@intentius/chant-lexicon-terraform 0.124.31 → 0.124.32

package/dist/lint/post-synth/flat-attributes.js

@@ -0,0 +1,135 @@
+/**
+ * Shared reading helpers for TF033-TF037, the five flat encryption and
+ * immutability rules (chant #2288, epic #2284).
+ *
+ * Each of those rules reads one or two scalar attributes of one resource type
+ * and answers a three-valued question: the literal proves the resource
+ * secure, the literal proves it insecure, or the parse cannot tell. This
+ * module is the reading half; each rule file holds its own answer for
+ * absence, because that answer differs per resource (see each rule's doc
+ * comment and its section of `docs/pages/lint-rules.mdx`). It exports no
+ * `PostSynthCheck`, so the generated barrel skips it.
+ */
+import { RESOURCE_TYPE } from "../../hcl/parse.js";
+import { attr } from "../../hcl/value.js";
+import { blocksOfType, nestedBodies } from "./blocks.js";
+/** Every `resource` block of one provider type (`aws_sqs_queue`), in entity order. */
+export function resourcesOfType(ctx, type) {
+    return blocksOfType(ctx, RESOURCE_TYPE).filter((b) => b.address.startsWith(`${type}.`));
+}
+/** One expression, for a message: `var.encrypted`, or the template text. */
+function describe(name, raw, refs, kind) {
+    return kind === "reference"
+        ? `\`${name}\` is an expression (${refs?.[0] ?? String(raw)})`
+        : `\`${name}\` is a template string ("${String(raw)}")`;
+}
+/**
+ * A bool attribute. Terraform converts the strings `"true"` and `"false"` to
+ * bool, so those read as the bool they convert to. Any other literal (a
+ * number, a list) is a plan-time type error, not this rule's concern, and
+ * reads as unknown.
+ */
+export function readBool(body, name) {
+    const a = attr(body, name);
+    if (a.kind === "absent")
+        return { kind: "absent" };
+    if (a.kind === "reference" || a.kind === "template") {
+        return { kind: "unknown", reason: describe(name, a.raw, a.refs, a.kind) };
+    }
+    if (typeof a.value === "boolean")
+        return { kind: "known", value: a.value };
+    if (a.value === "true" || a.value === "false")
+        return { kind: "known", value: a.value === "true" };
+    return { kind: "unknown", reason: `\`${name}\` is not a bool (${JSON.stringify(a.value)})` };
+}
+/** A string attribute, literal or not. */
+export function readString(body, name) {
+    const a = attr(body, name);
+    if (a.kind === "absent")
+        return { kind: "absent" };
+    if (a.kind === "reference" || a.kind === "template") {
+        return { kind: "unknown", reason: describe(name, a.raw, a.refs, a.kind) };
+    }
+    if (typeof a.value === "string")
+        return { kind: "known", value: a.value };
+    return { kind: "unknown", reason: `\`${name}\` is not a string (${JSON.stringify(a.value)})` };
+}
+/** Expression roots that name an input or a computed value, not a managed object. */
+const VALUE_ROOTS = new Set(["var", "local", "module", "each", "count", "path", "terraform", "self"]);
+/** `aws_kms_key.sns.arn`, `data.aws_kms_alias.sqs.target_key_arn`, with an optional index or splat. */
+const OBJECT_ATTRIBUTE = /^(?:data\.)?([a-z][a-z0-9_]*)\.[A-Za-z_][\w-]*(?:\[[^\]]*\])?(?:\.[A-Za-z_][\w-]*|\[[^\]]*\])+$/;
+/** Every `${...}` span in a template, as `attr()` finds them. */
+const SPANS = /\$\{(?:[^{}]|\{[^{}]*\})*\}/g;
+/**
+ * Whether a key-like argument (`kms_master_key_id`) is set to something.
+ *
+ * - absent, or `null`: `absent`.
+ * - a literal: `known`, with the string (`""` is a value, and a rule decides
+ *   what an empty key means).
+ * - an attribute of a managed resource or data source (`aws_kms_key.x.arn`):
+ *   `known` and non-empty. The provider computes a key's id or ARN; it is
+ *   never the empty string, so the key is set whatever its value turns out to
+ *   be.
