@intentius/chant-lexicon-terraform 0.101.0 → 0.102.0

package/dist/codegen/package.d.ts

@@ -5,7 +5,7 @@ export declare function packageLexicon(options?: {
     verbose?: boolean;
     force?: boolean;
 }): Promise<{
-    spec: import("packages/core/src").BundleSpec;
+    spec: import("@intentius/chant").BundleSpec;
     stats: {
         resources: number;
         properties: number;

package/dist/config.d.ts

@@ -101,9 +101,9 @@ export declare const terraformConfigSchema: z.ZodObject<{
      * binary alone runs the root stock, exactly as `terraform`/`tofu` do.
      */
     binary: z.ZodOptional<z.ZodEnum<{
+        choudoufu: "choudoufu";
         terraform: "terraform";
         tofu: "tofu";
-        choudoufu: "choudoufu";
     }>>;
     /**
      * How far a root's parse follows its `module` calls (#2112), spelled the
@@ -114,9 +114,9 @@ export declare const terraformConfigSchema: z.ZodObject<{
      * nothing. See `hcl/descend.ts`.
      */
     callModuleType: z.ZodOptional<z.ZodEnum<{
-        none: "none";
-        local: "local";
         all: "all";
+        local: "local";
+        none: "none";
     }>>;
     /**
      * The directory a root's local module sources may resolve within (#2874),

package/dist/hcl/jsonencode.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Read the argument of a `jsonencode(...)` call as structure, when it is
+ * literal (chant #2286, shared with #2287).
+ *
+ * hcl2json does not evaluate expressions. `policy = jsonencode({...})` and
+ * `container_definitions = jsonencode([...])` both reach a block body as ONE
+ * string holding the expression's source text, wrapped as an interpolation:
+ *
+ * ```
+ * "${jsonencode({\n    Version = \"2012-10-17\"\n    Statement = [{ Action = \"*\" }]\n  })}"
+ * ```
+ *
+ * The text inside is HCL object syntax, not JSON (`=` or `:` separators, bare
+ * keys, newline-separated items, `#` comments). A rule that wants the policy
+ * or the container definitions has to read that text itself. This file does
+ * so, narrowly: it accepts literal objects, tuples, quoted strings, numbers,
+ * `true`, `false` and `null`, and nothing else. Any expression in the
+ * argument (a reference, a function call, a for-expression, a splat, a
+ * conditional, an operator, a template interpolation inside a string, a
+ * heredoc, a parenthesised key) makes the whole read `not-determined`, with a
+ * reason naming what was found. It never evaluates anything, so it can never
+ * return a value Terraform would not also produce from the same text.
+ *
+ * Three answers:
+ * - `literal`: the value is a single whole-string `${jsonencode(...)}` and
+ *   its argument is fully literal. `value` is the plain JS value
+ *   `jsonencode` would encode.
+ * - `not-determined`: the value is a `${jsonencode(...)}` call, but the
+ *   argument holds something this reader does not evaluate.
+ * - `not-jsonencode`: the value is not a `${jsonencode(...)}` call at all
+ *   (a plain string, a reference, `file(...)`, a number, absent). Callers
+ *   decide what that means for their attribute; a plain string, for example,
+ *   may itself be JSON from a heredoc.
+ *
+ * The whole-string test is shape-based: the string starts `${jsonencode(` and
+ * ends `)}`. A string that matches that shape but is really a template with
+ * two interpolations (`${jsonencode(a)}-${jsonencode(b)}`) fails the literal
+ * parse at the point where the first call closes early, and reads as
+ * `not-determined`, never as `literal`.
+ */
+export type JsonencodeRead = 
+/** The argument is a fully literal HCL object/tuple/string/number/bool/null tree. */
+{
+    kind: "literal";
+    value: unknown;
+}
+/** `jsonencode(...)` whose argument contains a reference, function call, for-expression, splat, conditional, etc. */
+ | {
+    kind: "not-determined";
+    reason: string;
+}
+/** The value is not a single whole-string `${jsonencode(...)}` at all. */
+ | {
+    kind: "not-jsonencode";
+};
+export interface ReadJsonencodeOptions {
+    /**
+     * Read past a non-literal VALUE instead of giving up on the whole argument.
+     * Each such value (a reference, a function call, a conditional, an
+     * interpolated string, a heredoc, any other expression) becomes an
+     * {@link UnknownLeaf} in the returned tree, so a rule can still read the
+     * literal fields beside it: `Action = "*"` next to
+     * `Resource = aws_s3_bucket.x.arn`, or a container's literal `environment`
+     * next to `image = var.image`.
+     *
+     * The skip is narrow. It consumes one value expression, balancing `()[]{}`
+     * and quoted strings, up to the next `,`, newline or closing bracket at its
+     * own depth. A member whose KEY is an expression (an interpolated quoted
+     * key or a parenthesised computed key) is dropped from its object and listed
+     * under {@link UNKNOWN_KEYS} on that object. Damage to the STRUCTURE is
+     * still `not-determined`: an expression as the whole argument, including
+     * a for-expression or a splat (`jsonencode(local.policy)`,
+     * `jsonencode(var.x[*])`), since then no key or element is known.
+     */
+    unknownLeaves?: boolean;
+}
+/** Marks a value position `readJsonencode(raw, { unknownLeaves: true })` could not read. */
+export declare const UNKNOWN: unique symbol;
+/** A value position holding an expression; `reason` names what was found there. */
+export interface UnknownLeaf {
+    readonly [UNKNOWN]: true;
+    readonly reason: string;
+    /**
+     * The skipped expression's own source text, trimmed (`aws_s3_bucket.x.arn`,
+     * `"arn:aws:s3:::${var.bucket}/*"` with its quotes). A rule may read it to
+     * rule a value OUT (a quoted template whose literal text already differs
+     * from the value it looks for), never to evaluate it.
+     */
+    readonly source: string;
+}
+/**
+ * Marks an object, read with `unknownLeaves`, that had members whose KEY is an
+ * expression (`"router-${var.n}.rule" = ...`, `(var.k) = ...`). Those members
+ * are dropped from the object and their reasons listed here, so a reader can
+ * tell "this key is absent" from "some key here could not be read".
+ */
+export declare const UNKNOWN_KEYS: unique symbol;
+/** Whether `obj` is an object that dropped one or more members with an expression key. */
+export declare function hasUnknownKeys(obj: unknown): obj is Record<string, unknown> & {
+    [UNKNOWN_KEYS]: string[];
+};
+/** Whether `v` is a value position the reader skipped. */
+export declare function isUnknown(v: unknown): v is UnknownLeaf;
+/** Read `raw` (an hcl2json attribute value) as a `jsonencode(...)` call. */
+export declare function readJsonencode(raw: unknown, options?: ReadJsonencodeOptions): JsonencodeRead;
+//# sourceMappingURL=jsonencode.d.ts.map

