@intentius/chant-lexicon-terraform 0.57.0

package/dist/hcl/parse.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The one shared HCL parse for the terraform lexicon.
+ *
+ * Two entry points, one entity shape. `parseTerraformRootDir` reads the `.tf`
+ * files of a directory (non-recursive, matching Terraform's own module
+ * scoping) and is what `buildRoots()` calls. `parseTerraformRootContent` takes
+ * the joined-file string `chant audit` hands a lexicon for a discovered root
+ * module: every `.tf` in filename order behind a `# file: <name>` line comment.
+ * Both funnel through `blocksToEntities`, so an entity the audit path sees is
+ * the entity the build path sees.
+ *
+ * Core owns the parser glue: `loadHcl2json()` lazy-loads `@cdktf/hcl2json`
+ * (a ~1.8 MB wasm blob) and raises a one-line install hint when it is absent.
+ * `parseTerraformDir()` next to it is NOT reused: it returns carve's `TfGraph`,
+ * a scoring-and-excision shape with no room for the per-block bodies a
+ * serializer and the post-synth checks read. The import path is the wildcard
+ * core's exports map already carries (`"./*"` to `./src/*.ts`), so nothing
+ * changed in `packages/core/package.json` for this.
+ */
+import { type Hcl2Json } from "@intentius/chant/terraform/parse";
+import { type Declarable } from "@intentius/chant/declarable";
+/** A parsed HCL block body, as `@cdktf/hcl2json` encodes it. */
+export type BlockBody = Record<string, unknown>;
+/** The entity every block becomes. `props` is what post-synth checks read. */
+export interface TerraformEntity extends Declarable {
+    readonly lexicon: "terraform";
+    readonly kind: "resource";
+    readonly props: {
+        /** Terraform address, e.g. `aws_s3_bucket.assets`, `var.region`, `module.cdn`. */
+        readonly address: string;
+        /** The block body, verbatim from hcl2json (interpolations survive as `"${...}"`). */
+        readonly body: BlockBody;
+        /** File the block came from, as named by the parse input. */
+        readonly file: string;
+        /** Configured root name this block belongs to. */
+        readonly root: string;
+    };
+}
+/** `entityType` per block kind. */
+export declare const TERRAFORM_TYPE = "Terraform::Terraform";
+export declare const PROVIDER_TYPE = "Terraform::Provider";
+export declare const RESOURCE_TYPE = "Terraform::Resource";
+export declare const DATA_TYPE = "Terraform::Data";
+export declare const MODULE_TYPE = "Terraform::Module";
+export declare const VARIABLE_TYPE = "Terraform::Variable";
+export declare const OUTPUT_TYPE = "Terraform::Output";
+export declare const LOCALS_TYPE = "Terraform::Locals";
+/**
+ * Build one entity. Written out rather than run through `createResource`
+ * from `@intentius/chant/runtime`: that factory is for generated resource
+ * classes and hides `props` behind a non-enumerable descriptor plus an
+ * `attrMap` of `AttrRef`s this lexicon has nothing to put in. The literal
+ * carries the same marker, so `isDeclarable()` and `isResourceDeclarable()`
+ * both hold.
+ */
+export declare function terraformEntity(entityType: string, address: string, body: BlockBody, file: string, root: string): TerraformEntity;
+/** One `.tf` file's name and source. */
+export interface TerraformFile {
+    name: string;
+    source: string;
+}
+/**
+ * Split the joined form back into files. A string with no marker at all is one
+ * anonymous file, so a caller that hands over a single `.tf` still parses.
+ */
+export declare function splitBundleContent(content: string, fallbackName?: string): TerraformFile[];
+/** Every `.tf` directly under `dir`, in filename order. Non-recursive. */
+export declare function listTerraformFiles(dir: string): string[];
+/**
+ * Parse a set of files into entities keyed `<root>/<address>`. Two blocks that
+ * genuinely share an address (two `locals` blocks, or the same address in two
+ * files of one root) are numbered `~2`, `~3` rather than overwriting.
+ */
+export declare function blocksToEntities(files: readonly TerraformFile[], root: string, hcl2json?: Hcl2Json): Promise<Map<string, Declarable>>;
+/**
+ * Parse a root module directory. Reads every `.tf` directly under `dir`.
+ * Throws whatever the parser throws for malformed HCL; `buildRoots()` is where
+ * that becomes a warning.
+ */
+export declare function parseTerraformRootDir(dir: string, root: string, hcl2json?: Hcl2Json): Promise<Map<string, Declarable>>;
+/**
+ * Parse the joined-file string form `chant audit` produces for a discovered
+ * root module (`AuditInput.content`). Unwired for now: #2085's
+ * `auditEntities()` is what calls it.
+ */
+export declare function parseTerraformRootContent(content: string, root: string, hcl2json?: Hcl2Json): Promise<Map<string, Declarable>>;
+//# sourceMappingURL=parse.d.ts.map