+ * - a template with literal text (`"alias/${var.env}-sns"`): `known` and
+ *   non-empty, for the same reason.
+ * - anything else (`var.kms_key`, `local.key`, a conditional, a function
+ *   call): `unknown`. A variable can be `null` or `""`.
+ */
+export function readKeySet(body, name) {
+    const a = attr(body, name);
+    if (a.kind === "absent")
+        return { kind: "absent" };
+    if (a.kind === "literal") {
+        return typeof a.value === "string"
+            ? { kind: "known", value: a.value }
+            : { kind: "unknown", reason: `\`${name}\` is not a string (${JSON.stringify(a.value)})` };
+    }
+    const raw = String(a.raw);
+    if (a.kind === "template") {
+        if (raw.replace(SPANS, "").length > 0)
+            return { kind: "known", value: raw };
+        return { kind: "unknown", reason: describe(name, a.raw, a.refs, "template") };
+    }
+    const expr = (a.refs?.[0] ?? "").trim();
+    const m = OBJECT_ATTRIBUTE.exec(expr);
+    if (m && !VALUE_ROOTS.has(m[1]))
+        return { kind: "known", value: raw };
+    return { kind: "unknown", reason: describe(name, a.raw, a.refs, "reference") };
+}
+/**
+ * Whether an argument that names a source (`snapshot_identifier`,
+ * `replicate_source_db`) or a nested block (`restore_to_point_in_time`) is
+ * given. The provider reads these with `GetOk`, so a literal `""` is the same
+ * as leaving the argument out; anything else, a reference included, is given.
+ */
+export function isGiven(body, name) {
+    const a = attr(body, name);
+    if (a.kind === "absent")
+        return false;
+    if (a.kind === "literal") {
+        if (a.value === "" || a.value === false)
+            return false;
+        if (Array.isArray(a.value))
+            return a.value.length > 0;
+    }
+    return true;
+}
+/** The bodies of a nested block, re-exported for the rule files. */
+export { nestedBodies };
+/** A finding the literal proves. */
+export function finding(checkId, severity, block, message) {
+    return { checkId, severity, message: `"${block.address}" ${message}`, entity: block.key, lexicon: "terraform" };
+}
+/**
+ * The one `info` diagnostic a rule emits when it cannot read the value it
+ * needs. The message starts `Not determined:`, as #2284 fixed for TF030-TF037.
+ */
+export function notDetermined(checkId, block, reason, tail) {
+    return {
+        checkId,
+        severity: "info",
+        message: `Not determined: "${block.address}" ${reason}. ${tail}`,
+        entity: block.key,
+        lexicon: "terraform",
+    };
+}

package/dist/lint/post-synth/index.js

@@ -0,0 +1,90 @@
+import { tf001 } from "./tf001.js";
+import { tf002 } from "./tf002.js";
+import { tf003 } from "./tf003.js";
+import { tf004 } from "./tf004.js";
+import { tf005 } from "./tf005.js";
+import { tf006 } from "./tf006.js";
+import { tf007 } from "./tf007.js";
+import { tf008 } from "./tf008.js";
+import { tf009 } from "./tf009.js";
+import { tf010 } from "./tf010.js";
+import { tf011 } from "./tf011.js";
+import { tf012 } from "./tf012.js";
+import { tf013 } from "./tf013.js";
+import { tf014 } from "./tf014.js";
+import { tf015 } from "./tf015.js";
+import { tf016 } from "./tf016.js";
+import { tf017 } from "./tf017.js";
+import { tf018 } from "./tf018.js";
+import { tf019 } from "./tf019.js";
+import { tf020 } from "./tf020.js";
+import { tf021 } from "./tf021.js";
+import { tf022 } from "./tf022.js";
