@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/dist/lint/post-synth/tf012.d.ts

@@ -0,0 +1,17 @@
+/**
+ * TF012: an `output` declares no `description`.
+ *
+ * The other half of a module's API. An output is what a caller wires into the
+ * next module, and the description is the only place to say what the value
+ * actually is (an id or an ARN, a full URL or a bare hostname) and whether it
+ * is stable enough to depend on.
+ *
+ * Report-only, for the same reason TF011 is.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf012: PostSynthCheck;
+//# sourceMappingURL=tf012.d.ts.map

package/dist/lint/post-synth/tf012.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf012.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf012.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,KAAK,EAAE,cAuBnB,CAAC"}

package/dist/lint/post-synth/tf013.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TF013: `lifecycle { ignore_changes = all }`.
+ *
+ * `all` tells Terraform to ignore drift on every attribute of the resource
+ * after it is created. Nothing about that resource is ever reconciled again:
+ * a manual console edit, a deleted security-group rule, a downgraded instance
+ * class, all of it plans clean forever. It is also silent, because a plan that
+ * finds nothing looks exactly like a plan that was told to look at nothing.
+ *
+ * That is the observe half of chant's lifecycle switched off, so this is
+ * merge-worthy rather than hygiene. A list of specific attributes is fine and
+ * is not reported: ignoring `tags` an external tool writes is a real need, and
+ * naming them is what makes the intent auditable.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf013: PostSynthCheck;
+//# sourceMappingURL=tf013.d.ts.map

package/dist/lint/post-synth/tf013.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf013.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf013.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAc1C,eAAO,MAAM,KAAK,EAAE,cAyBnB,CAAC"}

package/dist/lint/post-synth/tf014.d.ts

@@ -0,0 +1,25 @@
+/**
+ * TF014: a `provider` block inside a child module that configures anything.
+ *
+ * Scope: child modules only. A `provider` block in the ROOT module is where
+ * providers are supposed to be configured, and TF008 is what checks its
+ * contents.
+ *
+ * A child module that configures its own provider takes the decision away
+ * from its caller: the caller can no longer point the module at a different
+ * region, account or endpoint, and two calls of the module in one root cannot
+ * differ. Worse, Terraform cannot remove a module whose provider is declared
+ * inside it, because destroying the resources needs a provider configuration
+ * that the removal itself deletes. That is the "Provider configuration not
+ * present" failure that leaves a root unable to plan.
+ *
+ * The one legal form is a provider block that declares only `alias`, which
+ * names a slot the caller fills through `providers = { aws.replica =
+ * aws.west }`. That is a declaration, not a configuration, so a block whose
+ * body has nothing but `alias` is not reported. Everything else is: a
+ * `region`, a `profile`, an `assume_role` block, and `version` too, which has
+ * been deprecated in favour of `required_providers` since Terraform 0.13.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf014: PostSynthCheck;
+//# sourceMappingURL=tf014.d.ts.map

package/dist/lint/post-synth/tf014.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf014.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf014.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAU1C,eAAO,MAAM,KAAK,EAAE,cAkCnB,CAAC"}

package/dist/lint/post-synth/tf015.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TF015: a `backend` or `cloud` block inside a child module.
+ *
+ * Scope: child modules only. This is TF001's mirror image. TF001 wants a root
+ * module to declare a backend, because a root without one keeps its state on
+ * local disk. A child module must declare neither: state belongs to the root,
+ * one state per root however many modules it calls, and Terraform says so
+ * directly, "A backend block can only appear in the root module" and the
+ * same for `cloud`. Depending on the version, the block is ignored with a
+ * warning or the root refuses to initialize, and either way the block is a
+ * claim about where state lives that the module does not get to make.
+ *
+ * The usual cause is a directory that used to be a root module and became a
+ * child when someone factored it out, with its `terraform` block carried
+ * along. The rest of that block is fine to keep: `required_version` and
+ * `required_providers` are meaningful in a child module and are not reported
+ * here.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf015: PostSynthCheck;
+//# sourceMappingURL=tf015.d.ts.map

