@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/dist/hcl/parse.d.ts

@@ -19,8 +19,12 @@
  */
 import { type Hcl2Json } from "@intentius/chant/terraform/parse";
 import { type Declarable } from "@intentius/chant/declarable";
+import type { SuppressionDirective } from "@intentius/chant/lint/suppressions";
+import type { TerraformDeleteMode } from "../config.js";
 /** A parsed HCL block body, as `@cdktf/hcl2json` encodes it. */
 export type BlockBody = Record<string, unknown>;
+/** Whether a root runs under choudoufu with a declared estate (#2103). */
+export type TerraformRootMode = "live" | "state";
 /** The entity every block becomes. `props` is what post-synth checks read. */
 export interface TerraformEntity extends Declarable {
     readonly lexicon: "terraform";
@@ -34,7 +38,70 @@ export interface TerraformEntity extends Declarable {
         readonly file: string;
         /** Configured root name this block belongs to. */
         readonly root: string;
+        /**
+         * The chain of `module.<name>` calls that reached this block, outermost
+         * first (chant #2112). Empty or absent on a block declared in the root
+         * module itself; `["module.cdn"]` on a block of the module `./modules/cdn`
+         * called as `cdn` from the root; `["module.cdn", "module.bucket"]` one
+         * level deeper. The same chain is in the entity key, which is
+         * `<root>/module.cdn/<address>` for the first case, so a reader can tell
+         * root scope from child scope from either.
+         *
+         * The names are the CALL names (`module.<label>`), not the directory the
+         * source points at, matching `terraform show -json`'s `child_modules[]`
+         * addresses, choudoufu's marker grammar, and tflint's `Callers:` chain.
+         */
+        readonly callers?: readonly string[];
+        /**
+         * Whether this root is live: `terraform.binary` is `"choudoufu"` and an
+         * estate is declared (a `live` block or an `estate.chdf.hcl` sidecar).
+         * Set on every entity of the root, not just the `Terraform::Live` one, so
+         * a post-synth check or `describeResources()` reads it without
+         * re-parsing (#2103). Absent when the caller supplied no `binary` (the
+         * `chant audit` content path, which has no project config to read).
+         */
+        readonly mode?: TerraformRootMode;
+        /** The declared estate name. Present only when `mode` is `"live"`. */
+        readonly estate?: string;
+        /** `terraform.roots.<name>.workspace`, recorded so TF025 can flag a non-default one on a live root. */
+        readonly workspace?: string;
+        /**
+         * `terraform.roots.<name>.delete` (#2106), recorded so TF026 can check a
+         * live root declaring `"never"` against its `policy` block's
+         * `undeclared_tagged` setting. Present regardless of mode, same as
+         * `workspace`; only a live root's TF026 reads it.
+         */
+        readonly delete?: TerraformDeleteMode;
+        /**
+         * 1-based line the block's header starts on, from a line scan over the
+         * raw source (chant #2111): hcl2json exposes no ranges to read this from
+         * instead (see `../hcl/suppressions.ts`). Undefined when the scan's block
+         * regex didn't recognize the header (unusual formatting); a suppression
+         * comment simply can't anchor to that block then.
+         */
+        readonly line?: number;
+        /**
+         * The raw text of the file this block came from, verbatim.
+         *
+         * Every other field here is post-`hcl2json`, and that parse is lossy in
+         * one way that matters: it renders a bare reference (`value = var.x`) and
+         * a quoted interpolation (`value = "${var.x}"`) as the same string,
+         * `"${var.x}"`. The second is the deprecated pre-0.12 form TF016 reports
+         * and the first is idiomatic, so a check written against `body` alone
