@intentius/chant 0.124.13 → 0.124.14

package/dist/lint/rules/no-unused-declarable.js

@@ -0,0 +1,142 @@
+import * as ts from "typescript";
+import { isPropertyKindNew } from "./property-kind.js";
+function isCapitalized(name) {
+    return name.length > 0 && name[0] === name[0].toUpperCase() && name[0] !== name[0].toLowerCase();
+}
+function getNewExpressionClassName(expr) {
+    if (ts.isIdentifier(expr.expression)) {
+        return expr.expression.text;
+    }
+    if (ts.isPropertyAccessExpression(expr.expression)) {
+        return expr.expression.name.text;
+    }
+    return undefined;
+}
+/** Names of this file's top-level consts initialised with a property-kind `new`. */
+function collectPropertyKindConsts(context) {
+    const names = new Set();
+    for (const stmt of context.sourceFile.statements) {
+        if (!ts.isVariableStatement(stmt))
+            continue;
+        for (const decl of stmt.declarationList.declarations) {
+            if (ts.isIdentifier(decl.name) &&
+                decl.initializer &&
+                ts.isNewExpression(decl.initializer) &&
+                isPropertyKindNew(decl.initializer, context)) {
+                names.add(decl.name.text);
+            }
+        }
+    }
+    return names;
+}
+/**
+ * True when the constructor arguments hold a property-kind declarable,
+ * either inline (`panels: [new Row(…)]`) or through a const from
+ * `propertyConsts` (`panels: [red]`).
+ */
+function holdsPropertyKind(expr, context, propertyConsts) {
+    let found = false;
+    function visit(node) {
+        if (found)
+            return;
+        if (ts.isNewExpression(node) && isPropertyKindNew(node, context)) {
+            found = true;
+            return;
+        }
+        if (ts.isIdentifier(node) && propertyConsts.has(node.text)) {
+            found = true;
+            return;
+        }
+        ts.forEachChild(node, visit);
+    }
+    for (const arg of expr.arguments ?? [])
+        visit(arg);
+    return found;
+}
+function collectExportedDeclarables(context) {
+    const declarables = [];
+    const sourceFile = context.sourceFile;
+    const propertyConsts = collectPropertyKindConsts(context);
+    ts.forEachChild(sourceFile, (node) => {
+        if (!ts.isVariableStatement(node))
+            return;
+        // Must have export modifier
+        const hasExport = node.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+        if (!hasExport)
+            return;
+        for (const decl of node.declarationList.declarations) {
+            if (!ts.isIdentifier(decl.name))
+                continue;
+            if (!decl.initializer)
+                continue;
+            // Must be a new expression with a capitalized name
+            if (!ts.isNewExpression(decl.initializer))
+                continue;
+            const className = getNewExpressionClassName(decl.initializer);
+            if (!className || !isCapitalized(className))
+                continue;
+            // Parameters are inherently cross-file (declared in params.ts, consumed via Ref() elsewhere)
+            if (className === "Parameter")
+                continue;
+            // chant #2957: a property-kind declarable is part of a resource, and a
+            // resource holding one is the root that emits it.
+            if (isPropertyKindNew(decl.initializer, context))
+                continue;
+            if (holdsPropertyKind(decl.initializer, context, propertyConsts))
+                continue;
+            declarables.push({
+                name: decl.name.text,
+                node,
+            });
+        }
+    });
+    return declarables;
+}
+function collectReferences(name, sourceFile, declarationNode) {
+    let found = false;
+    function visit(node) {
+        if (found)
+            return;
+        // Skip the declaration itself
+        if (node === declarationNode)
+            return;
+        if (ts.isIdentifier(node) && node.text === name) {
+            // Make sure this isn't the declaration's own name
+            const parent = node.parent;
+            if (parent && ts.isVariableDeclaration(parent) && parent.name === node) {
+                // This is the declaration itself, skip
+            }
+            else {
+                found = true;
+                return;
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    return found;
+}
+export const noUnusedDeclarableRule = {
+    id: "COR004",
+    severity: "warning",
+    category: "correctness",
+    description: "Detects exported declarables that are never referenced in the same file",
+    check(context) {
+        const diagnostics = [];
+        const declarables = collectExportedDeclarables(context);
+        for (const decl of declarables) {
+            if (!collectReferences(decl.name, context.sourceFile, decl.node)) {
+                const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(decl.node.getStart(context.sourceFile));
+                diagnostics.push({
+                    file: context.filePath,
+                    line: line + 1,
+                    column: character + 1,
+                    ruleId: "COR004",
+                    severity: "warning",
+                    message: `Exported declarable '${decl.name}' is never referenced in this file — it may be dead infrastructure code.`,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/op/index.js

