@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/dist/pin/scan.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Byte offsets for the attribute values the pin edit rewrites (#3189).
+ *
+ * `@cdktn/hcl2json` is the reader that says what a file means, and the pin
+ * edit asks it first (`./edit.ts`). It gives back values and no positions
+ * (`../hcl/value.ts` says why), so it cannot say WHERE in the file a
+ * `source` or `version` literal sits. This lexer answers only that: it walks
+ * the raw text token by token, skipping comments, quoted strings, template
+ * interpolations and heredocs, counts braces, and records each top-level
+ * block and the plain string literal of each of its own attributes, with the
+ * literal's offsets.
+ *
+ * It is an HCL tokenizer, not a pattern match over lines: a `source =` inside
+ * a comment, a heredoc or another string is never a match, and a block opened
+ * on the same line as its attributes reads the same as one split over lines.
+ * What it finds is checked against the reader before anything is written:
+ * the literal's unescaped value has to equal what hcl2json read for that
+ * attribute, and the edited file has to parse to the same tree with only the
+ * pinned values changed.
+ */
+/** One plain string literal: the offsets of its content, quotes excluded. */
+export interface ScannedLiteral {
+    start: number;
+    end: number;
+    /** The content as written, escapes included. */
+    raw: string;
+}
+/** One attribute of a block body. `literal` is set when the value is a single string with no interpolation. */
+export interface ScannedAttribute {
+    name: string;
+    literal?: ScannedLiteral;
+}
+/** One top-level block: `module "vpc" { ... }`, `terraform { ... }`. */
+export interface ScannedBlock {
+    type: string;
+    labels: string[];
+    /** Offset of the block's type keyword. */
+    start: number;
+    /** Offset just past the closing brace. */
+    end: number;
+    /** The block body's own attributes, in file order. Nested blocks' attributes are not included. */
+    attributes: ScannedAttribute[];
+}
+/** Thrown when the text is not well-formed enough to place an edit in. */
+export declare class HclScanError extends Error {
+    constructor(file: string, message: string);
+}
+/** Every top-level block in `text`, with its own attributes' literals. */
+export declare function scanBlocks(text: string, file: string): ScannedBlock[];
+/** Undo HCL's string escapes, so a literal's raw text compares to the value the reader returned. */
+export declare function unescapeHcl(raw: string): string;
+/** Write a value as the content of an HCL string literal. */
+export declare function escapeHcl(value: string): string;
+//# sourceMappingURL=scan.d.ts.map