+         * would flag every reference in the root. The source text is where the
+         * quotes still exist. Empty when a caller built the entity by hand.
+         */
+        readonly source: string;
     };
+    /**
+     * `# chant-ignore`/`chant-ignore-file`/`chant-ignore-block` directives that
+     * apply to this entity (chant #2111): the ones anchored to its own block,
+     * plus any file-level one. Read generically by
+     * `@intentius/chant/lint/suppressions`'s `entitySuppressions()`; see that
+     * module's doc comment for why this is a plain duck-typed field rather than
+     * a `PostSynthContext` addition.
+     */
+    readonly suppressions?: readonly SuppressionDirective[];
 }
 /** `entityType` per block kind. */
 export declare const TERRAFORM_TYPE = "Terraform::Terraform";
@@ -45,6 +112,10 @@ export declare const MODULE_TYPE = "Terraform::Module";
 export declare const VARIABLE_TYPE = "Terraform::Variable";
 export declare const OUTPUT_TYPE = "Terraform::Output";
 export declare const LOCALS_TYPE = "Terraform::Locals";
+/** A `live { estate = "..." }` block, or an `estate.chdf.hcl` sidecar's content (#2103). */
+export declare const LIVE_TYPE = "Terraform::Live";
+/** The sidecar filename choudoufu reads an estate declaration from when no in-block `live { }` is used. */
+export declare const LIVE_SIDECAR_FILENAME = "estate.chdf.hcl";
 /**
  * Build one entity. Written out rather than run through `createResource`
  * from `@intentius/chant/runtime`: that factory is for generated resource
@@ -53,7 +124,13 @@ export declare const LOCALS_TYPE = "Terraform::Locals";
  * carries the same marker, so `isDeclarable()` and `isResourceDeclarable()`
  * both hold.
  */
-export declare function terraformEntity(entityType: string, address: string, body: BlockBody, file: string, root: string): TerraformEntity;
+export declare function terraformEntity(entityType: string, address: string, body: BlockBody, file: string, root: string, extra?: {
+    mode?: TerraformRootMode;
+    estate?: string;
+    workspace?: string;
+    delete?: TerraformDeleteMode;
+    callers?: readonly string[];
+}, source?: string, line?: number, suppressions?: readonly SuppressionDirective[]): TerraformEntity;
 /** One `.tf` file's name and source. */
 export interface TerraformFile {
     name: string;
@@ -66,22 +143,78 @@ export interface TerraformFile {
 export declare function splitBundleContent(content: string, fallbackName?: string): TerraformFile[];
 /** Every `.tf` directly under `dir`, in filename order. Non-recursive. */
 export declare function listTerraformFiles(dir: string): string[];
+/**
+ * Read the `estate.chdf.hcl` sidecar beside `dir`'s `.tf` files, if present.
+ * Sibling to {@link listTerraformFiles}: the sidecar is plain HCL (a bare
+ * `estate = "..."` attribute, no wrapper block) and is never a `.tf` file, so
+ * it falls outside that glob and needs its own read.
+ */
+export declare function readLiveSidecarFile(dir: string): TerraformFile | undefined;
+/**
+ * Options threading the config-level facts a root's mode depends on into the
+ * parse, so `blocksToEntities` can stamp `mode`/`estate`/`workspace` onto
+ * every entity without a second pass over the project config (#2103).
+ */
+export interface TerraformRootModeOptions {
+    /** `terraform.binary`. A root is live only when this is `"choudoufu"` and an estate is declared. */
+    binary?: string;
+    /** `terraform.roots.<name>.workspace`, recorded verbatim regardless of mode. */
+    workspace?: string;
+    /** `terraform.roots.<name>.delete`, recorded verbatim regardless of mode (#2106). */
+    delete?: TerraformDeleteMode;
+}
 /**
  * Parse a set of files into entities keyed `<root>/<address>`. Two blocks that
  * genuinely share an address (two `locals` blocks, or the same address in two
  * files of one root) are numbered `~2`, `~3` rather than overwriting.
+ *
+ * Recognises both ways an estate is declared: a `live { }` block nested in a
