@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/dist/lint/audit-lineage.d.ts

@@ -15,6 +15,101 @@
  * `terraform_workspace_remote` (a `terraform.workspace` compatibility check
  * against remote execution, a different condition than "no backend is
  * configured at all"). Ship with no lineage rather than invent a credit.
+ *
+ * TF101 (plan-before-apply, `lint/rules/plan-before-apply.ts`) is a source-level
+ * lint rule over chant's own Op builders, not a post-synth check, so it carries
+ * no `RuleMeta`/`Lineage` entry here at all: this file's `Record` only ever
+ * keys post-synth check ids. Its own page section (docs/pages/lint-rules.mdx)
+ * says the same thing directly: no tool anywhere models "this plan file traces
+ * back to a specific preceding plan step", because that is a question about
+ * chant's own DSL, not about a Terraform root.
+ *
+ * ## The survey registry
+ *
+ * #2107 ran three research passes over every serious Terraform lint, scan and
+ * policy tool (1,888 lines, 222 cited URLs, attached to that issue as
+ * comments). The tools and documents below are what the survey found worth
+ * crediting from across that research. #2108 added none of them to
+ * `PRIOR_ART`: `packages/core/src/audit/catalog.test.ts`'s "every registered
+ * tool is credited" test fails on an entry no shipped rule cites yet, and
+ * neither TF001 nor TF101 cites anything. #2109 (TF002-TF005) is the first to
+ * draw from this list: `tflint-ruleset-terraform`, `terraform-sentinel-policies`,
+ * `hashicorp-style-guide` and `aws-terraform-prescriptive-guidance` are now in
+ * `PRIOR_ART`, spelled exactly as below. `checkov` and `kics` were already
+ * registered (other lexicons cite them); TF004 and TF005 are the first
+ * Terraform rules to. Each later rule issue adds the remaining entries it
+ * needs the first time a shipped rule cites them: #2112 (TF014, TF015, TF020,
+ * TF021) added `gcp-terraform-best-practices`, the last row of the table below
+ * that no shipped rule had cited yet.
+ *
+ * Each row's Sweep note says whether `scripts/prior-art-sweep.ts` can index the
+ * source and, when it cannot, why (#2219). Five of these are indexed as of
+ * 2026-09-07: the three tflint rulesets, tfsec and the Sentinel policy set,
+ * 311 upstream rule ids in `scripts/prior-art/snapshot.json`. The rest are
+ * prose or code, so the tools they credit are re-read by hand when their
+ * documents change.
+ *
+ * | Key | Name | URL | Licence | Kind | Note |
+ * |---|---|---|---|---|---|
+ * | `tflint` | tflint | https://github.com/terraform-linters/tflint | MPL-2.0 (its `terraform` package is BUSL-1.1; binaries are bound by both) | scanner | The plugin host; ships no language rules of its own. Sweep: not registered in `PRIOR_ART` (no rule cites it), so it is not swept. |
+ * | `tflint-ruleset-terraform` | tflint-ruleset-terraform | https://github.com/terraform-linters/tflint-ruleset-terraform | MPL-2.0 | scanner | The official language-level ruleset, bundled into tflint. Sweep: indexed from `docs/rules/README.md`, whose table links each rule's page (20 rules). |
+ * | `tflint-ruleset-redeploy` | tflint-ruleset-redeploy | https://github.com/RedeployAB/tflint-ruleset-redeploy | 0BSD | scanner | Community ruleset; richest source of language-level rules outside the official set. Sweep: indexed from `docs/rules/README.md`, same table shape (33 rules). |
+ * | `tflint-ruleset-avm` | tflint-ruleset-avm | https://github.com/Azure/tflint-ruleset-avm | MIT | scanner | Azure Verified Modules conformance; two of its 33 rules are provider-agnostic. Sweep: indexed from the repository-root `RULES.md`, since `docs/` holds pages for only two rules (33 rules). |
+ * | `tfsec` | tfsec | https://github.com/aquasecurity/tfsec | MIT | scanner | Historical: not archived but effectively frozen (no release since 2025-05); its docs site 404s above v0.61.x, so cite pinned repository paths (`github.com/aquasecurity/tfsec/blob/master/docs/checks/...`), not the docs site. Sweep: indexed from the root `rules.md` on `master`, a flat table of all 152 check ids, because `docs/checks` nests a directory per provider, service and check. |
+ * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. Sweep: not registered in `PRIOR_ART` (no rule cites it yet) and its `long_id`s live in Rego metadata under `checks/<kind>/<provider>/<service>/`, with no flat index. |
+ * | `terraform-sentinel-policies` | HashiCorp reference Sentinel policies | https://github.com/hashicorp/terraform-sentinel-policies | MPL-2.0 | specification | HashiCorp's own example policy set; ships zero rules baked into HCP Terraform itself, so treat a cited policy as a documented pattern (`specification`) unless a future entry runs it as a real check (`scanner`); the `kind` union allows either. Sweep: indexed by listing the five per-cloud directories, whose `.sentinel` filenames are the policy ids credits cite (73 policies); the repository publishes no index page. |
