@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/dist/lint/post-synth/tf009.d.ts

@@ -0,0 +1,24 @@
+/**
+ * TF009: a credential-named variable is not marked `sensitive`.
+ *
+ * No tool in #2107's survey checks this. The authority is HashiCorp's own style
+ * guide, whose variables section says plainly: "For sensitive variables, such
+ * as passwords and private keys, set the sensitive parameter to true."
+ *
+ * Without the flag the value is echoed in `terraform plan` and
+ * `terraform apply` output, which means it lands in CI logs, in the pull
+ * request comment a plan bot posts, and in every terminal scrollback. The flag
+ * does not keep the value out of state (nothing does), which is why the
+ * remediation says both things.
+ *
+ * Only the name is read. A variable with no default and no value in the
+ * repository is still flagged, because the finding is about where the value
+ * goes at run time, not about what is committed. That is TF007's question.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf009: PostSynthCheck;
+//# sourceMappingURL=tf009.d.ts.map

package/dist/lint/post-synth/tf009.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf009.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf009.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cA2BnB,CAAC"}

package/dist/lint/post-synth/tf010.d.ts

@@ -0,0 +1,19 @@
+/**
+ * TF010: a `variable` declares no `type`.
+ *
+ * Without a type constraint Terraform accepts whatever it is given and infers
+ * the type from the value, so a variable meant to be a list arrives as a
+ * string from a `TF_VAR_` environment variable, or a number arrives as `"3"`
+ * from a tfvars file, and the failure surfaces deep inside a resource
+ * argument rather than at the module boundary where it was introduced.
+ *
+ * A blank `type` counts as absent, matching KICS, which fails a `type` that
+ * trims to empty.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf010: PostSynthCheck;
+//# sourceMappingURL=tf010.d.ts.map

package/dist/lint/post-synth/tf010.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf010.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf010.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,KAAK,EAAE,cAyBnB,CAAC"}

package/dist/lint/post-synth/tf011.d.ts

@@ -0,0 +1,18 @@
+/**
+ * TF011: a `variable` declares no `description`.
+ *
+ * A module's variables are its API. The description is what `terraform-docs`
+ * renders into the README, what the HCP Terraform and Terraform Cloud variable
+ * UI shows next to the input box, and what a caller reads before deciding what
+ * to pass. Without it the only documentation is the variable's name.
+ *
+ * Report-only: this is documentation hygiene, filed the way KICS files it (as
+ * INFO) and the way tflint files it (in the `all` preset, not `recommended`).
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf011: PostSynthCheck;
+//# sourceMappingURL=tf011.d.ts.map

package/dist/lint/post-synth/tf011.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf011.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf011.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,KAAK,EAAE,cAwBnB,CAAC"}

package/dist/lint/post-synth/tf012.d.ts

@@ -0,0 +1,17 @@
+/**
+ * TF012: an `output` declares no `description`.
+ *
+ * The other half of a module's API. An output is what a caller wires into the
+ * next module, and the description is the only place to say what the value
+ * actually is (an id or an ARN, a full URL or a bare hostname) and whether it
+ * is stable enough to depend on.
+ *
+ * Report-only, for the same reason TF011 is.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf012: PostSynthCheck;
+//# sourceMappingURL=tf012.d.ts.map

package/dist/lint/post-synth/tf012.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf012.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf012.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,KAAK,EAAE,cAuBnB,CAAC"}

package/dist/lint/post-synth/tf013.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TF013: `lifecycle { ignore_changes = all }`.
+ *
+ * `all` tells Terraform to ignore drift on every attribute of the resource
+ * after it is created. Nothing about that resource is ever reconciled again:
+ * a manual console edit, a deleted security-group rule, a downgraded instance
+ * class, all of it plans clean forever. It is also silent, because a plan that
+ * finds nothing looks exactly like a plan that was told to look at nothing.
+ *
+ * That is the observe half of chant's lifecycle switched off, so this is
+ * merge-worthy rather than hygiene. A list of specific attributes is fine and
+ * is not reported: ignoring `tags` an external tool writes is a real need, and
+ * naming them is what makes the intent auditable.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf013: PostSynthCheck;
+//# sourceMappingURL=tf013.d.ts.map

package/dist/lint/post-synth/tf013.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf013.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf013.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAc1C,eAAO,MAAM,KAAK,EAAE,cAyBnB,CAAC"}

