@intentius/chant 0.45.0 → 0.49.0

package/src/lint/receipt-checks.ts

@@ -0,0 +1,93 @@
+import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth";
+import { isEffectReceipt } from "../effect-receipt";
+import { isSensitiveKey } from "../deep-observation";
+import { isResourceDeclarable } from "../declarable";
+
+/**
+ * COR023: Receipt Materializes Into a Plain Store (#1833, epic #1703)
+ *
+ * A receipt's materialization target must be a plain store — never a
+ * SecureString, a Secret, or any secret-capable kind. A receipt value is a
+ * witness (an existence marker or a `sha256:` digest,
+ * ../effect-receipt.ts), not a secret: parking it in a secret-capable store
+ * invites masking, rotation, and access-control semantics that defeat the
+ * observe-and-compare loop the receipt exists for, and quietly teaches
+ * readers that the value is sensitive when it must never be.
+ *
+ * This is the honest core half of the guard. Core recognizes receipts
+ * lexicon-independently through the marker (#1831) but cannot know what any
+ * lexicon's kinds mean, so it checks the two signals it does have, both
+ * reusing the secret-kind knowledge core already carries
+ * (SENSITIVE_KEY_PATTERNS, ../deep-observation.ts):
+ *
+ *  - the materialized `entityType` names a secret-capable kind
+ *    (`K8s::Core::Secret`, `AWS::SecretsManager::Secret`, ...);
+ *  - the declared props select a secret-capable variant of an otherwise
+ *    plain kind (a `Type`/`Kind` prop whose value matches secret/secure —
+ *    SSM's `Type: "SecureString"` is the canonical case).
+ *
+ * The concrete per-kind enforcement is each materialization row's job — the
+ * aws row (#1835) pins SSM to plain `String` at the source.
+ */
+
+/** Prop names that select a store variant. */
+const VARIANT_PROP = /^(type|kind)$/i;
+/** Variant values that make the store secret-capable. */
+const SECRET_VARIANT = /secret|secure/i;
+
+export const RECEIPT_PLAIN_STORE_CHECK_ID = "COR023";
+
+const receiptPlainStoreCheck: PostSynthCheck = {
+  id: RECEIPT_PLAIN_STORE_CHECK_ID,
+  description:
+    "An effect receipt's materialization target must be a plain store — never a secret-capable kind or variant",
+  check(ctx) {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const [name, entity] of ctx.entities) {
+      if (!isEffectReceipt(entity)) continue;
+
+      if (isSensitiveKey(entity.entityType)) {
+        diagnostics.push({
+          checkId: RECEIPT_PLAIN_STORE_CHECK_ID,
+          severity: "error",
+          entity: name,
+          lexicon: entity.lexicon,
+          message:
+            `Effect receipt "${name}" materializes into secret-capable kind "${entity.entityType}" — ` +
+            `a receipt's target must be a plain store. The receipt value is a witness ` +
+            `(an existence marker or a sha256 digest), not a secret; a secret-capable store adds ` +
+            `masking and rotation semantics that defeat the receipt's observe-and-compare loop.`,
+        });
+        continue;
+      }
+
+      if (isResourceDeclarable(entity) && typeof entity.props === "object" && entity.props !== null) {
+        for (const [key, value] of Object.entries(entity.props as Record<string, unknown>)) {
+          if (VARIANT_PROP.test(key) && typeof value === "string" && SECRET_VARIANT.test(value)) {
+            diagnostics.push({
+              checkId: RECEIPT_PLAIN_STORE_CHECK_ID,
+              severity: "error",
+              entity: name,
+              lexicon: entity.lexicon,
+              message:
+                `Effect receipt "${name}" (${entity.entityType}) declares ${key}: "${value}" — ` +
+                `a secret-capable store variant. A receipt's target must be a plain store; ` +
+                `use the plain variant (e.g. SSM Type: "String") so the witness value stays ` +
+                `readable to the observe-and-compare loop.`,
+            });
+          }
+        }
+      }
+    }
+    return diagnostics;
+  },
+};
+
+/**
+ * Core's own post-synth checks over effect receipts, run by `chant build`
+ * over the full build result (plugin checks are lexicon-scoped; receipts are
+ * recognized by marker, so this set is deliberately not).
+ */
+export function coreReceiptChecks(): PostSynthCheck[] {
+  return [receiptPlainStoreCheck];
+}