package/dist/pin/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/pin/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,+GAA+G;AAC/G,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAYD,0EAA0E;AAC1E,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxC;CACF;AAmID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAgCrE;AAkDD,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyB/C;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/pin/source.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Where a module call keeps its pin, and how the pin moves (#3189).
+ *
+ * A module call names a module and, if it is pinned, one exact version of it.
+ * The version sits in one of two places:
+ *
+ * - the `version` argument, beside a registry `source`
+ *   (`source = "app.terraform.io/acme/vpc/aws"`, `version = "1.3.0"`);
+ * - a query argument of the `source` itself: OpenTofu's `oci://` sources take
+ *   `?tag=` or `?digest=`, a git source takes `?ref=`, and Terragrunt's
+ *   `tfr://` source takes `?version=`.
+ *
+ * The module's identity is the source with the pin taken out, so
+ * `oci://r.example.com/m/vpc?tag=1.3.0` and `oci://r.example.com/m/vpc?tag=1.4.0`
+ * call the same module.
+ *
+ * A `version` constraint (`~> 1.4`, `>= 1.4, < 2`) is not a pin. An upstream
+ * release changes what such a root runs with no diff to review, and there is
+ * no single version to move, so the call is refused with that reason. The
+ * same holds for a call with no pin at all.
+ *
+ * OpenTofu writes an OCI pin as a query argument
+ * (https://opentofu.org/docs/language/modules/sources/#oci-distribution-registries),
+ * not as a `:tag` or `@sha256:` suffix on the repository, so the query form is
+ * the one read here.
+ *
+ * This module is pure string work over values the HCL reader has already
+ * parsed. Finding those values in a file, and writing the new ones back, is
+ * `./edit.ts`. #3190 adds an `oci` kind to the lint classifier
+ * (`../lint/post-synth/module-source.ts`) with the same parse; the two can
+ * share one once both have landed.
+ */
+/** The query arguments that carry a pin. */
+export type PinParam = "tag" | "digest" | "ref" | "version";
+/** What a module call pins, read from its `source` and `version`. */
+export interface ModuleCallPin {
+    /** The module the call names: its `source` with the pin argument taken out. */
+    module: string;
+    /** Where the pin is: the `version` argument, or a query argument of `source`. */
+    at: "version" | "source";
+    /** The query argument holding the pin, when `at` is `source`. */
+    param?: PinParam;
+    /** The pinned version, tag, digest or ref. Null when there is no pin to move. */
+    pin: string | null;
+    /** Why the call has no pin to move, when `pin` is null. */
+    unpinned?: string;
+}
+/** The outcome of moving one call's pin. */
+export type PinMove = {
+    outcome: "moved";
+    from: string;
+    to: string;
+    source: string;
+    version?: string;
+} | {
+    outcome: "already";
+    pin: string;
+} | {
+    outcome: "elsewhere";
+    pin: string;
+} | {
+    outcome: "refused";
+    reason: string;
+};
+/**
+ * The exact version a `version` argument pins, or null when it is a
+ * constraint. `1.4.0` and `= 1.4.0` are exact; `~> 1.4`, `>= 1.4` and
+ * `1.4.0, < 2` are not.
+ */
+export declare function exactVersion(constraint: string): string | null;
+/** Whether a value can be a pin's new value: an exact version, a tag, a ref or a digest, never a constraint. */
+export declare function isPinValue(value: string): boolean;
+/** Read the pin a module call carries. `version` is the call's `version` argument, when it has one. */
+export declare function readModulePin(source: string, version?: string): ModuleCallPin;
+/**
+ * Move a call's pin from `from` to `to`, when the call names `module`.
+ * Returns null when it names another module. `version` keeps any `=` it was
+ * written with, so `= 1.3.0` becomes `= 1.4.0`.
+ */
+export declare function movePin(source: string, version: string | undefined, request: {
+    module: string;
+    from: string;
+    to: string;
+}): PinMove | null;
+/** The module a source names, with any pin taken out, so a caller may name the module by a pinned source. */
+export declare function moduleOf(source: string): string;
+/** Refuse a request whose `to` is not something a pin can hold. */
+export declare function checkPinRequest(request: {
+    module: string;
+    from: string;
+    to: string;
+}): void;
+//# sourceMappingURL=source.d.ts.map

package/dist/pin/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/pin/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,4CAA4C;AAC5C,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,CAAC;AAE5D,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,EAAE,EAAE,SAAS,GAAG,QAAQ,CAAC;IACzB,iEAAiE;IACjE,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,iFAAiF;IACjF,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,4CAA4C;AAC5C,MAAM,MAAM,OAAO,GACf;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAChF;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ3C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D;AAED,gHAAgH;AAChH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AA6CD,uGAAuG;AACvG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,CAO7E;AA4CD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,GAAG,IAAI,CAa1I;AAED,6GAA6G;AAC7G,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAM3F"}