package/dist/hcl/jsonencode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonencode.d.ts","sourceRoot":"","sources":["../../src/hcl/jsonencode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,MAAM,cAAc;AACxB,qFAAqF;AACnF;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE;AACrC,qHAAqH;GACnH;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC5C,0EAA0E;GACxE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE/B,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,4FAA4F;AAC5F,eAAO,MAAM,OAAO,EAAE,OAAO,MAAqC,CAAC;AAEnE,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,OAAO,MAAyC,CAAC;AAE5E,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAO1G;AAED,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,WAAW,CAEtD;AAKD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,qBAA0B,GAAG,cAAc,CAmBhG"}

package/dist/hcl/marker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"marker.d.ts","sourceRoot":"","sources":["../../src/hcl/marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,kGAAkG;AAClG,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAEjD,mFAAmF;AACnF,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,iEAInC,CAAC;AA4CX;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAkBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO/D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED,iEAAiE;AACjE,MAAM,MAAM,aAAa;AACvB,sFAAsF;AACpF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AACnE,8FAA8F;GAC5F;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE;AACrB;;;;GAIG;GACD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAgB9F;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,GAAG,aAAa,CAe9F"}
+{"version":3,"file":"marker.d.ts","sourceRoot":"","sources":["../../src/hcl/marker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,kGAAkG;AAClG,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAEjD,mFAAmF;AACnF,eAAO,MAAM,eAAe,cAAc,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,YAC3C,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,CACR,CAAC;AA4CX;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAkBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO/D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEjF;AAED,iEAAiE;AACjE,MAAM,MAAM,aAAa;AACvB,sFAAsF;AACpF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AACnE,8FAA8F;GAC5F;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE;AACrB;;;;GAIG;GACD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAgB9F;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,GAAG,aAAa,CAe9F"}

