@intentius/chant-lexicon-terraform 0.124.31 → 0.124.32

package/dist/lint/post-synth/tf038.js

@@ -0,0 +1,63 @@
+/**
+ * TF038: an `oci://` module source names no tag and no digest, or a mutable
+ * tag.
+ *
+ * OpenTofu resolves an OCI module source with no `tag` to the `latest` tag
+ * (https://opentofu.org/docs/language/modules/sources/), so an unpinned source
+ * and `?tag=latest` are the same thing: a push to the registry changes what
+ * the root provisions with no diff to review. A digest, or an exact version
+ * tag, holds it. `classifyModuleSource` (`./module-source.ts`) reads the tag
+ * and digest from either spelling.
+ *
+ * A warning rather than an error: a registry can make a version tag
+ * immutable, and a source that names `?tag=1.4.0` is read as pinned here
+ * whether or not the registry enforces that. A digest is the only pin the
+ * registry cannot move, which the message says. A source that names a digest
+ * is never flagged, whatever tag sits beside it.
+ *
+ * Scope: root and child modules alike (#2112), same as TF004 and TF005.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE } from "../../hcl/parse.js";
+import { classifyModuleSource, isMutableOciTag } from "./module-source.js";
+export const tf038 = {
+    id: "TF038",
+    description: "OCI module source has no tag or digest, or a mutable tag",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [key, entity] of ctx.entities) {
+            if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const source = typeof body.source === "string" ? body.source : undefined;
+            if (source === undefined)
+                continue;
+            const classified = classifyModuleSource(source);
+            if (classified.kind !== "oci" || classified.digest)
+                continue;
+            const address = typeof props.address === "string" ? props.address : key;
+            let message;
+            if (!classified.tag) {
+                message =
+                    `Module "${address}" sources "${source}" with no tag or digest, so OpenTofu pulls the \`latest\` tag. ` +
+                        "Pin it to a digest (`?digest=sha256:...`) or an exact version tag (`?tag=1.4.0`).";
+            }
+            else if (isMutableOciTag(classified.tag)) {
+                message =
+                    `Module "${address}" sources "${source}" with the mutable tag "${classified.tag}". ` +
+                        "Pin it to a digest (`?digest=sha256:...`) or an exact version tag (`?tag=1.4.0`).";
+            }
+            if (!message)
+                continue;
+            diagnostics.push({
+                checkId: "TF038",
+                severity: "warning",
+                message,
+                entity: key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf039.js

@@ -0,0 +1,55 @@
+/**
+ * TF039: a registry module's `version` is a range, not an exact version.
+ *
+ * TF004 flags a registry module with no `version`; a `version` of `~> 1.4`,
+ * `>= 1.4` or `>= 1.0, < 2.0` passes it, yet an upstream release inside the
+ * range changes what the root provisions with no diff to review. This rule is
+ * for projects that pin modules to one version (`1.4.0` or `= 1.4.0`).
+ *
+ * Off by default: it is a `report-only` catalog entry, so the `recommended`
+ * preset leaves it out and `lint.presets: { terraform: "all" }` (or a
+ * `lint.rules` entry for TF039) turns it on. Ranges are common and often
+ * intended, so a default warning would be noise for most roots. It is a
+ * separate rule from TF004 because a post-synth check receives no options
+ * (`PostSynthCheck.check(ctx)`), while the preset mechanism already carries
+ * exactly this on/off choice per rule id (#3190).
+ *
+ * A module that has no `version` is TF004's finding and is skipped here.
+ *
+ * Scope: root and child modules alike (#2112).
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE } from "../../hcl/parse.js";
+import { classifyModuleSource, isExactVersionConstraint } from "./module-source.js";
+export const tf039 = {
+    id: "TF039",
+    description: "Registry module version is a range, not an exact version",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [key, entity] of ctx.entities) {
+            if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const source = typeof body.source === "string" ? body.source : undefined;
+            if (source === undefined || classifyModuleSource(source).kind !== "registry")
+                continue;
+            const version = body.version;
+            if (typeof version !== "string" || version.trim() === "")
+                continue;
+            if (isExactVersionConstraint(version))
+                continue;
+            const address = typeof props.address === "string" ? props.address : key;
+            diagnostics.push({
+                checkId: "TF039",
+                severity: "warning",
+                message: `Module "${address}" sources "${source}" with the version range "${version}". ` +
+                    "A release inside the range changes what the root provisions with no diff to review. " +
+                    'Pin an exact version (`version = "1.4.0"`).',
+                entity: key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf040.js