package/dist/pin/waves.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The wave plan for a pin-bump rollout (#3189): which roots move in which PR.
+ *
+ * Two sources give the same shape, an ordered list of root lists:
+ *
+ * - **Declared canaries, then dependency order.** The canaries form wave 1.
+ *   Every other root lands in the earliest wave after every root it depends
+ *   on. That is the Kahn layering `chant components fan-out` uses
+ *   (`resolveComponentGraph`, `@intentius/chant/components/layers`), and the
+ *   order #3049 gives its gated waves. A canary that depends on a root outside
+ *   the canaries is refused, since wave 1 would apply before what it reads.
+ * - **choudoufu's wave planner** (`choudoufu live-waves -json`, choudoufu#1754).
+ *   It reads cross-estate references from the estates' own configuration, puts
+ *   `-canary` roots in wave 1, and emits each wave's roots on their own, so
+ *   {@link wavesFromChoudoufu} takes its document as it is.
+ *
+ * A root's dependencies come from the caller (`dependsOn`) and, for a
+ * Terragrunt unit, from its `dependency` and `dependencies` blocks
+ * ({@link terragruntDependencies}). A dependency on a root outside the
+ * rollout orders nothing: it is not moving.
+ */
+import type { Hcl2Json } from "@intentius/chant/terraform/hcl2json";
+/** One root in a rollout. `root` is its directory, relative to the repository, with `/` separators. */
+export interface PinRoot {
+    root: string;
+    /** Roots this one reads, by directory. They land in an earlier wave. */
+    dependsOn?: string[];
+    /**
+     * The TypeScript file a generated root is built from. The pin edit then
+     * goes to the module declaration there rather than to the `.tf` chant
+     * writes (`./edit-ts.ts`).
+     */
+    tsSource?: string;
+}
+/** One wave: its number from 1, whether the declared canaries form it, and its roots, sorted. */
+export interface PinWave {
+    wave: number;
+    canary: boolean;
+    roots: string[];
+}
+/** Thrown when the roots cannot be split into waves. The message names the roots. */
+export declare class PinWavePlanError extends Error {
+    constructor(message: string);
+}
+/** Canaries first, then dependency order. */
+export declare function planPinWaves(roots: readonly PinRoot[], canaries?: readonly string[]): PinWave[];
+/**
+ * The waves of a `choudoufu live-waves -json` document (format version 1).
+ * `prefix` is the directory choudoufu ran in, relative to the repository,
+ * when its roots are named relative to that rather than to the repository.
+ */
+export declare function wavesFromChoudoufu(doc: unknown, prefix?: string): PinWave[];
+/**
+ * Keep only the roots in `keep`, renumbering the waves and dropping any left
+ * empty. A wave plan from choudoufu covers every root it was given; the
+ * rollout moves only the roots that call the module at the old or new pin.
+ */
+export declare function restrictWaves(waves: readonly PinWave[], keep: ReadonlySet<string>): PinWave[];
+/**
+ * The roots a Terragrunt unit depends on: each `dependency` block's
+ * `config_path` and the `dependencies` block's `paths`, resolved against the
+ * unit's directory. A path that is an expression is skipped, since it names
+ * no directory until Terragrunt evaluates it.
+ */
+export declare function terragruntDependencies(root: string, text: string, parser: Hcl2Json): Promise<string[]>;
+//# sourceMappingURL=waves.d.ts.map

package/dist/pin/waves.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waves.d.ts","sourceRoot":"","sources":["../../src/pin/waves.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,uGAAuG;AACvG,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iGAAiG;AACjG,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,qFAAqF;AACrF,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,6CAA6C;AAC7C,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,QAAQ,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,EAAE,CAqBnG;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,SAAK,GAAG,OAAO,EAAE,CAUvE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,EAAE,CAO7F;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAS5G"}

package/dist/plan-digest.d.ts

@@ -0,0 +1,59 @@
+/**
+ * A terraform plan's identity (#2300), kept apart from the activities so the
+ * change-set adapter (`../change-set.ts`, #3181) can import it without the
+ * config loader, the HCL parse or anything else the activities reach. It
+ * imports chant's `lifecycle/plan-digest` subpath and nothing more, which is
+ * what lets terragucci bundle it into one file (#3421).
+ */
+/**
+ * One resource's proposed change, as a plan digest sees it (#2300) — the
+ * projection of a `terraform show -json` `resource_changes` entry that
+ * survives into {@link terraformPlanDigest}.
+ */
+export interface TerraformPlannedChange {
+    address: unknown;
+    mode: unknown;
+    type: unknown;
+    name: unknown;
+    index: unknown;
+    provider_name: unknown;
+    deposed: unknown;
+    actions: unknown;
+    before: unknown;
+    after: unknown;
+    after_unknown: unknown;
+    replace_paths: unknown;
+    importing: unknown;
+}
+/**
+ * The change set a `terraform show -json` plan describes, canonicalised
+ * (#2300): every proposed change, at its address, with the values that would
+ * be written, sorted so two renderings of the same plan project identically.
+ *
+ * Everything else in the document is dropped, and the drops are the point —
+ * see `packages/core/src/lifecycle/plan-digest.ts` for the general rule. Here
+ * that means `timestamp` and `terraform_version` (when the plan was taken and
+ * by which binary), `format_version` (how it was rendered), `prior_state` and
+ * `planned_values` (restatements of the same change set from another angle),
+ * `configuration` (the source that produced it, which can be refactored
+ * without changing a single proposed action) and `checks` / `relevant_
+ * attributes` (diagnostics about the plan, not the plan). What is left is
+ * what applying it would do.
+ */
+export declare function terraformPlanChangeSet(planJson: unknown): {
+    resourceChanges: TerraformPlannedChange[];
+    outputChanges: unknown;
+    actionInvocations?: unknown[];
+};
+/**
+ * The identity of a terraform plan (#2300): {@link terraformPlanChangeSet}
+ * hashed. This is what a `TerraformApplyOp` gate binds its approval to, and
+ * what a later run recomputes and compares.
+ *
+ * Taken over the `show -json` rendering rather than the plan file's bytes on
+ * purpose: the file is an opaque, version-stamped archive, and two runs of
+ * `plan -out` over an unchanged root produce different bytes. The rendering
+ * is the same plan both times.
+ */
+export declare function terraformPlanDigest(planJson: unknown): string;
+//# sourceMappingURL=plan-digest.d.ts.map