+ * | `choudoufu` | choudoufu | https://github.com/INTENTIUS/choudoufu | MPL-2.0 | scanner | Its `internal/live/lint` package; experimental, AWS-only. Sweep: unsweepable, its rule ids are Go constants in `internal/live/lint/issue.go` and it publishes no rule index. |
+ * | `hashicorp-style-guide` | HashiCorp Terraform style guide | https://developer.hashicorp.com/terraform/language/style | n/a | specification | Sweep: unsweepable, one prose page of recommendations with no rule ids; a credit quotes the sentence and links its fragment. |
+ * | `gcp-terraform-best-practices` | Google Cloud Terraform best-practices series | https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure | n/a | specification | A multi-page series; cite the specific page's fragment. Sweep: unsweepable, prose across several pages with no rule ids. |
+ * | `aws-terraform-prescriptive-guidance` | AWS prescriptive guidance for Terraform | https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/ | n/a | specification | Sweep: unsweepable, a prose guide whose sections carry headings rather than rule ids. |
+ *
+ * Deliberately excluded, per the survey: Terrascan and regula (both archived,
+ * do not build on dead projects); Snyk IaC (a product, not a rule source);
+ * semgrep (no SPDX id: its engine is LGPL-2.1 but its rules ship under the
+ * proprietary Semgrep Rules License v1.0, which forbids redistribution; cite
+ * it by name in prose if a rule's idea comes from it, never register it in
+ * `PRIOR_ART` with an SPDX licence). TF008 credits semgrep by name under that
+ * rule, so `PRIOR_ART` does carry the entry, with the licence spelled out
+ * rather than as an SPDX id. Sweep: unsweepable, the registry publishes no
+ * index and a rule id is the path of its YAML file under
+ * `terraform/<provider>/<category>/`, which no single directory listing covers.
+ *
+ * TF024 (#2103, live root declares a backend/cloud block) credits choudoufu's
+ * own `RuleStateBackend`, `internal/live/lint/issue.go` of
+ * github.com/INTENTIUS/choudoufu: the identical condition, checked the same
+ * way this fork checks it at `init` before any command runs. TF025 (a live
+ * root's non-default `terraform.workspace`) has no entry: its workspace half
+ * is refused at the CLI argument-parsing layer there
+ * (`internal/command/live_mode.go`), not by a dedicated lint rule under
+ * `internal/live/lint`, so there is no `Rule*` constant to point at.
+ *
+ * TF026 (#2106, a live root's `delete: "never"` against its `policy` block's
+ * `undeclared_tagged` verb) has no entry either, the same reason TF001 has
+ * none: choudoufu's own `internal/live/lint` package checks a policy block
+ * for internal validity (`RulePolicyVerb`: an unrecognized or wrong-quadrant
+ * verb; `RulePolicyScope`: `undeclared_untagged = "delete"` with no `scope`
+ * block), never against a `delete: "never" | "owned-only" | "gated"`
+ * classification, because choudoufu has no such classification — that
+ * vocabulary is chant's own, shared across lexicons (`lexicons/k8s/src/op/
+ * activities/kubectl.ts`'s `ApplyDeleteMode`, `packages/core/src/op/
+ * activities/apply.ts`'s `DeleteMode`), applied here to a tool that does not
+ * itself carry the concept. Ship with no lineage rather than invent a credit.
+ *
+ * TF027 (#2216, a live root's `policy` block setting `undeclared_untagged =
+ * "delete"`) does have one: choudoufu's `RulePolicyScope`
+ * (`internal/live/lint/policy.go`) refuses the same assignment, and issue #67
+ * there makes it a lint refusal rather than a default. The relation is
+ * `extends`, because choudoufu refuses it only when no `scope` block narrows
+ * the purge, while chant refuses it either way: a `scope` block bounds an
+ * account-wide sweep to a service, type or region, and every resource inside
+ * that boundary is still one this estate never marked. "Bounded" is not
+ * "owned", and owning it is the condition chant applies.
+ *
+ * TF028 (#2216, a live root watched by a `TerraformWatchOp` built without
+ * `live: true`) has no entry. It reads a chant Op's own configuration against
+ * a root's mode, and no surveyed tool has an Op model to read: choudoufu lints
+ * HCL, and every tflint ruleset, tfsec/trivy-checks and the Sentinel policies
+ * do the same. There is nothing upstream to credit.
  */
 import type { Lineage } from "@intentius/chant/audit/catalog";
 export declare const terraformAuditLineage: Record<string, Lineage[]>;