+ * `terraform { }` block of any file here, and, when `sidecar` is given, the
+ * `estate.chdf.hcl` sidecar's bare `estate = "..."` attribute. Either becomes
+ * a {@link LIVE_TYPE} entity, and the root is live (`mode: "live"`) exactly
+ * when `modeOptions.binary` is `"choudoufu"` and one of the two named an
+ * estate; that verdict, and the estate name when live, is then stamped onto
+ * every entity this call returns, sidecar and in-block declaration alike so
+ * a post-synth check or `describeResources()` reads it without re-parsing.
+ * When both forms are present the sidecar wins, matching choudoufu's own
+ * "the sidecar is the leading one" (choudoufu refuses the combination
+ * outright; this lexicon does not police that here, see TF024/TF025 for
+ * what it does police on a live root).
+ *
+ * `callers` is the module-call chain these files were reached through
+ * (chant #2112), empty for a root module. When it is non-empty the keys
+ * become `<root>/module.<name>/<address>` (one segment per caller) and every
+ * entity carries the chain on `props.callers`. `./descend.ts` is what fills
+ * it in; nothing else should pass it.
  */
-export declare function blocksToEntities(files: readonly TerraformFile[], root: string, hcl2json?: Hcl2Json): Promise<Map<string, Declarable>>;
+export declare function blocksToEntities(files: readonly TerraformFile[], root: string, hcl2json?: Hcl2Json, modeOptions?: TerraformRootModeOptions, sidecar?: TerraformFile, callers?: readonly string[]): Promise<Map<string, Declarable>>;
 /**
- * Parse a root module directory. Reads every `.tf` directly under `dir`.
- * Throws whatever the parser throws for malformed HCL; `buildRoots()` is where
- * that becomes a warning.
+ * Parse a root module directory. Reads every `.tf` directly under `dir`, plus
+ * the `estate.chdf.hcl` sidecar beside them when present. Throws whatever the
+ * parser throws for malformed HCL; `buildRoots()` is where that becomes a
+ * warning.
  */
-export declare function parseTerraformRootDir(dir: string, root: string, hcl2json?: Hcl2Json): Promise<Map<string, Declarable>>;
+export declare function parseTerraformRootDir(dir: string, root: string, hcl2json?: Hcl2Json, modeOptions?: TerraformRootModeOptions, callers?: readonly string[]): Promise<Map<string, Declarable>>;
 /**
  * Parse the joined-file string form `chant audit` produces for a discovered
- * root module (`AuditInput.content`). Unwired for now: #2085's
- * `auditEntities()` is what calls it.
+ * root module (`AuditInput.content`). `auditEntities()` is what calls it; that
+ * hook's single-argument contract carries no project config, so `modeOptions`
+ * is left undefined there and every entity gets `mode: "state"`; the audit
+ * path does not detect live mode (#2103). `modeOptions` exists here mainly for
+ * tests exercising the mode-stamping behaviour directly against inline HCL,
+ * the same way `parseTerraformRootDir`'s callers exercise it against files.
+ */
+export declare function parseTerraformRootContent(content: string, root: string, hcl2json?: Hcl2Json, modeOptions?: TerraformRootModeOptions): Promise<Map<string, Declarable>>;
+/**
+ * The module scope an entity key names: the part before the address.
+ *
+ * `"app/aws_s3_bucket.assets"` is scope `"app"` (the root module);
+ * `"app/module.cdn/aws_s3_bucket.assets"` is scope `"app/module.cdn"`. Keys
+ * are built here (see {@link blocksToEntities}), so the split lives here too:
+ * the reference index (`./references.ts`) and the module-scoped checks read
+ * scopes through it rather than re-deriving the key shape.
  */
-export declare function parseTerraformRootContent(content: string, root: string, hcl2json?: Hcl2Json): Promise<Map<string, Declarable>>;
+export declare function scopeOfKey(key: string): string;
+/** The `module.<name>` chain in an entity key, outermost first. Empty for a root-module block. */
+export declare function callersOfKey(key: string): string[];
 //# sourceMappingURL=parse.d.ts.map