package/dist/plan-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-digest.d.ts","sourceRoot":"","sources":["../src/plan-digest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG;IACzD,eAAe,EAAE,sBAAsB,EAAE,CAAC;IAC1C,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;CAC/B,CAkCA;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAE7D"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAgElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAiQ7B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAmElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAqR7B,CAAC"}

package/dist/rules/flat-attributes.ts

@@ -0,0 +1,146 @@
+/**
+ * Shared reading helpers for TF033-TF037, the five flat encryption and
+ * immutability rules (chant #2288, epic #2284).
+ *
+ * Each of those rules reads one or two scalar attributes of one resource type
+ * and answers a three-valued question: the literal proves the resource
+ * secure, the literal proves it insecure, or the parse cannot tell. This
+ * module is the reading half; each rule file holds its own answer for
+ * absence, because that answer differs per resource (see each rule's doc
+ * comment and its section of `docs/pages/lint-rules.mdx`). It exports no
+ * `PostSynthCheck`, so the generated barrel skips it.
+ */
+
+import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { RESOURCE_TYPE, type BlockBody } from "../../hcl/parse";
+import { attr } from "../../hcl/value";
+import { blocksOfType, nestedBodies, type TerraformBlock } from "./blocks";
+
+/** What one attribute read settles. `reason` says why a value could not be read. */
+export type Read<T> = { kind: "known"; value: T } | { kind: "absent" } | { kind: "unknown"; reason: string };
+
+/** Every `resource` block of one provider type (`aws_sqs_queue`), in entity order. */
+export function resourcesOfType(ctx: PostSynthContext, type: string): TerraformBlock[] {
+  return blocksOfType(ctx, RESOURCE_TYPE).filter((b) => b.address.startsWith(`${type}.`));
+}
+
+/** One expression, for a message: `var.encrypted`, or the template text. */
+function describe(name: string, raw: unknown, refs: string[] | undefined, kind: "reference" | "template"): string {
+  return kind === "reference"
+    ? `\`${name}\` is an expression (${refs?.[0] ?? String(raw)})`
+    : `\`${name}\` is a template string ("${String(raw)}")`;
+}
+
+/**
+ * A bool attribute. Terraform converts the strings `"true"` and `"false"` to
+ * bool, so those read as the bool they convert to. Any other literal (a
+ * number, a list) is a plan-time type error, not this rule's concern, and
+ * reads as unknown.
+ */
+export function readBool(body: BlockBody, name: string): Read<boolean> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "reference" || a.kind === "template") {
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, a.kind) };
+  }
+  if (typeof a.value === "boolean") return { kind: "known", value: a.value };
+  if (a.value === "true" || a.value === "false") return { kind: "known", value: a.value === "true" };
+  return { kind: "unknown", reason: `\`${name}\` is not a bool (${JSON.stringify(a.value)})` };
+}
+
+/** A string attribute, literal or not. */
+export function readString(body: BlockBody, name: string): Read<string> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "reference" || a.kind === "template") {
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, a.kind) };
+  }
+  if (typeof a.value === "string") return { kind: "known", value: a.value };
+  return { kind: "unknown", reason: `\`${name}\` is not a string (${JSON.stringify(a.value)})` };
+}
+