@@ -0,0 +1,28 @@
+/**
+ * OPS* Op-model post-synth checks (#2122, epic #2114 sub-issue 6) — ported
+ * from a hosting lexicon's own TMP012/TMP013/TMP014. Registered as core-owned
+ * post-synth checks (`coreOpChecks`, mirroring `../../receipt-checks.ts`'s
+ * `coreReceiptChecks`) so they run over the FULL build result regardless of
+ * which lexicons are configured — an Op is recognized by entity type
+ * (`../../../op/resource.ts`'s `OpResource`), not by which lexicon declared
+ * it. SYS010 (#2828) joined them when the `decide` activity moved into core:
+ * it reads the decide steps, and the `decide.backends` the caller passes.
+ */
+import { ops012 } from "./ops012-activity-contract.js";
+import { ops013 } from "./ops013-step-output-ref.js";
+import { ops014 } from "./ops014-converge-rule-refusals.js";
+import { ops015 } from "./ops015-gate-approval.js";
+import { sys010Check } from "./sys010-key-over-plain-http.js";
+export { ops012 } from "./ops012-activity-contract.js";
+export { ops013 } from "./ops013-step-output-ref.js";
+export { ops014 } from "./ops014-converge-rule-refusals.js";
+export { ops015 } from "./ops015-gate-approval.js";
+export { sys010, sys010Check } from "./sys010-key-over-plain-http.js";
+/**
+ * Core's own post-synth checks over the Op model: OPS012, OPS013, OPS014,
+ * OPS015, and SYS010 over the `decide` steps and the configured decide
+ * backends.
+ */
+export function coreOpChecks(opts = {}) {
+    return [ops012, ops013, ops014, ops015, sys010Check(opts.decideBackends)];
+}

package/dist/lint/rules/op/ops012-activity-contract.js

@@ -0,0 +1,54 @@
+/**
+ * OPS012: activity step args/outcomeAttribute must match the activity's
+ * declared contract (chant #1288 Stage 1; moved from a hosting lexicon's own
+ * TMP012 to core in #2122, epic #2114 sub-issue 6, so it fires on every
+ * project that declares an Op, not only one with that lexicon configured).
+ *
+ * Validates every Op entity's steps against core's own base-activity
+ * contracts (`../../../op/activities/activity-contracts.ts`, #2117), using
+ * the generic walk in `@intentius/chant/op`'s `validateActivitySteps`. A step
+ * whose `fn` has no registered contract here is skipped — most activities
+ * don't have one yet; see that module's doc for why that's the intended,
+ * non-breaking default.
+ *
+ * Cross-lexicon (chant #2101): an Op step may call an activity any
+ * configured lexicon contributes (`terraformPlan`, `k3sInstall`,
+ * `flyApply`), and since this check became core-owned it fires on every
+ * project that declares an Op. `ctx.activityContracts` carries the contracts
+ * every configured lexicon declared, resolved by `loadActivityContracts`
+ * (`../../../op/activity-contract-registry.ts`) the same way
+ * `loadActivities` resolves the implementations, and is merged over the
+ * static table below. A context that carries none — a hand-built one in a
+ * test, a caller that has not loaded any — falls back to that table alone,
+ * exactly as before.
+ */
+import { validateActivitySteps, mergeActivityContracts } from "../../../op/index.js";
+import * as contracts from "../../../op/activities/activity-contracts.js";
+import { isOpEntity } from "./support.js";
+const CONTRACTS = new Map(Object.values(contracts).map((c) => [c.name, c]));
+export const ops012 = {
+    id: "OPS012",
+    description: "Activity step args and outcomeAttribute.from must match the activity's declared contract",
+    check(ctx) {
+        const diagnostics = [];
+        const activeContracts = mergeActivityContracts(CONTRACTS, ctx.activityContracts);
+        for (const [entityKey, entity] of ctx.entities) {
+            if (!isOpEntity(entity))
+                continue;
+            const rec = entity;
+            const props = (entity.props ?? {});
+            if (typeof props.name !== "string" || !Array.isArray(props.phases))
+                continue;
+            for (const issue of validateActivitySteps(props, activeContracts)) {
+                diagnostics.push({
+                    checkId: "OPS012",
+                    severity: "error",
+                    message: `Op "${issue.opName}", phase "${issue.phase}", step "${issue.fn}": ${issue.message}`,
+                    entity: entityKey,
+                    lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/op/ops013-step-output-ref.js