@@ -0,0 +1,67 @@
+/**
+ * TF040: a root that uses providers has no `.terraform.lock.hcl`.
+ *
+ * The lock file records the provider versions and hashes `terraform init`
+ * selected. Without it, each `init` resolves `required_providers` constraints
+ * afresh, so a provider release changes a plan with no diff. None of
+ * TF001 to TF029 looks at it.
+ *
+ * "Committed" is decided by presence: the file sits beside the root's `.tf`
+ * files in the source tree being parsed (`props.lockFile`, stamped by
+ * `parseTerraformRootDir` and by the local audit path). Whether git tracks it
+ * is not asked, so a lock file that is present but gitignored counts as
+ * committed. A parse with no directory to look in (a fetched repository,
+ * inline source) leaves `lockFile` unset and the rule reports nothing: not
+ * determined, not clean.
+ *
+ * A root that implies no provider (no `provider` block and no resource or data
+ * type) gets no lock file from `init`, so it is skipped, as is a live
+ * choudoufu root, which runs no `init`. One diagnostic per root, anchored on
+ * the first block that implies a provider.
+ *
+ * Off by default in both places: the `report-only` tier keeps it out of a
+ * build's `recommended` preset, and `auditOptIn` keeps it out of `chant audit`.
+ * Many estates run `init` in CI and never commit the file.
+ *
+ * Scope: root modules only (#2112); a child module has no lock file of its own.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LOCK_FILENAME } from "../../hcl/parse.js";
+import { isRootScoped } from "./scope.js";
+import { impliedProviders } from "./tf002.js";
+export const tf040 = {
+    id: "TF040",
+    description: "Root has no committed .terraform.lock.hcl",
+    // `chant audit` runs every rule, report-only ones included, so without this a
+    // new rule would change every project's audit output. A `lint.rules` entry
+    // for TF040 turns it on in the audit as well as in a build (#3190).
+    auditOptIn: true,
+    check(ctx) {
+        const diagnostics = [];
+        const missing = new Set();
+        for (const entity of ctx.entities.values()) {
+            if (!isResourceDeclarable(entity) || !isRootScoped(entity))
+                continue;
+            const props = entity.props;
+            if (props.lockFile !== false || props.mode === "live" || typeof props.root !== "string")
+                continue;
+            missing.add(props.root);
+        }
+        for (const root of [...missing].sort()) {
+            const implied = impliedProviders(ctx.entities, root);
+            if (implied.size === 0)
+                continue;
+            const names = [...implied.keys()].sort();
+            diagnostics.push({
+                checkId: "TF040",
+                severity: "warning",
+                message: `Root module "${root}" uses ${names.length === 1 ? "provider" : "providers"} ${names.map((n) => `"${n}"`).join(", ")} ` +
+                    `but has no ${LOCK_FILENAME} beside its .tf files. Run \`terraform init\` and commit the file, ` +
+                    "so every init selects the same provider versions.",
+                entity: implied.get(names[0]),
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf041.js