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAM,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CA0R3D,CAAC"}

package/dist/lint/post-synth/blocks.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Shared reading helpers for the single-block post-synth checks (#2110).
+ *
+ * Thirteen of the fourteen rules in that issue do the same three things: pick
+ * the entities of one block type out of `ctx.entities`, read one attribute of
+ * each body, and report. This module is those three things, so a rule file is
+ * its condition and its message and nothing else. It exports no
+ * `PostSynthCheck`, so the generated barrel skips it (see
+ * `packages/core/src/codegen/generate-post-synth-barrel.ts`).
+ */
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { BlockBody } from "../../hcl/parse.js";
+/** One parsed block, with the entity key the diagnostic reports against. */
+export interface TerraformBlock {
+    /** `ctx.entities` key: `<root>/<address>`. */
+    key: string;
+    address: string;
+    body: BlockBody;
+    file: string;
+    root: string;
+    /** The raw text of the file this block came from (see `TerraformEntity.props`). */
+    source: string;
+}
+/** Every block of one entity type, in `ctx.entities` order. */
+export declare function blocksOfType(ctx: PostSynthContext, entityType: string): TerraformBlock[];
+/** Blocks of several types at once, in the order the types are given. */
+export declare function blocksOfTypes(ctx: PostSynthContext, entityTypes: string[]): TerraformBlock[];
+/** The name half of a `var.<name>` / `output.<name>` address. */
+export declare function blockName(address: string): string;
+/**
+ * The bodies of a nested block (`lifecycle`, `validation`, a provider's
+ * `assume_role`). hcl2json encodes a repeatable block as an array of bodies
+ * and a singleton as a bare object, so both are normalized to an array here.
+ */
+export declare function nestedBodies(body: BlockBody, key: string): BlockBody[];
+/** Is this attribute value a string that says nothing? */
+export declare function isBlank(value: unknown): boolean;
+/** One scalar attribute found by {@link walkAttributes}. */
+export interface Attribute {
+    /** The attribute's own name (the last path segment). */
+    name: string;
+    /** Dotted path from the block body, e.g. `connection.password`. */
+    path: string;
+    value: unknown;
+}
+/**
+ * Every scalar attribute in a block body, descending through nested blocks so
+ * a credential inside `connection {}` or `assume_role {}` is not invisible.
+ * Depth-limited: a Terraform block nests a handful of levels at most, and an
+ * unbounded walk over a large body buys nothing.
+ */
+export declare function walkAttributes(body: BlockBody, maxDepth?: number): Attribute[];
+//# sourceMappingURL=blocks.d.ts.map

package/dist/lint/post-synth/blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocks.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,iBAAiB,CAAC;AAElE,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,cAAc,EAAE,CAgBxF;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAE5F;AAED,iEAAiE;AACjE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,CAKtE;AAED,0DAA0D;AAC1D,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/C;AAED,4DAA4D;AAC5D,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,SAAI,GAAG,SAAS,EAAE,CAmBzE"}

