@intentius/chant 0.124.13 → 0.124.15

package/dist/lint/presets/strict.json

@@ -1,26 +1,26 @@
 {
-    "rules": {
-        "COR001": "error",
-        "COR002": "error",
-        "COR003": "warning",
-        "COR004": "warning",
-        "COR005": "warning",
-        "COR006": "error",
-        "COR007": "warning",
-        "COR008": "error",
-        "COR009": "warning",
-        "COR010": "warning",
-        "COR011": "error",
-        "COR012": "warning",
-        "COR013": "info",
-        "COR014": "warning",
-        "COR015": "warning",
-        "COMP001": "error",
-        "COMP002": "error",
-        "COMP003": "error",
-        "COMP004": "error",
-        "COMP005": "error",
-        "COMP006": "error",
-        "COMP007": "warning"
-    }
+  "rules": {
+    "COR001": "error",
+    "COR002": "error",
+    "COR003": "warning",
+    "COR004": "warning",
+    "COR005": "warning",
+    "COR006": "error",
+    "COR007": "warning",
+    "COR008": "error",
+    "COR009": "warning",
+    "COR010": "warning",
+    "COR011": "error",
+    "COR012": "warning",
+    "COR013": "info",
+    "COR014": "warning",
+    "COR015": "warning",
+    "COMP001": "error",
+    "COMP002": "error",
+    "COMP003": "error",
+    "COMP004": "error",
+    "COMP005": "error",
+    "COMP006": "error",
+    "COMP007": "warning"
+  }
 }

package/dist/lint/receipt-checks.js

@@ -0,0 +1,83 @@
+import { isEffectReceipt } from "../effect-receipt.js";
+import { isSensitiveKey } from "../deep-observation.js";
+import { isResourceDeclarable } from "../declarable.js";
+/**
+ * COR023: Receipt Materializes Into a Plain Store (#1833, epic #1703)
+ *
+ * A receipt's materialization target must be a plain store — never a
+ * SecureString, a Secret, or any secret-capable kind. A receipt value is a
+ * witness (an existence marker or a `sha256:` digest,
+ * ../effect-receipt.ts), not a secret: parking it in a secret-capable store
+ * invites masking, rotation, and access-control semantics that defeat the
+ * observe-and-compare loop the receipt exists for, and quietly teaches
+ * readers that the value is sensitive when it must never be.
+ *
+ * This is the honest core half of the guard. Core recognizes receipts
+ * lexicon-independently through the marker (#1831) but cannot know what any
+ * lexicon's kinds mean, so it checks the two signals it does have, both
+ * reusing the secret-kind knowledge core already carries
+ * (SENSITIVE_KEY_PATTERNS, ../deep-observation.ts):
+ *
+ *  - the materialized `entityType` names a secret-capable kind
+ *    (`K8s::Core::Secret`, `AWS::SecretsManager::Secret`, ...);
+ *  - the declared props select a secret-capable variant of an otherwise
+ *    plain kind (a `Type`/`Kind` prop whose value matches secret/secure —
+ *    SSM's `Type: "SecureString"` is the canonical case).
+ *
+ * The concrete per-kind enforcement is each materialization row's job — the
+ * aws row (#1835) pins SSM to plain `String` at the source.
+ */
+/** Prop names that select a store variant. */
+const VARIANT_PROP = /^(type|kind)$/i;
+/** Variant values that make the store secret-capable. */
+const SECRET_VARIANT = /secret|secure/i;
+export const RECEIPT_PLAIN_STORE_CHECK_ID = "COR023";
+const receiptPlainStoreCheck = {
+    id: RECEIPT_PLAIN_STORE_CHECK_ID,
+    description: "An effect receipt's materialization target must be a plain store — never a secret-capable kind or variant",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [name, entity] of ctx.entities) {
+            if (!isEffectReceipt(entity))
+                continue;
+            if (isSensitiveKey(entity.entityType)) {
+                diagnostics.push({
+                    checkId: RECEIPT_PLAIN_STORE_CHECK_ID,
+                    severity: "error",
+                    entity: name,
+                    lexicon: entity.lexicon,
+                    message: `Effect receipt "${name}" materializes into secret-capable kind "${entity.entityType}" — ` +
+                        `a receipt's target must be a plain store. The receipt value is a witness ` +
+                        `(an existence marker or a sha256 digest), not a secret; a secret-capable store adds ` +
+                        `masking and rotation semantics that defeat the receipt's observe-and-compare loop.`,
+                });
+                continue;
+            }
+            if (isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null) {
+                for (const [key, value] of Object.entries(entity.props)) {
+                    if (VARIANT_PROP.test(key) && typeof value === "string" && SECRET_VARIANT.test(value)) {
+                        diagnostics.push({
+                            checkId: RECEIPT_PLAIN_STORE_CHECK_ID,
+                            severity: "error",
+                            entity: name,
+                            lexicon: entity.lexicon,
+                            message: `Effect receipt "${name}" (${entity.entityType}) declares ${key}: "${value}" — ` +
+                                `a secret-capable store variant. A receipt's target must be a plain store; ` +
+                                `use the plain variant (e.g. SSM Type: "String") so the witness value stays ` +
+                                `readable to the observe-and-compare loop.`,
+                        });
+                    }
+                }
+            }
+        }
+        return diagnostics;
+    },
+};
+/**
+ * Core's own post-synth checks over effect receipts, run by `chant build`
+ * over the full build result (plugin checks are lexicon-scoped; receipts are
+ * recognized by marker, so this set is deliberately not).
+ */
+export function coreReceiptChecks() {
+    return [receiptPlainStoreCheck];
+}