package/dist/integrity.json

@@ -1,11 +1,12 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "9560691f509a16c8f0dca2b8464f1784aa1463d9d56a6c2c7fb9a02a1988de4d",
+    "manifest.json": "d7619e357f8ddb66f17dd8331e2f4024d6a5b9d5e2bbf9fb1434d90eae5000a3",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
     "rules/blocks.ts": "d69f65c13b44ff425ccd465644f41c160e07b4c221bd60698d3ec84bf5d9cef8",
+    "rules/flat-attributes.ts": "135b4b118cb76ea7ef7a6f2851bb5c80d0907485b86a364c017f66388d0d4cb2",
     "rules/module-source.ts": "147025cf53eba006473ddcb771bf7452928fc476e6daee10bbb86bcc7ee3848a",
     "rules/scope.ts": "a6d327d821f219c98a9d4ae6e6eed6325f3d3edf6286f3622b41be591d190dc8",
     "rules/tf001.ts": "1f07f0f9172a7ddb9c726ba4be1bea08e54e25701fbe59cc54c3cf4401aca999",
@@ -36,7 +37,15 @@
     "rules/tf027.ts": "0a6062a230cdaa707f82b2353be4b34dff81322d24075d46f732a47bcef15893",
     "rules/tf028.ts": "81ef95659c40ad1774c83e663473ed769143d894a4ba0517c3defa31f00ba723",
     "rules/tf029.ts": "52e02b4921a64f3f928836896b8b80682400adb50bd7a0645f3fe2e8819433c2",
+    "rules/tf030.ts": "02aa051ad7ce95d2ed4df4f529a0d979bffe8765b54d0f402d2ced97a2d6c28b",
+    "rules/tf031.ts": "f4b05c45988ad816161c6c842e87206a3c3dd5bcefcfbed99451f5c582d8c453",
+    "rules/tf032.ts": "e31a5531d60c0bd42844b0600c9353d503f16cec9a74ca8a7b5001539d81dd7e",
+    "rules/tf033.ts": "84774cd31409f33325b09bfb1d3e9a6f20eeb961a52217948331cf801479c6f1",
+    "rules/tf034.ts": "7d5770d3f654e900b7275906646c541444bcdd5d92289b7bcc15bc10198d3a4c",
+    "rules/tf035.ts": "2514b58731114a29c1a447a173d138c7e442ecb2a180da49929e1899ac6fd188",
+    "rules/tf036.ts": "94fd91568341b6868ecd090772b93e675d2084547ae919586a496b9cb8a8f47b",
+    "rules/tf037.ts": "d6fc1e8ab4478f7983f28c6679f56a3fcfe5f6a5fb2402981bbca98114b486bf",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "00b0a8be3f5266c34cac292348884094414470053a029a5fb87ef86a44dfa35e"
+  "composite": "5cedcb8fdfd0bee9e59a770470ef1207999c624e87595866029b40b70ad8c96b"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAe1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0S1D,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+D1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA8Y1D,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -56,7 +56,7 @@
  * | `tflint-ruleset-redeploy` | tflint-ruleset-redeploy | https://github.com/RedeployAB/tflint-ruleset-redeploy | 0BSD | scanner | Community ruleset; richest source of language-level rules outside the official set. Sweep: indexed from `docs/rules/README.md`, same table shape (33 rules). |
  * | `tflint-ruleset-avm` | tflint-ruleset-avm | https://github.com/Azure/tflint-ruleset-avm | MIT | scanner | Azure Verified Modules conformance; two of its 33 rules are provider-agnostic. Sweep: indexed from the repository-root `RULES.md`, since `docs/` holds pages for only two rules (33 rules). |
  * | `tfsec` | tfsec | https://github.com/aquasecurity/tfsec | MIT | scanner | Historical: not archived but effectively frozen (no release since 2025-05); its docs site 404s above v0.61.x, so cite pinned repository paths (`github.com/aquasecurity/tfsec/blob/master/docs/checks/...`), not the docs site. Sweep: indexed from the root `rules.md` on `master`, a flat table of all 152 check ids, because `docs/checks` nests a directory per provider, service and check. |
- * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. Sweep: not registered in `PRIOR_ART` (no rule cites it yet) and its `long_id`s live in Rego metadata under `checks/<kind>/<provider>/<service>/`, with no flat index. |
+ * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. Sweep: registered in `PRIOR_ART` since TF030 (#2285) cited `aws-ec2-no-public-ingress-sgr` (TF032 also cites `aws-ecs-no-plaintext-secrets`, AWS-0036), but not swept: its `long_id`s live in Rego metadata under `checks/<kind>/<provider>/<service>/`, with no flat index. Check a cited id is live: TF031's counterpart, `aws-iam-no-policy-wildcards`, is a `deprecated: true` stub with no rule body, so TF031 does not cite it. |
  * | `terraform-sentinel-policies` | HashiCorp reference Sentinel policies | https://github.com/hashicorp/terraform-sentinel-policies | MPL-2.0 | specification | HashiCorp's own example policy set; ships zero rules baked into HCP Terraform itself, so treat a cited policy as a documented pattern (`specification`) unless a future entry runs it as a real check (`scanner`); the `kind` union allows either. Sweep: indexed by listing the five per-cloud directories, whose `.sentinel` filenames are the policy ids credits cite (73 policies); the repository publishes no index page. |
  * | `choudoufu` | choudoufu | https://github.com/INTENTIUS/choudoufu | MPL-2.0 | scanner | Its `internal/live/lint` package; experimental, AWS-only. Sweep: unsweepable, its rule ids are Go constants in `internal/live/lint/issue.go` and it publishes no rule index. |
  * | `hashicorp-style-guide` | HashiCorp Terraform style guide | https://developer.hashicorp.com/terraform/language/style | n/a | specification | Sweep: unsweepable, one prose page of recommendations with no rule ids; a credit quotes the sentence and links its fragment. |

