@intentius/chant 0.124.13 → 0.124.14

package/dist/lint/rules/flat-declarations.js

@@ -0,0 +1,62 @@
+import * as ts from "typescript";
+import { isPropertyKindNew } from "./property-kind.js";
+/**
+ * COR001: No inline objects in Declarable constructors
+ *
+ * Detects inline object literals or array literals as property values
+ * in Declarable constructor arguments. All structure should be expressed
+ * through typed Declarable declarations, never inline object literals.
+ *
+ * Triggers on: new Bucket({ bucketEncryption: { serverSideEncryptionConfiguration: [...] } })
+ * Triggers on: new Bucket({ tags: [{ key: "env", value: "prod" }] })
+ * OK: new Bucket({ bucketName: "my-bucket", accessControl: "Private" })
+ * OK: new Bucket({ encryption: dataEncryption })
+ * OK: new TimeSeriesPanel({ fieldConfig: { defaults: { unit: "ms" } } }) when
+ *     the lexicon declares TimeSeriesPanel property-kind (chant #2957). A
+ *     property-kind declarable is itself a nested value inside a resource, so
+ *     the object literals it holds are already at the depth this rule asks for.
+ */
+function checkNode(node, context, diagnostics) {
+    // Check for NewExpression nodes (constructor calls)
+    if (ts.isNewExpression(node) && !isPropertyKindNew(node, context)) {
+        // Check if the first argument is an object literal
+        if (node.arguments && node.arguments.length > 0) {
+            const firstArg = node.arguments[0];
+            if (ts.isObjectLiteralExpression(firstArg)) {
+                // Check each property in the constructor argument
+                for (const property of firstArg.properties) {
+                    if (ts.isPropertyAssignment(property)) {
+                        const initializer = property.initializer;
+                        // Flag inline object literals
+                        // Flag array literals only if they contain inline objects/arrays
+                        if (ts.isObjectLiteralExpression(initializer) ||
+                            (ts.isArrayLiteralExpression(initializer) && initializer.elements.some(el => ts.isObjectLiteralExpression(el) || ts.isArrayLiteralExpression(el)))) {
+                            const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(initializer.getStart(context.sourceFile));
+                            diagnostics.push({
+                                file: context.filePath,
+                                line: line + 1,
+                                column: character + 1,
+                                ruleId: "COR001",
+                                severity: "warning",
+                                message: "Inline object in Declarable constructor — extract to a named 'const' with 'export'. Each config value should be its own Declarable.",
+                            });
+                        }
+                    }
+                }
+            }
+        }
+    }
+    // Recursively check child nodes
+    ts.forEachChild(node, child => checkNode(child, context, diagnostics));
+}
+export const flatDeclarationsRule = {
+    id: "COR001",
+    severity: "warning",
+    category: "style",
+    description: "Detects inline object literals in Declarable constructors — extract to named exports",
+    check(context) {
+        const diagnostics = [];
+        checkNode(context.sourceFile, context, diagnostics);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/index.js