@@ -0,0 +1,53 @@
+/**
+ * TF041: a Terragrunt `dependency` has `mock_outputs` and lets them stand in
+ * for `apply`.
+ *
+ * `mock_outputs` is what a dependency returns when it has no outputs yet.
+ * `mock_outputs_allowed_terraform_commands` limits which commands may use
+ * them. Terragrunt reads a missing list and an empty list the same way, as no
+ * limit (`shouldReturnMockOutputs` in `pkg/config/dependency.go`, v1.1.6:
+ * `nil || len == 0 || slices.Contains(list, command)`). So a dependency with
+ * mocks and no list, or a list that names `apply`, can apply the mock values
+ * to real state when the upstream unit has not been applied, and the apply
+ * reports success. The usual list is `["validate", "plan"]`.
+ *
+ * A list that is an expression (`local.mock_commands`) is not determined and
+ * passes. A dependency with `enabled = false` returns its mocks whatever the
+ * list says; that is a different decision and is not reported here.
+ */
+import { TERRAGRUNT_DEPENDENCY_TYPE } from "../../hcl/parse.js";
+import { isExpression, terragruntEntities } from "./terragrunt.js";
+export const tf041 = {
+    id: "TF041",
+    description: "Terragrunt dependency lets mock_outputs stand in for apply",
+    check(ctx) {
+        const diagnostics = [];
+        for (const dep of terragruntEntities(ctx.entities, TERRAGRUNT_DEPENDENCY_TYPE)) {
+            if (dep.body.mock_outputs === undefined)
+                continue;
+            const allowed = dep.body.mock_outputs_allowed_terraform_commands;
+            if (isExpression(allowed))
+                continue;
+            let problem;
+            if (allowed === undefined || (Array.isArray(allowed) && allowed.length === 0)) {
+                problem =
+                    "sets no `mock_outputs_allowed_terraform_commands`, and Terragrunt reads a missing or empty list as every command";
+            }
+            else if (Array.isArray(allowed) && allowed.includes("apply")) {
+                problem = 'lists "apply" in `mock_outputs_allowed_terraform_commands`';
+            }
+            if (problem === undefined)
+                continue;
+            diagnostics.push({
+                checkId: "TF041",
+                severity: "warning",
+                message: `Dependency "${dep.address.replace(/^dependency\./, "")}" in ${dep.file} sets \`mock_outputs\` and ${problem}. ` +
+                    "An apply that runs before the upstream unit is applied writes the mock values to real state. " +
+                    'Set `mock_outputs_allowed_terraform_commands = ["validate", "plan"]`.',
+                entity: dep.key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf042.js

@@ -0,0 +1,38 @@
+/**
+ * TF042: a Terragrunt `dependency` sets `skip_outputs = true` and
+ * `mock_outputs`.
+ *
+ * With `skip_outputs = true` Terragrunt never reads the upstream unit's
+ * outputs (`shouldGetOutputs` in `pkg/config/dependency.go`, v1.1.6), so the
+ * only values the dependency can return are the mocks. Every plan and apply
+ * the mocks are allowed for runs on them, however far the upstream unit has
+ * been applied. The pair is sometimes meant, to break a cycle or to avoid
+ * reading state, and then the mock values are the configuration; that is
+ * worth writing as inputs, which a reader of the unit can see.
+ *
+ * Only a literal `skip_outputs = true` is reported. A `skip_outputs` built
+ * from an expression is not determined.
+ */
+import { TERRAGRUNT_DEPENDENCY_TYPE } from "../../hcl/parse.js";
+import { terragruntEntities } from "./terragrunt.js";
+export const tf042 = {
+    id: "TF042",
+    description: "Terragrunt dependency sets skip_outputs together with mock_outputs",
+    check(ctx) {
+        const diagnostics = [];
+        for (const dep of terragruntEntities(ctx.entities, TERRAGRUNT_DEPENDENCY_TYPE)) {
+            if (dep.body.skip_outputs !== true || dep.body.mock_outputs === undefined)
+                continue;
+            diagnostics.push({
+                checkId: "TF042",
+                severity: "warning",
+                message: `Dependency "${dep.address.replace(/^dependency\./, "")}" in ${dep.file} sets \`skip_outputs = true\` with \`mock_outputs\`. ` +
+                    "Terragrunt then never reads the upstream unit's outputs, so every plan and apply runs on the mock values. " +
+                    "Drop `skip_outputs`, or pass the values as `inputs` so they are visible as configuration.",
+                entity: dep.key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf043.js

