@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/dist/lint/post-synth/record-store.js

@@ -0,0 +1,104 @@
+/**
+ * The record store a live root resolves to, read from its HCL the way
+ * choudoufu resolves it (INTENTIUS/choudoufu#2293, `internal/configs/live_derive.go`
+ * at choudoufu 74ffde956bfd97f44b8ad444424584e23321adc2). Shared by TF024,
+ * which names where records go, and TF046, which guards a CI root that ends
+ * up on the local store, so the two never disagree.
+ *
+ * The order is choudoufu's:
+ *
+ * 1. A `record_store "<kind>"` block in the `live` block or the
+ *    `estate.chdf.hcl` sidecar always wins (`source: "record_store"`).
+ * 2. Otherwise the backend block choudoufu ignores under live gives the store,
+ *    s3 to s3, gcs to gcs, azurerm to azurerm (`source: "backend"`). s3 and gcs
+ *    need a literal `bucket`; azurerm needs literal `storage_account_name`,
+ *    `container_name` and `resource_group_name`. A value passed only with
+ *    `-backend-config` is not in the configuration, so choudoufu does not see
+ *    it either.
+ * 3. Otherwise the store is local (`source: "implied"`), with `note` saying
+ *    why a backend that was there was not used.
+ *
+ * This mirrors `record_store.source` and `record_store.note` in
+ * `choudoufu live-check -json`. A literal here is a string hcl2json hands back
+ * with no `${...}` in it, the same "not determined" reading the Terragrunt
+ * rules use (`./terragrunt.ts`).
+ */
+import { backendTypes } from "./tf001.js";
+import { isExpression } from "./terragrunt.js";
+/** Backend types choudoufu derives a record store from (INTENTIUS/choudoufu#2293). */
+export const DERIVABLE_BACKENDS = new Set(["s3", "gcs", "azurerm"]);
+const asRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? v : {};
+const firstBody = (v) => asRecord(Array.isArray(v) ? v[0] : v);
+/**
+ * The label of a `record_store "<kind>"` block in a live declaration body, or
+ * undefined when it declares none. hcl2json nests the label one level down,
+ * as it does for `backend` (see `backendTypes` in `./tf001.ts`).
+ */
+export function recordStoreKind(liveBody) {
+    const raw = liveBody["record_store"];
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const labels = Object.keys(raw);
+    return labels[0];
+}
+/** A top-level backend argument as a literal string, or undefined when it is absent, empty or an expression. */
+function literal(body, name) {
+    const v = body[name];
+    if (typeof v !== "string" || v === "" || isExpression(v))
+        return undefined;
+    return v;
+}
+/**
+ * Why a backend block gives no record store, or undefined when it gives one.
+ * The wording follows choudoufu's `Live.RecordStoreNote`; an empty string
+ * means no store and nothing to say (a `local` backend).
+ */
+function derivationNote(type, body) {
+    const where = `backend "${type}"`;
+    switch (type) {
+        case "s3":
+        case "gcs":
+            return literal(body, "bucket") === undefined
+                ? `${where} sets no literal bucket; values passed with -backend-config are not read`
+                : undefined;
+        case "azurerm":
+            for (const name of ["storage_account_name", "container_name", "resource_group_name"]) {
+                if (literal(body, name) === undefined)
+                    return `${where} sets no literal ${name}, which the azurerm record store needs`;
+            }
+            return undefined;
+        case "local":
+            // choudoufu leaves no note here: a local backend and the local store agree.
+            return "";
+        default:
+            return `${where} has no record store counterpart`;
+    }
+}
+/**
+ * Resolve one live root's record store.
+ *
+ * `terraformBodies` are the bodies of every `terraform` block in the root (a
+ * backend can sit in a separate `backend.tf`). `liveBodies` are the root's
+ * live declarations: its `live` block and its sidecar, if any. choudoufu
+ * refuses a root that has both, so the first `record_store` found is the one.
+ */
+export function resolveRecordStore(terraformBodies, liveBodies) {
+    for (const live of liveBodies) {
+        const kind = recordStoreKind(live);
+        if (kind !== undefined)
+            return { kind, source: "record_store" };
+    }
+    for (const tf of terraformBodies) {
+        const type = backendTypes(tf)[0];
+        if (type === undefined)
+            continue;
+        const body = firstBody(asRecord(tf["backend"])[type]);
+        const note = derivationNote(type, body);
+        if (note === undefined)
+            return { kind: type, source: "backend", backend: type };
+        return { kind: "local", source: "implied", backend: type, ...(note ? { note } : {}) };
+    }
+    return { kind: "local", source: "implied" };
+}