package/dist/lint/rule-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rule-loader.d.ts","sourceRoot":"","sources":["../../src/lint/rule-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AA+CvC;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAqC5E"}
+{"version":3,"file":"rule-loader.d.ts","sourceRoot":"","sources":["../../src/lint/rule-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAgDvC;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAsC5E"}

package/dist/lint/rule-loader.js

@@ -0,0 +1,89 @@
+import { readdirSync, existsSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { ensureTypeScriptLoader } from "../ts-loader.js";
+/**
+ * Type guard to check if a value conforms to the LintRule interface.
+ */
+function isLintRule(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "id" in value &&
+        typeof value.id === "string" &&
+        "severity" in value &&
+        "category" in value &&
+        "check" in value &&
+        typeof value.check === "function");
+}
+/**
+ * Walk up from `from` until a directory containing `.chant/rules/` is found,
+ * or until we hit the filesystem root or a non-project boundary (a directory
+ * with `package.json` but no `.chant/rules/` — that's the project root and
+ * we stop there even if no rules dir exists).
+ *
+ * Returns the absolute path to the discovered `.chant/rules/` directory, or
+ * null if none was found before we crossed the project root.
+ */
+function findRulesDir(from) {
+    let cur = resolve(from);
+    while (true) {
+        const candidate = join(cur, ".chant", "rules");
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+        // Stop at the nearest project root (where package.json sits) — going
+        // above it would pick up rules belonging to an unrelated parent project.
+        if (existsSync(join(cur, "package.json"))) {
+            return null;
+        }
+        const parent = dirname(cur);
+        if (parent === cur) {
+            return null;
+        }
+        cur = parent;
+    }
+}
+/**
+ * Load local lint rules from `.chant/rules/`.
+ *
+ * Scans for `.ts` files in the nearest `.chant/rules/` directory found by
+ * walking up from `projectDir` (stopping at the closest `package.json` to
+ * avoid leaking into unrelated parent projects). Dynamically imports each
+ * file and collects all exports that conform to the LintRule interface.
+ *
+ * @param projectDir - Directory the lint command was invoked against. May be
+ *                     a sub-stack of a larger project — the rules dir is
+ *                     resolved by walking up.
+ * @returns Array of LintRule objects found in the discovered `.chant/rules/`.
+ */
+export async function loadLocalRules(projectDir) {
+    const rulesDir = findRulesDir(projectDir);
+    if (rulesDir === null) {
+        return [];
+    }
+    const rules = [];
+    let entries;
+    try {
+        entries = readdirSync(rulesDir);
+    }
+    catch {
+        return [];
+    }
+    const tsFiles = entries.filter((f) => f.endsWith(".ts") && !f.endsWith(".test.ts") && !f.endsWith(".spec.ts"));
+    for (const file of tsFiles) {
+        const filePath = resolve(rulesDir, file);
+        let mod;
+        try {
+            ensureTypeScriptLoader();
+            mod = await import(filePath);
+        }
+        catch (err) {
+            throw new Error(`Failed to load rule file "${file}": ${err instanceof Error ? err.message : String(err)}`);
+        }
+        for (const value of Object.values(mod)) {
+            if (isLintRule(value)) {
+                rules.push(value);
+            }
+        }
+    }
+    return rules;
+}