+import { tf024 } from "./tf024.js";
+import { tf025 } from "./tf025.js";
+import { tf026 } from "./tf026.js";
+import { tf027 } from "./tf027.js";
+import { tf028 } from "./tf028.js";
+import { tf029 } from "./tf029.js";
+import { tf030 } from "./tf030.js";
+import { tf031 } from "./tf031.js";
+import { tf032 } from "./tf032.js";
+import { tf033 } from "./tf033.js";
+import { tf034 } from "./tf034.js";
+import { tf035 } from "./tf035.js";
+import { tf036 } from "./tf036.js";
+import { tf037 } from "./tf037.js";
+import { tf038 } from "./tf038.js";
+import { tf039 } from "./tf039.js";
+import { tf040 } from "./tf040.js";
+import { tf041 } from "./tf041.js";
+import { tf042 } from "./tf042.js";
+import { tf043 } from "./tf043.js";
+import { tf044 } from "./tf044.js";
+import { tf045 } from "./tf045.js";
+export const postSynthChecks = [
+    tf001,
+    tf002,
+    tf003,
+    tf004,
+    tf005,
+    tf006,
+    tf007,
+    tf008,
+    tf009,
+    tf010,
+    tf011,
+    tf012,
+    tf013,
+    tf014,
+    tf015,
+    tf016,
+    tf017,
+    tf018,
+    tf019,
+    tf020,
+    tf021,
+    tf022,
+    tf024,
+    tf025,
+    tf026,
+    tf027,
+    tf028,
+    tf029,
+    tf030,
+    tf031,
+    tf032,
+    tf033,
+    tf034,
+    tf035,
+    tf036,
+    tf037,
+    tf038,
+    tf039,
+    tf040,
+    tf041,
+    tf042,
+    tf043,
+    tf044,
+    tf045,
+];

package/dist/lint/post-synth/module-source.js

@@ -0,0 +1,153 @@
+/**
+ * Classify a `module` block's `source` string, shared by TF004 (registry
+ * module without a version) and TF005 (git/hg module unpinned or pinned to
+ * a branch). Neither rule evaluates HCL: both read `source` as the literal
+ * string hcl2json hands back, so a source built from a variable or a
+ * function call is never classified (`"other"`), matching tflint's own
+ * `SourceKnown` guard on `module.Source`.
+ *
+ * `registry` mirrors `hashicorp/terraform-registry-address`'s
+ * `ParseModuleSource` (MPL-2.0,
+ * https://github.com/hashicorp/terraform-registry-address/blob/main/module.go):
+ * three slash-separated parts (`namespace/name/target-system`), or four with
+ * a leading hostname that contains a dot and is not `github.com` or
+ * `bitbucket.org` (those are reserved for direct VCS installs, never a
+ * registry). `git` covers the sources tflint's `terraform_module_pinned_source`
+ * treats as git/hg: an explicit `git::`/`hg::` force prefix, the `github.com`
+ * and `bitbucket.org` shorthands its `GitHubDetector`/`BitBucketDetector`
+ * recognize, scp-style `git@host:path` addresses, and any source ending in
+ * `.git`. `local` is `./` or `../` (checkov's `UNKNOWN` case for module
+ * pinning: a local path cannot be pinned to anything and is never flagged).
+ * `oci` is an OpenTofu `oci://host/repo` source (#3190). OpenTofu selects a
+ * version with `?tag=` or `?digest=` (https://opentofu.org/docs/language/modules/sources/),
+ * and a source naming neither resolves the `latest` tag. The container-image
+ * shapes `repo:tag` and `repo@sha256:...` are read too, so a source written
+ * the way `docker pull` spells it is not misread as unpinned. A `:` inside the
+ * host (a registry port) is never a tag: only a colon in the last path
+ * segment is. The tag and digest rules were checked against the docs page
+ * above; the suffix forms are not documented there and are not verified
+ * against OpenTofu's parser.