package/dist/lint/post-synth/fixtures/load.d.ts

@@ -0,0 +1,37 @@
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { CallModuleType } from "../../../hcl/descend.js";
+/**
+ * Parse `fixtures/<checkId>/<name>.tf` into a {@link PostSynthContext} whose
+ * `entities` are exactly what a real root module of that one file would
+ * produce. `root` (the entity key prefix and the `TerraformEntity.props.root`
+ * value) defaults to `checkId`; pass a distinct value to load two fixtures
+ * into one context under different root names.
+ *
+ * Three lines per fixture in a test:
+ * ```ts
+ * const diags = tf001.check(await loadFixture("TF001", "positive"));
+ * expect(diags).toHaveLength(1);
+ * ```
+ */
+export declare function loadFixture(checkId: string, name: string, root?: string): Promise<PostSynthContext>;
+/**
+ * Parse a whole fixture DIRECTORY, `fixtures/<checkId>/<name>/`, the way
+ * `buildRoots()` parses a configured root: its own `.tf` files, then every
+ * local `module` call followed into its directory (chant #2112). A rule about
+ * child modules (TF014, TF015) or about a whole scope's references (TF020)
+ * cannot be shown a single file and still be tested honestly, so its fixture
+ * is a tree:
+ *
+ * ```
+ * fixtures/TF014/positive/main.tf                     # module "cdn" { source = "./modules/cdn" }
+ * fixtures/TF014/positive/modules/cdn/main.tf         # the provider block the rule reports
+ * ```
+ *
+ * The fixture directory is also the project root for the descent, so a
+ * fixture can exercise the outside-the-project refusal with a `../` source
+ * without reaching into the repository around it. `warnings` from the render
+ * lands on `buildResult.warnings`, where the descent's own refusals are
+ * readable by a test.
+ */
+export declare function loadTreeFixture(checkId: string, name: string, root?: string, callModuleType?: CallModuleType): Promise<PostSynthContext>;
+//# sourceMappingURL=load.d.ts.map

package/dist/lint/post-synth/fixtures/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../../src/lint/post-synth/fixtures/load.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAgB,EACtB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC,gBAAgB,CAAC,CAkB3B"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAE3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA6BvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA4B3C,CAAC"}

package/dist/lint/post-synth/module-source.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Classify a `module` block's `source` string, shared by TF004 (registry
+ * module without a version) and TF005 (git/hg module unpinned or pinned to
+ * a branch). Neither rule evaluates HCL: both read `source` as the literal
+ * string hcl2json hands back, so a source built from a variable or a
+ * function call is never classified (`"other"`), matching tflint's own
+ * `SourceKnown` guard on `module.Source`.
+ *
+ * `registry` mirrors `hashicorp/terraform-registry-address`'s
+ * `ParseModuleSource` (MPL-2.0,
+ * https://github.com/hashicorp/terraform-registry-address/blob/main/module.go):
+ * three slash-separated parts (`namespace/name/target-system`), or four with
+ * a leading hostname that contains a dot and is not `github.com` or
+ * `bitbucket.org` (those are reserved for direct VCS installs, never a
+ * registry). `git` covers the sources tflint's `terraform_module_pinned_source`
+ * treats as git/hg: an explicit `git::`/`hg::` force prefix, the `github.com`
+ * and `bitbucket.org` shorthands its `GitHubDetector`/`BitBucketDetector`
+ * recognize, scp-style `git@host:path` addresses, and any source ending in
+ * `.git`. `local` is `./` or `../` (checkov's `UNKNOWN` case for module
+ * pinning: a local path cannot be pinned to anything and is never flagged).
+ */
+export type ModuleSourceKind = "local" | "registry" | "git" | "other";
+export interface ModuleSourceClassification {
+    kind: ModuleSourceKind;
+    /** The `?ref=`/`&ref=` value (falling back to `rev`), when `kind` is `"git"`. */
+    ref?: string;
+}
+export declare function classifyModuleSource(source: string): ModuleSourceClassification;
+/**
+ * Is `ref` pinned tightly enough for TF005: a semver-shaped tag or a full
+ * 40-hex commit SHA. Stricter than checkov's `CKV_TF_1`/`CKV_TF_2`, which
+ * accept any `?ref=` containing `\d\.\d` (so `v1.2-dev` passes there); the
+ * page documents the difference.
+ */
+export declare function isPinnedRef(ref: string): boolean;
+/** Is `ref` one of the well-known mutable branch names tflint's `flexible` style rejects, plus `trunk`. */
+export declare function isDefaultBranch(ref: string): boolean;
+//# sourceMappingURL=module-source.d.ts.map