package/dist/lint/post-synth/tf001.d.ts

@@ -30,8 +30,8 @@
  * module's `terraform` block is skipped here rather than read as if it were
  * the root's.
  *
- * Does not fire on a live root (#2103): a `backend` block is exactly what
- * choudoufu refuses there (TF024's territory), and the fallback to local
+ * Does not fire on a live root (#2103): choudoufu ignores a `backend` block
+ * there (TF024 reports what it still does with it), and the fallback to local
  * state this check warns about does not apply, since a live root keeps no
  * state file at all, local or remote.
  */

package/dist/lint/post-synth/tf001.js

@@ -30,8 +30,8 @@
  * module's `terraform` block is skipped here rather than read as if it were
  * the root's.
  *
- * Does not fire on a live root (#2103): a `backend` block is exactly what
- * choudoufu refuses there (TF024's territory), and the fallback to local
+ * Does not fire on a live root (#2103): choudoufu ignores a `backend` block
+ * there (TF024 reports what it still does with it), and the fallback to local
  * state this check warns about does not apply, since a live root keeps no
  * state file at all, local or remote.
  */

package/dist/lint/post-synth/tf024.d.ts

@@ -1,24 +1,48 @@
 /**
  * TF024: a live root declares a `backend` or `cloud` block.
  *
- * choudoufu refuses this combination at `init`, before any command runs,
- * naming both blocks that collide: "Both a backend and a live configuration
- * are present" (a `backend` block) or "Both a cloud and a live configuration
- * are present" (a `cloud` block). A live root keeps no state to store, since
- * prior state is a projection rebuilt from the live system every run, so
- * either block is a contradiction about where the truth lives, not a
- * redundant setting.
+ * choudoufu used to refuse this pair at `init` (#1170). Since
+ * INTENTIUS/choudoufu#2213 it accepts both and ignores them with a warning
+ * (`internal/configs/module.go`, `ignoreStateStoreUnderLive`), because
+ * Terragrunt's `remote_state` and Atmos's `backend.tf.json` write a backend
+ * beside the live block on every run. What each block still does:
+ *
+ * - `backend "<type>"`: no state is read or written there, and
+ *   `init -migrate-state` is refused. choudoufu keeps the block as
+ *   `IgnoredBackend`: an apply publishes the estate's non-sensitive outputs
+ *   to the location it names, so `terraform_remote_state` readers keep
+ *   working, and when the live declaration has no `record_store` the record
+ *   store is derived from the backend's bucket, s3 to s3, gcs to gcs, azurerm
+ *   to azurerm (INTENTIUS/choudoufu#2293), when the bucket is a literal in
+ *   the configuration. An explicit `record_store` always wins. The resolution
+ *   is shared with TF046 in `./record-store.ts`.
+ * - `cloud {}`: dropped entirely. Nothing is published to it and no store is
+ *   derived from it.
+ *
+ * So the backend case is reported as `info` (the block is doing a job the
+ * author may want, and is the derivation source the maintainer ruled for),
+ * and the cloud case as `warning` (the block does nothing at all). Neither
+ * fails a build at default severity. The guard against a CI root that ends
+ * up on the local store is TF046 (chant#4561).
+ *
+ * The live marker is the root's `mode`, stamped from either a `live` block or
+ * an `estate.chdf.hcl` sidecar (`hcl/parse.ts`), so a sidecar estate is
+ * covered. A `record_store` is read from whichever `Terraform::Live` entity
+ * carries it: the `live` block, or the sidecar's top level.
  *
  * TF001 is the equivalent check for a stock root (no remote backend is
- * configured); it explicitly does not fire on a live root, and this check is
- * why: the two are mutually exclusive by construction; a root is flagged by
- * at most one of them.
+ * configured); it does not fire on a live root. A root is flagged by at most
+ * one of them.
  *
  * Scope: root modules only (#2112). A child module's backend or cloud block
  * is TF015's finding, whatever binary the root runs.
  *
  * One diagnostic per root, fired from the root's `terraform` block.
  */
-import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import type { PostSynthCheck, PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { type BlockBody } from "../../hcl/parse.js";
+export { DERIVABLE_BACKENDS } from "./record-store.js";
+/** Each root's live declarations (its `live` block and its sidecar), keyed by root. */
+export declare function liveBodiesByRoot(ctx: PostSynthContext): Map<string, BlockBody[]>;
 export declare const tf024: PostSynthCheck;
 //# sourceMappingURL=tf024.d.ts.map