@@ -0,0 +1,88 @@
+/**
+ * OPS013: a step-output reference (`stepOutput()`/`activity().out`, chant
+ * #1290) must name a step that precedes it, in scope (main `phases`, not
+ * `onFailure` or nested inside an `EffectStep`), with a registered
+ * `ActivityContract` whose `returns` schema the referenced path resolves
+ * against. Moved from a hosting lexicon's own TMP013 to core in #2122 (epic
+ * #2114 sub-issue 6), so it fires on every project that declares an Op — a
+ * project on the local runtime with no lexicons configured included.
+ *
+ * Same shape as OPS012 (`./ops012-activity-contract.ts`): the generic walk
+ * lives in `@intentius/chant/op`'s `validateStepOutputRefs`, over the same
+ * contract map this file builds from core's own base-activity contracts
+ * (`../../../op/activities/activity-contracts.ts`, #2117). A producer
+ * step whose `fn` has no registered contract is flagged (unlike OPS012's
+ * args/outcomeAttribute checks, which skip an unregistered `fn` — a
+ * reference has nothing to validate against without one, so it can't be
+ * silently allowed the way an unchecked arg can). The purely structural half
+ * of this check (an unknown step id, or a reference into a later phase) is
+ * independent of the contract map's contents entirely — no lexicon needs to
+ * be configured, and no activity needs a registered contract at all, for it
+ * to fire.
+ *
+ * Cross-lexicon (chant #2101): an Op step may call an activity any
+ * configured lexicon contributes (`terraformPlan`, `k3sInstall`,
+ * `flyApply`), and since this check became core-owned it fires on every
+ * project that declares an Op. `ctx.activityContracts` carries the contracts
+ * every configured lexicon declared, resolved by `loadActivityContracts`
+ * (`../../../op/activity-contract-registry.ts`) the same way
+ * `loadActivities` resolves the implementations, and is merged over the
+ * static table below. A context that carries none — a hand-built one in a
+ * test, a caller that has not loaded any — falls back to that table alone,
+ * exactly as before.
+ *
+ * That merge is what makes this rule usable at all on an Op whose steps are
+ * a lexicon's: before it, `terraformPlan` feeding `terraformApply` failed
+ * `chant build` for the absence of a contract the terraform lexicon does in
+ * fact declare, which is why both terraform examples carrying an Op kept it
+ * outside `src/` where the example-build harness could not see it.
+ *
+ * This check is what makes it safe for a lexicon's own serializer to compile
+ * every reference it finds unconditionally: `chant build` blocks file output
+ * while an error-severity post-synth finding stands, so generated code
+ * referencing an unresolved step never reaches disk (a lexicon's own Op
+ * serializer also runs the scope-only subset of this check directly —
+ * `validateStepOutputRefScope` — as defense-in-depth, chant #1950 pre-merge
+ * review finding 2).
+ *
+ * Cross-contract type compatibility (chant #1950 pre-merge review, finding
+ * 3): this rule also compares a producer's declared return type at `path`
+ * against the consumer's declared arg type at the same position
+ * (`string`/`number`/`boolean`/`object`/`array` only) and flags a mismatch —
+ * a string-returning path feeding a number-typed arg, for example.
+ * Deliberately shallow: a union, enum, literal, `z.any()`/`z.unknown()`, a
+ * transform, or a reference sitting inside an array in `args` all bail
+ * silently rather than being reasoned about. See `@intentius/chant/op`'s
+ * `step-output-ref.ts` module doc for the full writeup of what this catches
+ * and what it defers (to #1288 Stage 2).
+ */
+import { validateStepOutputRefs, mergeActivityContracts } from "../../../op/index.js";
+import * as contracts from "../../../op/activities/activity-contracts.js";
+import { isOpEntity } from "./support.js";
+const CONTRACTS = new Map(Object.values(contracts).map((c) => [c.name, c]));
+export const ops013 = {
+    id: "OPS013",
+    description: "A step-output reference must name an in-scope, preceding, contract-validated producer step",
+    check(ctx) {
+        const diagnostics = [];
+        const activeContracts = mergeActivityContracts(CONTRACTS, ctx.activityContracts);
+        for (const [entityKey, entity] of ctx.entities) {
+            if (!isOpEntity(entity))
+                continue;
+            const rec = entity;
+            const props = (entity.props ?? {});
+            if (typeof props.name !== "string" || !Array.isArray(props.phases))
+                continue;
+            for (const issue of validateStepOutputRefs(props, activeContracts)) {
+                diagnostics.push({
+                    checkId: "OPS013",
+                    severity: "error",
+                    message: `Op "${issue.opName}", phase "${issue.phase}", step "${issue.fn}": ${issue.message}`,
+                    entity: entityKey,
+                    lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/op/ops014-converge-rule-refusals.js