package/dist/lint/post-synth/module-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-source.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/module-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,CAAC;AAEtE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,0BAA0B,CAsB/E;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/lint/post-synth/scope.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Root scope or child scope, and the `Callers:` chain that says which call
+ * reached a finding (chant #2112).
+ *
+ * Since the parse descends into local modules, `ctx.entities` holds two kinds
+ * of block: the root module's own, keyed `<root>/<address>`, and a child
+ * module's, keyed `<root>/module.<name>/<address>` with the call chain on
+ * `props.callers`. Every check has to say which it applies to, and the three
+ * shapes that answer live here:
+ *
+ * - {@link isRootScoped} for a check about how a ROOT is assembled (TF001's
+ *   backend, TF002's `required_providers`): a child module has no backend and
+ *   no provider requirements of its own to judge, and reading one as if it
+ *   were the root's is how a root with a perfectly good backend gets flagged
+ *   because a module beneath it has none.
+ * - {@link isChildScoped} for the mirror, the two rules that are ONLY about
+ *   child modules (TF014, TF015).
+ * - {@link callersNote} for the sentence appended to a finding inside a
+ *   child, naming each call site with the file and line it sits on. tflint
+ *   prints the same thing as a `Callers:` block under the diagnostic
+ *   (https://github.com/terraform-linters/tflint/blob/master/docs/user-guide/calling-modules.md);
+ *   a `PostSynthDiagnostic` carries no ranges, so the chain goes in the
+ *   message, where a reader of any output format sees it.
+ *
+ * A check with no opinion (most of them: an unset `type` on a variable is the
+ * same finding wherever the variable lives) needs nothing from this module and
+ * runs over both scopes, which is what tflint does with its own language rules
+ * under `--call-module-type=local`.
+ */
+import type { PostSynthCheck, PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { type Declarable } from "@intentius/chant/declarable";
+/** The `module.<name>` chain on an entity, outermost first. Empty for a root block. */
+export declare function callersOf(entity: Declarable): readonly string[];
+/** Was this block declared in the root module itself? */
+export declare function isRootScoped(entity: Declarable): boolean;
+/** Was this block declared in a child module the root calls? */
+export declare function isChildScoped(entity: Declarable): boolean;
+/**
+ * The `Callers:` sentence for a finding on `key`, or `""` when the finding is
+ * in the root module.
+ *
+ * The call sites are the key's own prefixes: a finding on
+ * `app/module.cdn/module.bucket/aws_s3_bucket.assets` was reached through
+ * `app/module.cdn` and then `app/module.cdn/module.bucket`, both of them
+ * `module` block entities in `ctx.entities`, so the file and line each was
+ * parsed from are already recorded. A prefix with no entity (a hand-built
+ * context in a test) renders as the bare call name.
+ */
+export declare function callersNote(ctx: PostSynthContext, key: string): string;
+/**
+ * Wrap every check so a finding inside a child module carries its
+ * {@link callersNote}, whichever rule produced it.
+ *
+ * Done once, here, rather than in each rule's message: a reader of a finding
+ * on `module.cdn`'s bucket needs to know which call reached that code no
+ * matter which of the twenty-odd checks reported it, and a rule that forgot
+ * to append the chain would be a silent gap. The wrapper is what
+ * `terraformPlugin.postSynthChecks()` returns; a rule's own `check()` is
+ * unchanged, which is what its unit tests call.
+ *
+ * A message that already names the chain is left alone, so a rule with
+ * something more specific to say about its callers can say it.
+ */
+export declare function withCallersChain(checks: readonly PostSynthCheck[]): PostSynthCheck[];
+//# sourceMappingURL=scope.d.ts.map

package/dist/lint/post-synth/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGpF,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAI/D;AAED,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAExD;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAYpF"}