package/dist/lint/post-synth/tf015.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}

package/dist/lint/post-synth/tf016.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TF016: an attribute whose whole value is one quoted interpolation,
+ * `x = "${var.y}"`, the pre-0.12 style Terraform deprecated in 2019.
+ *
+ * The quotes buy nothing and cost readability: the expression is already an
+ * expression, and wrapping it in a template makes every value in the file look
+ * like a string whether it is one or not, which hides the actual type of an
+ * argument that takes a list or a bool.
+ *
+ * This is the one rule in the family that reads the block's SOURCE rather than
+ * its parsed body, and it has to. `@cdktf/hcl2json` renders both `x = var.y`
+ * and `x = "${var.y}"` as the string `"${var.y}"`, so a check over the parse
+ * cannot tell the deprecated form from the idiomatic one and would report every
+ * reference in the root. The quotes only survive in the text, so the text is
+ * what is scanned, one pass per file, through the same
+ * `interpolationOnlyLine` the deterministic fix uses, so the finding and the
+ * patch can never disagree.
+ *
+ * Out of reach, and deliberately not guessed at: tflint also reports the
+ * deprecated interpolation inside an object KEY (`"${var.k}" = "value"`).
+ * That is a different line shape and its fix is not a simple unquote, so this
+ * rule leaves it alone rather than emit a diff it cannot justify.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf016: PostSynthCheck;
+//# sourceMappingURL=tf016.d.ts.map

package/dist/lint/post-synth/tf016.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf016.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}

package/dist/lint/post-synth/tf017.d.ts

@@ -0,0 +1,19 @@
+/**
+ * TF017: a `module` block carries `depends_on`.
+ *
+ * `depends_on` on a module applies to every resource inside it, including the
+ * ones that had no reason to wait, so the whole module serializes behind the
+ * named dependency and a plan that could have run in parallel does not. It
+ * also makes the dependency invisible from inside the module, where the
+ * resource that actually needed the ordering lives.
+ *
+ * Passing an attribute of the dependency into a module input creates the same
+ * edge implicitly, only narrower and self-documenting.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf017: PostSynthCheck;
+//# sourceMappingURL=tf017.d.ts.map

package/dist/lint/post-synth/tf017.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf017.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf017.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,KAAK,EAAE,cAwBnB,CAAC"}

package/dist/lint/post-synth/tf018.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TF018: an `output` returns a whole resource or data source.
+ *
+ * `value = aws_instance.web` exports every attribute the provider schema
+ * happens to have, which is a much larger promise than the module meant to
+ * make. Consumers reach into whatever they find, the module can no longer
+ * change any of it, and a provider upgrade that adds or renames an attribute
+ * moves the module's public interface without anyone editing it. Sensitive
+ * attributes ride along too.
+ *
+ * A bare `module.x` reference is not reported: a module's outputs are already
+ * a curated surface, which is the property this rule is asking for.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf018: PostSynthCheck;
+//# sourceMappingURL=tf018.d.ts.map

package/dist/lint/post-synth/tf018.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf018.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf018.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAuB1C,eAAO,MAAM,KAAK,EAAE,cA0BnB,CAAC"}

package/dist/lint/post-synth/tf019.d.ts

@@ -0,0 +1,25 @@
+/**
+ * TF019: a meta-argument is explicitly set to its own default, `false`.
+ *
+ * `sensitive` and `ephemeral` on a `variable` or an `output`, `prevent_destroy`
+ * and `create_before_destroy` inside a `lifecycle` block. All four default to
+ * false, so writing it changes nothing and reads as though someone considered
+ * the setting and turned it off, which is exactly the impression a reviewer
+ * should not get from a variable called `password`.
+ *
+ * The first TF rule with a mechanical fix: the remediation is the deletion of
+ * the line, so this ships `fixKind: "deterministic"` and `chant audit` renders
+ * the diff in its quick-wins section. `packages/core/src/audit/proof.ts` owns
+ * the patch, as it does for every other deterministic rule.
+ *
+ * Only a literal `false` counts. `prevent_destroy = var.protect` is a real
+ * decision expressed as a variable, and hcl2json leaves it a `"${var.protect}"`
+ * string rather than a boolean, so it never reaches the comparison.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf019: PostSynthCheck;
+//# sourceMappingURL=tf019.d.ts.map