package/dist/hcl/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEjF,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,kFAAkF;QAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,qFAAqF;QACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,6DAA6D;QAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,kDAAkD;QAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;CACH;AAED,mCAAmC;AACnC,eAAO,MAAM,cAAc,yBAAyB,CAAC;AACrD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,eAAe,CAQjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,SAAY,GAAG,aAAa,EAAE,CAiB7F;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAYD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAoElC;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAMlC;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAElC"}

package/dist/hcl/roots.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Terraform build roots.
+ *
+ * An estate that keeps its `.tf` tree has no typed chant source for it. What
+ * it can declare is the directory: each entry in `terraform.roots` names a
+ * root module that parses at build time into entities, so the blocks are
+ * serialized into the build output and seen by the post-synth checks. Same
+ * shape `lexicons/k8s/src/kustomize/root.ts` uses for kustomize overlays: the
+ * render lives here, the plugin's `buildRoots()` member stays thin.
+ *
+ * Unlike the kustomize renderer, a missing directory or a `.tf` the parser
+ * refuses is a warning and zero entities for that root, never a throw. Reading
+ * someone else's estate is the whole job here, and half of it parsing is more
+ * useful than none of it, especially when the audit path (#2085) walks
+ * repositories it did not write.
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { Hcl2Json } from "@intentius/chant/terraform/parse";
+import type { TerraformRootConfig } from "../config.js";
+export interface TerraformRootsResult {
+    entities: Map<string, Declarable>;
+    warnings: string[];
+}
+export interface RenderTerraformRootsOptions {
+    /** Directory the project config was loaded from; relative `dir` resolves against it. */
+    projectRoot: string;
+    /** `terraform.roots`: name to root-module config. */
+    roots: Readonly<Record<string, TerraformRootConfig>>;
+    /** Injectable parser (tests); defaults to core's lazy-loaded `@cdktf/hcl2json`. */
+    hcl2json?: Hcl2Json;
+}
+/**
+ * Parse each configured root into entities keyed `<root>/<address>`. Roots are
+ * visited in declaration order, and one root's failure never stops the next.
+ */
+export declare function renderTerraformRoots(opts: RenderTerraformRootsOptions): Promise<TerraformRootsResult>;
+//# sourceMappingURL=roots.d.ts.map

package/dist/hcl/roots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAsB/B"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { terraformPlugin } from "./plugin.js";
+export { terraformSerializer } from "./serializer.js";
+export { terraformConfigSchema, terraformRootSchema, type TerraformConfig, type TerraformRootConfig, type TerraformConfigNamespace, } from "./config.js";
+export { blocksToEntities, parseTerraformRootContent, parseTerraformRootDir, splitBundleContent, terraformEntity, DATA_TYPE, LOCALS_TYPE, MODULE_TYPE, OUTPUT_TYPE, PROVIDER_TYPE, RESOURCE_TYPE, TERRAFORM_TYPE, VARIABLE_TYPE, type BlockBody, type TerraformEntity, type TerraformFile, } from "./hcl/parse.js";
+export { renderTerraformRoots, type TerraformRootsResult } from "./hcl/roots.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow } from "./op/builders.js";
+export { TerraformApplyOp } from "./composites/terraform-apply-op.js";
+export type { TerraformApplyOpConfig, TerraformApplyOpResources, TerraformGateMode, } from "./composites/terraform-apply-op.js";
+export { TerraformWatchOp } from "./composites/terraform-watch-op.js";
+export type { TerraformWatchOpConfig, TerraformWatchOpResources, TerraformFindingMode, } from "./composites/terraform-watch-op.js";
+export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -0,0 +1,12 @@
+{
+  "algorithm": "sha256",
+  "artifacts": {
+    "manifest.json": "8f4e78f1493a0dce03ed3956c7e35bd59583b665839b1d854212ce492cf000de",
+    "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
+    "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
+    "rules/plan-before-apply.ts": "b902d738a9cd4596b569f66b404c8e0e8358e58749708e76eb2521c459fb2f47",
+    "rules/tf001.ts": "1000540a1d2958efbae3356b221934f4c7ee76e977704d0e793a9864fd2d2936",
+    "skills/chant-terraform.md": "37b719bc43242250d61b80a6ee5c91da8e0c67a959cc92e2c182e3951adb8912"
+  },
+  "composite": "a69f5327abd011e634c05a6b123cb9680268a127a7f07e29615204bf1277c319"
+}