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CA0R3D,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAob3D,CAAC"}

package/dist/lint/post-synth/flat-attributes.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Shared reading helpers for TF033-TF037, the five flat encryption and
+ * immutability rules (chant #2288, epic #2284).
+ *
+ * Each of those rules reads one or two scalar attributes of one resource type
+ * and answers a three-valued question: the literal proves the resource
+ * secure, the literal proves it insecure, or the parse cannot tell. This
+ * module is the reading half; each rule file holds its own answer for
+ * absence, because that answer differs per resource (see each rule's doc
+ * comment and its section of `docs/pages/lint-rules.mdx`). It exports no
+ * `PostSynthCheck`, so the generated barrel skips it.
+ */
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { type BlockBody } from "../../hcl/parse.js";
+import { nestedBodies, type TerraformBlock } from "./blocks.js";
+/** What one attribute read settles. `reason` says why a value could not be read. */
+export type Read<T> = {
+    kind: "known";
+    value: T;
+} | {
+    kind: "absent";
+} | {
+    kind: "unknown";
+    reason: string;
+};
+/** Every `resource` block of one provider type (`aws_sqs_queue`), in entity order. */
+export declare function resourcesOfType(ctx: PostSynthContext, type: string): TerraformBlock[];
+/**
+ * A bool attribute. Terraform converts the strings `"true"` and `"false"` to
+ * bool, so those read as the bool they convert to. Any other literal (a
+ * number, a list) is a plan-time type error, not this rule's concern, and
+ * reads as unknown.
+ */
+export declare function readBool(body: BlockBody, name: string): Read<boolean>;
+/** A string attribute, literal or not. */
+export declare function readString(body: BlockBody, name: string): Read<string>;
+/**
+ * Whether a key-like argument (`kms_master_key_id`) is set to something.
+ *
+ * - absent, or `null`: `absent`.
+ * - a literal: `known`, with the string (`""` is a value, and a rule decides
+ *   what an empty key means).
+ * - an attribute of a managed resource or data source (`aws_kms_key.x.arn`):
+ *   `known` and non-empty. The provider computes a key's id or ARN; it is
+ *   never the empty string, so the key is set whatever its value turns out to
+ *   be.
+ * - a template with literal text (`"alias/${var.env}-sns"`): `known` and
+ *   non-empty, for the same reason.
+ * - anything else (`var.kms_key`, `local.key`, a conditional, a function
+ *   call): `unknown`. A variable can be `null` or `""`.
+ */
+export declare function readKeySet(body: BlockBody, name: string): Read<string>;
+/**
+ * Whether an argument that names a source (`snapshot_identifier`,
+ * `replicate_source_db`) or a nested block (`restore_to_point_in_time`) is
+ * given. The provider reads these with `GetOk`, so a literal `""` is the same
+ * as leaving the argument out; anything else, a reference included, is given.
+ */
+export declare function isGiven(body: BlockBody, name: string): boolean;
+/** The bodies of a nested block, re-exported for the rule files. */
+export { nestedBodies };
+/** A finding the literal proves. */
+export declare function finding(checkId: string, severity: "error" | "warning", block: TerraformBlock, message: string): PostSynthDiagnostic;
+/**
+ * The one `info` diagnostic a rule emits when it cannot read the value it
+ * needs. The message starts `Not determined:`, as #2284 fixed for TF030-TF037.
+ */
+export declare function notDetermined(checkId: string, block: TerraformBlock, reason: string, tail: string): PostSynthDiagnostic;
+//# sourceMappingURL=flat-attributes.d.ts.map