package/dist/lint/post-synth/tf019.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf019.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf019.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAqB1C,eAAO,MAAM,KAAK,EAAE,cAuBnB,CAAC"}

package/dist/lint/post-synth/tf020.d.ts

@@ -0,0 +1,38 @@
+/**
+ * TF020: a `variable`, a `locals` entry, a `data` source or an aliased
+ * `provider` that nothing in its module scope references.
+ *
+ * Scope: root and child modules, each judged on its own. Terraform's
+ * namespaces are per module, so `var.region` inside `module.cdn` is the child
+ * module's variable and a reference to it in the root proves nothing about
+ * the child's. The reference index (`hcl/references.ts`) is keyed the same
+ * way, one scope per module, and this check never looks outside the scope the
+ * declaration is in.
+ *
+ * An unused declaration is dead weight rather than a defect, which is why
+ * this is report-only. It still earns a finding: a variable nobody reads is
+ * usually the leftover of a refactor, and the next reader has to prove that
+ * before deleting it. A data source is worse than dead weight, since it is
+ * read from the provider's API on every plan whether or not anything uses the
+ * result.
+ *
+ * Two deliberate gaps, both from the index being a string scan rather than an
+ * expression tree (see its module doc), and both the reason the credit to
+ * tflint's `terraform_unused_declarations` is `overlaps`:
+ *
+ * - A name mentioned in a string that is not an expression (a `description`
+ *   that says "overrides var.region") reads as a reference, so the
+ *   declaration is not reported. Quiet, and wrong in the safe direction.
+ * - A value reached only dynamically (`lookup(local.by_env, ...)` where the
+ *   map is built elsewhere) is a real reference the scan does see, since the
+ *   local is still named; but a variable consumed only through
+ *   `TF_VAR_`-style external input is not, and a root's variables are
+ *   frequently exactly that. Report-only keeps that from failing a build.
+ *
+ * A `provider` block with no `alias` is never reported: it is the default
+ * configuration for its type, used by every resource of that type without
+ * naming it. Only an aliased one has to be asked for by name.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf020: PostSynthCheck;
+//# sourceMappingURL=tf020.d.ts.map

package/dist/lint/post-synth/tf020.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf020.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf020.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAuB1C,eAAO,MAAM,KAAK,EAAE,cA2DnB,CAAC"}