package/dist/lint/post-synth/tf024.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tf024.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf024.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}
+{"version":3,"file":"tf024.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf024.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAEjB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAK5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAKpD,uFAAuF;AACvF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAYhF;AAqCD,eAAO,MAAM,KAAK,EAAE,cA4CnB,CAAC"}

package/dist/lint/post-synth/tf024.js

@@ -1,18 +1,38 @@
 /**
  * TF024: a live root declares a `backend` or `cloud` block.
  *
- * choudoufu refuses this combination at `init`, before any command runs,
- * naming both blocks that collide: "Both a backend and a live configuration
- * are present" (a `backend` block) or "Both a cloud and a live configuration
- * are present" (a `cloud` block). A live root keeps no state to store, since
- * prior state is a projection rebuilt from the live system every run, so
- * either block is a contradiction about where the truth lives, not a
- * redundant setting.
+ * choudoufu used to refuse this pair at `init` (#1170). Since
+ * INTENTIUS/choudoufu#2213 it accepts both and ignores them with a warning
+ * (`internal/configs/module.go`, `ignoreStateStoreUnderLive`), because
+ * Terragrunt's `remote_state` and Atmos's `backend.tf.json` write a backend
+ * beside the live block on every run. What each block still does:
+ *
+ * - `backend "<type>"`: no state is read or written there, and
+ *   `init -migrate-state` is refused. choudoufu keeps the block as
+ *   `IgnoredBackend`: an apply publishes the estate's non-sensitive outputs
+ *   to the location it names, so `terraform_remote_state` readers keep
+ *   working, and when the live declaration has no `record_store` the record
+ *   store is derived from the backend's bucket, s3 to s3, gcs to gcs, azurerm
+ *   to azurerm (INTENTIUS/choudoufu#2293), when the bucket is a literal in
+ *   the configuration. An explicit `record_store` always wins. The resolution
+ *   is shared with TF046 in `./record-store.ts`.
+ * - `cloud {}`: dropped entirely. Nothing is published to it and no store is
+ *   derived from it.
+ *
+ * So the backend case is reported as `info` (the block is doing a job the
+ * author may want, and is the derivation source the maintainer ruled for),
+ * and the cloud case as `warning` (the block does nothing at all). Neither
+ * fails a build at default severity. The guard against a CI root that ends
+ * up on the local store is TF046 (chant#4561).
+ *
+ * The live marker is the root's `mode`, stamped from either a `live` block or
+ * an `estate.chdf.hcl` sidecar (`hcl/parse.ts`), so a sidecar estate is
+ * covered. A `record_store` is read from whichever `Terraform::Live` entity
+ * carries it: the `live` block, or the sidecar's top level.
  *
  * TF001 is the equivalent check for a stock root (no remote backend is
- * configured); it explicitly does not fire on a live root, and this check is
- * why: the two are mutually exclusive by construction; a root is flagged by
- * at most one of them.
+ * configured); it does not fire on a live root. A root is flagged by at most
+ * one of them.
  *
  * Scope: root modules only (#2112). A child module's backend or cloud block
  * is TF015's finding, whatever binary the root runs.
@@ -20,15 +40,61 @@
  * One diagnostic per root, fired from the root's `terraform` block.
  */
 import { isResourceDeclarable } from "@intentius/chant/declarable";
-import { TERRAFORM_TYPE } from "../../hcl/parse.js";
-import { hasBlock } from "./tf001.js";
+import { LIVE_TYPE, TERRAFORM_TYPE } from "../../hcl/parse.js";
+import { backendTypes, hasBlock } from "./tf001.js";
 import { isRootScoped } from "./scope.js";
+import { DERIVABLE_BACKENDS, resolveRecordStore } from "./record-store.js";
+export { DERIVABLE_BACKENDS } from "./record-store.js";
+const bodyOf = (props) => (typeof props.body === "object" && props.body !== null ? props.body : {});
+/** Each root's live declarations (its `live` block and its sidecar), keyed by root. */
+export function liveBodiesByRoot(ctx) {
+    const roots = new Map();
+    for (const entity of ctx.entities.values()) {
+        if (entity.entityType !== LIVE_TYPE)
+            continue;
+        if (!isResourceDeclarable(entity) || !isRootScoped(entity))