package/dist/lint/post-synth/flat-attributes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flat-attributes.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/flat-attributes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC9F,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAgB,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAE3E,oFAAoF;AACpF,MAAM,MAAM,IAAI,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7G,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAErF;AASD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CASrE;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAQtE;AAWD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAiBtE;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAQ9D;AAED,oEAAoE;AACpE,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,oCAAoC;AACpC,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,OAAO,GAAG,SAAS,EAC7B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,GACd,mBAAmB,CAErB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAQvH"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA8BvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA6B3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAsCvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAqC3C,CAAC"}

package/dist/lint/post-synth/tf030.d.ts

@@ -0,0 +1,51 @@
+/**
+ * TF030: a security group rule opens a sensitive port to the whole internet.
+ *
+ * The native Terraform counterpart of the aws lexicon's WAW019 (#2285, under
+ * #2284), with the same port list and the same two open CIDRs. It cannot be a
+ * bridge to WAW019: the probe (docs/design/waw-hcl-fidelity-probe.md) ran the
+ * shipped WAW019 over a root opening 22, 3389, 3306 and 5432 to the world and
+ * got nothing back, because none of the three Terraform shapes looks like
+ * CloudFormation's `SecurityGroupIngress[].CidrIp`:
+ *
+ * - `ingress` on `aws_security_group`. The AWS provider types it as an
+ *   attribute, `set(object({...}))`, not a nested block, though HCL lets it
+ *   be written either way. hcl2json renders both spellings as one array of
+ *   rule objects, so one reader covers both. `cidr_blocks` and
+ *   `ipv6_cidr_blocks` are lists where CloudFormation has a scalar.
+ * - `aws_security_group_rule`, which is ingress only when `type = "ingress"`.
+ * - `aws_vpc_security_group_ingress_rule`, which spells the CIDR as the
+ *   scalars `cidr_ipv4` / `cidr_ipv6` and the protocol as `ip_protocol`.
+ *
+ * A rule is reported when three things are all proved by literals: it is
+ * ingress, a CIDR is `0.0.0.0/0` or `::/0`, and its ports reach a sensitive
+ * port. Protocol `-1` (or `"all"`) reaches every port whatever `from_port` and
+ * `to_port` say. `tcp`, `udp`, `6` and `17` reach the ports between
+ * `from_port` and `to_port` inclusive, so `0`-`65535` reaches all four.
+ * Anything else (`icmp`, `icmpv6`, a protocol number like `50`) has no ports
+ * and is never reported.
+ *
+ * Nothing here evaluates an expression. When the answer hangs on a value the
+ * parse hands back as a reference or a template (`cidr_blocks =
+ * var.allowed`, `from_port = var.ssh_port`, `ingress = local.rules`, a
+ * `dynamic "ingress"` block), the rule emits one `info` finding that starts
+ * `Not determined:` and names the attributes, per the convention fixed on
+ * #2284. It never guesses a warning or an error out of something it could
+ * not read. A fact that settles the rule on its own still settles it, so
+ * `cidr_blocks = var.x` on port 443 is silent: no CIDR makes 443 sensitive.
+ *
+ * Absence is safe for this rule, which is the easy case of #2284's
+ * three-valued question. An `aws_security_group` with no `ingress` admits
+ * nothing (the provider default is no rules), and its rules may live in
+ * standalone resources, which this check reads in their own right.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+/** The ports WAW019 treats as sensitive, with the name a message gives each. */
+export declare const SENSITIVE_PORTS: ReadonlyMap<number, string>;
+/** The two CIDRs that mean "every address". */
+export declare const OPEN_CIDRS: ReadonlySet<string>;
+export declare const tf030: PostSynthCheck;
+//# sourceMappingURL=tf030.d.ts.map

package/dist/lint/post-synth/tf030.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf030.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf030.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,gFAAgF;AAChF,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAKtD,CAAC;AAEH,+CAA+C;AAC/C,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAAkC,CAAC;AA0I9E,eAAO,MAAM,KAAK,EAAE,cAwFnB,CAAC"}