package/dist/lint/post-synth/tf021.d.ts

@@ -0,0 +1,41 @@
+/**
+ * TF021: `count` used where `for_each` is safer, judged narrowly.
+ *
+ * Scope: root and child modules. A resource is a resource wherever it is
+ * declared, and the failure mode below does not depend on the scope.
+ *
+ * `count` addresses its instances by position: `aws_instance.web[0]`,
+ * `[1]`, `[2]`. Delete the middle element of the list the count was derived
+ * from and every instance after it shifts down one, so Terraform plans to
+ * destroy and recreate them all, in order, to move each one's identity onto
+ * the next index. `for_each` addresses by key instead, and removing one
+ * element removes exactly one instance.
+ *
+ * The narrow part is which counts get reported. Two conditions must both
+ * hold:
+ *
+ * 1. The count is plural and derived, not a switch. A numeric literal of two
+ *    or more, or `length(var.x)` / `length(local.x)`. `count = 0`, `count =
+ *    1` and `count = var.enabled ? 1 : 0` are the conditional-resource idiom,
+ *    which `for_each` does not replace, and they are never reported.
+ * 2. The resource uses `count.index` to build something that carries the
+ *    instance's identity: a name, a bucket, a key, a `tags.Name`. That is what
+ *    makes a shift destructive; a `count.index` used only to pick a subnet out
+ *    of a list is reindexed silently and harmlessly.
+ *
+ * Redeploy's `terraform_prefer_for_each` reports every `count` over a
+ * collection, which is a broader rule and a noisier one, so the credit is
+ * `overlaps` rather than `equivalent`. choudoufu's `RuleCountIndex`
+ * (`internal/live/lint/count_index.go`) is the survey's deepest treatment of
+ * the identity-bearing question, and it is credited the same way. Report-only
+ * either way: a `count` with a stable list behind it is fine forever, and
+ * only the person who knows whether that list is stable can say.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { type BlockBody } from "../../hcl/parse.js";
+/** The `count` value, when it is one this rule reports on. */
+export declare function pluralCount(body: BlockBody): string | undefined;
+/** Identity-bearing attributes of this body whose value is built from `count.index`. */
+export declare function identityUsesOfCountIndex(body: BlockBody): string[];
+export declare const tf021: PostSynthCheck;
+//# sourceMappingURL=tf021.d.ts.map

package/dist/lint/post-synth/tf021.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf021.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf021.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAiB,KAAK,SAAS,EAAwB,MAAM,iBAAiB,CAAC;AA+BtF,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAO/D;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,CAQlE;AAED,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}

package/dist/lint/post-synth/tf022.d.ts

@@ -0,0 +1,24 @@
+/**
+ * TF022: a credential-named attribute of a resource or data source holds a
+ * literal.
+ *
+ * tfsec's `general-secrets-sensitive-in-attribute`, consolidated in its v1
+ * line as `no-plaintext-exposure`, and KICS's `Passwords And Secrets` query.
+ * Broader and noisier than TF007, because a resource body has far more
+ * attributes than a variable has defaults, so the name heuristic does the
+ * gating: an attribute has to read like a credential AND hold a committed
+ * literal before it is reported.
+ *
+ * The value is in git history, in state, and in every plan output, and the
+ * blast radius is whatever the resource is: an RDS master password, a
+ * provider API token, a Kubernetes secret's data. The fix is always the same
+ * shape, a reference rather than a constant, which is what the message says
+ * rather than "remove this".
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf022: PostSynthCheck;
+//# sourceMappingURL=tf022.d.ts.map

package/dist/lint/post-synth/tf022.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf022.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf022.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cA6BnB,CAAC"}

package/dist/lint/post-synth/tf024.d.ts

@@ -0,0 +1,24 @@
+/**
+ * TF024: a live root declares a `backend` or `cloud` block.
+ *
+ * choudoufu refuses this combination at `init`, before any command runs,
+ * naming both blocks that collide: "Both a backend and a live configuration
+ * are present" (a `backend` block) or "Both a cloud and a live configuration
+ * are present" (a `cloud` block). A live root keeps no state to store, since
+ * prior state is a projection rebuilt from the live system every run, so
+ * either block is a contradiction about where the truth lives, not a
+ * redundant setting.
+ *
+ * TF001 is the equivalent check for a stock root (no remote backend is
+ * configured); it explicitly does not fire on a live root, and this check is
+ * why: the two are mutually exclusive by construction; a root is flagged by
+ * at most one of them.
+ *
+ * Scope: root modules only (#2112). A child module's backend or cloud block
+ * is TF015's finding, whatever binary the root runs.
+ *
+ * One diagnostic per root, fired from the root's `terraform` block.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf024: PostSynthCheck;
+//# sourceMappingURL=tf024.d.ts.map

package/dist/lint/post-synth/tf024.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf024.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf024.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}