@@ -0,0 +1,45 @@
+/**
+ * TF043: a Terragrunt unit's `terraform.source` names no version.
+ *
+ * A git source with no `?ref=` follows the default branch, a `tfr://` source
+ * with no `?version=` follows the registry's latest release, and an `oci://`
+ * source with no tag or digest pulls `latest`. A push or a release changes
+ * what the unit provisions with no diff to review. TF005 and TF038 do the same
+ * for `module` blocks; a Terragrunt unit has no `module` block, its source is
+ * the `source` argument of the `terraform` block.
+ *
+ * A local path and a source built from an expression (`${local.base}//x`) are
+ * not determined and pass. A mutable `?ref=main` is not judged
+ * here: the rule asks only whether a version is named.
+ */
+import { TERRAGRUNT_SOURCE_TYPE } from "../../hcl/parse.js";
+import { classifyTerragruntSource, terragruntEntities } from "./terragrunt.js";
+const FIX = {
+    git: "Add `?ref=` with a tag or commit SHA.",
+    tfr: "Add `?version=` with an exact version.",
+    oci: "Add `?digest=sha256:...` or `?tag=` with an exact version tag.",
+};
+export const tf043 = {
+    id: "TF043",
+    description: "Terragrunt terraform.source names no version (git ref, tfr version or oci tag)",
+    check(ctx) {
+        const diagnostics = [];
+        for (const block of terragruntEntities(ctx.entities, TERRAGRUNT_SOURCE_TYPE)) {
+            const source = block.body.source;
+            if (typeof source !== "string")
+                continue;
+            const classified = classifyTerragruntSource(source);
+            if (classified.pinned !== false)
+                continue;
+            diagnostics.push({
+                checkId: "TF043",
+                severity: "warning",
+                message: `The \`terraform\` block in ${block.file} sources "${source}" with no version, so a push or a release changes the unit with no diff to review. ` +
+                    FIX[classified.kind],
+                entity: block.key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf044.js

@@ -0,0 +1,45 @@
+/**
+ * TF044: a Terragrunt config keeps state in a local backend.
+ *
+ * Read from `remote_state { backend = "local" }` and from a `generate` block
+ * whose `contents` declare `backend "local"`. State on the runner's disk is
+ * gone when the job ends, a second job cannot read what the first applied, and
+ * a git-range run, which checks out each side in a temporary directory, never
+ * sees state at all. A shared backend (S3, GCS, azurerm, a Terraform HTTP
+ * backend) holds it.
+ *
+ * A backend named by an expression is not determined and passes. A local
+ * backend is sometimes right for a throwaway sandbox; suppress the rule there
+ * with `# chant-ignore TF044`.
+ */
+import { TERRAGRUNT_GENERATE_TYPE, TERRAGRUNT_REMOTE_STATE_TYPE } from "../../hcl/parse.js";
+import { terragruntEntities } from "./terragrunt.js";
+const LOCAL_BACKEND_BLOCK = /\bbackend\s+"local"/;
+export const tf044 = {
+    id: "TF044",
+    description: "Terragrunt config keeps state in a local backend",
+    check(ctx) {
+        const diagnostics = [];
+        const report = (key, file, how) => {
+            diagnostics.push({
+                checkId: "TF044",
+                severity: "warning",
+                message: `${how} in ${file} keeps state in a local backend. The state lives on the runner's disk, so a later job cannot read it ` +
+                    "and a git-range run, which checks out each side in a temporary directory, never sees it. Use a shared backend such as S3 or GCS.",
+                entity: key,
+                lexicon: "terraform",
+            });
+        };
+        for (const block of terragruntEntities(ctx.entities, TERRAGRUNT_REMOTE_STATE_TYPE)) {
+            if (block.body.backend === "local")
+                report(block.key, block.file, "`remote_state` sets `backend = \"local\"`");
+        }
+        for (const block of terragruntEntities(ctx.entities, TERRAGRUNT_GENERATE_TYPE)) {
+            const contents = block.body.contents;
+            if (typeof contents === "string" && LOCAL_BACKEND_BLOCK.test(contents)) {
+                report(block.key, block.file, `\`generate "${block.address.replace(/^generate\./, "")}"\` writes a \`backend "local"\` block`);
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf045.js