package/dist/lint/rule-registry.js

@@ -0,0 +1,86 @@
+/**
+ * Rule registry — collects metadata from all rule sources into a flat, sortable array.
+ * Used for documentation generation and programmatic rule introspection.
+ */
+/**
+ * Build a rule registry from core rules and plugin-provided rules/checks.
+ *
+ * @param coreRules - Core LintRules (COR/EVL rules from packages/core)
+ * @param plugins - Array of plugin contributions with name, rules, and post-synth checks
+ * @returns Flat array of RuleEntry sorted by ID
+ */
+export function buildRuleRegistry(coreRules, plugins = []) {
+    const entries = [];
+    // Core lint rules
+    for (const rule of coreRules) {
+        entries.push({
+            id: rule.id,
+            description: rule.description ?? rule.id,
+            category: rule.category,
+            defaultSeverity: rule.severity,
+            source: "core",
+            phase: "pre-synth",
+            hasAutoFix: typeof rule.fix === "function",
+            helpUri: rule.helpUri,
+        });
+    }
+    // Plugin-provided lint rules and post-synth checks
+    for (const plugin of plugins) {
+        if (plugin.rules) {
+            for (const rule of plugin.rules) {
+                entries.push({
+                    id: rule.id,
+                    description: rule.description ?? rule.id,
+                    category: rule.category,
+                    defaultSeverity: rule.severity,
+                    source: plugin.name,
+                    phase: "pre-synth",
+                    hasAutoFix: typeof rule.fix === "function",
+                    helpUri: rule.helpUri,
+                });
+            }
+        }
+        if (plugin.postSynthChecks) {
+            for (const check of plugin.postSynthChecks) {
+                entries.push({
+                    id: check.id,
+                    description: check.description,
+                    category: inferPostSynthCategory(check.id),
+                    defaultSeverity: inferPostSynthSeverity(check.id, check.description),
+                    source: plugin.name,
+                    phase: "post-synth",
+                    hasAutoFix: false,
+                    helpUri: `https://intentius.io/chant/lint-rules/${check.id.toLowerCase()}`,
+                });
+            }
+        }
+    }
+    return entries.sort((a, b) => a.id.localeCompare(b.id));
+}
+/**
+ * Infer category for post-synth checks from rule ID prefix.
+ * WAW018+ are security rules, existing WAW/COR/EXT default to correctness.
+ */
+function inferPostSynthCategory(id) {
+    const num = parseInt(id.replace(/\D/g, ""), 10);
+    if (id.startsWith("WAW") && num >= 18)
+        return "security";
+    return "correctness";
+}
+/**
+ * Infer default severity for post-synth checks.
+ * Security checks with "error" level: WAW018, WAW019, WAW021.
+ */
+function inferPostSynthSeverity(id, description) {
+    // Check if the description hints at severity
+    if (description.toLowerCase().includes("error"))
+        return "error";
+    // Known error-level security checks
+    const errorIds = new Set(["WAW018", "WAW019", "WAW021"]);
+    if (errorIds.has(id))
+        return "error";
+    // Info-level checks
+    if (id === "WAW027")
+        return "info";
+    return "warning";
+}

package/dist/lint/rule.js

@@ -0,0 +1 @@
+export {};

package/dist/lint/rules/__fixtures__/comp/comp000-discovery-error/broken-a.component.js