package/dist/lint/post-synth/tf025.d.ts

@@ -0,0 +1,29 @@
+/**
+ * TF025: a live root reads a non-default `terraform.workspace`, or configures
+ * one through `terraform.roots`.
+ *
+ * choudoufu refuses any workspace but `default` on a live root, and refuses
+ * `workspace new`/`workspace select` outright: only the default workspace
+ * exists there ("How you run it" in choudoufu's compatibility reference).
+ * Two independent ways a configuration ends up asking for one:
+ *
+ *   - `terraform.roots.<name>.workspace` in `chant.config.*` selects a
+ *     workspace via `TF_WORKSPACE` before any HCL is even read, chant's own
+ *     equivalent of `workspace select`, so it is flagged the same way.
+ *   - A `"${terraform.workspace}"` interpolation anywhere in a block's body
+ *     reads the (necessarily `"default"`) workspace name in configuration,
+ *     which is not itself refused by choudoufu but is dead code on a live
+ *     root and a sign the configuration was written for a workspace-per-
+ *     environment layout that live mode does not support.
+ *
+ * The first fires once per root (it names a root-level config field, not a
+ * particular block); the second fires once per block that contains the
+ * reference, since each is its own thing to fix.
+ *
+ * Scope: the config half is root-only, since it reads a root-level config
+ * field; the reference half reads any block of a live root, a descended child
+ * module's included, and names the call chain that reached it (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf025: PostSynthCheck;
+//# sourceMappingURL=tf025.d.ts.map

package/dist/lint/post-synth/tf025.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf025.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf025.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAY1C,eAAO,MAAM,KAAK,EAAE,cAyDnB,CAAC"}

package/dist/lint/post-synth/tf026.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TF026: a live root declares `delete: "never"` but its `policy` block still
+ * deletes an orphaned marked resource.
+ *
+ * chant's cross-lexicon delete-mode vocabulary (`terraform.roots.<name>.delete`,
+ * `../../config.ts`'s `TerraformDeleteMode`) maps onto choudoufu's `policy`
+ * block: `undeclared_tagged` governs what happens to a resource this estate
+ * marked that the configuration no longer declares, and defaults to
+ * `"delete"` when the `policy` block omits it, or the root declares no
+ * `policy` block at all. `delete: "never"` promises that `TerraformApplyOp`
+ * never proposes deleting a resource it owns, so a root making that promise
+ * has to have actually turned the quadrant's default off — `"keep"`,
+ * `"untag"` or `"report"` all satisfy it; anything else (the unset default,
+ * or an explicit `"delete"`) does not.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity —
+ * the same entity TF024 and TF025 fire from.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf026: PostSynthCheck;
+//# sourceMappingURL=tf026.d.ts.map

package/dist/lint/post-synth/tf026.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf026.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf026.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAe1C,eAAO,MAAM,KAAK,EAAE,cAyCnB,CAAC"}

package/dist/lint/rules/fixtures/load.d.ts

@@ -0,0 +1,13 @@
+import type { LintContext } from "@intentius/chant/lint/rule";
+/**
+ * Parse `fixtures/<ruleId>/<name>-op.ts` into a {@link LintContext} whose
+ * `filePath` is the logical `<name>.op.ts` a real Op file would carry.
+ *
+ * Three lines per fixture in a test:
+ * ```ts
+ * const diags = planBeforeApplyRule.check(loadRuleFixture("TF101", "positive"));
+ * expect(diags).toHaveLength(1);
+ * ```
+ */
+export declare function loadRuleFixture(ruleId: string, name: string): LintContext;
+//# sourceMappingURL=load.d.ts.map

package/dist/lint/rules/fixtures/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/fixtures/load.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAI9D;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAMzE"}

