint/rules/evl002-control-flow-resource.ts

@@ -0,0 +1,61 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic } from "../rule";
+
+/**
+ * EVL002: Control Flow Wrapping Resources
+ *
+ * Resource constructors (NewExpression) must not appear inside
+ * control flow statements (if, for, while, switch, try, etc.).
+ * Resources must be unconditionally declared.
+ */
+
+const CONTROL_FLOW_KINDS = new Set([
+  ts.SyntaxKind.IfStatement,
+  ts.SyntaxKind.ForStatement,
+  ts.SyntaxKind.ForInStatement,
+  ts.SyntaxKind.ForOfStatement,
+  ts.SyntaxKind.WhileStatement,
+  ts.SyntaxKind.DoStatement,
+  ts.SyntaxKind.SwitchStatement,
+  ts.SyntaxKind.TryStatement,
+]);
+
+function isInsideControlFlow(node: ts.Node): boolean {
+  let current = node.parent;
+  while (current) {
+    if (CONTROL_FLOW_KINDS.has(current.kind)) return true;
+    current = current.parent;
+  }
+  return false;
+}
+
+function checkNode(node: ts.Node, context: LintContext, diagnostics: LintDiagnostic[]): void {
+  if (ts.isNewExpression(node)) {
+    if (isInsideControlFlow(node)) {
+      const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+        node.getStart(context.sourceFile),
+      );
+      diagnostics.push({
+        file: context.filePath,
+        line: line + 1,
+        column: character + 1,
+        ruleId: "EVL002",
+        severity: "error",
+        message: "Resource constructor inside control flow — resources must be unconditionally declared",
+      });
+    }
+  }
+
+  ts.forEachChild(node, (child) => checkNode(child, context, diagnostics));
+}
+
+export const evl002ControlFlowResourceRule: LintRule = {
+  id: "EVL002",
+  severity: "error",
+  category: "correctness",
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    checkNode(context.sourceFile, context, diagnostics);
+    return diagnostics;
+  },
+};

package/src/lint/rules/evl003-dynamic-property-access.test.ts

@@ -0,0 +1,63 @@
+import { describe, test, expect } from "bun:test";
+import * as ts from "typescript";
+import { evl003DynamicPropertyAccessRule } from "./evl003-dynamic-property-access";
+import type { LintContext } from "../rule";
+
+function createContext(code: string, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined };
+}
+
+describe("EVL003: dynamic-property-access", () => {
+  test("rule metadata", () => {
+    expect(evl003DynamicPropertyAccessRule.id).toBe("EVL003");
+    expect(evl003DynamicPropertyAccessRule.severity).toBe("error");
+    expect(evl003DynamicPropertyAccessRule.category).toBe("correctness");
+  });
+
+  test("allows dot property access", () => {
+    const ctx = createContext(`const x = obj.prop;`);
+    expect(evl003DynamicPropertyAccessRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows string literal key", () => {
+    const ctx = createContext(`const x = obj["key"];`);
+    expect(evl003DynamicPropertyAccessRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("allows numeric literal key", () => {
+    const ctx = createContext(`const x = arr[0];`);
+    expect(evl003DynamicPropertyAccessRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("flags variable key", () => {
+    const ctx = createContext(`const x = obj[key];`);
+    const diags = evl003DynamicPropertyAccessRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("EVL003");
+    expect(diags[0].message).toContain("Dynamic property access");
+  });
+
+  test("flags expression key", () => {
+    const ctx = createContext(`const x = obj[a + b];`);
+    expect(evl003DynamicPropertyAccessRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags function call key", () => {
+    const ctx = createContext(`const x = obj[getKey()];`);
+    expect(evl003DynamicPropertyAccessRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags template literal key", () => {
+    const ctx = createContext("const x = obj[`key-${i}`];");
+    expect(evl003DynamicPropertyAccessRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("flags multiple violations", () => {
+    const ctx = createContext(`
+      const a = obj[x];
+      const b = arr[y];
+    `);
+    expect(evl003DynamicPropertyAccessRule.check(ctx)).toHaveLength(2);
+  });
+});

package/src/lint/rules/evl003-dynamic-property-access.ts

@@ -0,0 +1,41 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic } from "../rule";
+
+/**
+ * EVL003: Dynamic Property Access
+ *
+ * Computed property access (obj[key]) must use a string or numeric literal key.
+ * Dynamic keys (variables, expressions) are not statically evaluable.
+ */
+
+function checkNode(node: ts.Node, context: LintContext, diagnostics: LintDiagnostic[]): void {
+  if (ts.isElementAccessExpression(node)) {
+    const arg = node.argumentExpression;
+    if (!ts.isStringLiteral(arg) && !ts.isNumericLiteral(arg)) {
+      const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+        node.getStart(context.sourceFile),
+      );
+      diagnostics.push({
+        file: context.filePath,
+        line: line + 1,
+        column: character + 1,
+        ruleId: "EVL003",
+        severity: "error",
+        message: "Dynamic property access — computed key must be a string or numeric literal",
+      });
+    }
+  }
+
+  ts.forEachChild(node, (child) => checkNode(child, context, diagnostics));
+}
+
+export const evl003DynamicPropertyAccessRule: LintRule = {
+  id: "EVL003",
+  severity: "error",
+  category: "correctness",
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    checkNode(context.sourceFile, context, diagnostics);
+    return diagnostics;
+  },
+};