package/dist/lint/post-synth/tf014.d.ts

@@ -0,0 +1,25 @@
+/**
+ * TF014: a `provider` block inside a child module that configures anything.
+ *
+ * Scope: child modules only. A `provider` block in the ROOT module is where
+ * providers are supposed to be configured, and TF008 is what checks its
+ * contents.
+ *
+ * A child module that configures its own provider takes the decision away
+ * from its caller: the caller can no longer point the module at a different
+ * region, account or endpoint, and two calls of the module in one root cannot
+ * differ. Worse, Terraform cannot remove a module whose provider is declared
+ * inside it, because destroying the resources needs a provider configuration
+ * that the removal itself deletes. That is the "Provider configuration not
+ * present" failure that leaves a root unable to plan.
+ *
+ * The one legal form is a provider block that declares only `alias`, which
+ * names a slot the caller fills through `providers = { aws.replica =
+ * aws.west }`. That is a declaration, not a configuration, so a block whose
+ * body has nothing but `alias` is not reported. Everything else is: a
+ * `region`, a `profile`, an `assume_role` block, and `version` too, which has
+ * been deprecated in favour of `required_providers` since Terraform 0.13.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf014: PostSynthCheck;
+//# sourceMappingURL=tf014.d.ts.map

package/dist/lint/post-synth/tf014.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf014.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf014.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAU1C,eAAO,MAAM,KAAK,EAAE,cAkCnB,CAAC"}

package/dist/lint/post-synth/tf015.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TF015: a `backend` or `cloud` block inside a child module.
+ *
+ * Scope: child modules only. This is TF001's mirror image. TF001 wants a root
+ * module to declare a REMOTE backend, because a root without one keeps its
+ * state on local disk. A child module must declare neither: state belongs to
+ * the root,
+ * one state per root however many modules it calls, and Terraform says so
+ * directly, "A backend block can only appear in the root module" and the
+ * same for `cloud`. Depending on the version, the block is ignored with a
+ * warning or the root refuses to initialize, and either way the block is a
+ * claim about where state lives that the module does not get to make.
+ *
+ * The usual cause is a directory that used to be a root module and became a
+ * child when someone factored it out, with its `terraform` block carried
+ * along. The rest of that block is fine to keep: `required_version` and
+ * `required_providers` are meaningful in a child module and are not reported
+ * here.
+ *
+ * Label-blind on purpose (#2218). TF001 had to start reading the backend
+ * block's type label, since `local` is the state placement it warns about
+ * rather than a cure for it. Nothing of the sort applies here: what a child
+ * module may not do is name a backend at all, `local` included, and
+ * Terraform's own refusal ("A backend block can only appear in the root
+ * module") does not read the label either. `hasBlock` is the right test, and
+ * the `positive` fixture's child declares `backend "local"` for that reason.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf015: PostSynthCheck;
+//# sourceMappingURL=tf015.d.ts.map

package/dist/lint/post-synth/tf015.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}

package/dist/lint/post-synth/tf016.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TF016: an attribute whose whole value is one quoted interpolation,
+ * `x = "${var.y}"`, the pre-0.12 style Terraform deprecated in 2019.
+ *
+ * The quotes buy nothing and cost readability: the expression is already an
+ * expression, and wrapping it in a template makes every value in the file look
+ * like a string whether it is one or not, which hides the actual type of an
+ * argument that takes a list or a bool.
+ *
+ * This is the one rule in the family that reads the block's SOURCE rather than
+ * its parsed body, and it has to. `@cdktf/hcl2json` renders both `x = var.y`
+ * and `x = "${var.y}"` as the string `"${var.y}"`, so a check over the parse
+ * cannot tell the deprecated form from the idiomatic one and would report every
+ * reference in the root. The quotes only survive in the text, so the text is
+ * what is scanned, one pass per file, through the same
+ * `interpolationOnlyLine` the deterministic fix uses, so the finding and the
+ * patch can never disagree.
+ *
+ * Out of reach, and deliberately not guessed at: tflint also reports the
+ * deprecated interpolation inside an object KEY (`"${var.k}" = "value"`).
+ * That is a different line shape and its fix is not a simple unquote, so this
+ * rule leaves it alone rather than emit a diff it cannot justify.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf016: PostSynthCheck;
+//# sourceMappingURL=tf016.d.ts.map

package/dist/lint/post-synth/tf016.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf016.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf016.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}