package/src/lint/rule.ts

@@ -49,6 +49,21 @@ export interface LintDiagnostic {
   fix?: LintFix;
 }
 
+/**
+ * The slice of the project's `chant.config` a config-aware rule reads
+ * (#1221) — threaded into {@link LintContext} by `runLint` when the caller
+ * resolved the project's config (`chant lint` does; a bare unit test or the
+ * LSP's single-file lint may not). Structurally mirrors the corresponding
+ * `ChantConfig` fields (../config.ts) without importing them, so `rule.ts`
+ * stays dependency-light for lexicon rule authors.
+ */
+export interface LintProjectConfig {
+  /** Declared environments — a bare name or `{ name, endpoint }` (#1166). */
+  environments?: Array<string | { name: string; endpoint?: string }>;
+  /** Ownership marking config — `env` is a literal or a build-parameter reference (#1396). */
+  ownership?: { stack?: string; env?: string | { param: string }; enabled?: boolean };
+}
+
 /**
  * Context provided to lint rules during checking
  */
@@ -74,6 +89,14 @@ export interface LintContext {
    * call is a violation.
    */
   intrinsics?: readonly IntrinsicDef[];
+  /**
+   * chant #1221 — the project's resolved config slice for config-aware rules
+   * (COR021 reads `environments` + `ownership`). Threaded from `runLint`;
+   * undefined when the caller never loaded a project config (a unit test
+   * constructing a context directly, the LSP's single-file path), in which
+   * case config-aware rules stay silent.
+   */
+  projectConfig?: LintProjectConfig;
 }
 