@@ -0,0 +1,7 @@
+import { phase } from "../../../../../components/component.js";
+/** Duplicate component name (see broken-b.component.ts) — exercises the COMP000 discovery-error surfacing path in component-checks.ts. */
+export const dup = {
+    name: "duplicate-name",
+    dependsOn: [],
+    deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "a.json" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp000-discovery-error/broken-b.component.js

@@ -0,0 +1,7 @@
+import { phase } from "../../../../../components/component.js";
+/** Duplicate component name (see broken-a.component.ts) — exercises the COMP000 discovery-error surfacing path in component-checks.ts. */
+export const dup = {
+    name: "duplicate-name",
+    dependsOn: [],
+    deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "b.json" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp001/fail/orphan-lib.component.js

@@ -0,0 +1,9 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP001 fail case: publishes an artifact nothing ever consumes — no other component references it, and no later step in this component references the Publish phase's output. */
+export const orphanLib = {
+    name: "orphan-lib",
+    archetype: "producer-library",
+    dependsOn: [],
+    build: { kind: "jvm-build", context: ".", into: "archive" },
+    deploy: [phase("Publish", [{ kind: "publish-artifact", from: "archive", to: "$env.s3" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp001/pass/emr-job.component.js

@@ -0,0 +1,11 @@
+import { phase } from "../../../../../../components/component.js";
+/** Consumer that references jar-lib's published artifact — makes jar-lib's publish step "consumed" for COMP001. */
+export const emrJob = {
+    name: "emr-job",
+    archetype: "infra",
+    dependsOn: ["jar-lib"],
+    deploy: [
+        phase("Submit", [{ kind: "emr-start-job-run", jar: "@jar-lib.publish.uri", args: ["--input", "$env.inputPath"] }]),
+        phase("Verify", [{ kind: "wait-job", runId: "@Submit.runId" }]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp001/pass/jar-lib.component.js

@@ -0,0 +1,9 @@
+import { phase } from "../../../../../../components/component.js";
+/** Producer whose published artifact IS consumed downstream (by emr-job.component.ts) — COMP001 must not flag this. */
+export const jarLib = {
+    name: "jar-lib",
+    archetype: "producer-library",
+    dependsOn: [],
+    build: { kind: "jvm-build", context: ".", into: "archive" },
+    deploy: [phase("Publish", [{ kind: "publish-artifact", from: "archive", to: "$env.s3" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp002/fail/search-service.component.js

@@ -0,0 +1,25 @@
+import { phase } from "../../../../../../components/component.js";
+/**
+ * COMP002 fail case: two dangling wiring references.
+ *  - "@Build.digest" names a phase ("Build") that does not exist in this
+ *    component's deploy (the actual phase is named "Publish").
+ *  - "@missing-lib.publish.uri" names a component that was never discovered
+ *    at all in this fixture directory.
+ */
+export const searchService = {
+    name: "search-service",
+    archetype: "service",
+    dependsOn: [],
+    build: { kind: "docker-build", context: ".", into: "archive" },
+    deploy: [
+        phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+        phase("Apply", [
+            {
+                kind: "cfn-deploy",
+                template: "archive:search.template.json",
+                imageRef: "@Build.digest",
+                inputs: { jarUri: "@missing-lib.publish.uri" },
+            },
+        ]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp002/pass/jar-lib.component.js

@@ -0,0 +1,8 @@
+import { phase } from "../../../../../../components/component.js";
+export const jarLib = {
+    name: "jar-lib",
+    archetype: "producer-library",
+    dependsOn: [],
+    build: { kind: "jvm-build", context: ".", into: "archive" },
+    deploy: [phase("Publish", [{ kind: "publish-artifact", from: "archive", to: "$env.s3" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp002/pass/search-service.component.js