@@ -0,0 +1,90 @@
+/**
+ * Core lint rules for chant projects (COR + EVL, and SYS001 for the `decide`
+ * activity's backends, #2828).
+ */
+export { flatDeclarationsRule } from "./flat-declarations.js";
+export { exportRequiredRule } from "./export-required.js";
+export { fileDeclarableLimitRule } from "./file-declarable-limit.js";
+export { singleConcernFileRule } from "./single-concern-file.js";
+export { declarableNamingConventionRule } from "./declarable-naming-convention.js";
+export { noUnusedDeclarableImportRule } from "./no-unused-declarable-import.js";
+export { noRedundantValueCastRule } from "./no-redundant-value-cast.js";
+export { noUnusedDeclarableRule } from "./no-unused-declarable.js";
+export { noCyclicDeclarableRefRule } from "./no-cyclic-declarable-ref.js";
+export { noRedundantTypeImportRule } from "./no-redundant-type-import.js";
+export { noStringRefRule } from "./no-string-ref.js";
+export { evl001NonLiteralExpressionRule } from "./evl001-non-literal-expression.js";
+export { evl002ControlFlowResourceRule } from "./evl002-control-flow-resource.js";
+export { evl003DynamicPropertyAccessRule } from "./evl003-dynamic-property-access.js";
+export { evl004SpreadNonConstRule } from "./evl004-spread-non-const.js";
+export { evl005ResourceBlockBodyRule } from "./evl005-resource-block-body.js";
+export { evl007InvalidSiblingsRule } from "./evl007-invalid-siblings.js";
+export { evl009CompositeNoConstantRule } from "./evl009-composite-no-constant.js";
+export { evl010CompositeNoTransformRule } from "./evl010-composite-no-transform.js";
+export { evl011SymbolicInTemplateRule } from "./evl011-symbolic-in-template.js";
+export { cor017CompositeNameMatchRule } from "./cor017-composite-name-match.js";
+export { cor018CompositePreferLexiconTypeRule } from "./cor018-composite-prefer-lexicon-type.js";
+export { cor021EnvLiteralNameRule } from "./cor021-env-literal-name.js";
+export { cor022ReceiptLeafRule, collectReceiptVariables, receiptFactoryCall } from "./cor022-receipt-leaf.js";
+export { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer.js";
+export { noLiteralKeyRule } from "./sys001-no-literal-key.js";
+export { isInsideCompositeFactory } from "./composite-scope.js";
+import { flatDeclarationsRule } from "./flat-declarations.js";
+import { exportRequiredRule } from "./export-required.js";
+import { fileDeclarableLimitRule } from "./file-declarable-limit.js";
+import { singleConcernFileRule } from "./single-concern-file.js";
+import { declarableNamingConventionRule } from "./declarable-naming-convention.js";
+import { noUnusedDeclarableImportRule } from "./no-unused-declarable-import.js";
+import { noRedundantValueCastRule } from "./no-redundant-value-cast.js";
+import { noUnusedDeclarableRule } from "./no-unused-declarable.js";
+import { noCyclicDeclarableRefRule } from "./no-cyclic-declarable-ref.js";
+import { noRedundantTypeImportRule } from "./no-redundant-type-import.js";
+import { noStringRefRule } from "./no-string-ref.js";
+import { evl001NonLiteralExpressionRule } from "./evl001-non-literal-expression.js";
+import { evl002ControlFlowResourceRule } from "./evl002-control-flow-resource.js";
+import { evl003DynamicPropertyAccessRule } from "./evl003-dynamic-property-access.js";
+import { evl004SpreadNonConstRule } from "./evl004-spread-non-const.js";
+import { evl005ResourceBlockBodyRule } from "./evl005-resource-block-body.js";
+import { evl007InvalidSiblingsRule } from "./evl007-invalid-siblings.js";
+import { evl009CompositeNoConstantRule } from "./evl009-composite-no-constant.js";
+import { evl010CompositeNoTransformRule } from "./evl010-composite-no-transform.js";
+import { evl011SymbolicInTemplateRule } from "./evl011-symbolic-in-template.js";
+import { cor017CompositeNameMatchRule } from "./cor017-composite-name-match.js";
+import { cor018CompositePreferLexiconTypeRule } from "./cor018-composite-prefer-lexicon-type.js";
+import { cor021EnvLiteralNameRule } from "./cor021-env-literal-name.js";
+import { cor022ReceiptLeafRule } from "./cor022-receipt-leaf.js";
+import { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer.js";
+import { noLiteralKeyRule } from "./sys001-no-literal-key.js";
+/**
+ * Load all core lint rules (COR + EVL + SYS001).
+ */
+export function loadCoreRules() {
+    return [
+        flatDeclarationsRule,
+        exportRequiredRule,
+        fileDeclarableLimitRule,
+        singleConcernFileRule,
+        declarableNamingConventionRule,
+        noUnusedDeclarableImportRule,
+        noRedundantValueCastRule,
+        noUnusedDeclarableRule,
+        noCyclicDeclarableRefRule,
+        noRedundantTypeImportRule,
+        noStringRefRule,
+        evl001NonLiteralExpressionRule,
+        evl002ControlFlowResourceRule,
+        evl003DynamicPropertyAccessRule,
+        evl004SpreadNonConstRule,
+        evl005ResourceBlockBodyRule,
+        evl007InvalidSiblingsRule,
+        evl009CompositeNoConstantRule,
+        evl010CompositeNoTransformRule,
+        evl011SymbolicInTemplateRule,
+        cor017CompositeNameMatchRule,
+        cor018CompositePreferLexiconTypeRule,
+        cor021EnvLiteralNameRule,
+        cor022ReceiptLeafRule,
+        cor024ReceiptSecretPointerRule,
+        noLiteralKeyRule,
+    ];
+}