 /**

package/src/lint/rules/cor021-env-literal-name.test.ts

@@ -0,0 +1,128 @@
+import { describe, test, expect } from "vitest";
+import * as ts from "typescript";
+import { cor021EnvLiteralNameRule } from "./cor021-env-literal-name";
+import type { LintContext, LintProjectConfig } from "../rule";
+
+const MULTI_ENV_PARAM_BOUND: LintProjectConfig = {
+  environments: ["dev", "prod"],
+  ownership: { stack: "billing", env: { param: "env" } },
+};
+
+function createContext(code: string, projectConfig?: LintProjectConfig, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined, projectConfig };
+}
+
+describe("COR021: literal name in a multi-environment project (#1221)", () => {
+  test("rule metadata", () => {
+    expect(cor021EnvLiteralNameRule.id).toBe("COR021");
+    expect(cor021EnvLiteralNameRule.severity).toBe("warning");
+    expect(cor021EnvLiteralNameRule.category).toBe("correctness");
+  });
+
+  test("flags a bare string literal in a *Name property", () => {
+    const ctx = createContext(
+      `export const uploads = new Bucket({ bucketName: "billing-uploads" });`,
+      MULTI_ENV_PARAM_BOUND,
+    );
+    const diags = cor021EnvLiteralNameRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("COR021");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].message).toContain('"billing-uploads"');
+    expect(diags[0].message).toContain("params.env");
+  });
+
+  test("flags a bare `name` property, nested objects included", () => {
+    const ctx = createContext(
+      `export const svc = new Service({ metadata: { name: "web" } });`,
+      MULTI_ENV_PARAM_BOUND,
+    );
+    const diags = cor021EnvLiteralNameRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('name: "web"');
+  });
+
+  test("flags a no-substitution template literal the same as a string literal", () => {
+    const ctx = createContext(
+      "export const uploads = new Bucket({ bucketName: `billing-uploads` });",
+      MULTI_ENV_PARAM_BOUND,
+    );
+    expect(cor021EnvLiteralNameRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("passes a template literal interpolating the env parameter", () => {
+    const ctx = createContext(
+      "export const uploads = new Bucket({ bucketName: `billing-${params.env}-uploads` });",
+      MULTI_ENV_PARAM_BOUND,
+    );
+    expect(cor021EnvLiteralNameRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes non-name properties and non-literal name values", () => {
+    const ctx = createContext(
+      `
+        const shared = { prefix: "billing" };
+        export const uploads = new Bucket({ bucketName: shared.prefix, region: "us-east-1" });
+      `,
+      MULTI_ENV_PARAM_BOUND,
+    );
+    expect(cor021EnvLiteralNameRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("silent when ownership.env is a literal", () => {
+    const ctx = createContext(
+      `export const uploads = new Bucket({ bucketName: "billing-uploads" });`,
+      { environments: ["dev", "prod"], ownership: { stack: "billing", env: "prod" } },
+    );
+    expect(cor021EnvLiteralNameRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("silent when ownership.env is absent", () => {
+    const ctx = createContext(
+      `export const uploads = new Bucket({ bucketName: "billing-uploads" });`,
+      { environments: ["dev", "prod"], ownership: { stack: "billing" } },
+    );
+    expect(cor021EnvLiteralNameRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("silent with fewer than two declared environments", () => {
+    const oneEnv = createContext(
+      `export const uploads = new Bucket({ bucketName: "billing-uploads" });`,
+      { environments: ["prod"], ownership: { stack: "billing", env: { param: "env" } } },
+    );
+    expect(cor021EnvLiteralNameRule.check(oneEnv)).toHaveLength(0);
+
+    const noEnvs = createContext(
+      `export const uploads = new Bucket({ bucketName: "billing-uploads" });`,
+      { ownership: { stack: "billing", env: { param: "env" } } },
+    );
+    expect(cor021EnvLiteralNameRule.check(noEnvs)).toHaveLength(0);
+  });
+
+  test("silent without a project config on the context", () => {
+    const ctx = createContext(`export const uploads = new Bucket({ bucketName: "billing-uploads" });`);
+    expect(cor021EnvLiteralNameRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("names the bound parameter, whatever it is called", () => {
+    const ctx = createContext(
+      `export const uploads = new Bucket({ bucketName: "billing-uploads" });`,
+      { environments: ["dev", "prod"], ownership: { stack: "billing", env: { param: "stage" } } },
+    );
+    const diags = cor021EnvLiteralNameRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("params.stage");
+  });
+
+  test("object-form environments entries count toward the threshold", () => {
+    const ctx = createContext(
+      `export const uploads = new Bucket({ bucketName: "billing-uploads" });`,
+      {
+        environments: ["prod", { name: "floci", endpoint: "http://localhost:4566" }],
+        ownership: { stack: "billing", env: { param: "env" } },
+      },
+    );
+    expect(cor021EnvLiteralNameRule.check(ctx)).toHaveLength(1);
+  });
+});