package/dist/hcl/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEjF,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,kFAAkF;QAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,qFAAqF;QACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,6DAA6D;QAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,kDAAkD;QAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,mCAAmC;AACnC,eAAO,MAAM,cAAc,yBAAyB,CAAC;AACrD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,eAAe,CAQjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,SAAY,GAAG,aAAa,EAAE,CAiB7F;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAYD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAoElC;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAMlC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAElC"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,kFAAkF;QAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,qFAAqF;QACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,6DAA6D;QAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,kDAAkD;QAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;;;;;;;WAYG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC;;;;;;;WAOG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;QAClC,sEAAsE;QACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,uGAAuG;QACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;WAKG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC;;;;;;WAMG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACzD;AAED,mCAAmC;AACnC,eAAO,MAAM,cAAc,yBAAyB,CAAC;AACrD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,4FAA4F;AAC5F,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAE3C,2GAA2G;AAC3G,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACpI,MAAM,GAAE,MAAW,EACnB,IAAI,CAAC,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC7C,eAAe,CAqBjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,SAAY,GAAG,aAAa,EAAE,CAiB7F;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAI1E;AAsBD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CA6GlC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAUlC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAElC;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlD"}

package/dist/hcl/references.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Which declarations does a module scope actually reference (chant #2112)?
+ *
+ * One pass over every entity's body, collecting the reference forms Terraform
+ * writes as expressions: `var.<name>`, `local.<name>`, `data.<type>.<name>`,
+ * `module.<name>`, and the `provider = <type>.<alias>` / `providers = { <type>
+ * = <type>.<alias> }` meta-arguments. The result is keyed per module scope
+ * (`./parse.ts`'s `scopeOfKey`), because Terraform's own namespaces are: a
+ * `var.region` inside `module.cdn` is the child module's variable, never the
+ * root's, and a rule that pooled the two would call a genuinely unused root
+ * variable used.
+ *
+ * ## It is a string scan, and the rules built on it say so
+ *
+ * hcl2json gives back an expression as a STRING, with the `${...}` wrapper
+ * preserved: `count = length(var.subnets)` arrives as `"${length(var.subnets)}"`
+ * and `bucket = var.name` as `"${var.name}"`. There is no expression tree to
+ * walk, so this scans the strings with regexes. That reads a reference inside
+ * a comment-free body correctly and is deliberately generous at the edges: a
+ * name that appears inside a quoted literal (`description = "set var.region"`)
+ * counts as a reference, and a reference built dynamically
+ * (`lookup(local.by_env, terraform.workspace)` reaching a value nothing names
+ * directly) does not. Both directions are why TF020 is report-only and credits
+ * tflint's `terraform_unused_declarations` as `overlaps` rather than
+ * `equivalent`: it is the same question answered with a coarser instrument.
+ *
+ * The index records WHICH entity each reference came from, so a check can ask
+ * "is anything other than the declaration itself referring to this?". A
+ * `variable "port"` whose own `validation` block reads `var.port` is the case
+ * that needs it: without the exclusion every validated variable would look
+ * used.
+ */
+import { type Declarable } from "@intentius/chant/declarable";
+import { type BlockBody } from "./parse.js";
+/**
+ * Every reference token in one string, in the vocabulary the index keys by:
+ * `var.region`, `local.tags`, `data.aws_ami.ubuntu`, `module.cdn`.
+ *
+ * `data.` is matched before `local.`/`var.` can see it, and a `module.cdn.url`
+ * yields `module.cdn`, since the call is what a reference makes used.
+ */
+export declare function collectReferences(text: string): string[];
+/**
+ * The `provider`/`providers` meta-argument's own reference form, which is not
+ * an interpolation and has no prefix of its own: `provider = aws.west` names
+ * the `provider "aws" { alias = "west" }` block. Returned in the index's
+ * vocabulary, `provider.aws.west`, so it cannot collide with a resource
+ * address that happens to look the same.
+ */
+export declare function providerReference(value: unknown): string | undefined;
+/** Every reference in one block body, provider meta-arguments included. */
+export declare function referencesInBody(body: BlockBody): string[];
+/**
+ * Every reference in one module scope: token to the entity keys whose body
+ * mentions it.
+ */
+export type ScopeReferences = Map<string, Set<string>>;
+/** Reference tokens per module scope (`<root>`, `<root>/module.<name>`). */
+export interface ReferenceIndex {
+    readonly scopes: Map<string, ScopeReferences>;
+}
+/**
+ * Build the index over a whole build's entities. Scopes come from the entity
+ * keys, so a root and each of its descended child modules are separate, and
+ * two roots never pool.
+ */
+export declare function buildReferenceIndex(entities: Map<string, Declarable>): ReferenceIndex;
+/** The entity keys in `scope` whose body references `token`. */
+export declare function referencesTo(index: ReferenceIndex, scope: string, token: string): Set<string>;
+/**
+ * Is `token` referenced anywhere in `scope` other than by `declaredBy` itself?
+ * The exclusion is what keeps a variable read only by its own `validation`
+ * block, or a local read only by its own `locals` block, from looking used.
+ */
+export declare function isReferenced(index: ReferenceIndex, scope: string, token: string, declaredBy?: string): boolean;
+//# sourceMappingURL=references.d.ts.map

package/dist/hcl/references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../../src/hcl/references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAc,KAAK,SAAS,EAAwB,MAAM,SAAS,CAAC;AAc3E;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMpE;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,CA6B1D;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAEvD,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,cAAc,CAqBrF;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAE7F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,cAAc,EACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAMT"}