+ */
+const REGISTRY_NAME = /^[0-9A-Za-z](?:[0-9A-Za-z_-]{0,62}[0-9A-Za-z])?$/;
+const REGISTRY_TARGET_SYSTEM = /^[0-9a-z]{1,64}$/;
+const RESERVED_VCS_HOSTS = new Set(["github.com", "bitbucket.org"]);
+/** Split a raw query string (no leading `?`) into its key/value pairs, last write wins. */
+function parseQuery(query) {
+    const params = new Map();
+    for (const pair of query.split("&")) {
+        if (pair === "")
+            continue;
+        const eq = pair.indexOf("=");
+        const key = eq === -1 ? pair : pair.slice(0, eq);
+        const value = eq === -1 ? "" : decodeURIComponent(pair.slice(eq + 1));
+        params.set(decodeURIComponent(key), value);
+    }
+    return params;
+}
+/** Strip a `//<subdir>` package-subdirectory suffix, ignoring one embedded in the scheme (`https://`). */
+function stripSubdir(base) {
+    const schemeEnd = base.indexOf("://");
+    const searchFrom = schemeEnd === -1 ? 0 : schemeEnd + 3;
+    const idx = base.indexOf("//", searchFrom);
+    return idx === -1 ? base : base.slice(0, idx);
+}
+function isRegistryAddress(rest) {
+    const parts = stripSubdir(rest).split("/");
+    let namespace, name, targetSystem;
+    if (parts.length === 3) {
+        [namespace, name, targetSystem] = parts;
+    }
+    else if (parts.length === 4) {
+        const host = parts[0];
+        if (!host.includes(".") || RESERVED_VCS_HOSTS.has(host.toLowerCase()))
+            return false;
+        [, namespace, name, targetSystem] = parts;
+    }
+    else {
+        return false;
+    }
+    return REGISTRY_NAME.test(namespace) && REGISTRY_NAME.test(name) && REGISTRY_TARGET_SYSTEM.test(targetSystem);
+}
+/** Is `rest` (source with any `git::`/`hg::` force prefix already stripped) a git/hg-shaped source? */
+function isGitShaped(rest) {
+    if (/^[\w.-]+@[^:/]+:/.test(rest))
+        return true; // scp-style, e.g. git@github.com:org/repo.git
+    const withoutScheme = rest.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+    if (/^(github\.com|bitbucket\.org)\//i.test(withoutScheme))
+        return true;
+    if (/\.git($|[/?])/i.test(withoutScheme))
+        return true;
+    return false;
+}
+function classifyOci(base, query) {
+    const params = parseQuery(query);
+    let path = stripSubdir(base).replace(/^oci:\/\//i, "");
+    let tag = params.get("tag") || undefined;
+    let digest = params.get("digest") || undefined;
+    const at = path.indexOf("@");
+    if (at !== -1) {
+        digest = digest ?? (path.slice(at + 1) || undefined);
+        path = path.slice(0, at);
+    }
+    const lastSlash = path.lastIndexOf("/");
+    const colon = path.indexOf(":", lastSlash + 1); // a port sits before the first slash
+    if (colon !== -1) {
+        tag = tag ?? (path.slice(colon + 1) || undefined);
+    }
+    return { kind: "oci", ...(tag !== undefined ? { tag } : {}), ...(digest !== undefined ? { digest } : {}) };
+}
+export function classifyModuleSource(source) {
+    const trimmed = source.trim();
+    if (trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith(".\\") || trimmed.startsWith("..\\")) {
+        return { kind: "local" };
+    }
+    const queryIdx = trimmed.indexOf("?");
+    const base = queryIdx === -1 ? trimmed : trimmed.slice(0, queryIdx);
+    const query = queryIdx === -1 ? "" : trimmed.slice(queryIdx + 1);
+    if (/^oci:\/\//i.test(base))
+        return classifyOci(base, query);
+    const forced = /^(git|hg)::/i.exec(base);
+    const rest = forced ? base.slice(forced[0].length) : base;
+    if (forced || isGitShaped(rest)) {
+        const params = parseQuery(query);
+        const ref = params.get("ref") || params.get("rev") || undefined;
+        return { kind: "git", ref };
+    }
+    if (isRegistryAddress(rest))
+        return { kind: "registry" };
+    return { kind: "other" };
+}
+const TAG_LIKE = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const FULL_SHA = /^[0-9a-f]{40}$/i;
+const DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
+/**
+ * Is `ref` pinned tightly enough for TF005: a semver-shaped tag or a full
+ * 40-hex commit SHA. Stricter than checkov's `CKV_TF_1`/`CKV_TF_2`, which
+ * accept any `?ref=` containing `\d\.\d` (so `v1.2-dev` passes there); the
+ * page documents the difference.
+ */
+export function isPinnedRef(ref) {
+    return TAG_LIKE.test(ref) || FULL_SHA.test(ref);
+}
+/** Is `ref` one of the well-known mutable branch names tflint's `flexible` style rejects, plus `trunk`. */
+export function isDefaultBranch(ref) {
+    return DEFAULT_BRANCHES.has(ref);
+}
+const MUTABLE_TAGS = new Set(["latest", "main", "master", "develop", "dev", "stable", "edge", "nightly"]);
+/**
+ * Is `tag` a name that conventionally moves (`latest`, a branch-like name)
+ * rather than an exact version. Used by TF038. A tag is a mutable pointer in
+ * most registries whatever it looks like, so the rule is a warning and this
+ * only decides what reads as obviously floating.