package/dist/lint/post-synth/tf001.d.ts

@@ -1,17 +1,69 @@
 /**
  * TF001: a root module keeps its state on local disk.
  *
- * A `terraform` block with no `backend "<type>"` and no `cloud {}` falls back
- * to the local backend, which puts `terraform.tfstate` in the working
- * directory. That file holds every attribute of every managed resource,
- * secrets included, and it is not shared, not locked, and not versioned. The
- * first apply from a second machine or a CI runner starts from an empty state
- * and proposes to create the estate again.
+ * Two ways a root gets there, and this reports both (#2218). A `terraform`
+ * block with no `backend "<type>"` and no `cloud {}` falls back to the local
+ * backend implicitly. A `backend "local"` block asks for the same backend by
+ * name. Either way `terraform.tfstate` lands in the working directory, and
+ * that file holds every attribute of every managed resource, secrets
+ * included, and it is not shared, not locked, and not versioned. The first
+ * apply from a second machine or a CI runner starts from an empty state and
+ * proposes to create the estate again.
+ *
+ * So the rule reads the backend block's TYPE LABEL rather than its presence:
+ * the id means "no remote backend", which is what its name, its message and
+ * its page have always argued. `cloud {}` counts as remote (it is Terraform
+ * Cloud / HCP state, held off the machine and locked). Every other backend
+ * type is taken as remote without a list to maintain, since `local` is the
+ * only backend Terraform ships that writes to the working directory.
+ *
+ * A root that keeps local state on purpose says so with a
+ * `# chant-ignore-block: TF001` on the line above its `terraform` block
+ * (chant #2111), which is what the three shipped examples do.
  *
  * One diagnostic per root, fired from the root's `terraform` block. A root
  * with no `terraform` block at all is not flagged: it declares no version
  * constraints either, and the missing block is a different finding.
+ *
+ * Scope: root modules only (#2112). A child module must NOT declare a
+ * backend, which is the mirror image and TF015's finding, so a descended
+ * module's `terraform` block is skipped here rather than read as if it were
+ * the root's.
+ *
+ * Does not fire on a live root (#2103): a `backend` block is exactly what
+ * choudoufu refuses there (TF024's territory), and the fallback to local
+ * state this check warns about does not apply, since a live root keeps no
+ * state file at all, local or remote.
  */
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { type BlockBody } from "../../hcl/parse.js";
+/**
+ * `backend`/`cloud` are blocks, so hcl2json encodes them as a value under the
+ * key, structurally the same "literal value under this key" shape `attr()`
+ * (`../../hcl/value.ts`, chant #2113) reads for an ordinary attribute, so
+ * this reads through it rather than re-deriving presence by hand.
+ */
+export declare function hasBlock(body: BlockBody, key: string): boolean;
+/** The one backend type that writes state to the working directory. */
+export declare const LOCAL_BACKEND = "local";
+/**
+ * The type labels of the `backend` blocks in a `terraform` block body.
+ *
+ * `backend` takes one label, so hcl2json nests it one level deeper than an
+ * unlabelled block: `backend "s3" { bucket = "b" }` is
+ * `{ backend: { s3: [{ bucket: "b" }] } }`, where `cloud { ... }` is just
+ * `{ cloud: [{ ... }] }`. The keys of that inner object are the labels, which
+ * is the only place the type survives the parse. A malformed body that puts
+ * an array or a scalar under `backend` yields no labels, and the caller then
+ * treats the root as having no remote backend, the same verdict a missing
+ * block gets.
+ */
+export declare function backendTypes(body: BlockBody): string[];
+/**
+ * Whether the body configures state somewhere other than the working
+ * directory: any `backend` block whose type is not `local`, or a `cloud`
+ * block.
+ */
+export declare function hasRemoteBackend(body: BlockBody): boolean;
 export declare const tf001: PostSynthCheck;
 //# sourceMappingURL=tf001.d.ts.map

package/dist/lint/post-synth/tf001.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tf001.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf001.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAY1C,eAAO,MAAM,KAAK,EAAE,cAkCnB,CAAC"}
+{"version":3,"file":"tf001.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf001.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjE;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,uEAAuE;AACvE,eAAO,MAAM,aAAa,UAAU,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,CAMtD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAGzD;AAED,eAAO,MAAM,KAAK,EAAE,cAmDnB,CAAC"}