+/** Expression roots that name an input or a computed value, not a managed object. */
+const VALUE_ROOTS = new Set(["var", "local", "module", "each", "count", "path", "terraform", "self"]);
+
+/** `aws_kms_key.sns.arn`, `data.aws_kms_alias.sqs.target_key_arn`, with an optional index or splat. */
+const OBJECT_ATTRIBUTE = /^(?:data\.)?([a-z][a-z0-9_]*)\.[A-Za-z_][\w-]*(?:\[[^\]]*\])?(?:\.[A-Za-z_][\w-]*|\[[^\]]*\])+$/;
+
+/** Every `${...}` span in a template, as `attr()` finds them. */
+const SPANS = /\$\{(?:[^{}]|\{[^{}]*\})*\}/g;
+
+/**
+ * Whether a key-like argument (`kms_master_key_id`) is set to something.
+ *
+ * - absent, or `null`: `absent`.
+ * - a literal: `known`, with the string (`""` is a value, and a rule decides
+ *   what an empty key means).
+ * - an attribute of a managed resource or data source (`aws_kms_key.x.arn`):
+ *   `known` and non-empty. The provider computes a key's id or ARN; it is
+ *   never the empty string, so the key is set whatever its value turns out to
+ *   be.
+ * - a template with literal text (`"alias/${var.env}-sns"`): `known` and
+ *   non-empty, for the same reason.
+ * - anything else (`var.kms_key`, `local.key`, a conditional, a function
+ *   call): `unknown`. A variable can be `null` or `""`.
+ */
+export function readKeySet(body: BlockBody, name: string): Read<string> {
+  const a = attr(body, name);
+  if (a.kind === "absent") return { kind: "absent" };
+  if (a.kind === "literal") {
+    return typeof a.value === "string"
+      ? { kind: "known", value: a.value }
+      : { kind: "unknown", reason: `\`${name}\` is not a string (${JSON.stringify(a.value)})` };
+  }
+  const raw = String(a.raw);
+  if (a.kind === "template") {
+    if (raw.replace(SPANS, "").length > 0) return { kind: "known", value: raw };
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, "template") };
+  }
+  const expr = (a.refs?.[0] ?? "").trim();
+  const m = OBJECT_ATTRIBUTE.exec(expr);
+  if (m && !VALUE_ROOTS.has(m[1])) return { kind: "known", value: raw };
+  return { kind: "unknown", reason: describe(name, a.raw, a.refs, "reference") };
+}
+
+/**
+ * Whether an argument that names a source (`snapshot_identifier`,
+ * `replicate_source_db`) or a nested block (`restore_to_point_in_time`) is
+ * given. The provider reads these with `GetOk`, so a literal `""` is the same
+ * as leaving the argument out; anything else, a reference included, is given.
+ */
+export function isGiven(body: BlockBody, name: string): boolean {
+  const a = attr(body, name);
+  if (a.kind === "absent") return false;
+  if (a.kind === "literal") {
+    if (a.value === "" || a.value === false) return false;
+    if (Array.isArray(a.value)) return a.value.length > 0;
+  }
+  return true;
+}
+
+/** The bodies of a nested block, re-exported for the rule files. */
+export { nestedBodies };
+
+/** A finding the literal proves. */
+export function finding(
+  checkId: string,
+  severity: "error" | "warning",
+  block: TerraformBlock,
+  message: string,
+): PostSynthDiagnostic {
+  return { checkId, severity, message: `"${block.address}" ${message}`, entity: block.key, lexicon: "terraform" };
+}
+
+/**
+ * The one `info` diagnostic a rule emits when it cannot read the value it
+ * needs. The message starts `Not determined:`, as #2284 fixed for TF030-TF037.
+ */
+export function notDetermined(checkId: string, block: TerraformBlock, reason: string, tail: string): PostSynthDiagnostic {
+  return {
+    checkId,
+    severity: "info",
+    message: `Not determined: "${block.address}" ${reason}. ${tail}`,
+    entity: block.key,
+    lexicon: "terraform",
+  };
+}