+ */
+export function isMutableOciTag(tag) {
+    return MUTABLE_TAGS.has(tag.toLowerCase());
+}
+/**
+ * Is a registry `version` constraint an exact version (`1.4.0`, `= 1.4.0`,
+ * `=1.4.0`) rather than a range (`~> 1.4`, `>= 1.4`, `>= 1.0, < 2.0`). Used
+ * by TF039. A bare version is an exact constraint in Terraform.
+ */
+export function isExactVersionConstraint(version) {
+    return /^(?:=\s*)?v?\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version.trim()) && !version.includes(",");
+}

package/dist/lint/post-synth/scope.js

@@ -0,0 +1,104 @@
+/**
+ * Root scope or child scope, and the `Callers:` chain that says which call
+ * reached a finding (chant #2112).
+ *
+ * Since the parse descends into local modules, `ctx.entities` holds two kinds
+ * of block: the root module's own, keyed `<root>/<address>`, and a child
+ * module's, keyed `<root>/module.<name>/<address>` with the call chain on
+ * `props.callers`. Every check has to say which it applies to, and the three
+ * shapes that answer live here:
+ *
+ * - {@link isRootScoped} for a check about how a ROOT is assembled (TF001's
+ *   backend, TF002's `required_providers`): a child module has no backend and
+ *   no provider requirements of its own to judge, and reading one as if it
+ *   were the root's is how a root with a perfectly good backend gets flagged
+ *   because a module beneath it has none.
+ * - {@link isChildScoped} for the mirror, the two rules that are ONLY about
+ *   child modules (TF014, TF015).
+ * - {@link callersNote} for the sentence appended to a finding inside a
+ *   child, naming each call site with the file and line it sits on. tflint
+ *   prints the same thing as a `Callers:` block under the diagnostic
+ *   (https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/calling-modules.md);
+ *   a `PostSynthDiagnostic` carries no ranges, so the chain goes in the
+ *   message, where a reader of any output format sees it.
+ *
+ * A check with no opinion (most of them: an unset `type` on a variable is the
+ * same finding wherever the variable lives) needs nothing from this module and
+ * runs over both scopes, which is what tflint does with its own language rules
+ * under `--call-module-type=local`.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { callersOfKey } from "../../hcl/parse.js";
+/** The `module.<name>` chain on an entity, outermost first. Empty for a root block. */
+export function callersOf(entity) {
+    if (!isResourceDeclarable(entity))
+        return [];
+    const props = entity.props;
+    return Array.isArray(props.callers) ? props.callers : [];
+}
+/** Was this block declared in the root module itself? */
+export function isRootScoped(entity) {
+    return callersOf(entity).length === 0;
+}
+/** Was this block declared in a child module the root calls? */
+export function isChildScoped(entity) {
+    return callersOf(entity).length > 0;
+}
+/**
+ * The `Callers:` sentence for a finding on `key`, or `""` when the finding is
+ * in the root module.
+ *
+ * The call sites are the key's own prefixes: a finding on
+ * `app/module.cdn/module.bucket/aws_s3_bucket.assets` was reached through
+ * `app/module.cdn` and then `app/module.cdn/module.bucket`, both of them
+ * `module` block entities in `ctx.entities`, so the file and line each was
+ * parsed from are already recorded. A prefix with no entity (a hand-built
+ * context in a test) renders as the bare call name.
+ */
+export function callersNote(ctx, key) {
+    const callers = callersOfKey(key);
+    if (callers.length === 0)
+        return "";
+    const root = key.slice(0, key.indexOf("/"));
+    const hops = callers.map((caller, i) => {
+        const callSite = [root, ...callers.slice(0, i + 1)].join("/");
+        const entity = ctx.entities.get(callSite);
+        if (!entity || !isResourceDeclarable(entity))
+            return caller;
+        const props = entity.props;
+        const file = typeof props.file === "string" ? props.file : "";
+        if (file === "")
+            return caller;
+        return typeof props.line === "number" ? `${caller} (${file}:${props.line})` : `${caller} (${file})`;
+    });
+    return ` Callers: ${[root, ...hops].join(" -> ")}.`;
+}
+/**
+ * Wrap every check so a finding inside a child module carries its
+ * {@link callersNote}, whichever rule produced it.