+            continue;
+        const props = entity.props;
+        const root = typeof props.root === "string" ? props.root : "";
+        const list = roots.get(root) ?? [];
+        list.push(bodyOf(props));
+        roots.set(root, list);
+    }
+    return roots;
+}
+function backendMessage(root, type, store) {
+    const label = type ? `backend "${type}"` : "backend";
+    const head = `Root module "${root}" runs choudoufu with a declared estate and also declares a ${label} block. ` +
+        "choudoufu ignores it with a warning: no state is read or written there and `init -migrate-state` " +
+        "is refused. An apply publishes the estate's non-sensitive outputs to the location it names, so " +
+        "terraform_remote_state readers keep working.";
+    if (store.source === "record_store") {
+        return `${head} Records go to the record_store the live declaration names, which wins over the backend.`;
+    }
+    if (store.source === "backend") {
+        return (`${head} With no record_store declared, choudoufu derives the record store from this backend's ` +
+            "bucket and prints it on every init and plan (INTENTIUS/choudoufu#2293). Declare record_store to " +
+            "put records somewhere else.");
+    }
+    const why = DERIVABLE_BACKENDS.has(type) && store.note
+        ? `No record store is derived from it: ${store.note}.`
+        : `No record store is derived from a ${type ? `"${type}"` : "backend of unknown type"} (only s3, gcs and azurerm are).`;
+    return (`${head} ${why} No record_store is declared, so records stay in the local ` +
+        "store. Declare record_store if more than one machine runs this root (TF046 guards this in CI).");
+}
+function cloudMessage(root) {
+    return (`Root module "${root}" runs choudoufu with a declared estate and also declares a cloud block. ` +
+        "choudoufu ignores it entirely: no state is read or written there, no outputs are published to it, " +
+        "and no record store is derived from it. Remove it, or use a backend block if " +
+        "terraform_remote_state readers need this estate's outputs.");
+}
 export const tf024 = {
     id: "TF024",
-    description: "Live root declares a backend or cloud block, which choudoufu refuses",
+    description: "Live root declares a backend or cloud block, which choudoufu ignores",
     check(ctx) {
         const diagnostics = [];
         const flagged = new Set();
+        let liveBodies;
         for (const [name, entity] of ctx.entities) {
             if (entity.entityType !== TERRAFORM_TYPE)
                 continue;
@@ -40,19 +106,25 @@ export const tf024 = {
             const root = typeof props.root === "string" ? props.root : "";
             if (flagged.has(root))
                 continue;
-            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
-            const hasBackend = hasBlock(body, "backend");
+            const body = bodyOf(props);
             const hasCloud = hasBlock(body, "cloud");
+            const hasBackend = hasBlock(body, "backend");
             if (!hasBackend && !hasCloud)
                 continue;
             flagged.add(root);
-            const blockKind = hasBackend ? "backend" : "cloud";
+            // A cloud block does nothing at all, so it is the one worth a warning
+            // when a (malformed) root somehow carries both.
+            if (hasCloud) {
+                diagnostics.push({ checkId: "TF024", severity: "warning", message: cloudMessage(root), entity: name, lexicon: "terraform" });
+                continue;
+            }
+            liveBodies ?? (liveBodies = liveBodiesByRoot(ctx));
+            const type = backendTypes(body)[0] ?? "";
+            const store = resolveRecordStore([body], liveBodies.get(root) ?? []);
             diagnostics.push({
                 checkId: "TF024",
-                severity: "error",
-                message: `Root module "${root}" runs choudoufu with a declared estate and also declares a ` +
-                    `${blockKind} block. choudoufu refuses this at init: "Both a ${blockKind} and a live ` +
-                    `configuration are present." Remove the ${blockKind} block; a live root keeps no state to store.`,
+                severity: "info",
+                message: backendMessage(root, type, store),
                 entity: name,
                 lexicon: "terraform",
             });

package/dist/lint/post-synth/tf046.d.ts

@@ -0,0 +1,64 @@
+/**
+ * TF046: a live root's record store is local, and the lint runs in CI.
+ *
+ * A live root keeps its records (what binds a record-backed resource to the
+ * estate) in a record store. With nothing to say otherwise that store is a
+ * directory beside the module (choudoufu `live/STORAGE.md`), and on a CI
+ * runner the directory is empty on every run: an ordinary resource still binds
+ * by its marker, but a record-backed one is proposed for create again.
+ *
+ * "Local" is what choudoufu resolves, read here through `./record-store.ts`,
+ * the same resolution TF024 names in its message (INTENTIUS/choudoufu#2293):
+ *
+ * - an explicit `record_store "local"` fires;
+ * - an explicit `record_store` of any other kind is quiet, whatever backend
+ *   sits beside it;
+ * - with no `record_store`, an ignored `backend "s3"`, `"gcs"` or `"azurerm"`
+ *   block that names its bucket as a literal gives a derived store and is
+ *   quiet;
+ * - with no `record_store` and no backend, or a backend with no counterpart
+ *   (`local`, `consul`, `http`), or one whose bucket comes only from
+ *   `-backend-config`, the store is implied local and the rule fires, naming
+ *   the reason choudoufu would print.
+ *
+ * A root that is also a Terragrunt unit with a `remote_state`, a `generate`
+ * block that writes a backend, or an `include` of a parent config gets its
+ * backend file at run time, so what chant reads is not what choudoufu sees.
+ * The rule stays quiet there rather than guess; TF044 still reports a
+ * Terragrunt `backend = "local"`.
+ *
+ * CI is read from the environment chant runs in: `CI` set to anything but
+ * `false` or `0`, or `GITHUB_ACTIONS`, `GITLAB_CI`, `FORGEJO_ACTIONS`,
+ * `GITEA_ACTIONS` or `TF_BUILD` (Azure Pipelines) set to `true`. Outside CI the
+ * local store is a reasonable choice for one person or a demo, and the rule
+ * says nothing.
+ *
+ * Opt-outs, for emulator and test lanes that use the local store on purpose:
+ * `CHANT_ALLOW_LOCAL_RECORD_STORE=1` in the lane's environment, or
+ * `# chant-ignore-block: TF046` above the `terraform` block holding `live`
+ * for one root, or
+ * `lint.rules: { TF046: "off" }` for a whole project.
+ *
+ * The rule is `report-only` in the audit catalog, so it is off under the
+ * `recommended` preset: terragucci switches it on and holds the product
+ * wording (chant#4561 placement).
+ *
+ * One diagnostic per root. It fires from the `terraform` block that holds the
+ * `live` block, since suppression comments anchor on top-level blocks only,
+ * and from the sidecar's `Terraform::Live` entity for a sidecar estate, where
+ * `# chant-ignore-file: TF046` in `estate.chdf.hcl` suppresses it.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+/** The environment variable an emulator or test lane sets to keep the local store without a finding. */
+export declare const ALLOW_LOCAL_RECORD_STORE_ENV = "CHANT_ALLOW_LOCAL_RECORD_STORE";
+type Env = Readonly<Record<string, string | undefined>>;
+/** Whether the environment is a CI job. */
+export declare function isCiEnvironment(env: Env): boolean;
+/**
+ * TF046 against an explicit environment. `tf046.check` passes `process.env`;
+ * tests pass their own.
+ */
+export declare function checkLocalRecordStore(ctx: PostSynthContext, env: Env): PostSynthDiagnostic[];
+export declare const tf046: PostSynthCheck;
+export {};
+//# sourceMappingURL=tf046.d.ts.map

package/dist/lint/post-synth/tf046.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf046.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf046.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAa1C,wGAAwG;AACxG,eAAO,MAAM,4BAA4B,mCAAmC,CAAC;AAE7E,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAIxD,2CAA2C;AAC3C,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAMjD;AA4FD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,GAAG,mBAAmB,EAAE,CAgB5F;AAED,eAAO,MAAM,KAAK,EAAE,cAOnB,CAAC"}

package/dist/lint/post-synth/tf046.js

@@ -0,0 +1,175 @@
+/**
+ * TF046: a live root's record store is local, and the lint runs in CI.
+ *
+ * A live root keeps its records (what binds a record-backed resource to the
+ * estate) in a record store. With nothing to say otherwise that store is a
+ * directory beside the module (choudoufu `live/STORAGE.md`), and on a CI
+ * runner the directory is empty on every run: an ordinary resource still binds
+ * by its marker, but a record-backed one is proposed for create again.
+ *
+ * "Local" is what choudoufu resolves, read here through `./record-store.ts`,
+ * the same resolution TF024 names in its message (INTENTIUS/choudoufu#2293):
+ *
+ * - an explicit `record_store "local"` fires;
+ * - an explicit `record_store` of any other kind is quiet, whatever backend
+ *   sits beside it;
+ * - with no `record_store`, an ignored `backend "s3"`, `"gcs"` or `"azurerm"`
+ *   block that names its bucket as a literal gives a derived store and is
+ *   quiet;
+ * - with no `record_store` and no backend, or a backend with no counterpart
+ *   (`local`, `consul`, `http`), or one whose bucket comes only from
+ *   `-backend-config`, the store is implied local and the rule fires, naming
+ *   the reason choudoufu would print.
+ *
+ * A root that is also a Terragrunt unit with a `remote_state`, a `generate`
+ * block that writes a backend, or an `include` of a parent config gets its
+ * backend file at run time, so what chant reads is not what choudoufu sees.
+ * The rule stays quiet there rather than guess; TF044 still reports a
+ * Terragrunt `backend = "local"`.
+ *
+ * CI is read from the environment chant runs in: `CI` set to anything but
+ * `false` or `0`, or `GITHUB_ACTIONS`, `GITLAB_CI`, `FORGEJO_ACTIONS`,
+ * `GITEA_ACTIONS` or `TF_BUILD` (Azure Pipelines) set to `true`. Outside CI the
+ * local store is a reasonable choice for one person or a demo, and the rule
+ * says nothing.
+ *
+ * Opt-outs, for emulator and test lanes that use the local store on purpose:
+ * `CHANT_ALLOW_LOCAL_RECORD_STORE=1` in the lane's environment, or
+ * `# chant-ignore-block: TF046` above the `terraform` block holding `live`
+ * for one root, or
+ * `lint.rules: { TF046: "off" }` for a whole project.
+ *
+ * The rule is `report-only` in the audit catalog, so it is off under the
+ * `recommended` preset: terragucci switches it on and holds the product
+ * wording (chant#4561 placement).
+ *
+ * One diagnostic per root. It fires from the `terraform` block that holds the
+ * `live` block, since suppression comments anchor on top-level blocks only,
+ * and from the sidecar's `Terraform::Live` entity for a sidecar estate, where
+ * `# chant-ignore-file: TF046` in `estate.chdf.hcl` suppresses it.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE, TERRAFORM_TYPE, TERRAGRUNT_CONFIG_TYPE, TERRAGRUNT_GENERATE_TYPE, TERRAGRUNT_REMOTE_STATE_TYPE, } from "../../hcl/parse.js";
+import { isRootScoped } from "./scope.js";
+import { resolveRecordStore } from "./record-store.js";
+/** The environment variable an emulator or test lane sets to keep the local store without a finding. */
+export const ALLOW_LOCAL_RECORD_STORE_ENV = "CHANT_ALLOW_LOCAL_RECORD_STORE";
+const truthy = (v) => v !== undefined && v !== "" && v !== "0" && v.toLowerCase() !== "false";
+/** Whether the environment is a CI job. */
+export function isCiEnvironment(env) {
+    if (truthy(env.CI))
+        return true;
+    for (const name of ["GITHUB_ACTIONS", "GITLAB_CI", "FORGEJO_ACTIONS", "GITEA_ACTIONS", "TF_BUILD"]) {
+        if (env[name]?.toLowerCase() === "true")
+            return true;
+    }
+    return false;
+}
+const bodyOf = (entity) => {
+    const props = entity.props;
+    return (typeof props.body === "object" && props.body !== null ? props.body : {});
+};
+const rootOf = (entity) => {
+    const root = entity.props.root;
+    return typeof root === "string" ? root : "";
+};
+/** Whether a Terragrunt block in this root writes a backend file at run time. */
+function writesRuntimeBackend(entity) {
+    const body = bodyOf(entity);
+    switch (entity.entityType) {
+        case TERRAGRUNT_REMOTE_STATE_TYPE:
+            return body.backend !== "local";
+        case TERRAGRUNT_GENERATE_TYPE: {
+            const contents = typeof body.contents === "string" ? body.contents : "";
+            return /\bbackend\s+"(?!local")/.test(contents);
+        }
+        case TERRAGRUNT_CONFIG_TYPE:
+            return Array.isArray(body.includes) && body.includes.length > 0;
+        default:
+            return false;
+    }
+}
+function liveRoots(ctx) {
+    const roots = new Map();
+    const terraform = new Map();
+    /** Per root, the key of the first `terraform` block that holds a `live` block. */
+    const holder = new Map();
+    const runtime = new Set();
+    for (const [key, entity] of ctx.entities) {
+        if (!isResourceDeclarable(entity) || !isRootScoped(entity))
+            continue;
+        const root = rootOf(entity);
+        if (entity.entityType === TERRAFORM_TYPE) {
+            const list = terraform.get(root) ?? [];
+            const body = bodyOf(entity);
+            list.push(body);
+            terraform.set(root, list);
+            if (body.live !== undefined && !holder.has(root))
+                holder.set(root, key);
+            continue;
+        }
+        if (entity.entityType === LIVE_TYPE) {
+            if (entity.props.mode !== "live")
+                continue;
+            const found = roots.get(root);
+            if (found)
+                found.liveBodies.push(bodyOf(entity));
+            else
+                roots.set(root, { anchor: key, liveBodies: [bodyOf(entity)], terraformBodies: [], runtimeBackend: false });
+            continue;
+        }
+        if (writesRuntimeBackend(entity))
+            runtime.add(root);
+    }
+    for (const [root, live] of roots) {
+        live.terraformBodies = terraform.get(root) ?? [];
+        live.anchor = holder.get(root) ?? live.anchor;
+        live.runtimeBackend = runtime.has(root);
+    }
+    return roots;
+}
+function message(root, store) {
+    const why = store.source === "record_store"
+        ? 'Its live declaration names record_store "local", a directory beside the module.'
+        : store.note
+            ? `It declares no record_store, and no store is derived from its backend: ${store.note}.`
+            : store.backend
+                ? `It declares no record_store, and its backend "${store.backend}" block keeps state on local disk, so choudoufu uses the local store.`
+                : "It declares no record_store and has no backend block to derive one from, so choudoufu uses the local store.";
+    return (`Live root "${root}" keeps its records in the local store, and this is a CI run. ${why} ` +
+        "A CI runner starts with an empty directory every run, so each record-backed resource is proposed " +
+        "for create again. Keep or add a backend \"s3\", \"gcs\" or \"azurerm\" block with a literal bucket " +
+        "(choudoufu derives the store from it), or declare a record_store in the live block or " +
+        `estate.chdf.hcl. A lane that uses the local store on purpose sets ${ALLOW_LOCAL_RECORD_STORE_ENV}=1.`);
+}
+/**
+ * TF046 against an explicit environment. `tf046.check` passes `process.env`;
+ * tests pass their own.
+ */
+export function checkLocalRecordStore(ctx, env) {
+    if (!isCiEnvironment(env) || truthy(env[ALLOW_LOCAL_RECORD_STORE_ENV]))
+        return [];
+    const diagnostics = [];
+    for (const [root, live] of liveRoots(ctx)) {
+        if (live.runtimeBackend)
+            continue;
+        const store = resolveRecordStore(live.terraformBodies, live.liveBodies);
+        if (store.kind !== "local")
+            continue;
+        diagnostics.push({
+            checkId: "TF046",
+            severity: "error",
+            message: message(root, store),
+            entity: live.anchor,
+            lexicon: "terraform",
+        });
+    }
+    return diagnostics;
+}
+export const tf046 = {
+    id: "TF046",
+    description: "Live root resolves to the local record store in a CI run",
+    check(ctx) {
+        return checkLocalRecordStore(ctx, process.env);
+    },
+};

package/dist/lint/post-synth/tf047.d.ts

@@ -0,0 +1,36 @@
+/**
+ * TF047: a live root pins a registry module version the known-module catalog
+ * has no row for, or one whose row carries refusals.
+ *
+ * The catalog is choudoufu's module compatibility table, vendored in
+ * `../../module-catalog/` (chant#4560, choudoufu#2292). It has one static
+ * row per terraform-aws-modules example at one tag, measured offline in the
+ * onboarded form. A module call on a root whose binary is choudoufu (the
+ * root's `mode` is `live`) with an exact `version` is looked up there:
+ *
+ * - no row for the module, or none at the pinned version: `info`, naming the
+ *   versions the static tier did measure;
+ * - at least one example at that version refused: `warning`, with each
+ *   refusal ID, its site count, the examples that carry it and its
+ *   `live/LIMITATIONS.md` link;
+ * - every example clear: quiet.
+ *
+ * Every message names the tier. The catalog holds the static tier only, and
+ * no figure here counts a gauntlet run (choudoufu#2292 ruling: two tiers,
+ * never mixed).
+ *
+ * A stock root (`mode: "state"`) is skipped: the table measures choudoufu.
+ * A range is TF039's finding and a missing `version` TF004's, so both are
+ * skipped here. A `//subdir` source is looked up by its module repository.
+ *
+ * Off by default: `report-only` in the audit catalog, as TF039 is.
+ * terragucci turns it on and holds the product wording (terragucci#1286).
+ *
+ * Scope: root and child modules of a live root alike.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { type ModuleCompatibility } from "../../module-catalog/index.js";
+/** The TF047 message for one module call, or undefined when the call is clear. */
+export declare function catalogMessage(address: string, c: ModuleCompatibility): string | undefined;
+export declare const tf047: PostSynthCheck;
+//# sourceMappingURL=tf047.d.ts.map

package/dist/lint/post-synth/tf047.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf047.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf047.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAK9B,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CA2B1F;AAED,eAAO,MAAM,KAAK,EAAE,cAkCnB,CAAC"}