package/dist/hcl/roots.d.ts

@@ -13,10 +13,16 @@
  * someone else's estate is the whole job here, and half of it parsing is more
  * useful than none of it, especially when the audit path (#2085) walks
  * repositories it did not write.
+ *
+ * A root's own directory is not the end of the parse: a `module` block with a
+ * local source is followed into its directory and parsed as a child scope of
+ * the root (#2112). `./descend.ts` owns that walk and every refusal in it; the
+ * refusals surface here as this render's warnings.
  */
-import type { Declarable } from "@intentius/chant/declarable";
+import { type Declarable } from "@intentius/chant/declarable";
 import type { Hcl2Json } from "@intentius/chant/terraform/parse";
 import type { TerraformRootConfig } from "../config.js";
+import { type CallModuleType } from "./descend.js";
 export interface TerraformRootsResult {
     entities: Map<string, Declarable>;
     warnings: string[];
@@ -26,12 +32,25 @@ export interface RenderTerraformRootsOptions {
     projectRoot: string;
     /** `terraform.roots`: name to root-module config. */
     roots: Readonly<Record<string, TerraformRootConfig>>;
+    /**
+     * `terraform.binary`. A root is live only when this is `"choudoufu"` and it
+     * declares an estate; anything else runs stock (#2103).
+     */
+    binary?: string;
+    /**
+     * `terraform.callModuleType` (#2112): how far each root's parse follows its
+     * `module` calls. Defaults to `"local"`, so a module sourced from `./` or
+     * `../` is parsed as a child scope of the root that calls it.
+     */
+    callModuleType?: CallModuleType;
     /** Injectable parser (tests); defaults to core's lazy-loaded `@cdktf/hcl2json`. */
     hcl2json?: Hcl2Json;
 }
 /**
- * Parse each configured root into entities keyed `<root>/<address>`. Roots are
- * visited in declaration order, and one root's failure never stops the next.
+ * Parse each configured root into entities keyed `<root>/<address>`, plus its
+ * local child modules, keyed `<root>/module.<name>/<address>` (#2112). Roots
+ * are visited in declaration order, and one root's failure never stops the
+ * next.
  */
 export declare function renderTerraformRoots(opts: RenderTerraformRootsOptions): Promise<TerraformRootsResult>;
 //# sourceMappingURL=roots.d.ts.map

package/dist/hcl/roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAsB/B"}
+{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAEvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAyD/B"}

package/dist/hcl/suppressions.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Read `# chant-ignore*` comments out of raw `.tf` text.
+ *
+ * `hcl2json` drops comments entirely, and a probe of its output confirmed it
+ * exposes no source ranges either, so a suppression comment has nothing to
+ * attach to once a file goes through `@cdktf/hcl2json`. This module runs a
+ * second, cheap pass over the SAME raw text `./parse.ts` hands the parser,
+ * entirely with line-oriented regexes: a brace-depth counter to find each
+ * top-level block's start line (`terraform`, `locals`, `provider "x"`,
+ * `module "x"`, `variable "x"`, `output "x"`, `resource "t" "n"`,
+ * `data "t" "n"`, the exact set `blocksToEntities` turns into entities, and
+ * the address format below MUST stay in sync with that function's `add()`
+ * calls), and a directive regex for the three comment forms.
+ *
+ * `scanSuppressions` returns per-file lookups keyed by ADDRESS (`./parse.ts`'s
+ * `TerraformEntity.props.address`, e.g. `provider.aws`, `aws_s3_bucket.assets`)
+ * rather than by entity, because `blocksToEntities` computes an entity's final
+ * map key (with a `~2`/`~3` collision suffix) only after this scan has already
+ * run. A FIFO queue per address reconciles the two traversal orders: this
+ * scan reads the file top to bottom, but `blocksToEntities` walks hcl2json's
+ * tree grouped by section (all `variable` blocks together, then all
+ * `resource` blocks, etc.), not in source order. Two blocks that share one
+ * address (the same genuinely-duplicated declaration) are matched to their
+ * queue slot in file order, same as they're numbered `~2`/`~3` in file order.
+ */
+import type { SuppressionDirective } from "@intentius/chant/lint/suppressions";
+/** One file's suppression scan: block start lines by address, and the parsed directives. */
+export interface FileScan {
+    /** address -> start lines, in file order (a FIFO queue for repeated addresses). */
+    blockLineQueues: Map<string, number[]>;
+    /** The block start line a `chant-ignore`/`chant-ignore-block` comment anchors to -> directives found there. */
+    byAnchorLine: Map<number, SuppressionDirective[]>;
+    /** The file's `chant-ignore-file` directive, if any (`misplaced` set when it wasn't the first non-blank line). */
+    fileDirective?: SuppressionDirective;
+}
+/**
+ * Scan one `.tf` file's raw text. `fileName` only labels the directives it
+ * returns (for messages and dedup); the scan itself is pure text.
+ */
+export declare function scanSuppressions(fileName: string, source: string): FileScan;
+/** Pop the next recorded start line for `address` (FIFO; see module doc). */
+export declare function popBlockLine(scan: FileScan, address: string): number | undefined;
+/**
+ * Directives to attach to the entity being added for `address`: the ones
+ * anchored to its own start line (`chant-ignore`/`chant-ignore-block`), plus
+ * the file-level one, if any. Every entity in a file carries a file-level
+ * directive, misplaced or not (misplaced ones report themselves but suppress
+ * nothing; see `applyInlineSuppressions`).
+ */
+export declare function directivesFor(scan: FileScan, address: string): {
+    line?: number;
+    suppressions?: SuppressionDirective[];
+};
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/hcl/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/hcl/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAkB,MAAM,oCAAoC,CAAC;AA0E/F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAClD,kHAAkH;IAClH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CA8D3E;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;CAAE,CAKvH"}