package/dist/lint/post-synth/tf031.d.ts

@@ -0,0 +1,55 @@
+/**
+ * TF031: an IAM policy allows a wildcard Action or a wildcard Resource
+ * (chant #2286, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW020, written natively
+ * against the parsed HCL rather than bridged (docs/design/waw-hcl-fidelity-probe.md
+ * explains why a bridge reported nothing here). WAW020 flags `Action: "*"`
+ * only; this rule also flags `Resource: "*"`, as #2286 asks and as tfsec's
+ * `aws-iam-no-policy-wildcards` does.
+ *
+ * What it reads. A policy argument in Terraform is a string, and hcl2json
+ * hands it over unevaluated, so the rule reads three shapes and no others:
+ *
+ * - `jsonencode({...})`: hcl2json keeps the call as the one string
+ *   `"${jsonencode({...})}"` with HCL object syntax inside. `readJsonencode`
+ *   (`../../hcl/jsonencode.ts`) reads the literal parts of that argument as
+ *   structure, leaving each expression in it as an opaque leaf.
+ * - a literal string, which is what a heredoc with no interpolation becomes in
+ *   the parse: the JSON text itself, read with `JSON.parse`.
+ * - a `data "aws_iam_policy_document"` block, whose `statement { actions,
+ *   resources, effect }` arrive as plain structure. A policy argument that is
+ *   exactly `data.aws_iam_policy_document.<name>.json` (or `.minified_json`)
+ *   naming a document declared in the same module is not reported again: the
+ *   document is checked where it is declared.
+ *
+ * The three-valued answer. A finding needs a literal that proves it: an
+ * `Allow` statement (the data source's default effect, or a literal
+ * `"Allow"`) whose Action or Resource is the literal `"*"` or a list holding
+ * it. A `Deny` statement never fires; `Deny` with `Action = "*"` is the usual
+ * guard rail. When the value the rule needs is not readable (a reference, a
+ * `file()` or `templatefile()` call, a template, a for-expression, a
+ * `dynamic "statement"`), the rule emits one `info` diagnostic starting
+ * `Not determined:` that names the attribute and why, and never a warning.
+ * A value that cannot be `"*"` whatever it evaluates to is not "not
+ * determined": an attribute of a managed resource or data source
+ * (`aws_s3_bucket.logs.arn`) or a template whose literal text already
+ * differs from `*` (`"arn:aws:s3:::${var.bucket}/*"`) is read as scoped.
+ *
+ * Absence. A resource with no policy argument, or a role with no
+ * `inline_policy`, is unconfigured, not insecure, and is not reported.
+ *
+ * In scope: `aws_iam_policy.policy`, `aws_iam_role_policy.policy`,
+ * `aws_iam_user_policy.policy`, `aws_iam_group_policy.policy`,
+ * `aws_iam_role.inline_policy[].policy`, `aws_iam_role.assume_role_policy`
+ * (WAW020 walks `AssumeRolePolicyDocument` too) and the
+ * `aws_iam_policy_document` data source. Resource-based policies (S3, SQS,
+ * KMS, VPC endpoint) are out of scope: there `Resource: "*"` usually means
+ * "this resource" and the risk sits in `Principal`.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf031: PostSynthCheck;
+//# sourceMappingURL=tf031.d.ts.map

package/dist/lint/post-synth/tf031.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf031.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf031.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAsR1C,eAAO,MAAM,KAAK,EAAE,cAkCnB,CAAC"}