package/dist/lint/post-synth/tf002.d.ts

@@ -0,0 +1,32 @@
+/**
+ * TF002: a provider a root implies has no `required_providers` entry, or an
+ * incomplete one.
+ *
+ * A provider is implied two ways: an explicit `provider "<name>" {}` block,
+ * or a resource/data type prefix (`aws_instance` implies `aws`, up to the
+ * first underscore, the same heuristic tflint's `terraform_required_providers`
+ * reads via `GetProviderRefs()`). The `terraform` builtin (the provider
+ * behind `terraform_remote_state`) is never implied: it has no registry
+ * entry to require. Every implied provider needs a `required_providers`
+ * entry that is an object carrying both `source` and `version`, since the old
+ * shorthand form (`aws = "~> 4.0"`, a bare string) has neither and fires the
+ * same as a missing entry.
+ *
+ * Fires once per incomplete or missing provider, not once per resource: two
+ * resources implying the same unconstrained provider produce one diagnostic.
+ * Anchored on whichever entity first implied the provider, preferring an
+ * explicit `provider` block over a resource/data type, so the diagnostic
+ * points at the most specific place a fix belongs.
+ *
+ * A root with no `terraform` block at all is out of scope, same as TF001:
+ * the missing block is that rule's finding, not this one's.
+ *
+ * Scope: root modules only (#2112). A child module's own `required_providers`
+ * are the child's business, and its resources are constrained by the root's
+ * block at plan time, so folding a descended module's blocks into this pass
+ * would both credit the root with requirements it never declared and judge it
+ * on providers it never named.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf002: PostSynthCheck;
+//# sourceMappingURL=tf002.d.ts.map

package/dist/lint/post-synth/tf002.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf002.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf002.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAyE1C,eAAO,MAAM,KAAK,EAAE,cA2CnB,CAAC"}

package/dist/lint/post-synth/tf003.d.ts

@@ -0,0 +1,22 @@
+/**
+ * TF003: a root's `terraform` block has no `required_version`.
+ *
+ * Sits on the same `terraform` block TF001 already walks. Without
+ * `required_version`, a root can be applied by whatever Terraform binary
+ * happens to be on the runner's `PATH`, and a binary upgrade that changes
+ * behavior (a provider protocol bump, a changed default) surfaces as a
+ * surprise plan diff instead of a version-check failure before anything runs.
+ *
+ * One diagnostic per root, fired once even if the root spreads its
+ * `terraform` block across several files (a legacy-config split into
+ * `terraform.tf` and `versions.tf`, say). A root with no `terraform` block
+ * at all is out of scope, same as TF001 and TF002: the missing block is
+ * their finding, not this one's.
+ *
+ * Scope: root modules only (#2112). A child module may legitimately leave
+ * `required_version` to the root that calls it, so a descended module's
+ * `terraform` block is skipped here.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf003: PostSynthCheck;
+//# sourceMappingURL=tf003.d.ts.map

package/dist/lint/post-synth/tf003.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf003.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf003.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAS1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}

package/dist/lint/post-synth/tf004.d.ts

@@ -0,0 +1,22 @@
+/**
+ * TF004: a registry-sourced `module` block has no `version`.
+ *
+ * "Registry-sourced" means `source` parses as a Terraform module registry
+ * address (`classifyModuleSource`, `./module-source.ts`): a bare
+ * `namespace/name/target-system`, or a hostname-prefixed
+ * `host/namespace/name/target-system`. Without `version`, `terraform init`
+ * always resolves to the newest release that satisfies no constraint at
+ * all, so an upstream module release can change what a root provisions with
+ * no local edit and no diff to review first.
+ *
+ * A local (`./`, `../`) or git/hg source is never flagged here: git/hg is
+ * TF005's territory, and a local source cannot carry a registry version at
+ * all. One diagnostic per module block.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf004: PostSynthCheck;
+//# sourceMappingURL=tf004.d.ts.map

package/dist/lint/post-synth/tf004.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf004.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf004.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}