@@ -0,0 +1,114 @@
+import { classifyOpVerbClass, isWellFormedPredicate, predicateReferencesField } from "../../../op/index.js";
+import { CONVERGE_SYMPTOM_FIELDS, RESOURCE_SYMPTOM_FIELDS } from "../../../lifecycle/symptoms.js";
+import { isOpEntity } from "./support.js";
+function looksLikeOpProps(props) {
+    return typeof props.name === "string" && Array.isArray(props.phases);
+}
+/** Read a ConvergeOp's rule table back off its `convergeTick` step's `args.rules`. `undefined` if this doesn't look like a ConvergeOp-shaped Op (defensive — never crashes the build over an unexpected shape). */
+function findConvergeRules(props) {
+    for (const phase of props.phases) {
+        for (const step of phase.steps) {
+            if (step.kind === "activity" && step.fn === "convergeTick") {
+                const rules = step.args?.rules;
+                // #2778: a ConvergeOp with an observer step passes its result as
+                // `observed`, and its rules read a ResourceSymptom.
+                const fields = step.args?.observed !== undefined ? RESOURCE_SYMPTOM_FIELDS : CONVERGE_SYMPTOM_FIELDS;
+                return Array.isArray(rules) ? { rules: rules, fields } : undefined;
+            }
+        }
+    }
+    return undefined;
+}
+export const ops014 = {
+    id: "OPS014",
+    description: "A ConvergeOp rule table: run() must name a declared Op, a mutating dispatch requires dial apply (reconcile opens a PR in a future version, not implemented in v1), a destructive dispatch is refused outright in v1 (a converge tick is unattended and a destructive dispatch needs approval before it's attempted, not a gate consulted after the tick already committed to it), an adoptCount-reading rule may not dispatch a mutation, and every rule must carry its why",
+    check(ctx) {
+        const diagnostics = [];
+        const opsByName = new Map();
+        for (const entity of ctx.entities.values()) {
+            if (!isOpEntity(entity))
+                continue;
+            const rawProps = (entity.props ?? {});
+            if (!looksLikeOpProps(rawProps))
+                continue;
+            const opProps = rawProps;
+            opsByName.set(opProps.name, opProps);
+        }
+        for (const [entityKey, entity] of ctx.entities) {
+            if (!isOpEntity(entity))
+                continue;
+            const rec = entity;
+            const rawProps = (entity.props ?? {});
+            if (!looksLikeOpProps(rawProps))
+                continue;
+            const props = rawProps;
+            if (props.labels?.Converge !== "true")
+                continue;
+            const dial = props.labels?.Dial ?? "observe";
+            const found = findConvergeRules(props);
+            if (!found)
+                continue;
+            const { rules, fields } = found;
+            for (const rule of rules) {
+                const label = typeof rule?.id === "string" ? rule.id : "(unnamed rule)";
+                const push = (message) => {
+                    diagnostics.push({
+                        checkId: "OPS014",
+                        severity: "error",
+                        message: `ConvergeOp "${props.name}", rule "${label}": ${message}`,
+                        entity: entityKey,
+                        lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+                    });
+                };
+                if (typeof rule?.why !== "string" || rule.why.trim().length === 0) {
+                    push("every rule must carry its why — refused at build");
+                    continue;
+                }
+                if (!isWellFormedPredicate(rule.when, fields)) {
+                    push("predicate is outside the evaluable subset (build it from eq/neq/gt/gte/lt/lte/truthy/falsy/allOf/anyOf over a known symptom field)");
+                    continue;
+                }
+                if (!rule.then || rule.then.kind !== "run")
+                    continue;
+                const targetName = rule.then.op;
+                const target = opsByName.get(targetName);
+                if (!target) {
+                    push(`references unknown op "${targetName}" — no declared Op has that name`);
+                    continue;
+                }
+                const verbClass = classifyOpVerbClass(target);
+                // Mutating: the issue's Autonomy table gives `reconcile` "open PR",
+                // not "run directly" — building that channel is out of v1 scope
+                // (epic #1487's onDrift-channel open question), so only `apply`
+                // (the dial the issue's table marks "run, gated per op") may free-run
+                // a mutating dispatch. Refusing this at build is the honest
+                // alternative to silently escalating `reconcile`'s authority to
+                // match `apply`.
+                if (verbClass === "mutating" && dial !== "apply") {
+                    const escalationNote = dial === "reconcile"
+                        ? ` — the issue's table answer for "reconcile" is "open PR", which v1 does not implement (see epic #1487's onDrift-channel open question); this Op would otherwise silently run a mutation "reconcile" was never granted`
+                        : "";
+                    push(`dispatches "${targetName}" (mutating), but dial "${dial}" only permits a mutating dispatch under "apply"${escalationNote} — report instead, or raise the dial to "apply"`);
+                }
+                // Destructive: refused outright, regardless of dial or gate. A
+                // converge tick runs unattended on a schedule — nothing is watching
+                // it fire — so a destructive dispatch needs a human's approval
+                // *before* it is attempted, not a gate the tick consults only after
+                // it has already committed to running the op. `run()` has no way to
+                // ask first, so the target is refused rather than dispatched.
+                if (verbClass === "destructive") {
+                    push(`dispatches "${targetName}" (destructive) — destructive run() targets are refused in v1 under any dial: a converge tick is unattended, and a destructive dispatch needs a human's approval before it is attempted, not a gate consulted after the tick has already committed to running it. Destructive remediation via ConvergeOp arrives once a tick can ask for that approval before it dispatches — until then, remediate manually via a gated ApplyOp/ReconcileOp run.`);
+                }
+                // Adopt safety: enforced, not just documented. A rule that reads
+                // `adoptCount` — the "unowned resource" signal — has no honest
+                // reason to dispatch a mutation; the only sanctioned action for that
+                // signal is `report()`. (A destructive target already gets refused
+                // above regardless of what its predicate reads.)
+                if (verbClass === "mutating" && predicateReferencesField(rule.when, "adoptCount")) {
+                    push(`predicate reads "adoptCount" but dispatches "${targetName}" (mutating) — an unowned resource is reported, never auto-claimed by a dispatched mutation; use report() for a rule that reads the adopt signal`);
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/op/ops015-gate-approval.js