@@ -0,0 +1,21 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP002 pass case: every wiring reference resolves — "@Publish.digest" points at this component's own "Publish" phase, and "@jar-lib.publish.uri" points at a discovered component listed in dependsOn. */
+export const searchService = {
+    name: "search-service",
+    archetype: "service",
+    dependsOn: ["jar-lib"],
+    build: { kind: "docker-build", context: ".", into: "archive" },
+    deploy: [
+        phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+        phase("Apply", [
+            {
+                kind: "cfn-deploy",
+                template: "archive:search.template.json",
+                imageRef: "@Publish.digest",
+                inputs: { jarUri: "@jar-lib.publish.uri" },
+            },
+            { kind: "ecs-update-service", cluster: "$env.cluster", service: "search" },
+        ]),
+        phase("Verify", [{ kind: "wait-steady-state", service: "search" }]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp003/fail/migrator.component.js

@@ -0,0 +1,8 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP003 fail case: "run-migration" has no native rollback, no noRollback opt-out, no component-level rollback, and no compensation sibling step. */
+export const migrator = {
+    name: "migrator",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [phase("Apply", [{ kind: "run-migration", tool: "flyway", target: "ecs-task:migrate" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp003/pass/agent-turn.component.js

@@ -0,0 +1,24 @@
+import { phase } from "../../../../../../components/component.js";
+/**
+ * COMP003 pass case (#1944): a bare "run-agent" step with no "noRollback"
+ * opt-out and no component-level "rollback" — must pass COMP003 because
+ * "run-agent"'s rollbackPolicy is "native" (#1941), not "needs-opt-out". This
+ * is the regression test proving the registry's declared rollbackPolicy for
+ * "run-agent" is wired correctly into ctx.rollbackPolicies, the same seam
+ * COMP005 uses for ctx.knownKinds — see comp.test.ts's FIXTURE_ROLLBACK_POLICIES.
+ */
+export const agentTurn = {
+    name: "agent-turn",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Run", [
+            {
+                kind: "run-agent",
+                agent: "claude",
+                task: { prompt: "run the migration script and report the result" },
+                workspace: {},
+            },
+        ]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp003/pass/migrator.component.js

@@ -0,0 +1,17 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP003 pass case: "run-migration" is a needs-opt-out kind, but declares an explicit noRollback reason. */
+export const migrator = {
+    name: "migrator",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Apply", [
+            {
+                kind: "run-migration",
+                tool: "flyway",
+                target: "ecs-task:migrate",
+                noRollback: "forward-only schema migration; rolling back would drop columns already backfilled",
+            },
+        ]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp003/pass/orders-table.component.js

@@ -0,0 +1,8 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP003 pass case: cfn-deploy has a known native rollback, so no opt-out is required. */
+export const ordersTable = {
+    name: "orders-table",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "archive:orders-table.template.json", onReplace: "block" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp004/fail/neo4j-cluster.component.js

@@ -0,0 +1,18 @@
+import { gate, phase } from "../../../../../../components/component.js";
+/** COMP004 fail case: a gate step with no disable directive — flagged, since the local executor cannot run it. */
+export const neo4jCluster = {
+    name: "neo4j-cluster",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Seed", [
+            { kind: "cfn-deploy", template: "archive:neo4j-az0-0.template.json" },
+            { kind: "wait-cluster-healthy", size: 1 },
+        ]),
+        phase("Node 1", [
+            gate("approve-neo4j-node-1", { description: "Confirm the seed node is healthy before rolling to node 1" }),
+            { kind: "cfn-deploy", template: "archive:neo4j-1.template.json" },
+            { kind: "wait-cluster-healthy", quorum: true },
+        ]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.js

@@ -0,0 +1,20 @@
+import { gate, phase } from "../../../../../../components/component.js";
+/** COMP004 pass case: a genuine gate, opted out via a file-level disable directive with a documented reason — the intended path for a component whose rollout genuinely waits on a person. */
+export const neo4jCluster = {
+    name: "neo4j-cluster",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Seed", [
+            { kind: "cfn-deploy", template: "archive:neo4j-az0-0.template.json" },
+            { kind: "code-deploy", instance: 0, revision: "@Seed.templateUri" },
+            { kind: "wait-cluster-healthy", size: 1 },
+        ]),
+        phase("Node 1", [
+            gate("approve-neo4j-node-1", { description: "Confirm the seed node is healthy before rolling to node 1", timeout: "24h" }),
+            { kind: "cfn-deploy", template: "archive:neo4j-1.template.json" },
+            { kind: "code-deploy", instance: 1, revision: "@Seed.templateUri" },
+            { kind: "wait-cluster-healthy", quorum: true },
+        ]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.js