package/dist/lint/post-synth/tf017.d.ts

@@ -0,0 +1,19 @@
+/**
+ * TF017: a `module` block carries `depends_on`.
+ *
+ * `depends_on` on a module applies to every resource inside it, including the
+ * ones that had no reason to wait, so the whole module serializes behind the
+ * named dependency and a plan that could have run in parallel does not. It
+ * also makes the dependency invisible from inside the module, where the
+ * resource that actually needed the ordering lives.
+ *
+ * Passing an attribute of the dependency into a module input creates the same
+ * edge implicitly, only narrower and self-documenting.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf017: PostSynthCheck;
+//# sourceMappingURL=tf017.d.ts.map

package/dist/lint/post-synth/tf017.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf017.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf017.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,eAAO,MAAM,KAAK,EAAE,cAwBnB,CAAC"}

package/dist/lint/post-synth/tf018.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TF018: an `output` returns a whole resource or data source.
+ *
+ * `value = aws_instance.web` exports every attribute the provider schema
+ * happens to have, which is a much larger promise than the module meant to
+ * make. Consumers reach into whatever they find, the module can no longer
+ * change any of it, and a provider upgrade that adds or renames an attribute
+ * moves the module's public interface without anyone editing it. Sensitive
+ * attributes ride along too.
+ *
+ * A bare `module.x` reference is not reported: a module's outputs are already
+ * a curated surface, which is the property this rule is asking for.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf018: PostSynthCheck;
+//# sourceMappingURL=tf018.d.ts.map

package/dist/lint/post-synth/tf018.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf018.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf018.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAuB1C,eAAO,MAAM,KAAK,EAAE,cA0BnB,CAAC"}

package/dist/lint/post-synth/tf019.d.ts

@@ -0,0 +1,25 @@
+/**
+ * TF019: a meta-argument is explicitly set to its own default, `false`.
+ *
+ * `sensitive` and `ephemeral` on a `variable` or an `output`, `prevent_destroy`
+ * and `create_before_destroy` inside a `lifecycle` block. All four default to
+ * false, so writing it changes nothing and reads as though someone considered
+ * the setting and turned it off, which is exactly the impression a reviewer
+ * should not get from a variable called `password`.
+ *
+ * The first TF rule with a mechanical fix: the remediation is the deletion of
+ * the line, so this ships `fixKind: "deterministic"` and `chant audit` renders
+ * the diff in its quick-wins section. `packages/core/src/audit/proof.ts` owns
+ * the patch, as it does for every other deterministic rule.
+ *
+ * Only a literal `false` counts. `prevent_destroy = var.protect` is a real
+ * decision expressed as a variable, and hcl2json leaves it a `"${var.protect}"`
+ * string rather than a boolean, so it never reaches the comparison.
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf019: PostSynthCheck;
+//# sourceMappingURL=tf019.d.ts.map

package/dist/lint/post-synth/tf019.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf019.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf019.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAqB1C,eAAO,MAAM,KAAK,EAAE,cAuBnB,CAAC"}

package/dist/lint/post-synth/tf020.d.ts

@@ -0,0 +1,38 @@
+/**
+ * TF020: a `variable`, a `locals` entry, a `data` source or an aliased
+ * `provider` that nothing in its module scope references.
+ *
+ * Scope: root and child modules, each judged on its own. Terraform's
+ * namespaces are per module, so `var.region` inside `module.cdn` is the child
+ * module's variable and a reference to it in the root proves nothing about
+ * the child's. The reference index (`hcl/references.ts`) is keyed the same
+ * way, one scope per module, and this check never looks outside the scope the
+ * declaration is in.
+ *
+ * An unused declaration is dead weight rather than a defect, which is why
+ * this is report-only. It still earns a finding: a variable nobody reads is
+ * usually the leftover of a refactor, and the next reader has to prove that
+ * before deleting it. A data source is worse than dead weight, since it is
+ * read from the provider's API on every plan whether or not anything uses the
+ * result.
+ *
+ * Two deliberate gaps, both from the index being a string scan rather than an
+ * expression tree (see its module doc), and both the reason the credit to
+ * tflint's `terraform_unused_declarations` is `overlaps`:
+ *
+ * - A name mentioned in a string that is not an expression (a `description`
+ *   that says "overrides var.region") reads as a reference, so the
+ *   declaration is not reported. Quiet, and wrong in the safe direction.
+ * - A value reached only dynamically (`lookup(local.by_env, ...)` where the
+ *   map is built elsewhere) is a real reference the scan does see, since the
+ *   local is still named; but a variable consumed only through
+ *   `TF_VAR_`-style external input is not, and a root's variables are
+ *   frequently exactly that. Report-only keeps that from failing a build.
+ *
+ * A `provider` block with no `alias` is never reported: it is the default
+ * configuration for its type, used by every resource of that type without
+ * naming it. Only an aliased one has to be asked for by name.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf020: PostSynthCheck;
+//# sourceMappingURL=tf020.d.ts.map