package/dist/hcl/value.d.ts

@@ -0,0 +1,77 @@
+/**
+ * A value envelope over a parsed block body (chant #2113).
+ *
+ * Every TF post-synth check reads `BlockBody` (`./parse.ts`), raw
+ * `@cdktf/hcl2json` output, and re-derives, by hand, whether an attribute is
+ * a plain literal, a reference/expression, or absent. tflint's OPA ruleset
+ * hands a policy `{value, unknown, sensitive, ephemeral, range}` per
+ * attribute so a check reads that uniformly instead of re-deriving it
+ * (`tflint-ruleset-opa`'s `docs/functions.md`, cited in the #2107 survey).
+ * `attr()` is the equivalent for chant's static string-based body.
+ *
+ * The shape here is narrower than tflint's for one structural reason.
+ * hcl2json converts HCL to plain JSON with no evaluation and no position
+ * data. There is no live Terraform graph behind this parse, so there is no
+ * `unknown` (this runs over source, not a plan), and no `sensitive`/
+ * `ephemeral` flag (those live on a `variable` block's own attributes, not on
+ * every attribute that happens to reference one; a check that cares reads
+ * the referenced variable's declaration itself). `range` is the one field
+ * tflint's envelope carries that this cannot. hcl2json's own output is bare
+ * values, JSON-round-tripped from HCL, with no line/column/byte-range
+ * attached anywhere in the tree, so there is nothing for `attr()` to read a
+ * position from. (#2111 adds a `props.line` to the *entity*, from a separate
+ * text-based mechanism this file does not touch and is not a substitute for
+ * per-attribute ranges. See that issue for how it gets a line at all.)
+ */
+import type { BlockBody } from "./parse.js";
+/** What kind of value an attribute holds, once template interpolation is accounted for. */
+export type AttrKind = "literal" | "reference" | "template" | "absent";
+/**
+ * The value envelope `attr()` returns for one attribute of a block body.
+ *
+ * `raw` is always the untouched `body[name]` (or `undefined` when absent),
+ * so a caller that needs the original hcl2json value for a case this
+ * envelope doesn't model can still reach it without a second lookup.
+ */
+export interface AttrValue {
+    kind: AttrKind;
+    /**
+     * The attribute's value when `kind` is `"literal"`: a string, number,
+     * boolean, array or object, verbatim from hcl2json. Absent for every other
+     * kind (a reference/template's "value" is not known statically).
+     */
+    value?: unknown;
+    /**
+     * The expression(s) found inside `${...}` for `"reference"` and
+     * `"template"`: one entry for `"reference"` (the whole interpolation),
+     * one per `${...}` span in source order for `"template"`. Absent for
+     * `"literal"`/`"absent"`.
+     */
+    refs?: string[];
+    /** The untouched `body[name]`, regardless of `kind`. `undefined` when absent. */
+    raw: unknown;
+}
+/**
+ * Read one attribute of a parsed block body as a value envelope.
+ *
+ * - `"absent"`: `name` is not a key of `body` at all (or is `undefined`/`null`).
+ * - `"reference"`: the value is a string that is nothing but one
+ *   `${...}` interpolation (`"${aws_s3_bucket.foo.id}"`, `"${var.x}"`,
+ *   `"${lower(var.x)}"`; a function call counts, since the whole value is
+ *   still one expression, not a literal). `refs` carries that one expression.
+ * - `"template"`: the value is a string with `${...}` interpolation mixed
+ *   with literal text (`"prefix-${var.x}-suffix"`, or two interpolations in
+ *   one string). `refs` carries every span found, in source order.
+ * - `"literal"`: anything else. A plain string with no interpolation, a
+ *   number, a boolean, an array, or an object (which is how hcl2json encodes
+ *   a nested block under the same key a caller might ask `attr()` about, so
+ *   a nested block reads as `kind: "literal"` with `value` holding its body
+ *   or bodies array). See `hasBlock()` in `../lint/post-synth/tf001.ts`,
+ *   which is exactly that case.
+ *
+ * A malformed `${` with no matching `}` is not specially detected; it falls
+ * through to `"literal"` (no complete span found), matching hcl2json's own
+ * behavior of passing such text through as a plain string.
+ */
+export declare function attr(body: BlockBody, name: string): AttrValue;
+//# sourceMappingURL=value.d.ts.map