@@ -0,0 +1,45 @@
+import { gateApprovalProblems } from "../../../op/gate-approval.js";
+import { gateName } from "../../../op/gate-name.js";
+import { isOpEntity } from "./support.js";
+function* gateSteps(phases) {
+    for (const phase of phases ?? []) {
+        for (const step of phase.steps ?? []) {
+            if (step.kind === "gate")
+                yield step;
+            else if (step.kind === "effect") {
+                for (const nested of step.steps ?? [])
+                    if (nested.kind === "gate")
+                        yield nested;
+            }
+        }
+    }
+}
+export const ops015 = {
+    id: "OPS015",
+    description: "A gate's approval block is well formed: quorum count at least 1, roles named, mode log-only or enforce, enforce has a policy, and policy resolves to a gate policy set whose version is the digest of its text",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [entityKey, entity] of ctx.entities) {
+            if (!isOpEntity(entity))
+                continue;
+            const rec = entity;
+            const props = (entity.props ?? {});
+            if (!Array.isArray(props.phases))
+                continue;
+            for (const step of [...gateSteps(props.phases), ...gateSteps(props.onFailure)]) {
+                if (step.approval === undefined)
+                    continue;
+                for (const problem of gateApprovalProblems(step.approval)) {
+                    diagnostics.push({
+                        checkId: "OPS015",
+                        severity: "error",
+                        message: `Op "${props.name}", gate "${gateName(step)}": ${problem}`,
+                        entity: entityKey,
+                        lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+                    });
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/op/support.js

