@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/dist/okf/index.md

@@ -5,4 +5,28 @@ okf_version: '0.2'
 # Rules
 
 * [TF001](/rules/TF001.md) - Root module declares no remote backend
+* [TF002](/rules/TF002.md) - A provider the root implies has no required_providers entry, or an incomplete one
+* [TF003](/rules/TF003.md) - Root module's terraform block has no required_version
+* [TF004](/rules/TF004.md) - Registry-sourced module block has no version
+* [TF005](/rules/TF005.md) - Git/hg module source is unpinned, or pinned to a mutable ref
+* [TF006](/rules/TF006.md) - Sensitive variable declares a default value
+* [TF007](/rules/TF007.md) - Secret-shaped literal in a variable default or a locals value
+* [TF008](/rules/TF008.md) - Provider block configures a hardcoded credential
+* [TF009](/rules/TF009.md) - Credential-named variable is not marked sensitive
+* [TF010](/rules/TF010.md) - Variable declares no type constraint
+* [TF011](/rules/TF011.md) - Variable declares no description
+* [TF012](/rules/TF012.md) - Output declares no description
+* [TF013](/rules/TF013.md) - lifecycle ignore_changes is set to all
+* [TF014](/rules/TF014.md) - Child module configures a provider block
+* [TF015](/rules/TF015.md) - Child module declares a backend or cloud block
+* [TF016](/rules/TF016.md) - Attribute value is a quoted interpolation of a single expression
+* [TF017](/rules/TF017.md) - Module block uses depends_on
+* [TF018](/rules/TF018.md) - Output value is a whole resource or data source
+* [TF019](/rules/TF019.md) - Meta-argument explicitly set to its default of false
+* [TF020](/rules/TF020.md) - Declaration is never referenced in its module scope
+* [TF021](/rules/TF021.md) - count builds instance identities from count.index where for_each is safer
+* [TF022](/rules/TF022.md) - Credential-named resource attribute holds a plaintext literal
+* [TF024](/rules/TF024.md) - Live root declares a backend or cloud block, which choudoufu refuses
+* [TF025](/rules/TF025.md) - Live root references a non-default terraform.workspace, which choudoufu refuses
+* [TF026](/rules/TF026.md) - Live root declares delete: "never" but its policy leaves undeclared_tagged at "delete"
 * [TF101](/rules/TF101.md) - terraformApply's planFile must reference a preceding terraformPlan step.

package/dist/okf/rules/TF002.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF002
+description: A provider the root implies has no required_providers entry, or an incomplete one
+id: TF002
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+A provider the root implies has no required_providers entry, or an incomplete one

package/dist/okf/rules/TF003.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF003
+description: Root module's terraform block has no required_version
+id: TF003
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Root module's terraform block has no required_version

package/dist/okf/rules/TF004.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF004
+description: Registry-sourced module block has no version
+id: TF004
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Registry-sourced module block has no version

package/dist/okf/rules/TF005.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF005
+description: Git/hg module source is unpinned, or pinned to a mutable ref
+id: TF005
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Git/hg module source is unpinned, or pinned to a mutable ref

package/dist/okf/rules/TF006.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF006
+description: Sensitive variable declares a default value
+id: TF006
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Sensitive variable declares a default value

package/dist/okf/rules/TF007.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF007
+description: Secret-shaped literal in a variable default or a locals value
+id: TF007
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Secret-shaped literal in a variable default or a locals value

package/dist/okf/rules/TF008.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF008
+description: Provider block configures a hardcoded credential
+id: TF008
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Provider block configures a hardcoded credential

package/dist/okf/rules/TF009.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF009
+description: Credential-named variable is not marked sensitive
+id: TF009
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Credential-named variable is not marked sensitive

package/dist/okf/rules/TF010.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF010
+description: Variable declares no type constraint
+id: TF010
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Variable declares no type constraint

package/dist/okf/rules/TF011.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF011
+description: Variable declares no description
+id: TF011
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Variable declares no description

package/dist/okf/rules/TF012.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF012
+description: Output declares no description
+id: TF012
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Output declares no description

package/dist/okf/rules/TF013.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF013
+description: lifecycle ignore_changes is set to all
+id: TF013
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+lifecycle ignore_changes is set to all

package/dist/okf/rules/TF014.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF014
+description: Child module configures a provider block
+id: TF014
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Child module configures a provider block

package/dist/okf/rules/TF015.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF015
+description: Child module declares a backend or cloud block
+id: TF015
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Child module declares a backend or cloud block

package/dist/okf/rules/TF016.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF016
+description: Attribute value is a quoted interpolation of a single expression
+id: TF016
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Attribute value is a quoted interpolation of a single expression

package/dist/okf/rules/TF017.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF017
+description: Module block uses depends_on
+id: TF017
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Module block uses depends_on

package/dist/okf/rules/TF018.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF018
+description: Output value is a whole resource or data source
+id: TF018
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Output value is a whole resource or data source

package/dist/okf/rules/TF019.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF019
+description: Meta-argument explicitly set to its default of false
+id: TF019
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Meta-argument explicitly set to its default of false

package/dist/okf/rules/TF020.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF020
+description: Declaration is never referenced in its module scope
+id: TF020
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Declaration is never referenced in its module scope

package/dist/okf/rules/TF021.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF021
+description: count builds instance identities from count.index where for_each is safer
+id: TF021
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+count builds instance identities from count.index where for_each is safer

package/dist/okf/rules/TF022.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF022
+description: Credential-named resource attribute holds a plaintext literal
+id: TF022
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Credential-named resource attribute holds a plaintext literal