@@ -0,0 +1,44 @@
+/**
+ * TF045: no Terragrunt config sets `terragrunt_version_constraint`.
+ *
+ * The attribute makes Terragrunt refuse to run on a release outside the range.
+ * Without it each machine and each CI image runs whatever Terragrunt it
+ * installed, and a behaviour change between releases reaches a plan with no
+ * diff. It is usually set once, in the root config every unit includes.
+ *
+ * The rule looks at the whole set of configs in the scan and reports once. It
+ * reports only when the set holds a config that includes no other file (the
+ * root config, or a self-contained unit) and none of the configs sets the
+ * attribute. A set made only of units that include a parent it did not read,
+ * such as one unit directory passed alone, is not determined: the parent may
+ * set it. The finding is anchored on `root.hcl` when the set has one.
+ *
+ * Off by default: the `report-only` tier keeps it out of the `recommended`
+ * preset, since many repos pin Terragrunt in the toolchain (`.tool-versions`,
+ * a CI image) rather than in config.
+ */
+import { TERRAGRUNT_CONFIG_TYPE } from "../../hcl/parse.js";
+import { terragruntEntities } from "./terragrunt.js";
+export const tf045 = {
+    id: "TF045",
+    description: "No Terragrunt config sets terragrunt_version_constraint",
+    check(ctx) {
+        const configs = terragruntEntities(ctx.entities, TERRAGRUNT_CONFIG_TYPE);
+        if (configs.some((c) => c.body.terragrunt_version_constraint !== undefined))
+            return [];
+        const tops = configs.filter((c) => Array.isArray(c.body.includes) && c.body.includes.length === 0);
+        if (tops.length === 0)
+            return [];
+        const anchor = [...tops].sort((a, b) => Number(b.file === "root.hcl") - Number(a.file === "root.hcl") || a.key.localeCompare(b.key))[0];
+        return [
+            {
+                checkId: "TF045",
+                severity: "warning",
+                message: `No Terragrunt config sets \`terragrunt_version_constraint\` (${anchor.file} is the top config read). ` +
+                    'Set it once in the root config, for example `terragrunt_version_constraint = ">= 1.1.0"`, so every machine runs a release the repo was tested with.',
+                entity: anchor.key,
+                lexicon: "terraform",
+            },
+        ];
+    },
+};

package/dist/lint/rules/fixtures/load.js

@@ -0,0 +1,50 @@
+/**
+ * Shared lint-rule fixture loader, the `lint/rules/` sibling of
+ * `../../post-synth/fixtures/load.ts`.
+ *
+ * A post-synth check's fixtures are `.tf`, a real Terraform root. A lint
+ * rule's fixtures are Op-shaped source, the kind `chant lint` runs a rule's
+ * `check(context)` against directly. TF101's live under
+ * `fixtures/TF101/positive-op.ts` (triggers) and `negative-op.ts` (passes),
+ * deliberately unimported and unresolved at the identifier level: TF101
+ * itself matches purely on callee name (see `plan-before-apply.ts`'s doc
+ * comment), so a fixture that only needs to parse, not typecheck or run as a
+ * standalone program, stays honest about what the rule actually reads.
+ *
+ * On disk these are named `<name>-op.ts`, not `<name>.op.ts`: a real
+ * `*.op.ts` file is exactly what `packages/core/src/op/discover.ts`'s
+ * `discoverOps()` walks the whole repository (down from the git root, absent
+ * a `chant.config.*`) to find and `import()`, and it does that unconditionally
+ * in tests like `generate-pipeline.test.ts` that exercise real discovery. A
+ * fixture named `positive.op.ts` would be swept into that scan, imported,
+ * and fail at the top-level `const plan = terraformPlan(...)` reference,
+ * turning into a discovery error that breaks an unrelated, already-passing
+ * test. `loadRuleFixture` still hands the rule a logical `.op.ts` filename
+ * (below) so parsing and diagnostics see the file the way a real one would
+ * appear; only the on-disk name dodges the scan. Both physical files are
+ * also excluded from every tsconfig that would otherwise try to compile them
+ * as real source (root `tsconfig.json`, `tsconfig.typecheck.json`, and this
+ * lexicon's `tsconfig.build.json`).
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { ts } from "@intentius/chant/lint/typescript";
+const FIXTURES_DIR = dirname(fileURLToPath(import.meta.url));
+/**
+ * Parse `fixtures/<ruleId>/<name>-op.ts` into a {@link LintContext} whose
+ * `filePath` is the logical `<name>.op.ts` a real Op file would carry.
+ *
+ * Three lines per fixture in a test:
+ * ```ts
+ * const diags = planBeforeApplyRule.check(loadRuleFixture("TF101", "positive"));
+ * expect(diags).toHaveLength(1);
+ * ```
+ */
+export function loadRuleFixture(ruleId, name) {
+    const onDisk = `${name}-op.ts`;
+    const logical = `${name}.op.ts`;
+    const code = readFileSync(join(FIXTURES_DIR, ruleId, onDisk), "utf-8");
+    const sourceFile = ts.createSourceFile(logical, code, ts.ScriptTarget.Latest, true);
+    return { sourceFile, entities: [], filePath: logical };
+}