package/dist/lint/rules/no-cyclic-declarable-ref.js

@@ -0,0 +1,138 @@
+import * as ts from "typescript";
+function isCapitalized(name) {
+    return name.length > 0 && name[0] === name[0].toUpperCase() && name[0] !== name[0].toLowerCase();
+}
+function getNewExpressionClassName(expr) {
+    if (ts.isIdentifier(expr.expression)) {
+        return expr.expression.text;
+    }
+    if (ts.isPropertyAccessExpression(expr.expression)) {
+        return expr.expression.name.text;
+    }
+    return undefined;
+}
+function collectExportedDeclarables(sourceFile) {
+    const declarables = [];
+    ts.forEachChild(sourceFile, (node) => {
+        if (!ts.isVariableStatement(node))
+            return;
+        const hasExport = node.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+        if (!hasExport)
+            return;
+        for (const decl of node.declarationList.declarations) {
+            if (!ts.isIdentifier(decl.name))
+                continue;
+            if (!decl.initializer)
+                continue;
+            if (!ts.isNewExpression(decl.initializer))
+                continue;
+            const className = getNewExpressionClassName(decl.initializer);
+            if (!className || !isCapitalized(className))
+                continue;
+            declarables.push({
+                name: decl.name.text,
+                node,
+                initializer: decl.initializer,
+            });
+        }
+    });
+    return declarables;
+}
+function collectReferencedDeclarables(initializerNode, declarableNames) {
+    const refs = new Set();
+    function visit(node) {
+        // Match property access like `role.arn` or plain identifier references
+        if (ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression)) {
+            if (declarableNames.has(node.expression.text)) {
+                refs.add(node.expression.text);
+            }
+        }
+        else if (ts.isIdentifier(node)) {
+            // Direct identifier reference (e.g., passing `bucket` as an argument)
+            if (declarableNames.has(node.text)) {
+                // Make sure it's not part of a property access we already handled
+                const parent = node.parent;
+                if (!parent || !ts.isPropertyAccessExpression(parent) || parent.expression !== node) {
+                    refs.add(node.text);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(initializerNode);
+    return refs;
+}
+function detectCycles(graph) {
+    const cycles = [];
+    const visited = new Set();
+    const recStack = new Set();
+    const path = [];
+    function dfs(node) {
+        visited.add(node);
+        recStack.add(node);
+        path.push(node);
+        const neighbors = graph[node] || [];
+        for (const neighbor of neighbors) {
+            if (!visited.has(neighbor)) {
+                dfs(neighbor);
+            }
+            else if (recStack.has(neighbor)) {
+                const cycleStartIndex = path.indexOf(neighbor);
+                const cycle = path.slice(cycleStartIndex);
+                cycles.push(cycle);
+            }
+        }
+        recStack.delete(node);
+        path.pop();
+    }
+    for (const node of Object.keys(graph)) {
+        if (!visited.has(node)) {
+            dfs(node);
+        }
+    }
+    return cycles;
+}
+export const noCyclicDeclarableRefRule = {
+    id: "COR011",
+    severity: "error",
+    category: "correctness",
+    description: "Detects circular references between declarables in the same file",
+    check(context) {
+        const diagnostics = [];
+        const declarables = collectExportedDeclarables(context.sourceFile);
+        if (declarables.length < 2)
+            return diagnostics;
+        const declarableNames = new Set(declarables.map((d) => d.name));
+        const declarableMap = new Map(declarables.map((d) => [d.name, d]));
+        // Build directed graph: A → B means A's constructor references B
+        const graph = {};
+        for (const decl of declarables) {
+            const refs = collectReferencedDeclarables(decl.initializer, declarableNames);
+            // Exclude self-references
+            refs.delete(decl.name);
+            graph[decl.name] = [...refs];
+        }
+        const cycles = detectCycles(graph);
+        // Track which nodes we've already reported to avoid duplicate diagnostics
+        const reported = new Set();
+        for (const cycle of cycles) {
+            // Create a canonical key for the cycle to deduplicate
+            const cycleKey = [...cycle].sort().join(",");
+            if (reported.has(cycleKey))
+                continue;
+            reported.add(cycleKey);
+            const cyclePath = [...cycle, cycle[0]].join(" \u2192 ");
+            const firstDecl = declarableMap.get(cycle[0]);
+            const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(firstDecl.node.getStart(context.sourceFile));
+            diagnostics.push({
+                file: context.filePath,
+                line: line + 1,
+                column: character + 1,
+                ruleId: "COR011",
+                severity: "error",
+                message: `Circular reference detected: ${cyclePath}. Break the cycle by restructuring your declarations.`,
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/no-redundant-type-import.js