package/src/lint/rules/cor021-env-literal-name.ts

@@ -0,0 +1,114 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic, LintProjectConfig } from "../rule";
+
+/**
+ * COR021: Literal Name in a Multi-Environment Project (#1221)
+ *
+ * A project that declares two or more `environments` and binds its ownership
+ * marker to a build parameter (`ownership.env: { param: "env" }`) is built
+ * once per environment — and every physical name that does not vary with
+ * that parameter is the SAME name in every build. The collision is silent at
+ * build time and only surfaces at apply time, when the second environment's
+ * deploy walks over the first's resources.
+ *
+ * This rule warns on the declaration: a name-bearing property (`name`, or a
+ * `*Name` property like `bucketName`) whose value is a bare string literal,
+ * in a project shaped for per-environment builds. The fix is interpolation —
+ * `` `billing-${params.env}-uploads` `` — which folds to a per-environment
+ * literal because build parameters resolve before any file is imported
+ * (#1064). See the resource-naming guide's multi-environment section.
+ *
+ * Deliberately silent when:
+ * - no project config was threaded (a bare unit test, the LSP single-file path),
+ * - the project declares fewer than two environments (nothing to collide),
+ * - `ownership.env` is not param-bound — a literal `ownership.env` (or none)
+ *   means the project is not doing per-environment builds from one source
+ *   tree, so per-instance names are presumably managed another way (the
+ *   layered-config all-in-one pattern hand-names each instance),
+ * - the value is anything other than a bare string literal — a template
+ *   interpolating `params.<name>` is the fixed shape, and other non-literal
+ *   values are EVL territory, not this rule's.
+ */
+
+/** Does this property name carry a physical resource name — `name` or a camelCase `*Name`? */
+function isNameBearingProperty(propName: string): boolean {
+  return propName === "name" || /^[a-z][A-Za-z0-9]*Name$/.test(propName);
+}
+
+/** The property's declared name, for Identifier and string-literal keys; undefined for computed keys. */
+function propertyName(prop: ts.PropertyAssignment): string | undefined {
+  if (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) return prop.name.text;
+  return undefined;
+}
+
+/** Whether the rule's preconditions hold: 2+ declared environments and a param-bound ownership.env. */
+function projectIsMultiEnvParamBound(config: LintProjectConfig | undefined): string | undefined {
+  const env = config?.ownership?.env;
+  const paramBound = typeof env === "object" && env !== null && typeof env.param === "string";
+  if (!paramBound) return undefined;
+  if ((config?.environments?.length ?? 0) < 2) return undefined;
+  return env.param;
+}
+
+/** Walk an object literal (nested included, e.g. k8s `metadata: { name }`), flagging literal name-bearing values. */
+function checkObjectLiteral(
+  obj: ts.ObjectLiteralExpression,
+  paramName: string,
+  context: LintContext,
+  diagnostics: LintDiagnostic[],
+): void {
+  for (const prop of obj.properties) {
+    if (!ts.isPropertyAssignment(prop)) continue;
+    const name = propertyName(prop);
+    const value = prop.initializer;
+    if (
+      name !== undefined &&
+      isNameBearingProperty(name) &&
+      (ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value))
+    ) {
+      const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+        value.getStart(context.sourceFile),
+      );
+      diagnostics.push({
+        file: context.filePath,
+        line: line + 1,
+        column: character + 1,
+        ruleId: "COR021",
+        severity: "warning",
+        message:
+          `Literal ${name}: "${value.text}" in a multi-environment project — every environment's build ` +
+          `produces this same physical name, so two deployed environments collide. Interpolate the env ` +
+          `parameter: \`${value.text}-\${params.${paramName}}\` (see the resource-naming guide's ` +
+          `multi-environment section).`,
+      });
+    }
+    if (ts.isObjectLiteralExpression(value)) {
+      checkObjectLiteral(value, paramName, context, diagnostics);
+    }
+  }
+}
+
+function checkNode(node: ts.Node, paramName: string, context: LintContext, diagnostics: LintDiagnostic[]): void {
+  if (ts.isNewExpression(node) && node.arguments && node.arguments.length > 0) {
+    const firstArg = node.arguments[0];
+    if (ts.isObjectLiteralExpression(firstArg)) {
+      checkObjectLiteral(firstArg, paramName, context, diagnostics);
+    }
+  }
+  ts.forEachChild(node, (child) => checkNode(child, paramName, context, diagnostics));
+}
+
+export const cor021EnvLiteralNameRule: LintRule = {
+  id: "COR021",
+  severity: "warning",
+  category: "correctness",
+  description:
+    "In a multi-environment project with a param-bound ownership.env, name-bearing properties should interpolate the env parameter, not hold a bare literal",
+  check(context: LintContext): LintDiagnostic[] {
+    const paramName = projectIsMultiEnvParamBound(context.projectConfig);
+    if (paramName === undefined) return [];
+    const diagnostics: LintDiagnostic[] = [];
+    checkNode(context.sourceFile, paramName, context, diagnostics);
+    return diagnostics;
+  },
+};