package/dist/lint/post-synth/tf005.d.ts

@@ -0,0 +1,28 @@
+/**
+ * TF005: a git or hg `module` source with no `?ref=`, or a `?ref=` that
+ * isn't tight enough to call pinned.
+ *
+ * "Git or hg" is `classifyModuleSource`'s `"git"` kind (`./module-source.ts`):
+ * an explicit `git::`/`hg::` prefix, the bare `github.com`/`bitbucket.org`
+ * shorthands, an scp-style `git@host:path`, or anything ending in `.git`.
+ * A ref counts as pinned only if it is a semver-shaped tag or a full 40-hex
+ * commit SHA (`isPinnedRef`), stricter than checkov's `CKV_TF_1`/`CKV_TF_2`,
+ * which accept any `?ref=` containing `\d\.\d` (so `v1.2-dev` passes there;
+ * it does not here, and the rule's page section says so). A ref matching a
+ * well-known mutable branch name (`main`, `master`, `develop`, `trunk`) gets
+ * its own, more specific message, since that's the exact case tflint's
+ * `flexible` style (the style this rule ships; see the page section for what
+ * `semver` style would add) already reports on.
+ *
+ * A local (`./`, `../`) source is never flagged: it can't be pinned to a
+ * ref at all, and checkov's own module-pinning checks return `UNKNOWN`
+ * (not a failure) for the same reason. A registry source is TF004's
+ * territory, not this rule's; the two never fire on the same module block.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf005: PostSynthCheck;
+//# sourceMappingURL=tf005.d.ts.map

package/dist/lint/post-synth/tf005.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf005.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf005.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cAwCnB,CAAC"}

package/dist/lint/post-synth/tf006.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TF006: a `sensitive = true` variable carries a `default`.
+ *
+ * Marking a variable sensitive is a statement that its value must not be seen.
+ * A default is a value committed to the repository, so the two together are a
+ * contradiction: the secret is in git, and the `sensitive` flag only hides it
+ * from plan output, where it was never the exposure. It is also the shape that
+ * survives longest, because every environment that forgets to pass the variable
+ * silently gets the committed one.
+ *
+ * Any default counts, not only a secret-shaped one. `default = ""` and
+ * `default = null` are the two that look harmless, and both make a required
+ * secret optional, which is the other half of the failure.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf006: PostSynthCheck;
+//# sourceMappingURL=tf006.d.ts.map

package/dist/lint/post-synth/tf006.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf006.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf006.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,KAAK,EAAE,cAyBnB,CAAC"}

package/dist/lint/post-synth/tf007.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TF007: a variable default or a `locals` value holds a secret-shaped literal.
+ *
+ * This is the check tfsec shipped as `general-secrets-sensitive-in-variable`
+ * and `general-secrets-sensitive-in-local`, and that trivy dropped when it
+ * absorbed tfsec. #2107's survey found no maintained tool that has it today.
+ *
+ * A committed default or local is a credential in git history, which no later
+ * edit removes, and Terraform copies it into state and into plan output on
+ * every run. Both heuristics in `../secret-shape.ts` count: the name (a
+ * variable called `db_password`) and the value (something shaped like a live
+ * credential whatever it is called). References and interpolations are never
+ * flagged, because passing the value in is the fix.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf007: PostSynthCheck;
+//# sourceMappingURL=tf007.d.ts.map

package/dist/lint/post-synth/tf007.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf007.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf007.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAY1C,eAAO,MAAM,KAAK,EAAE,cA0CnB,CAAC"}

package/dist/lint/post-synth/tf008.d.ts

@@ -0,0 +1,22 @@
+/**
+ * TF008: a `provider` block configures a credential inline.
+ *
+ * The most corroborated rule in #2107's survey: checkov (`CKV_AWS_41` and its
+ * `credentials.py` siblings), KICS, Snyk and semgrep all ship a version of it,
+ * and it is the only Terraform-language-shaped check any of Snyk or semgrep
+ * ships at all. Every one of them is written per provider. This one is written
+ * against attribute NAMES, so it covers the providers those tools cover and
+ * the several hundred they do not.
+ *
+ * A credential in a provider block is used by every resource that provider
+ * manages, so it is the highest-value one in the root, and it is read from the
+ * repository by everyone who can clone it. Providers all accept the same
+ * credential through the environment or a shared config file instead.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf008: PostSynthCheck;
+//# sourceMappingURL=tf008.d.ts.map

package/dist/lint/post-synth/tf008.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf008.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf008.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAmB1C,eAAO,MAAM,KAAK,EAAE,cA+BnB,CAAC"}