@@ -0,0 +1,8 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP004 pass case: no gate step anywhere — nothing here stops the run for a person. */
+export const ordersTable = {
+    name: "orders-table",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [phase("Apply", [{ kind: "cfn-deploy", template: "archive:orders-table.template.json" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp005/fail/search-service.component.js

@@ -0,0 +1,12 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP005 fail case: the Apply step's kind is named after this very component ("deploy-search-service") — a noun, not an operation. */
+export const searchService = {
+    name: "search-service",
+    archetype: "service",
+    dependsOn: [],
+    build: { kind: "docker-build", context: ".", into: "archive" },
+    deploy: [
+        phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+        phase("Apply", [{ kind: "deploy-search-service", imageRef: "@Publish.digest" }]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp005/pass/search-service.component.js

@@ -0,0 +1,16 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP005 pass case: every step kind is a verb (an operation), never the component's own name. */
+export const searchService = {
+    name: "search-service",
+    archetype: "service",
+    dependsOn: [],
+    build: { kind: "docker-build", context: ".", into: "archive" },
+    deploy: [
+        phase("Publish", [{ kind: "publish-image", from: "archive", to: "$env.registry" }]),
+        phase("Apply", [
+            { kind: "cfn-deploy", template: "archive:search.template.json", imageRef: "@Publish.digest" },
+            { kind: "ecs-update-service", cluster: "$env.cluster", service: "search" },
+        ]),
+        phase("Verify", [{ kind: "wait-steady-state", service: "search" }]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp006/fail/legacy-tool.component.js

@@ -0,0 +1,8 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP006 fail case: a raw "shell" step with no "reason" at all. */
+export const legacyTool = {
+    name: "legacy-tool",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [phase("Apply", [{ kind: "shell", cmd: "./legacy-deploy.sh" }])],
+};

package/dist/lint/rules/__fixtures__/comp/comp006/pass/legacy-tool.component.js

@@ -0,0 +1,12 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP006 pass case: the "shell" escape hatch declares a non-empty reason. */
+export const legacyTool = {
+    name: "legacy-tool",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Apply", [
+            { kind: "shell", cmd: "./legacy-deploy.sh", reason: "no capability wraps this vendor's proprietary CLI yet" },
+        ]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp007/fail/inventory-table.component.js

@@ -0,0 +1,11 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP007 fail case: identical phase/step-kind shape to orders-table.component.ts. */
+export const inventoryTable = {
+    name: "inventory-table",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Apply", [{ kind: "cfn-deploy", template: "archive:inventory-table.template.json" }]),
+        phase("Verify", [{ kind: "wait-for-stack", stack: "inventory-table" }]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp007/fail/orders-table.component.js

@@ -0,0 +1,11 @@
+import { phase } from "../../../../../../components/component.js";
+/** COMP007 fail case: identical phase/step-kind shape to inventory-table.component.ts — a declaration-sprawl hint (should reach for a preset). */
+export const ordersTable = {
+    name: "orders-table",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Apply", [{ kind: "cfn-deploy", template: "archive:orders-table.template.json" }]),
+        phase("Verify", [{ kind: "wait-for-stack", stack: "orders-table" }]),
+    ],
+};

package/dist/lint/rules/__fixtures__/comp/comp007/pass/orders-table.component.js

@@ -0,0 +1,10 @@
+import { phase } from "../../../../../../components/component.js";
+export const ordersTable = {
+    name: "orders-table",
+    archetype: "infra",
+    dependsOn: [],
+    deploy: [
+        phase("Apply", [{ kind: "cfn-deploy", template: "archive:orders-table.template.json", onReplace: "block" }]),
+        phase("Verify", [{ kind: "wait-for-stack", stack: "orders-table" }]),
+    ],
+};