package/dist/rules/module-source.ts

@@ -18,14 +18,27 @@
  * recognize, scp-style `git@host:path` addresses, and any source ending in
  * `.git`. `local` is `./` or `../` (checkov's `UNKNOWN` case for module
  * pinning: a local path cannot be pinned to anything and is never flagged).
+ * `oci` is an OpenTofu `oci://host/repo` source (#3190). OpenTofu selects a
+ * version with `?tag=` or `?digest=` (https://opentofu.org/docs/language/modules/sources/),
+ * and a source naming neither resolves the `latest` tag. The container-image
+ * shapes `repo:tag` and `repo@sha256:...` are read too, so a source written
+ * the way `docker pull` spells it is not misread as unpinned. A `:` inside the
+ * host (a registry port) is never a tag: only a colon in the last path
+ * segment is. The tag and digest rules were checked against the docs page
+ * above; the suffix forms are not documented there and are not verified
+ * against OpenTofu's parser.
  */
 
-export type ModuleSourceKind = "local" | "registry" | "git" | "other";
+export type ModuleSourceKind = "local" | "registry" | "git" | "oci" | "other";
 
 export interface ModuleSourceClassification {
   kind: ModuleSourceKind;
   /** The `?ref=`/`&ref=` value (falling back to `rev`), when `kind` is `"git"`. */
   ref?: string;
+  /** The tag an `oci://` source names, from `?tag=` or a `:tag` suffix on the repository. */
+  tag?: string;
+  /** The digest an `oci://` source names, from `?digest=` or an `@sha256:...` suffix. */
+  digest?: string;
 }
 
 const REGISTRY_NAME = /^[0-9A-Za-z](?:[0-9A-Za-z_-]{0,62}[0-9A-Za-z])?$/;
@@ -77,6 +90,25 @@ function isGitShaped(rest: string): boolean {
   return false;
 }
 
+function classifyOci(base: string, query: string): ModuleSourceClassification {
+  const params = parseQuery(query);
+  let path = stripSubdir(base).replace(/^oci:\/\//i, "");
+  let tag = params.get("tag") || undefined;
+  let digest = params.get("digest") || undefined;
+
+  const at = path.indexOf("@");
+  if (at !== -1) {
+    digest = digest ?? (path.slice(at + 1) || undefined);
+    path = path.slice(0, at);
+  }
+  const lastSlash = path.lastIndexOf("/");
+  const colon = path.indexOf(":", lastSlash + 1); // a port sits before the first slash
+  if (colon !== -1) {
+    tag = tag ?? (path.slice(colon + 1) || undefined);
+  }
+  return { kind: "oci", ...(tag !== undefined ? { tag } : {}), ...(digest !== undefined ? { digest } : {}) };
+}
+
 export function classifyModuleSource(source: string): ModuleSourceClassification {
   const trimmed = source.trim();
   if (trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith(".\\") || trimmed.startsWith("..\\")) {
@@ -87,6 +119,8 @@ export function classifyModuleSource(source: string): ModuleSourceClassification
   const base = queryIdx === -1 ? trimmed : trimmed.slice(0, queryIdx);
   const query = queryIdx === -1 ? "" : trimmed.slice(queryIdx + 1);
 
+  if (/^oci:\/\//i.test(base)) return classifyOci(base, query);
+
   const forced = /^(git|hg)::/i.exec(base);
   const rest = forced ? base.slice(forced[0].length) : base;
 
@@ -119,3 +153,24 @@ export function isPinnedRef(ref: string): boolean {
 export function isDefaultBranch(ref: string): boolean {
   return DEFAULT_BRANCHES.has(ref);
 }
+
+const MUTABLE_TAGS = new Set(["latest", "main", "master", "develop", "dev", "stable", "edge", "nightly"]);
+
+/**
+ * Is `tag` a name that conventionally moves (`latest`, a branch-like name)
+ * rather than an exact version. Used by TF038. A tag is a mutable pointer in
+ * most registries whatever it looks like, so the rule is a warning and this
+ * only decides what reads as obviously floating.
+ */
+export function isMutableOciTag(tag: string): boolean {
+  return MUTABLE_TAGS.has(tag.toLowerCase());
+}
+
+/**
+ * Is a registry `version` constraint an exact version (`1.4.0`, `= 1.4.0`,
+ * `=1.4.0`) rather than a range (`~> 1.4`, `>= 1.4`, `>= 1.0, < 2.0`). Used
+ * by TF039. A bare version is an exact constraint in Terraform.
+ */
+export function isExactVersionConstraint(version: string): boolean {
+  return /^(?:=\s*)?v?\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version.trim()) && !version.includes(",");
+}