package/dist/lint/rules/plan-before-apply.d.ts

@@ -25,6 +25,17 @@ import type { LintRule } from "@intentius/chant/lint/rule";
  * silent — the same deliberately shallow "bail rather than guess" posture
  * `validateStepOutputRefs` takes, since the runtime brand on a real
  * `StepOutputRef` is invisible to a source-level AST match.
+ *
+ * Fires on every `terraformApply` call, live root or stock. #2106 exempted
+ * live roots for one release, because choudoufu refused `-out` and
+ * `apply <planfile>` and the activity ran a bare `apply -auto-approve` with no
+ * plan file to pair. choudoufu v0.13.0 admits both under a `live` block
+ * ([choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878)), and
+ * there the pairing matters more than on a stock root, not less: the apply
+ * re-plans the live system and compares its fresh plan against the file it was
+ * handed, so a plan file spelled out as a literal is an approval for a run
+ * nobody can trace back to a plan step. The exemption is gone with the
+ * condition that produced it, and this rule reads no project config at all.
  */
 export declare const planBeforeApplyRule: LintRule;
 //# sourceMappingURL=plan-before-apply.d.ts.map

package/dist/lint/rules/plan-before-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-before-apply.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/plan-before-apply.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAgHjC,CAAC"}
+{"version":3,"file":"plan-before-apply.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/plan-before-apply.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAgHjC,CAAC"}

package/dist/lint/secret-shape.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The two heuristics the secrets rules of the TF family share: does this
+ * attribute's NAME read like a credential, and does its VALUE look like one.
+ *
+ * tfsec shipped `general-secrets-sensitive-in-variable`,
+ * `-in-local` and `-in-attribute`, and trivy dropped all three when it
+ * absorbed tfsec, so no maintained tool checks them today (#2107's survey).
+ * TF007, TF008, TF009 and TF022 are chant's versions, and they only stay
+ * consistent with each other if "secret-shaped" means one thing. That is what
+ * this module is.
+ *
+ * Nothing here re-implements a detector `packages/core/src/audit/secrets.ts`
+ * already has. The value heuristic runs a candidate through `scanForSecrets`
+ * first, so every vendor prefix the SEC family knows (AWS key ids, GitHub,
+ * Slack, Google, Stripe), the PEM block shape and the connection-string shape
+ * are recognised here for free, and it reuses that module's placeholder
+ * vocabulary, its identifier-slug filter and its entropy function. What it
+ * adds is what a Terraform attribute needs and a raw text scan does not: the
+ * JWT and bare PEM-header shapes, and a lower length floor than SEC010's 24
+ * characters, because an attribute value is already a single token rather
+ * than a line of prose to fish tokens out of.
+ */
+/** Minimum length for a value to be worth judging at all. */
+export declare const MIN_SECRET_LENGTH = 8;
+/**
+ * Does this attribute or variable name read like a credential? Case-insensitive
+ * and word-bounded, with the locator suffixes excluded.
+ */
+export declare function isSecretName(name: string): boolean;
+/**
+ * Is this a plain string literal, as opposed to an expression? `hcl2json`
+ * renders every expression as a `"${...}"` template, so a value carrying one
+ * is a reference (`var.db_password`, `data.aws_secretsmanager_secret_version.x.secret_string`)
+ * or an interpolation, never a committed constant. Those are the fix, not the
+ * finding.
+ */
+export declare function isLiteralString(value: unknown): value is string;
+/**
+ * A placeholder rather than a credential. Core's list is checked twice: once
+ * as written, once with separators stripped, so the `CHANGE_ME` and
+ * `YOUR_API_KEY` spellings land on the same `changeme` / `your-api-key`
+ * entries as the unseparated ones.
+ */
+export declare function isPlaceholderValue(value: string): boolean;
+/**
+ * Does this value look like a live credential on its own, whatever it is
+ * called? A known vendor shape (through core's detectors), a JWT, a PEM key,
+ * or a high-entropy token.
+ */
+export declare function isCredentialShapedValue(value: unknown): boolean;
+/** Which heuristic fired, so a diagnostic can say why it is complaining. */
+export type SecretShapeReason = "name" | "value";
+export interface SecretShape {
+    reason: SecretShapeReason;
+    /** The value's length, for a message that never quotes the value itself. */
+    length: number;
+}
+/**
+ * The combined test the rules use: is `value`, assigned to an attribute called
+ * `name`, a committed secret? Either heuristic is enough, but both sides of the
+ * gate are the same, since the value has to be a literal, long enough to be a
+ * credential, and not a placeholder, so `sensitive = true`-style
+ * remediation advice is never given for `password = "changeme"`.
+ *
+ * Findings never carry the value. Callers get the reason and the length.
+ */
+export declare function secretShapedAssignment(name: string, value: unknown): SecretShape | undefined;
+//# sourceMappingURL=secret-shape.d.ts.map