package/dist/lint/rules/index.js

@@ -0,0 +1,4 @@
+import { planBeforeApplyRule } from "./plan-before-apply.js";
+export { planBeforeApplyRule } from "./plan-before-apply.js";
+/** All lint rules provided by this lexicon (imported by plugin.ts's lintRules()). */
+export const rules = [planBeforeApplyRule];

package/dist/lint/rules/plan-before-apply.js

@@ -0,0 +1,136 @@
+import { ts } from "@intentius/chant/lint/typescript";
+/**
+ * TF101: terraformApply's planFile must reference a preceding terraformPlan step.
+ *
+ * Applying a plan file chosen by a string means the applied plan can be
+ * stale, hand-edited, or simply the wrong one — the entire point of the
+ * plan/apply split (review exactly what will change, then apply exactly
+ * that) is defeated the moment the path is spelled out in source instead of
+ * carried forward from the `terraformPlan` step that produced it.
+ *
+ * The two builders this rule is written against (`terraformPlan`,
+ * `terraformApply`) don't exist yet (#2086 ships them in parallel), so this
+ * matches purely on callee identifier name — same posture as
+ * `lexicons/k3s/src/lint/rules/token-literal.ts`.
+ *
+ * Accepts exactly the two authoring forms that produce a genuine step-output
+ * reference (`packages/core/src/op/step-output-ref.ts`):
+ *   - `stepOutput(<ident>, "planFile")`
+ *   - `<ident>.out.planFile`
+ * where `<ident>` is bound (`const <ident> = terraformPlan(...)`) in the same
+ * file. Flags a string literal, a template literal, or one of the two
+ * accepted reference forms pointing at an identifier that resolves to
+ * something other than a `terraformPlan` call. When `<ident>` cannot be
+ * resolved at all (not declared anywhere in the file), this rule stays
+ * silent — the same deliberately shallow "bail rather than guess" posture
+ * `validateStepOutputRefs` takes, since the runtime brand on a real
+ * `StepOutputRef` is invisible to a source-level AST match.
+ *
+ * Fires on every `terraformApply` call, live root or stock. #2106 exempted
+ * live roots for one release, because choudoufu refused `-out` and
+ * `apply <planfile>` and the activity ran a bare `apply -auto-approve` with no
+ * plan file to pair. choudoufu v0.13.0 admits both under a `live` block
+ * ([choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878)), and
+ * there the pairing matters more than on a stock root, not less: the apply
+ * re-plans the live system and compares its fresh plan against the file it was
+ * handed, so a plan file spelled out as a literal is an approval for a run
+ * nobody can trace back to a plan step. The exemption is gone with the
+ * condition that produced it, and this rule reads no project config at all.
+ */
+export const planBeforeApplyRule = {
+    id: "TF101",
+    severity: "error",
+    category: "correctness",
+    description: "terraformApply's planFile must reference a preceding terraformPlan step",
+    check(context) {
+        const diagnostics = [];
+        const source = context.sourceFile;
+        /** Identifier name bound to a `terraformPlan(...)` call, to whether it truly is one. */
+        const bindings = new Map();
+        const calleeName = (expr) => ts.isIdentifier(expr) ? expr.text : ts.isPropertyAccessExpression(expr) ? expr.name.text : undefined;
+        const collectBindings = (node) => {
+            if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+                const init = node.initializer;
+                if (ts.isCallExpression(init) || ts.isNewExpression(init)) {
+                    bindings.set(node.name.text, calleeName(init.expression) === "terraformPlan");
+                }
+            }
+            ts.forEachChild(node, collectBindings);
+        };