package/src/lint/rules/cor022-receipt-leaf.test.ts

@@ -0,0 +1,116 @@
+import { describe, test, expect } from "vitest";
+import * as ts from "typescript";
+import { cor022ReceiptLeafRule, collectReceiptVariables } from "./cor022-receipt-leaf";
+import type { LintContext } from "../rule";
+
+function createContext(code: string, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined };
+}
+
+describe("COR022: effect receipt is a leaf (#1833)", () => {
+  test("rule metadata", () => {
+    expect(cor022ReceiptLeafRule.id).toBe("COR022");
+    expect(cor022ReceiptLeafRule.severity).toBe("error");
+    expect(cor022ReceiptLeafRule.category).toBe("correctness");
+  });
+
+  test("flags a property access on a receipt inside another declarable", () => {
+    const ctx = createContext(`
+      export const seeded = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const app = new Service({ marker: seeded.effect });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("COR022");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain('"seeded" is an effect receipt');
+    expect(diags[0].message).toContain('"effect"');
+    expect(diags[0].message).toContain("sole writer");
+  });
+
+  test("const indirection fires: const r = EffectReceipt(...); other.prop = r.something", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("migrated", { effect: "schema-migrate", flavor: "hash" });
+      export const other = new Store({});
+      other.prop = r.something;
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"r" is an effect receipt');
+    expect(diags[0].message).toContain('"something"');
+  });
+
+  test("an alias of a receipt is still the receipt", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("migrated", { effect: "schema-migrate", flavor: "existence" });
+      const alias = r;
+      export const svc = new Service({ tag: alias.name });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"alias"');
+  });
+
+  test("element access fires like property access", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const svc = new Service({ tag: r["effect"] });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"effect"');
+  });
+
+  test("namespaced factory call is recognized", () => {
+    const ctx = createContext(`
+      const r = chant.EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const svc = new Service({ tag: r.effect });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("passes: a receipt that nothing dereferences", () => {
+    const ctx = createContext(`
+      import { EffectReceipt } from "@intentius/chant";
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { schema: "v3" },
+      });
+      export const app = new Service({ image: "app:1" });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: referencing the receipt value itself (no attribute access)", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      registerReceipt(r);
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: property access on a non-receipt declarable", () => {
+    const ctx = createContext(`
+      export const db = new Database({ name: "main" });
+      export const app = new Service({ endpoint: db.endpoint });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("collectReceiptVariables resolves aliases declared before the receipt", () => {
+    const sf = ts.createSourceFile(
+      "t.ts",
+      `
+      const early = late;
+      const late = EffectReceipt("r", { effect: "e", flavor: "existence" });
+      `,
+      ts.ScriptTarget.Latest,
+      true,
+    );
+    const vars = collectReceiptVariables(sf);
+    expect(vars.has("late")).toBe(true);
+    expect(vars.has("early")).toBe(true);
+  });
+});