@@ -0,0 +1,11 @@
+/**
+ * Shared support for the OPS* Op-model post-synth checks (#2122, epic #2114
+ * sub-issue 6) — OPS012 (`./ops012-activity-contract.ts`), OPS013
+ * (`./ops013-step-output-ref.ts`) and OPS014
+ * (`./ops014-converge-rule-refusals.ts`), ported here from a hosting
+ * lexicon's own TMP012/TMP013/TMP014.
+ *
+ * Op-entity recognition is core's own `isOpEntity` (`../../../op/resource.ts`,
+ * #2118) — re-exported here so every OPS* check imports it from one place.
+ */
+export { isOpEntity } from "../../../op/resource.js";

package/dist/lint/rules/op/sys010-key-over-plain-http.js

@@ -0,0 +1,100 @@
+/**
+ * SYS010: a `decide` backend sends its key over plain HTTP (#2740, core's
+ * since #2828).
+ *
+ * A backend in `decide.backends` in chant.config, or in a `decide` step's own
+ * `backends`, may have a key and an `http://` URL. The bearer key then crosses
+ * the network in clear text. A loopback address (127.0.0.1, ::1, localhost)
+ * is exempt, since that is where a local server such as `von serve` or the
+ * stub runs, and where a broker that is itself the endpoint listens.
+ *
+ * The steps are read off the Op entities, which covers a step written with
+ * the `decide` builder and one written with `activity("decide", ...)`. The
+ * configured backends are not entities: `chant build` and `chant lint` read
+ * them from the project's config and hand them to {@link sys010Check}. The id
+ * keeps the SYS prefix it had in the systemone lexicon.
+ */
+import { isOpEntity } from "./support.js";
+const LOOPBACK = new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
+function* decideSteps(phases) {
+    for (const phase of phases ?? []) {
+        for (const step of phase.steps ?? []) {
+            if (step.kind === "activity" && step.fn === "decide")
+                yield step;
+            else if (step.kind === "effect") {
+                for (const nested of step.steps ?? [])
+                    if (nested.kind === "activity" && nested.fn === "decide")
+                        yield nested;
+            }
+        }
+    }
+}
+/** The host of an http:// URL that is not loopback, or undefined. */
+export function plainRemoteHost(url) {
+    if (typeof url !== "string")
+        return undefined;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed.protocol !== "http:")
+        return undefined;
+    return LOOPBACK.has(parsed.hostname) ? undefined : parsed.hostname;
+}
+const DESCRIPTION = "A decide backend sends its key over plain HTTP to a host that is not loopback";
+/**
+ * SYS010 over the Op entities and, when given, the backends configured in
+ * `decide.backends`. A configured backend's diagnostic names it as the entity
+ * `decide.backends.<name>`.
+ */
+export function sys010Check(configured) {
+    return {
+        id: "SYS010",
+        description: DESCRIPTION,
+        check(ctx) {
+            const diagnostics = [];
+            for (const [name, b] of Object.entries(configured ?? {})) {
+                const host = b?.key !== undefined ? plainRemoteHost(b.url) : undefined;
+                if (!host)
+                    continue;
+                diagnostics.push({
+                    checkId: "SYS010",
+                    severity: "error",
+                    message: `decide.backends.${name} sends its key over http:// to ${host}; use https://, or a loopback broker`,
+                    entity: `decide.backends.${name}`,
+                });
+            }
+            for (const [entityKey, entity] of ctx.entities) {
+                if (!isOpEntity(entity))
+                    continue;
+                const rec = entity;
+                const props = (entity.props ?? {});
+                for (const step of [...decideSteps(props.phases), ...decideSteps(props.onFailure)]) {
+                    const backends = step.args?.backends;
+                    if (backends === null || typeof backends !== "object")
+                        continue;
+                    for (const [name, b] of Object.entries(backends)) {
+                        if (b?.key === undefined)
+                            continue;
+                        const host = plainRemoteHost(b.url);
+                        if (!host)
+                            continue;
+                        diagnostics.push({
+                            checkId: "SYS010",
+                            severity: "error",
+                            message: `Op "${props.name}", decide ${JSON.stringify(step.args.point)}: backend ${name} sends its key over http:// to ${host}; use https://, or a loopback broker`,
+                            entity: entityKey,
+                            lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+                        });
+                    }
+                }
+            }
+            return diagnostics;
+        },
+    };
+}
+/** SYS010 over the Op entities alone, with no configured backends. */
+export const sys010 = sys010Check();