package/dist/lint/post-synth/tf032.d.ts

@@ -0,0 +1,71 @@
+/**
+ * TF032: an ECS container definition passes a credential as a plaintext
+ * environment value.
+ *
+ * The Terraform counterpart of the aws lexicon's WAW046. A value under a
+ * container's `environment` is stored verbatim in the task definition: it is
+ * readable by anyone with `ecs:DescribeTaskDefinition`, it shows in the
+ * console, and it is in Terraform state and plan output. ECS has a field for
+ * exactly this, `secrets`, whose `valueFrom` is a Secrets Manager or SSM
+ * Parameter Store ARN that the agent resolves at task start. A credential
+ * belongs there.
+ *
+ * Why this is a native rule and not WAW046 through a bridge
+ * (docs/design/waw-hcl-fidelity-probe.md): `container_definitions` is a JSON
+ * string. In HCL it is almost always `jsonencode([...])`, which hcl2json hands
+ * back as the call's unevaluated source text, so the structure WAW046 reads
+ * does not exist in the parse until something reads that text.
+ * `../../hcl/jsonencode.ts` does, for literal structure only, and never
+ * evaluates anything.
+ *
+ * The three answers, per task definition:
+ *
+ * - Readable. `container_definitions` is `jsonencode([...])` whose list and
+ *   containers are literal, or a plain JSON string (a heredoc with no
+ *   interpolation is one). A reference or function call in a leaf
+ *   (`image = var.image`, `value = var.db_password`) does not stop the read:
+ *   that leaf is unknown and the literal fields beside it are still read. An
+ *   environment entry whose value is a reference is skipped, since a
+ *   reference is not a committed literal (TF007 and TF022 judge where the
+ *   referenced value comes from).
+ * - Violation. A readable environment entry whose `value` is a literal string
+ *   and is secret-shaped by `../secret-shape.ts`: a credential-looking name
+ *   with a literal of at least 8 characters that is not a placeholder, or a
+ *   value that is a credential on its own (a vendor key shape, a JWT, a PEM
+ *   key, a high-entropy token) whatever it is called.
+ * - Not determined. `container_definitions` is a reference
+ *   (`local.defs`, `data.template_file.x.rendered`), `file()`,
+ *   `templatefile()`, a heredoc or string with interpolation, a jsonencode
+ *   argument that is not a literal list (`jsonencode(concat(...))`,
+ *   `jsonencode(local.containers)`), or a container whose `environment` is an
+ *   expression (`environment = local.env`). One `info` diagnostic starting
+ *   `Not determined:` per task definition or container, never a warning.
+ *
+ * Absence: a container with no `environment` is not insecure, and a task
+ * definition with no `container_definitions` is not reported (the attribute
+ * is required, so that is a plan error, not this rule's finding). A name in
+ * `secrets` is never reported: `secrets` is not read at all.
+ *
+ * Findings never carry the value, only its length.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+/** The container definitions of one task definition, or why they cannot be read. */
+export type ContainerDefinitionsRead = {
+    kind: "readable";
+    containers: unknown;
+} | {
+    kind: "not-determined";
+    reason: string;
+} | {
+    kind: "absent";
+};
+/**
+ * Read `container_definitions` as structure without evaluating anything.
+ * `jsonencode(...)` goes through the shared reader with unknown leaves; a
+ * plain string with no interpolation is JSON (a heredoc arrives as one);
+ * everything else is named in the not-determined reason.
+ */
+export declare function readContainerDefinitions(body: Record<string, unknown>): ContainerDefinitionsRead;
+export declare function checkEcsPlaintextCredentials(ctx: PostSynthContext): PostSynthDiagnostic[];
+export declare const tf032: PostSynthCheck;
+//# sourceMappingURL=tf032.d.ts.map

package/dist/lint/post-synth/tf032.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf032.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf032.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAS1C,oFAAoF;AACpF,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,wBAAwB,CAsBhG;AA+BD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAuFzF;AAED,eAAO,MAAM,KAAK,EAAE,cAOnB,CAAC"}

package/dist/lint/post-synth/tf033.d.ts

@@ -0,0 +1,50 @@
+/**
+ * TF033: an RDS DB instance or cluster does not encrypt its storage
+ * (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW021, written natively.
+ * WAW021 reads a template chant synthesized, where `StorageEncrypted` absent
+ * means false. Reading somebody else's HCL, absence means different things
+ * for the two resources and for how the database is created, so each case is
+ * decided here against the provider schema and the AWS default.
+ *
+ * `aws_db_instance` (provider `internal/service/rds/instance.go`, v6.67.0):
+ * `storage_encrypted` is optional, not computed, and the docs say "The
+ * default is `false` if not specified". The plain create path and `s3_import`
+ * send `StorageEncrypted: d.Get("storage_encrypted")`, so absent means false
+ * and is reported. The replica (`replicate_source_db`), snapshot
+ * (`snapshot_identifier`) and point-in-time (`restore_to_point_in_time`)
+ * paths never send it: the new instance takes its encryption from the source
+ * (and a cross-region replica from `kms_key_id`). For those the rule cannot
+ * know, and says so, unless `storage_encrypted = true` is written down.
+ *
+ * `aws_rds_cluster` (`cluster.go`): `storage_encrypted` is optional and
+ * computed, sent only when set, and "Terraform will only perform drift
+ * detection if a configuration value is provided". Two engine families:
+ *
+ * - Aurora (`engine` `aurora-mysql`/`aurora-postgresql`, or absent, which
+ *   provider v5 defaulted to `aurora`). Since 2026-02-16 AWS encrypts every
+ *   new Aurora cluster at rest with an AWS-owned key whatever
+ *   `StorageEncrypted` says, and reports `StorageEncrypted: false` with
+ *   `StorageEncryptionType: sse-rds` for it. A cluster created before that
+ *   date with storage encryption off is unencrypted, and the configuration
+ *   does not say when its cluster was created. So an Aurora cluster with
+ *   `storage_encrypted` absent or `false` is not determined, not a finding.
+ *   `engine_mode = "serverless"` (Serverless v1) was always encrypted and
+ *   is not reported at all.
+ * - Multi-AZ DB clusters (`engine` `mysql`/`postgres`): the default is
+ *   `false` and nothing changed it, so absent or `false` is a finding,
+ *   unless the cluster is restored or replicated from a source
+ *   (`snapshot_identifier`, `restore_to_point_in_time`,
+ *   `replication_source_identifier`, `global_cluster_identifier`), which
+ *   again decides the encryption.
+ *
+ * Not checked: `aws_rds_cluster_instance` (its `storage_encrypted` is
+ * computed-only and never appears in a body), `aws_rds_global_cluster`, and
+ * whether the key is customer managed.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf033: PostSynthCheck;
+//# sourceMappingURL=tf033.d.ts.map