package/dist/lint/post-synth/tf020.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf020.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf020.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAuB1C,eAAO,MAAM,KAAK,EAAE,cA2DnB,CAAC"}

package/dist/lint/post-synth/tf021.d.ts

@@ -0,0 +1,41 @@
+/**
+ * TF021: `count` used where `for_each` is safer, judged narrowly.
+ *
+ * Scope: root and child modules. A resource is a resource wherever it is
+ * declared, and the failure mode below does not depend on the scope.
+ *
+ * `count` addresses its instances by position: `aws_instance.web[0]`,
+ * `[1]`, `[2]`. Delete the middle element of the list the count was derived
+ * from and every instance after it shifts down one, so Terraform plans to
+ * destroy and recreate them all, in order, to move each one's identity onto
+ * the next index. `for_each` addresses by key instead, and removing one
+ * element removes exactly one instance.
+ *
+ * The narrow part is which counts get reported. Two conditions must both
+ * hold:
+ *
+ * 1. The count is plural and derived, not a switch. A numeric literal of two
+ *    or more, or `length(var.x)` / `length(local.x)`. `count = 0`, `count =
+ *    1` and `count = var.enabled ? 1 : 0` are the conditional-resource idiom,
+ *    which `for_each` does not replace, and they are never reported.
+ * 2. The resource uses `count.index` to build something that carries the
+ *    instance's identity: a name, a bucket, a key, a `tags.Name`. That is what
+ *    makes a shift destructive; a `count.index` used only to pick a subnet out
+ *    of a list is reindexed silently and harmlessly.
+ *
+ * Redeploy's `terraform_prefer_for_each` reports every `count` over a
+ * collection, which is a broader rule and a noisier one, so the credit is
+ * `overlaps` rather than `equivalent`. choudoufu's `RuleCountIndex`
+ * (`internal/live/lint/count_index.go`) is the survey's deepest treatment of
+ * the identity-bearing question, and it is credited the same way. Report-only
+ * either way: a `count` with a stable list behind it is fine forever, and
+ * only the person who knows whether that list is stable can say.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { type BlockBody } from "../../hcl/parse.js";
+/** The `count` value, when it is one this rule reports on. */
+export declare function pluralCount(body: BlockBody): string | undefined;
+/** Identity-bearing attributes of this body whose value is built from `count.index`. */
+export declare function identityUsesOfCountIndex(body: BlockBody): string[];
+export declare const tf021: PostSynthCheck;
+//# sourceMappingURL=tf021.d.ts.map

package/dist/lint/post-synth/tf021.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf021.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf021.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAiB,KAAK,SAAS,EAAwB,MAAM,iBAAiB,CAAC;AA+BtF,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAO/D;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,CAQlE;AAED,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}

package/dist/lint/post-synth/tf022.d.ts

@@ -0,0 +1,24 @@
+/**
+ * TF022: a credential-named attribute of a resource or data source holds a
+ * literal.
+ *
+ * tfsec's `general-secrets-sensitive-in-attribute`, consolidated in its v1
+ * line as `no-plaintext-exposure`, and KICS's `Passwords And Secrets` query.
+ * Broader and noisier than TF007, because a resource body has far more
+ * attributes than a variable has defaults, so the name heuristic does the
+ * gating: an attribute has to read like a credential AND hold a committed
+ * literal before it is reported.
+ *
+ * The value is in git history, in state, and in every plan output, and the
+ * blast radius is whatever the resource is: an RDS master password, a
+ * provider API token, a Kubernetes secret's data. The fix is always the same
+ * shape, a reference rather than a constant, which is what the message says
+ * rather than "remove this".
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf022: PostSynthCheck;
+//# sourceMappingURL=tf022.d.ts.map

package/dist/lint/post-synth/tf022.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf022.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf022.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cA6BnB,CAAC"}

package/dist/lint/post-synth/tf024.d.ts

@@ -0,0 +1,24 @@
+/**
+ * TF024: a live root declares a `backend` or `cloud` block.
+ *
+ * choudoufu refuses this combination at `init`, before any command runs,
+ * naming both blocks that collide: "Both a backend and a live configuration
+ * are present" (a `backend` block) or "Both a cloud and a live configuration
+ * are present" (a `cloud` block). A live root keeps no state to store, since
+ * prior state is a projection rebuilt from the live system every run, so
+ * either block is a contradiction about where the truth lives, not a
+ * redundant setting.
+ *
+ * TF001 is the equivalent check for a stock root (no remote backend is
+ * configured); it explicitly does not fire on a live root, and this check is
+ * why: the two are mutually exclusive by construction; a root is flagged by
+ * at most one of them.
+ *
+ * Scope: root modules only (#2112). A child module's backend or cloud block
+ * is TF015's finding, whatever binary the root runs.
+ *
+ * One diagnostic per root, fired from the root's `terraform` block.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf024: PostSynthCheck;
+//# sourceMappingURL=tf024.d.ts.map

package/dist/lint/post-synth/tf024.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf024.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf024.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}

package/dist/lint/post-synth/tf025.d.ts

@@ -0,0 +1,29 @@
+/**
+ * TF025: a live root reads a non-default `terraform.workspace`, or configures
+ * one through `terraform.roots`.
+ *
+ * choudoufu refuses any workspace but `default` on a live root, and refuses
+ * `workspace new`/`workspace select` outright: only the default workspace
+ * exists there ("How you run it" in choudoufu's compatibility reference).
+ * Two independent ways a configuration ends up asking for one:
+ *
+ *   - `terraform.roots.<name>.workspace` in `chant.config.*` selects a
+ *     workspace via `TF_WORKSPACE` before any HCL is even read, chant's own
+ *     equivalent of `workspace select`, so it is flagged the same way.
+ *   - A `"${terraform.workspace}"` interpolation anywhere in a block's body
+ *     reads the (necessarily `"default"`) workspace name in configuration,
+ *     which is not itself refused by choudoufu but is dead code on a live
+ *     root and a sign the configuration was written for a workspace-per-
+ *     environment layout that live mode does not support.
+ *
+ * The first fires once per root (it names a root-level config field, not a
+ * particular block); the second fires once per block that contains the
+ * reference, since each is its own thing to fix.
+ *
+ * Scope: the config half is root-only, since it reads a root-level config
+ * field; the reference half reads any block of a live root, a descended child
+ * module's included, and names the call chain that reached it (#2112).
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf025: PostSynthCheck;
+//# sourceMappingURL=tf025.d.ts.map

package/dist/lint/post-synth/tf025.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf025.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf025.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAY1C,eAAO,MAAM,KAAK,EAAE,cAyDnB,CAAC"}

package/dist/lint/post-synth/tf026.d.ts

@@ -0,0 +1,28 @@
+/**
+ * TF026: a live root declares `delete: "never"` but its `policy` block still
+ * deletes an orphaned marked resource.
+ *
+ * chant's cross-lexicon delete-mode vocabulary (`terraform.roots.<name>.delete`,
+ * `../../config.ts`'s `TerraformDeleteMode`) maps onto choudoufu's `policy`
+ * block: `undeclared_tagged` governs what happens to a resource this estate
+ * marked that the configuration no longer declares, and defaults to
+ * `"delete"` when the `policy` block omits it, or the root declares no
+ * `policy` block at all. `delete: "never"` promises that `TerraformApplyOp`
+ * never proposes deleting a resource it owns, so a root making that promise
+ * has to have actually turned the quadrant's default off — `"keep"`,
+ * `"untag"` or `"report"` all satisfy it; anything else (the unset default,
+ * or an explicit `"delete"`) does not.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity —
+ * the same entity TF024 and TF025 fire from.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { type BlockBody } from "../../hcl/parse.js";
+/**
+ * The `policy { }` block nested in a `live { }` block's body, hcl2json's own
+ * "one block, wrapped in an array" shape. Exported for TF027 (`./tf027.ts`),
+ * which reads the other quadrant of the same block.
+ */
+export declare function policyBlockOf(liveBody: BlockBody): BlockBody | undefined;
+export declare const tf026: PostSynthCheck;
+//# sourceMappingURL=tf026.d.ts.map

package/dist/lint/post-synth/tf026.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf026.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf026.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAK5D;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAKxE;AAED,eAAO,MAAM,KAAK,EAAE,cAyCnB,CAAC"}

package/dist/lint/post-synth/tf027.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TF027: a live root's `policy` block sets `undeclared_untagged = "delete"`.
+ *
+ * The `undeclared_untagged` quadrant covers a live resource this estate never
+ * marked and the configuration does not declare, a resource chant does not
+ * own. `"delete"` there is account-scoped reconciliation: choudoufu compares
+ * the configuration against everything a `scope` block reaches and removes
+ * what is not in it. chant never proposes deleting a resource it does not
+ * own, and neither does an Op it generates, so the setting is refused on any
+ * live root the project builds, scoped or not. Narrowing the estate's own
+ * ownership answer (`undeclared_tagged`, which TF026 checks against
+ * `delete: "never"`) is the setting to reach for instead.
+ *
+ * `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`) makes the
+ * same refusal when it builds, but only for a project on a `chant.config.json`
+ * whose root it can resolve synchronously (#2216): a `chant.config.ts` is
+ * project-authored code that `resolveRootModeSync` will not evaluate, so the
+ * composite reads the root as stock and never asks the policy question. This
+ * check reads `props.mode` off the parsed HCL instead, which the build stamps
+ * on every entity whatever the config file is written in, so it is the
+ * refusal that actually fires. It also fires for a live root with no apply Op
+ * at all, since the setting is a statement about the estate rather than about
+ * one Op.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity,
+ * the same entity TF024, TF025 and TF026 fire from.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf027: PostSynthCheck;
+//# sourceMappingURL=tf027.d.ts.map

package/dist/lint/post-synth/tf027.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf027.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf027.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cAoCnB,CAAC"}

package/dist/lint/post-synth/tf028.d.ts

@@ -0,0 +1,33 @@
+/**
+ * TF028: a live root is watched by a `TerraformWatchOp` built in stock mode.
+ *
+ * `TerraformWatchOp`'s `live` flag is declared, not detected: a composite is
+ * built by `chant build` without reading a root module's `.tf` files, so the
+ * Op author says which shape the Plan phase takes and, until #2216, nothing
+ * checked the answer against the root. Leaving it off a live root is silent
+ * and lossy. `live: true` swaps the Plan step for `choudoufuLivePlan`, whose
+ * single read of the live system answers three questions (drift, how many
+ * live resources sit at a declared identity carrying no marker, and how many
+ * of those an exact content match makes claimable); a stock `terraformPlan`
+ * step answers the first alone, so the watch reports drift and stays quiet
+ * about every unowned and adoptable resource in the estate.
+ *
+ * The check runs over the whole built graph because that is where both halves
+ * of the question are: the root's mode is stamped on every parsed entity by
+ * the build (`props.mode`, #2103), and the Op is a `Chant::Op` entity carrying
+ * the composite's own labels. `TerraformWatchOp` itself cross-checks the flag
+ * where it can (`../../op/resolve-root-mode.ts`), but that read is a
+ * `chant.config.json`-only one, so on a `chant.config.ts` project, which is
+ * every project in this repository, this check is what actually fires.
+ *
+ * Read off the labels the composite stamps rather than off the emitted step,
+ * since a stock `terraformPlan -out` step against a live root is correct in
+ * `TerraformApplyOp`: choudoufu v0.13.0 accepts `plan -out` and re-plans
+ * against the file at apply (#2157), so the apply Op builds one shape for
+ * both kinds of root and the step alone says nothing about a mistake.
+ *
+ * One diagnostic per Op, fired from the Op's entity.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf028: PostSynthCheck;
+//# sourceMappingURL=tf028.d.ts.map

package/dist/lint/post-synth/tf028.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf028.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf028.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAuB1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}

package/dist/lint/rules/fixtures/load.d.ts

@@ -0,0 +1,13 @@
+import type { LintContext } from "@intentius/chant/lint/rule";
+/**
+ * Parse `fixtures/<ruleId>/<name>-op.ts` into a {@link LintContext} whose
+ * `filePath` is the logical `<name>.op.ts` a real Op file would carry.
+ *
+ * Three lines per fixture in a test:
+ * ```ts
+ * const diags = planBeforeApplyRule.check(loadRuleFixture("TF101", "positive"));
+ * expect(diags).toHaveLength(1);
+ * ```
+ */
+export declare function loadRuleFixture(ruleId: string, name: string): LintContext;
+//# sourceMappingURL=load.d.ts.map

package/dist/lint/rules/fixtures/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/fixtures/load.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAI9D;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAMzE"}