+        collectBindings(source);
+        const flag = (node, message) => {
+            const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+            diagnostics.push({
+                ruleId: "TF101",
+                severity: "error",
+                message,
+                file: context.filePath,
+                line: line + 1,
+                column: character + 1,
+            });
+        };
+        /**
+         * `stepOutput(<ident>, "planFile")` or `<ident>.out.planFile`, returning
+         * the referenced identifier's name, or `undefined` if `initializer`
+         * isn't one of those two shapes.
+         */
+        const referencedIdent = (initializer) => {
+            if (ts.isCallExpression(initializer) && calleeName(initializer.expression) === "stepOutput") {
+                const arg = initializer.arguments[0];
+                return arg && ts.isIdentifier(arg) ? arg.text : undefined;
+            }
+            if (ts.isPropertyAccessExpression(initializer) &&
+                initializer.name.text === "planFile" &&
+                ts.isPropertyAccessExpression(initializer.expression) &&
+                initializer.expression.name.text === "out" &&
+                ts.isIdentifier(initializer.expression.expression)) {
+                return initializer.expression.expression.text;
+            }
+            return undefined;
+        };
+        const checkPlanFile = (obj) => {
+            for (const prop of obj.properties) {
+                if (!ts.isPropertyAssignment(prop))
+                    continue;
+                const name = ts.isIdentifier(prop.name)
+                    ? prop.name.text
+                    : ts.isStringLiteral(prop.name)
+                        ? prop.name.text
+                        : undefined;
+                if (name !== "planFile")
+                    continue;
+                const value = prop.initializer;
+                if (ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value) || ts.isTemplateExpression(value)) {
+                    flag(value, "`planFile` is a literal path in source. Pass the preceding `terraformPlan` step's output " +
+                        '(`stepOutput(plan, "planFile")` or `plan.out.planFile`), not a hardcoded path.');
+                    continue;
+                }
+                const ident = referencedIdent(value);
+                if (ident === undefined)
+                    continue; // not one of the two accepted forms — out of this rule's reach
+                const isPlan = bindings.get(ident);
+                if (isPlan === false) {
+                    flag(value, `\`planFile\` references "${ident}", which is not bound to a \`terraformPlan(...)\` call. ` +
+                        "Apply only a plan this Op itself produced.");
+                }
+                // isPlan === true: paired correctly.
+                // isPlan === undefined: `ident` isn't declared anywhere in this file — cannot resolve
+                // statically, so stay silent rather than guess.
+            }
+        };
+        const visit = (node) => {
+            if (ts.isCallExpression(node) && calleeName(node.expression) === "terraformApply") {
+                // The options object may be the first argument (`terraformApply({ planFile })`)
+                // or follow a positional one (`terraformApply("app", { planFile })`, the
+                // k3s-shaped builder signature); inspect every object-literal argument.
+                for (const arg of node.arguments) {
+                    if (ts.isObjectLiteralExpression(arg))
+                        checkPlanFile(arg);
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+        return diagnostics;
+    },
+};