package/dist/lint/post-synth/tf033.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf033.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf033.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AA+F9G,eAAO,MAAM,KAAK,EAAE,cAgBnB,CAAC"}

package/dist/lint/post-synth/tf034.d.ts

@@ -0,0 +1,25 @@
+/**
+ * TF034: an SNS topic has no server-side encryption (chant #2288, epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW025, written natively.
+ *
+ * Absence is insecure for this resource, and the rule reports it.
+ * `aws_sns_topic.kms_master_key_id` (provider `internal/service/sns/topic.go`,
+ * v6.67.0) is optional with no default, and SNS has no service-owned
+ * encryption that applies when no key is named: server-side encryption
+ * (https://docs.aws.amazon.com/sns/latest/dg/sns-server-side-encryption.html)
+ * is on only when the topic names a KMS key, either the AWS managed
+ * `alias/aws/sns` or a customer managed key. Unlike SQS (TF035), no AWS
+ * default turns it on for new topics. A literal `kms_master_key_id = ""`
+ * names no key and is the same finding.
+ *
+ * Present and secure: a non-empty literal, an attribute of a managed resource
+ * or data source (`aws_kms_key.sns.arn`, `aws_kms_alias.sns.arn`), or a
+ * template with literal text. Not determined: a variable, local, module
+ * output, conditional or function call, any of which can be `null` or `""`.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf034: PostSynthCheck;
+//# sourceMappingURL=tf034.d.ts.map

package/dist/lint/post-synth/tf034.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf034.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf034.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,KAAK,EAAE,cAkCnB,CAAC"}

package/dist/lint/post-synth/tf035.d.ts

@@ -0,0 +1,33 @@
+/**
+ * TF035: an SQS queue turns its server-side encryption off (chant #2288,
+ * epic #2284).
+ *
+ * The Terraform counterpart of the aws lexicon's WAW026, and the case that
+ * shows why the five flat rules could not be bridged. WAW026 reports a queue
+ * with neither `SqsManagedSseEnabled: true` nor `KmsMasterKeyId`. Bridged onto
+ * HCL, that reports every correctly encrypted queue in an estate
+ * (docs/design/waw-hcl-fidelity-probe.md).
+ *
+ * Absence is secure for this resource, and the rule does not report it.
+ * `sqs_managed_sse_enabled` is optional and computed (provider
+ * `internal/service/sqs/queue.go`, v6.67.0), and the provider docs say
+ * Terraform "will only perform drift detection of its value when present in
+ * a configuration". Since October 2022 SQS encrypts every new queue with
+ * SSE-SQS unless the request turns it off
+ * (https://aws.amazon.com/blogs/compute/announcing-server-side-encryption-with-amazon-simple-queue-service-managed-encryption-keys-sse-sqs-by-default/),
+ * and the provider creates queues over HTTPS, so a queue that sets neither
+ * attribute is encrypted. A queue created before that date and never
+ * changed can still be unencrypted; the configuration cannot show that, and
+ * TF035 does not guess it.
+ *
+ * The finding: `sqs_managed_sse_enabled = false` with no KMS key. Present and
+ * secure: `sqs_managed_sse_enabled = true`, or a `kms_master_key_id` that is
+ * a non-empty literal, a managed key's attribute, or a template with literal
+ * text. Not determined: `sqs_managed_sse_enabled` from an expression with no
+ * key, or a key from a variable beside `sqs_managed_sse_enabled = false`.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf035: PostSynthCheck;
+//# sourceMappingURL=tf035.d.ts.map

package/dist/lint/post-synth/tf035.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf035.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf035.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAO9G,eAAO,MAAM,KAAK,EAAE,cAmCnB,CAAC"}