package/src/lint/rules/cor022-receipt-leaf.ts

@@ -0,0 +1,130 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic } from "../rule";
+
+/**
+ * COR022: Effect Receipt Is a Leaf (#1833, epic #1703)
+ *
+ * Nothing may reference an effect receipt's attributes. A receipt is the
+ * declared witness that an out-of-band effect ran — the `effect()` step
+ * (#1834) is its sole writer, on success, last (../../effect-receipt.ts).
+ * Any resource that derives a property from a receipt couples itself to a
+ * value only the effect controls: the coupling is invisible at synthesis,
+ * and the receipt's late write (or its absence after a crash) would ripple
+ * into resources that were supposed to be independent of whether the effect
+ * has fired yet.
+ *
+ * The rule walks the file's reference graph the way COR011 does: it collects
+ * every variable initialized from an `EffectReceipt(...)` call (aliases
+ * included — `const alias = receipt` is still the receipt), then flags every
+ * property or element access rooted at one of them. Const indirection fires:
+ *
+ *   const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+ *   other.prop = r.something;   // COR022
+ *
+ * Referencing the receipt VALUE (passing `r` itself around) is not flagged —
+ * the leaf constraint is about attributes, and lexicon materialization rows
+ * legitimately take the whole declaration.
+ *
+ * Core recognizes the factory call by name; a lexicon-materialized receipt
+ * row (#1835) is recognized at build time by its marker instead — this rule
+ * is the source-level half.
+ */
+
+/** Simple callee name of a call: `EffectReceipt(...)` or `chant.EffectReceipt(...)`. */
+function calleeName(expr: ts.CallExpression): string | undefined {
+  if (ts.isIdentifier(expr.expression)) return expr.expression.text;
+  if (ts.isPropertyAccessExpression(expr.expression)) return expr.expression.name.text;
+  return undefined;
+}
+
+/** A variable declaration's `EffectReceipt(...)` initializer, if that is what it is. */
+export function receiptFactoryCall(decl: ts.VariableDeclaration): ts.CallExpression | undefined {
+  if (!decl.initializer || !ts.isCallExpression(decl.initializer)) return undefined;
+  return calleeName(decl.initializer) === "EffectReceipt" ? decl.initializer : undefined;
+}
+
+/**
+ * Every variable name bound to an effect receipt in this file: direct
+ * `EffectReceipt(...)` initializers plus identifier aliases, resolved to a
+ * fixpoint so declaration order does not matter. Scope-naive by design, the
+ * same trade COR011 makes — a chant source file is flat declarations.
+ */
+export function collectReceiptVariables(sourceFile: ts.SourceFile): Set<string> {
+  const receipts = new Set<string>();
+  const aliases: Array<[string, string]> = [];
+
+  function visit(node: ts.Node): void {
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+      if (receiptFactoryCall(node)) {
+        receipts.add(node.name.text);
+      } else if (ts.isIdentifier(node.initializer)) {
+        aliases.push([node.name.text, node.initializer.text]);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const [name, source] of aliases) {
+      if (receipts.has(source) && !receipts.has(name)) {
+        receipts.add(name);
+        grew = true;
+      }
+    }
+  }
+  return receipts;
+}
+
+/** The accessed attribute's name, for the message: `r.something` → "something". */
+function accessedAttribute(node: ts.PropertyAccessExpression | ts.ElementAccessExpression): string {
+  if (ts.isPropertyAccessExpression(node)) return node.name.text;
+  const arg = node.argumentExpression;
+  return ts.isStringLiteralLike(arg) ? arg.text : "<computed>";
+}
+
+export const cor022ReceiptLeafRule: LintRule = {
+  id: "COR022",
+  severity: "error",
+  category: "correctness",
+  description:
+    "An effect receipt is a leaf — nothing may reference its attributes; the effect() step is the receipt's sole writer",
+  check(context: LintContext): LintDiagnostic[] {
+    const receipts = collectReceiptVariables(context.sourceFile);
+    if (receipts.size === 0) return [];
+
+    const diagnostics: LintDiagnostic[] = [];
+
+    function visit(node: ts.Node): void {
+      if (
+        (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) &&
+        ts.isIdentifier(node.expression) &&
+        receipts.has(node.expression.text)
+      ) {
+        const receipt = node.expression.text;
+        const attribute = accessedAttribute(node);
+        const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+          node.getStart(context.sourceFile),
+        );
+        diagnostics.push({
+          file: context.filePath,
+          line: line + 1,
+          column: character + 1,
+          ruleId: "COR022",
+          severity: "error",
+          message:
+            `"${receipt}" is an effect receipt — a receipt is a leaf, and nothing may reference its ` +
+            `attributes ("${attribute}" here). The effect() step is the receipt's sole writer, so a ` +
+            `property derived from it couples this resource to a value only the effect controls. ` +
+            `Reference the effect's inputs (or the resources they come from) directly instead.`,
+        });
+      }
+      ts.forEachChild(node, visit);
+    }
+    visit(context.sourceFile);
+
+    return diagnostics;
+  },
+};