+ *
+ * Done once, here, rather than in each rule's message: a reader of a finding
+ * on `module.cdn`'s bucket needs to know which call reached that code no
+ * matter which of the twenty-odd checks reported it, and a rule that forgot
+ * to append the chain would be a silent gap. The wrapper is what
+ * `terraformPlugin.postSynthChecks()` returns; a rule's own `check()` is
+ * unchanged, which is what its unit tests call.
+ *
+ * A message that already names the chain is left alone, so a rule with
+ * something more specific to say about its callers can say it.
+ */
+export function withCallersChain(checks) {
+    return checks.map((check) => ({
+        ...check,
+        check(ctx) {
+            return check.check(ctx).map((diagnostic) => {
+                if (typeof diagnostic.entity !== "string")
+                    return diagnostic;
+                if (diagnostic.message.includes("Callers:"))
+                    return diagnostic;
+                const note = callersNote(ctx, diagnostic.entity);
+                return note === "" ? diagnostic : { ...diagnostic, message: diagnostic.message + note };
+            });
+        },
+    }));
+}

package/dist/lint/post-synth/terragrunt.js

@@ -0,0 +1,63 @@
+/**
+ * Shared reading for the Terragrunt rules TF041 to TF045 (#3417).
+ *
+ * These rules look at `terragrunt.hcl` and `root.hcl`, which the parse reads
+ * into their own entity types (`TERRAGRUNT_*_TYPE` in `../../hcl/parse.ts`)
+ * and never into the module types the other TF rules check. Like the module
+ * source rules, they read the literal values hcl2json hands back: an
+ * attribute built from a function or a `local.` reference arrives as a
+ * `"${...}"` string and is treated as not determined, never as a finding.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { classifyModuleSource } from "./module-source.js";
+/** Entities of one Terragrunt type, with their keys, in map order. */
+export function terragruntEntities(entities, entityType) {
+    const out = [];
+    for (const [key, entity] of entities) {
+        if (entity.entityType !== entityType || !isResourceDeclarable(entity))
+            continue;
+        const props = entity.props;
+        out.push({
+            key,
+            address: typeof props.address === "string" ? props.address : key,
+            file: typeof props.file === "string" ? props.file : "terragrunt.hcl",
+            body: (typeof props.body === "object" && props.body !== null ? props.body : {}),
+        });
+    }
+    return out;
+}
+/** An HCL expression hcl2json left as `"${...}"`: its value is not known without evaluating it. */
+export function isExpression(value) {
+    return typeof value === "string" && value.includes("${");
+}
+/**
+ * Classify a unit's `terraform.source`. Git and `oci://` sources go through
+ * {@link classifyModuleSource}, the reader TF005 and TF038 use. `tfr://` is
+ * Terragrunt's own scheme for registry modules and takes its version from the
+ * `?version=` query argument. A source that holds an interpolation, or that
+ * names an absolute path or an archive URL, is `other` or `local` and is
+ * never reported.
+ */
+export function classifyTerragruntSource(source) {
+    const trimmed = source.trim();
+    if (trimmed.includes("${"))
+        return { kind: "other" };
+    if (/^tfr:\/\//i.test(trimmed)) {
+        const query = trimmed.includes("?") ? trimmed.slice(trimmed.indexOf("?") + 1) : "";
+        const version = new URLSearchParams(query).get("version");
+        return { kind: "tfr", pinned: version !== null && version.trim() !== "" };
+    }
+    if (trimmed.startsWith("/"))
+        return { kind: "local" };
+    const classified = classifyModuleSource(trimmed);
+    switch (classified.kind) {
+        case "local":
+            return { kind: "local" };
+        case "git":
+            return { kind: "git", pinned: classified.ref !== undefined };
+        case "oci":
+            return { kind: "oci", pinned: classified.tag !== undefined || classified.digest !== undefined };
+        default:
+            return { kind: "other" };
+    }
+}