package/dist/okf/rules/TF024.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF024
+description: Live root declares a backend or cloud block, which choudoufu refuses
+id: TF024
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root declares a backend or cloud block, which choudoufu refuses

package/dist/okf/rules/TF025.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF025
+description: Live root references a non-default terraform.workspace, which choudoufu refuses
+id: TF025
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root references a non-default terraform.workspace, which choudoufu refuses

package/dist/okf/rules/TF026.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF026
+description: 'Live root declares delete: "never" but its policy leaves undeclared_tagged at "delete"'
+id: TF026
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root declares delete: "never" but its policy leaves undeclared_tagged at "delete"

package/dist/op/activities/index.d.ts

@@ -8,15 +8,22 @@
  *   - terraformInit — `init` with the root's `backendConfig`.
  *   - terraformPlan — `plan -detailed-exitcode -out=<planFile>`, plus both
  *     `show` renders of the written plan.
- *   - terraformApply — `apply <planFile>`, a saved plan only.
+ *   - terraformApply: `apply <planFile>` on a stock root, a saved plan only;
+ *     `apply -auto-approve` with no plan file on a live root (#2103).
  *   - terraformShow — state, or a saved plan, as JSON and as text.
+ *   - choudoufuLivePlan: `live-plan -detailed-exitcode -json -estate=<estate>`,
+ *     plus a second `live-plan` for the human render (#2103).
+ *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
+ *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
+ *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
  *
  * The module is dependency-light on purpose: it shells out to the configured
  * binary and reads the `terraform` config namespace, and never touches the
- * lexicon's HCL parse or serializer, so a Temporal worker loads it cheaply.
- * The pure command and environment builders are exported alongside the
- * activities because they are what the tests assert on.
+ * lexicon's HCL parse or serializer, so `loadActivities` imports it cheaply at
+ * run time. The pure command and environment builders are exported alongside
+ * the activities because they are what the tests assert on.
  */
-export { terraformInit, terraformPlan, terraformApply, terraformShow, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, terraformEnvironment, terraformBinary, countPlanChanges, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, } from "./terraform.js";
-export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformShowResult, PlanChangeCounts, } from "./terraform.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
+export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformApprovalRefusal, TerraformShowResult, ChoudoufuLivePlanResult, ChoudoufuLiveLsResult, ChoudoufuLiveCheckResult, ChoudoufuAdoptResult, AdoptionRefusal, PlanChangeCounts, LivePlanUnownedCounts, } from "./terraform.js";
+export { detectLiveEstate } from "./live-detect.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/op/activities/live-detect.d.ts

@@ -0,0 +1,51 @@
+/**
+ * A fast, regex-based read of whether a root module directory declares a
+ * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
+ * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ *
+ * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
+ * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
+ * `op/activities/terraform.ts` is imported by core's activity registry at run
+ * time and is dependency-light on purpose, since it shells out to the
+ * configured binary and never touches the lexicon's HCL parse or serializer,
+ * so it never pulls in
+ * the ~1.8 MB `@cdktf/hcl2json` wasm parser just to decide whether an apply
+ * should run `apply -auto-approve` with no plan file. Plain text and a
+ * hand-rolled brace counter are enough for that narrower question, and the
+ * literal sidecar filename below is kept in sync with `LIVE_SIDECAR_FILENAME`
+ * in `../../hcl/parse.ts` by hand rather than by importing it, for the same
+ * reason.
+ */
+/**
+ * The declared estate name for the root module directory `dir`, or
+ * `undefined` when none is declared. Checks the `estate.chdf.hcl` sidecar
+ * first (cheaper: one file, no brace matching), then every `.tf` file in
+ * directory order for a `live { }` block nested in a `terraform { }` block.
+ * Returns the first estate name found; a directory with no `.tf` files and
+ * no sidecar (or one this function cannot read) yields `undefined` rather
+ * than throwing, since this is a best-effort check, not the authoritative parse.
+ */
+export declare function detectLiveEstate(dir: string): string | undefined;
+/**
+ * The `undeclared_tagged`/`undeclared_untagged` verbs a live root's `policy {
+ * }` block assigns, or `undefined` when the directory declares no `policy`
+ * block at all (#2106). Same best-effort posture as {@link detectLiveEstate}:
+ * a plain read of the in-block form only (the `estate.chdf.hcl` sidecar's own
+ * `policy` block, if choudoufu ever admits one there, is not read here — a
+ * known, narrower gap than the estate check above, which does read the
+ * sidecar). `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`)
+ * uses this to refuse a root whose `policy` sets
+ * `undeclared_untagged = "delete"` outright, at build time, before any
+ * activity runs; TF026 (`../../lint/post-synth/tf026.ts`) checks the same
+ * block's `undeclared_tagged` verb against a root's declared `delete: "never"`
+ * from the parsed HCL entities instead, since a post-synth check already has
+ * the block body in hand and has no need of this file-reading version.
+ */
+export interface LivePolicyVerbs {
+    /** The `undeclared_tagged` quadrant's verb, verbatim, or `undefined` when the attribute is absent (defaults to `"delete"`). */
+    undeclaredTagged?: string;
+    /** The `undeclared_untagged` quadrant's verb, verbatim, or `undefined` when the attribute is absent. */
+    undeclaredUntagged?: string;
+}
+export declare function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined;
+//# sourceMappingURL=live-detect.d.ts.map

package/dist/op/activities/live-detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-detect.d.ts","sourceRoot":"","sources":["../../../src/op/activities/live-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA6CH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoChE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,+HAA+H;IAC/H,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CA8B9E"}