package/dist/lint/audit-catalog.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The terraform lexicon's chant audit catalog: metadata for its post-synth
+ * checks, contributed through `terraformPlugin.auditCatalog()` (#687, #1346).
+ * Every post-synth check needs an entry or it contributes nothing to
+ * `chant audit`, silently, and `packages/core/src/audit/catalog.test.ts` fails.
+ *
+ * TF001 reads the chant model (`ctx.entities`), never emitted output, so
+ * `yamlBased` is false. Prior-art lineage lives in ./audit-lineage.ts.
+ */
+import type { RuleMeta } from "@intentius/chant/audit/catalog";
+export declare const terraformAuditCatalog: Record<string, RuleMeta>;
+//# sourceMappingURL=audit-catalog.d.ts.map

package/dist/lint/audit-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAI/D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAY1D,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Prior art for the terraform lexicon's audit rules: the open-source tools
+ * whose checks cover the same condition, credited per rule. See
+ * packages/core/src/audit/prior-art.ts for the registry, the relation
+ * vocabulary, and why this is credit rather than authority. Kept by hand; the
+ * prior-art sweep (scripts/prior-art-sweep.ts) reports when a credited tool's
+ * index no longer lists a rule cited here.
+ *
+ * TF001 (no remote backend) has no entry here. Checkov's `CKV_TF_*` family
+ * (checkov.io) has no rule for a missing backend block, and
+ * tflint-ruleset-terraform's own rule index
+ * (github.com/terraform-linters/tflint-ruleset-terraform/blob/main/docs/rules/README.md)
+ * has none either: its closest neighbors are `terraform_required_providers`
+ * (unconstrained provider versions, TF002's territory, not TF001's) and
+ * `terraform_workspace_remote` (a `terraform.workspace` compatibility check
+ * against remote execution, a different condition than "no backend is
+ * configured at all"). Ship with no lineage rather than invent a credit.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+export declare const terraformAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=audit-lineage.d.ts.map

package/dist/lint/audit-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAM,CAAC"}

package/dist/lint/post-synth/index.d.ts

@@ -0,0 +1,3 @@
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const postSynthChecks: PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/post-synth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAE3C,CAAC"}

package/dist/lint/post-synth/tf001.d.ts

@@ -0,0 +1,17 @@
+/**
+ * TF001: a root module keeps its state on local disk.
+ *
+ * A `terraform` block with no `backend "<type>"` and no `cloud {}` falls back
+ * to the local backend, which puts `terraform.tfstate` in the working
+ * directory. That file holds every attribute of every managed resource,
+ * secrets included, and it is not shared, not locked, and not versioned. The
+ * first apply from a second machine or a CI runner starts from an empty state
+ * and proposes to create the estate again.
+ *
+ * One diagnostic per root, fired from the root's `terraform` block. A root
+ * with no `terraform` block at all is not flagged: it declares no version
+ * constraints either, and the missing block is a different finding.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf001: PostSynthCheck;
+//# sourceMappingURL=tf001.d.ts.map

package/dist/lint/post-synth/tf001.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf001.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf001.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAY1C,eAAO,MAAM,KAAK,EAAE,cAkCnB,CAAC"}

package/dist/lint/rules/index.d.ts

@@ -0,0 +1,5 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+export { planBeforeApplyRule } from "./plan-before-apply.js";
+/** All lint rules provided by this lexicon (imported by plugin.ts's lintRules()). */
+export declare const rules: LintRule[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAG3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,qFAAqF;AACrF,eAAO,MAAM,KAAK,EAAE,QAAQ,EAA0B,CAAC"}