@@ -0,0 +1,76 @@
+import * as ts from "typescript";
+/**
+ * COR012: no-redundant-type-import
+ *
+ * Flag `import type { X } from "@intentius/chant-pkg"` when a namespace import
+ * `import * as pkg from "@intentius/chant-pkg"` already exists — the type is
+ * accessible as `pkg.X`.
+ */
+export const noRedundantTypeImportRule = {
+    id: "COR012",
+    severity: "warning",
+    category: "style",
+    description: "Flags redundant type imports when a namespace import already provides access",
+    check(context) {
+        const diagnostics = [];
+        const sf = context.sourceFile;
+        // Pass 1: collect namespace imports from @intentius/chant* packages
+        // Map: module specifier → namespace alias
+        const namespaceImports = new Map();
+        for (const stmt of sf.statements) {
+            if (ts.isImportDeclaration(stmt) &&
+                ts.isStringLiteral(stmt.moduleSpecifier)) {
+                const modulePath = stmt.moduleSpecifier.text;
+                if (!modulePath.startsWith("@intentius/chant") && !modulePath.startsWith("@intentius/chant-lexicon-"))
+                    continue;
+                const clause = stmt.importClause;
+                if (clause && clause.namedBindings && ts.isNamespaceImport(clause.namedBindings)) {
+                    namespaceImports.set(modulePath, clause.namedBindings.name.text);
+                }
+            }
+        }
+        if (namespaceImports.size === 0)
+            return diagnostics;
+        // Pass 2: find type-only named imports from the same modules
+        for (const stmt of sf.statements) {
+            if (ts.isImportDeclaration(stmt) &&
+                ts.isStringLiteral(stmt.moduleSpecifier)) {
+                const modulePath = stmt.moduleSpecifier.text;
+                const alias = namespaceImports.get(modulePath);
+                if (alias === undefined)
+                    continue;
+                const clause = stmt.importClause;
+                if (!clause || !clause.isTypeOnly)
+                    continue;
+                if (!clause.namedBindings || !ts.isNamedImports(clause.namedBindings))
+                    continue;
+                const typeNames = clause.namedBindings.elements.map(e => e.name.text);
+                const qualifiedNames = typeNames.map(n => `${alias}.${n}`).join(", ");
+                const { line, character } = sf.getLineAndCharacterOfPosition(stmt.getStart(sf));
+                // Fix: remove the entire import line (including trailing newline)
+                const start = stmt.getFullStart();
+                const end = stmt.getEnd();
+                // Extend past trailing newline if present
+                const fullText = sf.getFullText();
+                let fixEnd = end;
+                if (fullText[fixEnd] === "\n")
+                    fixEnd++;
+                else if (fullText[fixEnd] === "\r" && fullText[fixEnd + 1] === "\n")
+                    fixEnd += 2;
+                diagnostics.push({
+                    file: context.filePath,
+                    line: line + 1,
+                    column: character + 1,
+                    ruleId: "COR012",
+                    severity: "warning",
+                    message: `Redundant type import — use ${qualifiedNames} instead. The namespace import already provides access to all exported types.`,
+                    fix: {
+                        range: [start, fixEnd],
+                        replacement: "",
+                    },
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/no-redundant-value-cast.js

@@ -0,0 +1,41 @@
+import * as ts from "typescript";
+/**
+ * COR015: no-redundant-value-cast
+ *
+ * Flag `as Value<...>` type assertions — AttrRef already implements Intrinsic,
+ * so it satisfies Value<T> without a cast.
+ *
+ * Triggers on: role.arn as Value<string>
+ * OK: role.arn (used directly)
+ */
+function checkNode(node, context, diagnostics) {
+    if (ts.isAsExpression(node)) {
+        const typeNode = node.type;
+        if (ts.isTypeReferenceNode(typeNode)) {
+            const typeName = typeNode.typeName;
+            if (ts.isIdentifier(typeName) && typeName.text === "Value") {
+                const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(node.getStart(context.sourceFile));
+                diagnostics.push({
+                    file: context.filePath,
+                    line: line + 1,
+                    column: character + 1,
+                    ruleId: "COR015",
+                    severity: "warning",
+                    message: `Redundant 'as Value<...>' cast — AttrRef and other Intrinsic types already satisfy Value<T>.`,
+                });
+            }
+        }
+    }
+    ts.forEachChild(node, child => checkNode(child, context, diagnostics));
+}
+export const noRedundantValueCastRule = {
+    id: "COR015",
+    severity: "warning",
+    category: "style",
+    description: "Flags redundant 'as Value<...>' casts — Intrinsic types already satisfy Value<T>",
+    check(context) {
+        const diagnostics = [];
+        checkNode(context.sourceFile, context, diagnostics);
+        return diagnostics;
+    },
+};

package/dist/lint/rules/no-string-ref.js

@@ -0,0 +1,59 @@
+import * as ts from "typescript";
+/**
+ * COR003: no-string-ref
+ *
+ * Flag string-based `GetAtt("name", "attr")` and `Ref("name")` intrinsic
+ * calls. These bypass type safety — users should import resources and use
+ * typed AttrRef properties like `resource.arn`.
+ */
+const TARGET_FUNCTIONS = new Set(["GetAtt", "Ref"]);
+export const noStringRefRule = {
+    id: "COR003",
+    severity: "warning",
+    category: "correctness",
+    description: "Flags string-based GetAtt() and Ref() calls — use typed property access instead",
+    check(context) {
+        const diagnostics = [];
+        const sf = context.sourceFile;
+        function visit(node) {
+            if (ts.isCallExpression(node)) {
+                const name = getCalledFunctionName(node);
+                if (name && TARGET_FUNCTIONS.has(name) && hasStringArguments(node)) {
+                    const { line, character } = sf.getLineAndCharacterOfPosition(node.getStart(sf));
+                    const fnText = name === "GetAtt" ? "GetAtt" : "Ref";
+                    diagnostics.push({
+                        file: context.filePath,
+                        line: line + 1,
+                        column: character + 1,
+                        ruleId: "COR003",
+                        severity: "warning",
+                        message: `Avoid string-based ${fnText}() — import the resource and use typed property access instead.`,
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        }
+        visit(sf);
+        return diagnostics;
+    },
+};
+/**
+ * Extract the function name from a call expression.
+ * Handles both `GetAtt(...)` and `aws.GetAtt(...)` patterns.
+ */
+function getCalledFunctionName(node) {
+    const expr = node.expression;
+    if (ts.isIdentifier(expr)) {
+        return expr.text;
+    }
+    if (ts.isPropertyAccessExpression(expr) && ts.isIdentifier(expr.name)) {
+        return expr.name.text;
+    }
+    return undefined;
+}
+/**
+ * Check if the call has at least one string literal argument.
+ */
+function hasStringArguments(node) {
+    return node.arguments.some((arg) => ts.isStringLiteral(arg));
+}

package/dist/lint/rules/no-unused-declarable-import.js

@@ -0,0 +1,75 @@
+import * as ts from "typescript";
+function collectNamespaceImports(sourceFile) {
+    const imports = [];
+    ts.forEachChild(sourceFile, (node) => {
+        if (!ts.isImportDeclaration(node))
+            return;
+        const moduleSpecifier = node.moduleSpecifier;
+        if (!ts.isStringLiteral(moduleSpecifier))
+            return;
+        if (!moduleSpecifier.text.startsWith("@intentius/chant") && !moduleSpecifier.text.startsWith("@intentius/chant-lexicon-"))
+            return;
+        // Skip type-only imports
+        if (node.importClause?.isTypeOnly)
+            return;
+        const importClause = node.importClause;
+        if (!importClause?.namedBindings)
+            return;
+        // Only check namespace imports (import * as X)
+        if (ts.isNamespaceImport(importClause.namedBindings)) {
+            imports.push({
+                name: importClause.namedBindings.name.text,
+                node,
+            });
+        }
+    });
+    return imports;
+}
+function isNamespaceUsed(name, sourceFile) {
+    let used = false;
+    function visit(node) {
+        if (used)
+            return;
+        // Check for property access: name.something
+        if (ts.isPropertyAccessExpression(node)) {
+            if (ts.isIdentifier(node.expression) && node.expression.text === name) {
+                used = true;
+                return;
+            }
+        }
+        // Check for qualified names in types: name.Type
+        if (ts.isQualifiedName(node)) {
+            if (ts.isIdentifier(node.left) && node.left.text === name) {
+                used = true;
+                return;
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    return used;
+}
+export const noUnusedDeclarableImportRule = {
+    id: "COR010",
+    severity: "warning",
+    category: "style",
+    description: "Flags unused namespace imports from @intentius/chant packages",
+    check(context) {
+        const diagnostics = [];
+        const imports = collectNamespaceImports(context.sourceFile);
+        for (const imp of imports) {
+            if (!isNamespaceUsed(imp.name, context.sourceFile)) {
+                const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(imp.node.getStart(context.sourceFile));
+                diagnostics.push({
+                    file: context.filePath,
+                    line: line + 1,
+                    column: character + 1,
+                    ruleId: "COR010",
+                    severity: "warning",
+                    message: `Namespace import '${imp.name}' is never used — remove the import or use ${imp.name}.<resource>.`,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};