package/dist/lint/secret-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-shape.d.ts","sourceRoot":"","sources":["../../src/lint/secret-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAyBH,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAmBnC;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIlD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAqBD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU/D;AAED,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAO5F"}

package/dist/live-ownership.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The live root's ownership channel (#2104): choudoufu's two marker tags.
+ *
+ * Sibling of `./state-ownership.ts`, and here for the same mechanical reason:
+ * `plugin.ts` declares `ownershipChannel` eagerly while `describeResources`
+ * is behind a dynamic import, so the key names cannot live in the reader
+ * without dragging the reader, and `node:child_process` with it, into every
+ * plugin load.
+ *
+ * ## Why the keys are declared and the verdicts are set by hand
+ *
+ * The issue that added this asked which of two ways to go: widen core's
+ * `OwnershipChannel` so a lexicon can supply its own classifier, or declare
+ * the keys for discoverability and set the verdicts in the reader, the way
+ * `lexicons/fly/src/ownership.ts` does for its two tiers. The second, and the
+ * reason is that the first buys nothing.
+ *
+ * Core's `classifyOwnership` tests one thing: does `tags[keys.managedBy]`
+ * equal the literal `"chant"`. Nothing in core ever calls it on a lexicon's
+ * behalf. `packages/core/src/ownership.ts` exports it, every lexicon calls it
+ * itself where the test happens to fit, and the ones it does not fit, fly's
+ * app boundary and aws's stack tags, already set verdicts directly. Adding a
+ * `classify` member to `OwnershipChannel` would give core a field only this
+ * lexicon passes and only this lexicon reads back, which is a longer way of
+ * writing the function `./describe-resources.ts` already has.
+ *
+ * What the declaration is still for is the claim it makes. Declaring
+ * `describeResources` on the channel is what turns the observation
+ * conformance suite's ownership assertion from a shape check into a
+ * behavioural one, and that claim holds on a live root exactly as it does on
+ * a stock one, from a different reading. The suite runs for both modes in
+ * `./describe-resources.test.ts`.
+ *
+ * ## The keys, and the slot that does not fit
+ *
+ * `ChannelKeys` is a managed-by / stack / env triple, because everywhere else
+ * chant stamps three tags. choudoufu's marker is two tags and no managed-by
+ * key at all: per `live/MARKERS.md`'s "Ownership semantics", a resource
+ * carrying `tofu-estate` belongs to that estate and there is no secondary
+ * check, so `tofu-estate` is both the managed-by claim and the stack
+ * identity. `tofu-address` takes the third slot because it is the marker's
+ * other half, not because it is an environment: a choudoufu marker has no
+ * environment in it, which is why `ResourceMetadata.marker` on a live read
+ * carries the estate as its `stack` and leaves `env` absent rather than
+ * filling it with an address.
+ */
+import type { ChannelKeys } from "@intentius/chant/ownership";
+/**
+ * The two tag keys `live/MARKERS.md` spec version 1 defines, named here so a
+ * reader of the plugin can see what a live root's verdict is read from.
+ * `./hcl/marker.ts` holds the constants the reader itself uses, along with
+ * the escaping and the ownership semantics that go with them.
+ */
+export declare const TERRAFORM_LIVE_MARKER_KEYS: ChannelKeys;
+//# sourceMappingURL=live-ownership.d.ts.map

package/dist/live-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-ownership.d.ts","sourceRoot":"","sources":["../src/live-ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAIxC,CAAC"}

package/dist/lsp/option-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAKtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAItC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}
+{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAMtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAWpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }