@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/dist/lint/rules/plan-before-apply.d.ts

@@ -25,6 +25,17 @@ import type { LintRule } from "@intentius/chant/lint/rule";
  * silent — the same deliberately shallow "bail rather than guess" posture
  * `validateStepOutputRefs` takes, since the runtime brand on a real
  * `StepOutputRef` is invisible to a source-level AST match.
+ *
+ * Fires on every `terraformApply` call, live root or stock. #2106 exempted
+ * live roots for one release, because choudoufu refused `-out` and
+ * `apply <planfile>` and the activity ran a bare `apply -auto-approve` with no
+ * plan file to pair. choudoufu v0.13.0 admits both under a `live` block
+ * ([choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878)), and
+ * there the pairing matters more than on a stock root, not less: the apply
+ * re-plans the live system and compares its fresh plan against the file it was
+ * handed, so a plan file spelled out as a literal is an approval for a run
+ * nobody can trace back to a plan step. The exemption is gone with the
+ * condition that produced it, and this rule reads no project config at all.
  */
 export declare const planBeforeApplyRule: LintRule;
 //# sourceMappingURL=plan-before-apply.d.ts.map

package/dist/lint/rules/plan-before-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-before-apply.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/plan-before-apply.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAgHjC,CAAC"}
+{"version":3,"file":"plan-before-apply.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/plan-before-apply.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAgHjC,CAAC"}

package/dist/lint/secret-shape.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The two heuristics the secrets rules of the TF family share: does this
+ * attribute's NAME read like a credential, and does its VALUE look like one.
+ *
+ * tfsec shipped `general-secrets-sensitive-in-variable`,
+ * `-in-local` and `-in-attribute`, and trivy dropped all three when it
+ * absorbed tfsec, so no maintained tool checks them today (#2107's survey).
+ * TF007, TF008, TF009 and TF022 are chant's versions, and they only stay
+ * consistent with each other if "secret-shaped" means one thing. That is what
+ * this module is.
+ *
+ * Nothing here re-implements a detector `packages/core/src/audit/secrets.ts`
+ * already has. The value heuristic runs a candidate through `scanForSecrets`
+ * first, so every vendor prefix the SEC family knows (AWS key ids, GitHub,
+ * Slack, Google, Stripe), the PEM block shape and the connection-string shape
+ * are recognised here for free, and it reuses that module's placeholder
+ * vocabulary, its identifier-slug filter and its entropy function. What it
+ * adds is what a Terraform attribute needs and a raw text scan does not: the
+ * JWT and bare PEM-header shapes, and a lower length floor than SEC010's 24
+ * characters, because an attribute value is already a single token rather
+ * than a line of prose to fish tokens out of.
+ */
+/** Minimum length for a value to be worth judging at all. */
+export declare const MIN_SECRET_LENGTH = 8;
+/**
+ * Does this attribute or variable name read like a credential? Case-insensitive
+ * and word-bounded, with the locator suffixes excluded.
+ */
+export declare function isSecretName(name: string): boolean;
+/**
+ * Is this a plain string literal, as opposed to an expression? `hcl2json`
+ * renders every expression as a `"${...}"` template, so a value carrying one
+ * is a reference (`var.db_password`, `data.aws_secretsmanager_secret_version.x.secret_string`)
+ * or an interpolation, never a committed constant. Those are the fix, not the
+ * finding.
+ */
+export declare function isLiteralString(value: unknown): value is string;
+/**
+ * A placeholder rather than a credential. Core's list is checked twice: once
+ * as written, once with separators stripped, so the `CHANGE_ME` and
+ * `YOUR_API_KEY` spellings land on the same `changeme` / `your-api-key`
+ * entries as the unseparated ones.
+ */
+export declare function isPlaceholderValue(value: string): boolean;
+/**
+ * Does this value look like a live credential on its own, whatever it is
+ * called? A known vendor shape (through core's detectors), a JWT, a PEM key,
+ * or a high-entropy token.
+ */
+export declare function isCredentialShapedValue(value: unknown): boolean;
+/** Which heuristic fired, so a diagnostic can say why it is complaining. */
+export type SecretShapeReason = "name" | "value";
+export interface SecretShape {
+    reason: SecretShapeReason;
+    /** The value's length, for a message that never quotes the value itself. */
+    length: number;
+}
+/**
+ * The combined test the rules use: is `value`, assigned to an attribute called
+ * `name`, a committed secret? Either heuristic is enough, but both sides of the
+ * gate are the same, since the value has to be a literal, long enough to be a
+ * credential, and not a placeholder, so `sensitive = true`-style
+ * remediation advice is never given for `password = "changeme"`.
+ *
+ * Findings never carry the value. Callers get the reason and the length.
+ */
+export declare function secretShapedAssignment(name: string, value: unknown): SecretShape | undefined;
+//# sourceMappingURL=secret-shape.d.ts.map

package/dist/lint/secret-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-shape.d.ts","sourceRoot":"","sources":["../../src/lint/secret-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAyBH,6DAA6D;AAC7D,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAmBnC;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIlD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE/D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEzD;AAqBD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU/D;AAED,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAO5F"}

package/dist/live-ownership.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The live root's ownership channel (#2104): choudoufu's two marker tags.
+ *
+ * Sibling of `./state-ownership.ts`, and here for the same mechanical reason:
+ * `plugin.ts` declares `ownershipChannel` eagerly while `describeResources`
+ * is behind a dynamic import, so the key names cannot live in the reader
+ * without dragging the reader, and `node:child_process` with it, into every
+ * plugin load.
+ *
+ * ## Why the keys are declared and the verdicts are set by hand
+ *
+ * The issue that added this asked which of two ways to go: widen core's
+ * `OwnershipChannel` so a lexicon can supply its own classifier, or declare
+ * the keys for discoverability and set the verdicts in the reader, the way
+ * `lexicons/fly/src/ownership.ts` does for its two tiers. The second, and the
+ * reason is that the first buys nothing.
+ *
+ * Core's `classifyOwnership` tests one thing: does `tags[keys.managedBy]`
+ * equal the literal `"chant"`. Nothing in core ever calls it on a lexicon's
+ * behalf. `packages/core/src/ownership.ts` exports it, every lexicon calls it
+ * itself where the test happens to fit, and the ones it does not fit, fly's
+ * app boundary and aws's stack tags, already set verdicts directly. Adding a
+ * `classify` member to `OwnershipChannel` would give core a field only this
+ * lexicon passes and only this lexicon reads back, which is a longer way of
+ * writing the function `./describe-resources.ts` already has.
+ *
+ * What the declaration is still for is the claim it makes. Declaring
+ * `describeResources` on the channel is what turns the observation
+ * conformance suite's ownership assertion from a shape check into a
+ * behavioural one, and that claim holds on a live root exactly as it does on
+ * a stock one, from a different reading. The suite runs for both modes in
+ * `./describe-resources.test.ts`.
+ *
+ * ## The keys, and the slot that does not fit
+ *
+ * `ChannelKeys` is a managed-by / stack / env triple, because everywhere else
+ * chant stamps three tags. choudoufu's marker is two tags and no managed-by
+ * key at all: per `live/MARKERS.md`'s "Ownership semantics", a resource
+ * carrying `tofu-estate` belongs to that estate and there is no secondary
+ * check, so `tofu-estate` is both the managed-by claim and the stack
+ * identity. `tofu-address` takes the third slot because it is the marker's
+ * other half, not because it is an environment: a choudoufu marker has no
+ * environment in it, which is why `ResourceMetadata.marker` on a live read
+ * carries the estate as its `stack` and leaves `env` absent rather than
+ * filling it with an address.
+ */
+import type { ChannelKeys } from "@intentius/chant/ownership";
+/**
+ * The two tag keys `live/MARKERS.md` spec version 1 defines, named here so a
+ * reader of the plugin can see what a live root's verdict is read from.
+ * `./hcl/marker.ts` holds the constants the reader itself uses, along with
+ * the escaping and the ownership semantics that go with them.
+ */
+export declare const TERRAFORM_LIVE_MARKER_KEYS: ChannelKeys;
+//# sourceMappingURL=live-ownership.d.ts.map

package/dist/live-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-ownership.d.ts","sourceRoot":"","sources":["../src/live-ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,WAIxC,CAAC"}

package/dist/lsp/option-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAKtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAItC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}
+{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAMtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/okf/index.md

@@ -5,4 +5,30 @@ okf_version: '0.2'
 # Rules
 
 * [TF001](/rules/TF001.md) - Root module declares no remote backend
+* [TF002](/rules/TF002.md) - A provider the root implies has no required_providers entry, or an incomplete one
+* [TF003](/rules/TF003.md) - Root module's terraform block has no required_version
+* [TF004](/rules/TF004.md) - Registry-sourced module block has no version
+* [TF005](/rules/TF005.md) - Git/hg module source is unpinned, or pinned to a mutable ref
+* [TF006](/rules/TF006.md) - Sensitive variable declares a default value
+* [TF007](/rules/TF007.md) - Secret-shaped literal in a variable default or a locals value
+* [TF008](/rules/TF008.md) - Provider block configures a hardcoded credential
+* [TF009](/rules/TF009.md) - Credential-named variable is not marked sensitive
+* [TF010](/rules/TF010.md) - Variable declares no type constraint
+* [TF011](/rules/TF011.md) - Variable declares no description
+* [TF012](/rules/TF012.md) - Output declares no description
+* [TF013](/rules/TF013.md) - lifecycle ignore_changes is set to all
+* [TF014](/rules/TF014.md) - Child module configures a provider block
+* [TF015](/rules/TF015.md) - Child module declares a backend or cloud block
+* [TF016](/rules/TF016.md) - Attribute value is a quoted interpolation of a single expression
+* [TF017](/rules/TF017.md) - Module block uses depends_on
+* [TF018](/rules/TF018.md) - Output value is a whole resource or data source
+* [TF019](/rules/TF019.md) - Meta-argument explicitly set to its default of false
+* [TF020](/rules/TF020.md) - Declaration is never referenced in its module scope
+* [TF021](/rules/TF021.md) - count builds instance identities from count.index where for_each is safer
+* [TF022](/rules/TF022.md) - Credential-named resource attribute holds a plaintext literal
+* [TF024](/rules/TF024.md) - Live root declares a backend or cloud block, which choudoufu refuses
+* [TF025](/rules/TF025.md) - Live root references a non-default terraform.workspace, which choudoufu refuses
+* [TF026](/rules/TF026.md) - Live root declares delete: "never" but its policy leaves undeclared_tagged at "delete"
+* [TF027](/rules/TF027.md) - Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own
+* [TF028](/rules/TF028.md) - A live root is watched by a TerraformWatchOp built without live: true
 * [TF101](/rules/TF101.md) - terraformApply's planFile must reference a preceding terraformPlan step.

package/dist/okf/rules/TF002.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF002
+description: A provider the root implies has no required_providers entry, or an incomplete one
+id: TF002
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+A provider the root implies has no required_providers entry, or an incomplete one

package/dist/okf/rules/TF003.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF003
+description: Root module's terraform block has no required_version
+id: TF003
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Root module's terraform block has no required_version

package/dist/okf/rules/TF004.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF004
+description: Registry-sourced module block has no version
+id: TF004
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Registry-sourced module block has no version

package/dist/okf/rules/TF005.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF005
+description: Git/hg module source is unpinned, or pinned to a mutable ref
+id: TF005
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Git/hg module source is unpinned, or pinned to a mutable ref

package/dist/okf/rules/TF006.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF006
+description: Sensitive variable declares a default value
+id: TF006
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Sensitive variable declares a default value

package/dist/okf/rules/TF007.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF007
+description: Secret-shaped literal in a variable default or a locals value
+id: TF007
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Secret-shaped literal in a variable default or a locals value

package/dist/okf/rules/TF008.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF008
+description: Provider block configures a hardcoded credential
+id: TF008
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Provider block configures a hardcoded credential

package/dist/okf/rules/TF009.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF009
+description: Credential-named variable is not marked sensitive
+id: TF009
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Credential-named variable is not marked sensitive

package/dist/okf/rules/TF010.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF010
+description: Variable declares no type constraint
+id: TF010
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Variable declares no type constraint

package/dist/okf/rules/TF011.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF011
+description: Variable declares no description
+id: TF011
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Variable declares no description

package/dist/okf/rules/TF012.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF012
+description: Output declares no description
+id: TF012
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Output declares no description

package/dist/okf/rules/TF013.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF013
+description: lifecycle ignore_changes is set to all
+id: TF013
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+lifecycle ignore_changes is set to all

package/dist/okf/rules/TF014.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF014
+description: Child module configures a provider block
+id: TF014
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Child module configures a provider block

package/dist/okf/rules/TF015.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF015
+description: Child module declares a backend or cloud block
+id: TF015
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Child module declares a backend or cloud block

package/dist/okf/rules/TF016.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF016
+description: Attribute value is a quoted interpolation of a single expression
+id: TF016
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Attribute value is a quoted interpolation of a single expression

package/dist/okf/rules/TF017.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF017
+description: Module block uses depends_on
+id: TF017
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Module block uses depends_on

package/dist/okf/rules/TF018.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF018
+description: Output value is a whole resource or data source
+id: TF018
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Output value is a whole resource or data source

package/dist/okf/rules/TF019.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF019
+description: Meta-argument explicitly set to its default of false
+id: TF019
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Meta-argument explicitly set to its default of false

package/dist/okf/rules/TF020.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF020
+description: Declaration is never referenced in its module scope
+id: TF020
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Declaration is never referenced in its module scope

package/dist/okf/rules/TF021.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF021
+description: count builds instance identities from count.index where for_each is safer
+id: TF021
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+count builds instance identities from count.index where for_each is safer

package/dist/okf/rules/TF022.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF022
+description: Credential-named resource attribute holds a plaintext literal
+id: TF022
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Credential-named resource attribute holds a plaintext literal

package/dist/okf/rules/TF024.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF024
+description: Live root declares a backend or cloud block, which choudoufu refuses
+id: TF024
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root declares a backend or cloud block, which choudoufu refuses

package/dist/okf/rules/TF025.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF025
+description: Live root references a non-default terraform.workspace, which choudoufu refuses
+id: TF025
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root references a non-default terraform.workspace, which choudoufu refuses

package/dist/okf/rules/TF026.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF026
+description: 'Live root declares delete: "never" but its policy leaves undeclared_tagged at "delete"'
+id: TF026
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root declares delete: "never" but its policy leaves undeclared_tagged at "delete"

package/dist/okf/rules/TF027.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF027
+description: Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own
+id: TF027
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own

package/dist/okf/rules/TF028.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF028
+description: 'A live root is watched by a TerraformWatchOp built without live: true'
+id: TF028
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+A live root is watched by a TerraformWatchOp built without live: true

package/dist/op/activities/index.d.ts

@@ -8,15 +8,22 @@
  *   - terraformInit — `init` with the root's `backendConfig`.
  *   - terraformPlan — `plan -detailed-exitcode -out=<planFile>`, plus both
  *     `show` renders of the written plan.
- *   - terraformApply — `apply <planFile>`, a saved plan only.
+ *   - terraformApply: `apply <planFile>` on a stock root, a saved plan only;
+ *     `apply -auto-approve` with no plan file on a live root (#2103).
  *   - terraformShow — state, or a saved plan, as JSON and as text.
+ *   - choudoufuLivePlan: `live-plan -detailed-exitcode -json -estate=<estate>`,
+ *     plus a second `live-plan` for the human render (#2103).
+ *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
+ *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
+ *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
  *
  * The module is dependency-light on purpose: it shells out to the configured
  * binary and reads the `terraform` config namespace, and never touches the
- * lexicon's HCL parse or serializer, so a Temporal worker loads it cheaply.
- * The pure command and environment builders are exported alongside the
- * activities because they are what the tests assert on.
+ * lexicon's HCL parse or serializer, so `loadActivities` imports it cheaply at
+ * run time. The pure command and environment builders are exported alongside
+ * the activities because they are what the tests assert on.
  */
-export { terraformInit, terraformPlan, terraformApply, terraformShow, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, terraformEnvironment, terraformBinary, countPlanChanges, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, } from "./terraform.js";
-export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformShowResult, PlanChangeCounts, } from "./terraform.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
+export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformApprovalRefusal, TerraformShowResult, ChoudoufuLivePlanResult, ChoudoufuLiveLsResult, ChoudoufuLiveCheckResult, ChoudoufuAdoptResult, AdoptionRefusal, PlanChangeCounts, LivePlanUnownedCounts, } from "./terraform.js";
+export { detectLiveEstate } from "./live-detect.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC"}

package/dist/op/activities/live-detect.d.ts

@@ -0,0 +1,51 @@
+/**
+ * A fast, regex-based read of whether a root module directory declares a
+ * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
+ * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ *
+ * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
+ * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
+ * `op/activities/terraform.ts` is imported by core's activity registry at run
+ * time and is dependency-light on purpose, since it shells out to the
+ * configured binary and never touches the lexicon's HCL parse or serializer,
+ * so it never pulls in
+ * the ~1.8 MB `@cdktf/hcl2json` wasm parser just to decide whether an apply
+ * should run `apply -auto-approve` with no plan file. Plain text and a
+ * hand-rolled brace counter are enough for that narrower question, and the
+ * literal sidecar filename below is kept in sync with `LIVE_SIDECAR_FILENAME`
+ * in `../../hcl/parse.ts` by hand rather than by importing it, for the same
+ * reason.
+ */
+/**
+ * The declared estate name for the root module directory `dir`, or
+ * `undefined` when none is declared. Checks the `estate.chdf.hcl` sidecar
+ * first (cheaper: one file, no brace matching), then every `.tf` file in
+ * directory order for a `live { }` block nested in a `terraform { }` block.
+ * Returns the first estate name found; a directory with no `.tf` files and
+ * no sidecar (or one this function cannot read) yields `undefined` rather
+ * than throwing, since this is a best-effort check, not the authoritative parse.
+ */
+export declare function detectLiveEstate(dir: string): string | undefined;
+/**
+ * The `undeclared_tagged`/`undeclared_untagged` verbs a live root's `policy {
+ * }` block assigns, or `undefined` when the directory declares no `policy`
+ * block at all (#2106). Same best-effort posture as {@link detectLiveEstate}:
+ * a plain read of the in-block form only (the `estate.chdf.hcl` sidecar's own
+ * `policy` block, if choudoufu ever admits one there, is not read here — a
+ * known, narrower gap than the estate check above, which does read the
+ * sidecar). `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`)
+ * uses this to refuse a root whose `policy` sets
+ * `undeclared_untagged = "delete"` outright, at build time, before any
+ * activity runs; TF026 (`../../lint/post-synth/tf026.ts`) checks the same
+ * block's `undeclared_tagged` verb against a root's declared `delete: "never"`
+ * from the parsed HCL entities instead, since a post-synth check already has
+ * the block body in hand and has no need of this file-reading version.
+ */
+export interface LivePolicyVerbs {
+    /** The `undeclared_tagged` quadrant's verb, verbatim, or `undefined` when the attribute is absent (defaults to `"delete"`). */
+    undeclaredTagged?: string;
+    /** The `undeclared_untagged` quadrant's verb, verbatim, or `undefined` when the attribute is absent. */
+    undeclaredUntagged?: string;
+}
+export declare function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined;
+//# sourceMappingURL=live-detect.d.ts.map

package/dist/op/activities/live-detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-detect.d.ts","sourceRoot":"","sources":["../../../src/op/activities/live-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA6CH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoChE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,+HAA+H;IAC/H,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CA8B9E"}