package/dist/hcl/value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"value.d.ts","sourceRoot":"","sources":["../../src/hcl/value.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,2FAA2F;AAC3F,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,iFAAiF;IACjF,GAAG,EAAE,OAAO,CAAC;CACd;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAc7D"}

package/dist/index.d.ts

@@ -1,12 +1,15 @@
 export { terraformPlugin } from "./plugin.js";
 export { terraformSerializer } from "./serializer.js";
 export { terraformConfigSchema, terraformRootSchema, type TerraformConfig, type TerraformRootConfig, type TerraformConfigNamespace, } from "./config.js";
-export { blocksToEntities, parseTerraformRootContent, parseTerraformRootDir, splitBundleContent, terraformEntity, DATA_TYPE, LOCALS_TYPE, MODULE_TYPE, OUTPUT_TYPE, PROVIDER_TYPE, RESOURCE_TYPE, TERRAFORM_TYPE, VARIABLE_TYPE, type BlockBody, type TerraformEntity, type TerraformFile, } from "./hcl/parse.js";
+export { blocksToEntities, parseTerraformRootContent, parseTerraformRootDir, readLiveSidecarFile, splitBundleContent, terraformEntity, DATA_TYPE, LIVE_SIDECAR_FILENAME, LIVE_TYPE, LOCALS_TYPE, MODULE_TYPE, OUTPUT_TYPE, PROVIDER_TYPE, RESOURCE_TYPE, TERRAFORM_TYPE, VARIABLE_TYPE, type BlockBody, type TerraformEntity, type TerraformFile, type TerraformRootMode, type TerraformRootModeOptions, } from "./hcl/parse.js";
 export { renderTerraformRoots, type TerraformRootsResult } from "./hcl/roots.js";
-export { terraformInit, terraformPlan, terraformApply, terraformShow } from "./op/builders.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, } from "./op/builders.js";
+export { parseAdoptionCommands, readAdoptionLedger, renderAdoptionLedger, type AdoptionCandidate, type AdoptionLedger, } from "./op/adoption.js";
 export { TerraformApplyOp } from "./composites/terraform-apply-op.js";
 export type { TerraformApplyOpConfig, TerraformApplyOpResources, TerraformGateMode, } from "./composites/terraform-apply-op.js";
 export { TerraformWatchOp } from "./composites/terraform-watch-op.js";
 export type { TerraformWatchOpConfig, TerraformWatchOpResources, TerraformFindingMode, } from "./composites/terraform-watch-op.js";
+export { TerraformAdoptOp } from "./composites/terraform-adopt-op.js";
+export type { TerraformAdoptOpConfig, TerraformAdoptOpResources } from "./composites/terraform-adopt-op.js";
 export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAKzG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -1,12 +1,39 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "8f4e78f1493a0dce03ed3956c7e35bd59583b665839b1d854212ce492cf000de",
+    "manifest.json": "708fe5c73583e3dae634d1b222678c040d2139995103aaf6f449be4488db7f62",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
-    "rules/plan-before-apply.ts": "b902d738a9cd4596b569f66b404c8e0e8358e58749708e76eb2521c459fb2f47",
-    "rules/tf001.ts": "1000540a1d2958efbae3356b221934f4c7ee76e977704d0e793a9864fd2d2936",
-    "skills/chant-terraform.md": "37b719bc43242250d61b80a6ee5c91da8e0c67a959cc92e2c182e3951adb8912"
+    "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
+    "rules/blocks.ts": "d69f65c13b44ff425ccd465644f41c160e07b4c221bd60698d3ec84bf5d9cef8",
+    "rules/module-source.ts": "147025cf53eba006473ddcb771bf7452928fc476e6daee10bbb86bcc7ee3848a",
+    "rules/scope.ts": "a6d327d821f219c98a9d4ae6e6eed6325f3d3edf6286f3622b41be591d190dc8",
+    "rules/tf001.ts": "8c4e305f2fa49fc02d739495b9d1fa3b5ba4c1da8635475b93ec36bba508cee3",
+    "rules/tf002.ts": "27720fcb578cceb1bfff86849d46b0309276f5a88d092eddcb7d7b961d1f5cd8",
+    "rules/tf003.ts": "7b705a08f03769f353910e524bb3f1b4cc844bcb620e240a9063288d0fd60802",
+    "rules/tf004.ts": "59ef2108aa561cc6a40cd970fc54604be60872b51a035ed3bc3c53346a31d358",
+    "rules/tf005.ts": "17fbaf5ac205c8a768415eacd2cbfb7749e9a251c8f2d0c05dce7462db7fa821",
+    "rules/tf006.ts": "2d6a80d048cb337d189e735224437ac851b51d73d9ff55f5d1ffedf736c16fb0",
+    "rules/tf007.ts": "9a1eeb1dbaf230b841cc32f2753219e57a6e7a2296d9ed6c1fb1e8e38a9a594d",
+    "rules/tf008.ts": "b09eefcdf6c37207d9d7270d1753a7812a0a07d2e88767f8c7a7885e42c0a730",
+    "rules/tf009.ts": "8631838f4756e5fdc163ccc283e59002accdcbe4384d11ee20a2be9514f7b2a9",
+    "rules/tf010.ts": "fc5937dc3ad87f5a127395e9793878b6bcac402b3006a715be97aabc1857ae32",
+    "rules/tf011.ts": "e7406f1b07205782df76690bd3f4882a540da0309bdcd63b6bc019ab4d46a927",
+    "rules/tf012.ts": "071d542786a1d5c19d485ab3e8fadb16210ba1c90a51843bf18b620cf99fe2a3",
+    "rules/tf013.ts": "096c3e7e51a8a54fd4354f6a93dc1f3540e155ef5e6ef39407904465803aaa2c",
+    "rules/tf014.ts": "c17d6c75fe0d38984a0108f4238667e9c069a0a761811d59f8ef9f67b5d8c5f3",
+    "rules/tf015.ts": "3b7933045d4c4c09810109582954a1c53f284a00f881e55900916f03afc4f987",
+    "rules/tf016.ts": "4dc8a815ee91bac7551bde90af0f5315bd8c03a0a090f19bd62ad305e0a06c93",
+    "rules/tf017.ts": "1b11c1a21aca33f5e634732fd23b57ac4c2e02af9ef531890d88c401fa593832",
+    "rules/tf018.ts": "188a56a73c53423ce4b653540cb4ab2b7aa64d10bb9bad090d392e2bfd821d0a",
+    "rules/tf019.ts": "ae1841a358e5b7a3f42c484f0b5cf1c1f5aa845a50516969a46d65b13e282951",
+    "rules/tf020.ts": "2210815c355e37459c34de0fe622f0b87b78010ee7c444135cf5abf7e048adf7",
+    "rules/tf021.ts": "ad3cd813a289437d33da866927697077e7a5b20f3c05341325193d286b57bbd5",
+    "rules/tf022.ts": "87483762b02e947aba94ec9b79fb9bf4dd6442287d602836306bc66b4a239a35",
+    "rules/tf024.ts": "c0c101f913bd3d0fdb5403ee57888e80d8fc612e363f0eb43d7ae759ac1d5651",
+    "rules/tf025.ts": "0c31be3885e940e2b3e9ac8e023067d8d6e2b42c04f628890405c9fc6db7d1ce",
+    "rules/tf026.ts": "db7c0f6669164dd439232708da03f0677a118504a83aec111051e60a967d95fb",
+    "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "a69f5327abd011e634c05a6b123cb9680268a127a7f07e29615204bf1277c319"
+  "composite": "4ea55eab06d2216269bf23fcf2d331ac4b59135ec80129ece6617f230f408126"
 }

package/dist/lint/audit-catalog.d.ts

@@ -4,8 +4,9 @@
  * Every post-synth check needs an entry or it contributes nothing to
  * `chant audit`, silently, and `packages/core/src/audit/catalog.test.ts` fails.
  *
- * TF001 reads the chant model (`ctx.entities`), never emitted output, so
- * `yamlBased` is false. Prior-art lineage lives in ./audit-lineage.ts.
+ * TF001, TF024, TF025 and TF026 all read the chant model (`ctx.entities`),
+ * never emitted output, so `yamlBased` is false for all four. Prior-art
+ * lineage lives in ./audit-lineage.ts.
  */
 import type { RuleMeta } from "@intentius/chant/audit/catalog";
 export declare const terraformAuditCatalog: Record<string, RuleMeta>;

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAI/D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAY1D,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAe1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAqQ1D,CAAC"}