package/dist/rules/terragrunt.ts

@@ -0,0 +1,76 @@
+/**
+ * Shared reading for the Terragrunt rules TF041 to TF045 (#3417).
+ *
+ * These rules look at `terragrunt.hcl` and `root.hcl`, which the parse reads
+ * into their own entity types (`TERRAGRUNT_*_TYPE` in `../../hcl/parse.ts`)
+ * and never into the module types the other TF rules check. Like the module
+ * source rules, they read the literal values hcl2json hands back: an
+ * attribute built from a function or a `local.` reference arrives as a
+ * `"${...}"` string and is treated as not determined, never as a finding.
+ */
+
+import { isResourceDeclarable, type Declarable } from "@intentius/chant/declarable";
+import type { BlockBody } from "../../hcl/parse";
+import { classifyModuleSource } from "./module-source";
+
+/** Entities of one Terragrunt type, with their keys, in map order. */
+export function terragruntEntities(
+  entities: ReadonlyMap<string, Declarable>,
+  entityType: string,
+): Array<{ key: string; address: string; file: string; body: BlockBody }> {
+  const out: Array<{ key: string; address: string; file: string; body: BlockBody }> = [];
+  for (const [key, entity] of entities) {
+    if (entity.entityType !== entityType || !isResourceDeclarable(entity)) continue;
+    const props = entity.props as { address?: unknown; file?: unknown; body?: unknown };
+    out.push({
+      key,
+      address: typeof props.address === "string" ? props.address : key,
+      file: typeof props.file === "string" ? props.file : "terragrunt.hcl",
+      body: (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody,
+    });
+  }
+  return out;
+}
+
+/** An HCL expression hcl2json left as `"${...}"`: its value is not known without evaluating it. */
+export function isExpression(value: unknown): boolean {
+  return typeof value === "string" && value.includes("${");
+}
+
+export type TerragruntSourceKind = "local" | "git" | "tfr" | "oci" | "other";
+
+export interface TerragruntSourceClassification {
+  kind: TerragruntSourceKind;
+  /** Whether the source names a version: `?ref=` for git, `?version=` for `tfr://`, a tag or digest for `oci://`. Undefined for `local` and `other`. */
+  pinned?: boolean;
+}
+
+/**
+ * Classify a unit's `terraform.source`. Git and `oci://` sources go through
+ * {@link classifyModuleSource}, the reader TF005 and TF038 use. `tfr://` is
+ * Terragrunt's own scheme for registry modules and takes its version from the
+ * `?version=` query argument. A source that holds an interpolation, or that
+ * names an absolute path or an archive URL, is `other` or `local` and is
+ * never reported.
+ */
+export function classifyTerragruntSource(source: string): TerragruntSourceClassification {
+  const trimmed = source.trim();
+  if (trimmed.includes("${")) return { kind: "other" };
+  if (/^tfr:\/\//i.test(trimmed)) {
+    const query = trimmed.includes("?") ? trimmed.slice(trimmed.indexOf("?") + 1) : "";
+    const version = new URLSearchParams(query).get("version");
+    return { kind: "tfr", pinned: version !== null && version.trim() !== "" };
+  }
+  if (trimmed.startsWith("/")) return { kind: "local" };
+  const classified = classifyModuleSource(trimmed);
+  switch (classified.kind) {
+    case "local":
+      return { kind: "local" };
+    case "git":
+      return { kind: "git", pinned: classified.ref !== undefined };
+    case "oci":
+      return { kind: "oci", pinned: classified.tag !== undefined || classified.digest !== undefined };
+    default:
+      return { kind: "other" };
+  }
+}

package/dist/rules/tf002.ts

@@ -51,7 +51,7 @@ function providerNameFromType(type: string): string {
 }
 
 /** One implied provider name to the entity key that first implied it in file order. */
-function impliedProviders(entities: PostSynthContext["entities"], root: string): Map<string, string> {
+export function impliedProviders(entities: PostSynthContext["entities"], root: string): Map<string, string> {
   const implied = new Map<string, string>();
   const fromProviderBlock = new Set<string>();