package/dist/lint/rules/property-kind.js

@@ -0,0 +1,56 @@
+import * as ts from "typescript";
+/**
+ * Property-kind declarables for the COR001, COR004 and COR009 heuristics
+ * (chant #2957).
+ *
+ * Those three rules were written for cloud resources, where every `new X(…)`
+ * is something the build emits. A property-kind declarable (`createProperty`)
+ * is not: it only exists inside the resource that holds it, like a Grafana
+ * panel inside its dashboard. The active lexicons name their property-kind
+ * classes through `LexiconPlugin.propertyClassNames()`, and `runLint` puts
+ * them on `LintContext.propertyClasses`. Without that set (a unit test, or a
+ * lexicon that declares none) nothing is property-kind and the rules behave
+ * as they always have.
+ */
+/**
+ * Map each locally bound import name to the name it was exported under, so
+ * `import { TimeSeriesPanel as Series }` still resolves `new Series(…)`.
+ */
+function importAliases(sourceFile) {
+    const aliases = new Map();
+    for (const stmt of sourceFile.statements) {
+        if (!ts.isImportDeclaration(stmt))
+            continue;
+        const bindings = stmt.importClause?.namedBindings;
+        if (!bindings || !ts.isNamedImports(bindings))
+            continue;
+        for (const el of bindings.elements) {
+            if (el.propertyName)
+                aliases.set(el.name.text, el.propertyName.text);
+        }
+    }
+    return aliases;
+}
+const aliasCache = new WeakMap();
+/** The exported class name a `new` expression constructs, if it has one. */
+export function constructedClassName(node, sourceFile) {
+    const expr = node.expression;
+    if (ts.isPropertyAccessExpression(expr))
+        return expr.name.text;
+    if (!ts.isIdentifier(expr))
+        return undefined;
+    let aliases = aliasCache.get(sourceFile);
+    if (!aliases) {
+        aliases = importAliases(sourceFile);
+        aliasCache.set(sourceFile, aliases);
+    }
+    return aliases.get(expr.text) ?? expr.text;
+}
+/** True when `node` constructs a class an active lexicon declares property-kind. */
+export function isPropertyKindNew(node, context) {
+    const classes = context.propertyClasses;
+    if (!classes || classes.size === 0)
+        return false;
+    const name = constructedClassName(node, context.sourceFile);
+    return name !== undefined && classes.has(name);
+}