package/dist/lint/rules/plan-before-apply.d.ts

@@ -0,0 +1,30 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+/**
+ * TF101: terraformApply's planFile must reference a preceding terraformPlan step.
+ *
+ * Applying a plan file chosen by a string means the applied plan can be
+ * stale, hand-edited, or simply the wrong one — the entire point of the
+ * plan/apply split (review exactly what will change, then apply exactly
+ * that) is defeated the moment the path is spelled out in source instead of
+ * carried forward from the `terraformPlan` step that produced it.
+ *
+ * The two builders this rule is written against (`terraformPlan`,
+ * `terraformApply`) don't exist yet (#2086 ships them in parallel), so this
+ * matches purely on callee identifier name — same posture as
+ * `lexicons/k3s/src/lint/rules/token-literal.ts`.
+ *
+ * Accepts exactly the two authoring forms that produce a genuine step-output
+ * reference (`packages/core/src/op/step-output-ref.ts`):
+ *   - `stepOutput(<ident>, "planFile")`
+ *   - `<ident>.out.planFile`
+ * where `<ident>` is bound (`const <ident> = terraformPlan(...)`) in the same
+ * file. Flags a string literal, a template literal, or one of the two
+ * accepted reference forms pointing at an identifier that resolves to
+ * something other than a `terraformPlan` call. When `<ident>` cannot be
+ * resolved at all (not declared anywhere in the file), this rule stays
+ * silent — the same deliberately shallow "bail rather than guess" posture
+ * `validateStepOutputRefs` takes, since the runtime brand on a real
+ * `StepOutputRef` is invisible to a source-level AST match.
+ */
+export declare const planBeforeApplyRule: LintRule;
+//# sourceMappingURL=plan-before-apply.d.ts.map

package/dist/lint/rules/plan-before-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-before-apply.d.ts","sourceRoot":"","sources":["../../../src/lint/rules/plan-before-apply.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAA+B,MAAM,4BAA4B,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAgHjC,CAAC"}

package/dist/lsp/completions.d.ts

@@ -0,0 +1,26 @@
+/**
+ * LSP completions for the terraform lexicon (#2088).
+ *
+ * k3s's shape (a generated `LexiconIndex` over typed resource classes) does
+ * not fit here: terraform's declarables are lightweight per-HCL-block
+ * entities `buildRoots()` produces at build time, not authored TypeScript
+ * types — there is nothing to generate a completion index from. What an
+ * ops-only lexicon can honestly complete is the surface an `*.op.ts` author
+ * actually types:
+ *
+ *   - `terraform.roots` names, read from the reachable `chant.config.*` (see
+ *     `./context.ts`) — completed inside a root-name position, e.g.
+ *     `terraformPlan("` or `root: "`.
+ *   - the composite/builder option keys (`./option-keys.ts`) — completed
+ *     inside the relevant call's options object.
+ *
+ * Root names complete only when a `chant.config.*` is reachable from the
+ * document's own `uri` and declares at least one; there is no synchronous,
+ * safe way to evaluate `chant.config.ts` (project-authored code) from inside
+ * a completion request, so an unreachable config yields no root-name
+ * completions rather than a guessed one. Option keys need no config at all
+ * and complete unconditionally.
+ */
+import type { CompletionContext, CompletionItem } from "@intentius/chant/lsp/types";
+export declare function completions(ctx: CompletionContext): CompletionItem[];
+//# sourceMappingURL=completions.d.ts.map

package/dist/lsp/completions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completions.d.ts","sourceRoot":"","sources":["../../src/lsp/completions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AA4CpF,wBAAgB,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAgCpE"}

package/dist/lsp/context.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Shared parsing for the terraform LSP pair (#2088).
+ *
+ * There is no generated `LexiconIndex` here (see `completions.ts`'s module
+ * doc for why), so both providers work off two different sources instead:
+ *
+ *   - `terraform.roots`, read out of the project's `chant.config.{ts,json}`.
+ *     `chant.config.ts` is project-authored code (`config.ts`'s own doc:
+ *     "where it is evaluated is a security question"), and evaluating it is
+ *     an async, sandboxed operation — `loadChantConfigUpward` — while
+ *     `completionProvider`/`hoverProvider` are synchronous. So this reads the
+ *     file's *text* and extracts the `terraform.roots` object literal with a
+ *     small brace-matching scanner, never `eval`/`import()`. A shape the
+ *     scanner cannot follow (roots built by a loop, spread from a helper)
+ *     yields no roots rather than a wrong guess — the same "reachable or
+ *     nothing" rule the config-loading code documents elsewhere.
+ *   - the option keys a `*.op.ts` author types: `TerraformApplyOpConfig`
+ *     (`composites/terraform-apply-op.ts`) and the four builders' own opts
+ *     (`op/builders.ts`, `op/activities/terraform.ts`). Those are a fixed
+ *     table, not read from any file.
+ */
+export interface ResolvedTerraformRoot {
+    dir?: string;
+    workspace?: string;
+    varFiles?: string[];
+}
+/**
+ * `terraform.roots`, extracted from a `chant.config.ts`/`.json`'s raw text.
+ * Never executes the file. `format` distinguishes the two because JSON's
+ * `roots` value is already a plain object — no brace-matching needed.
+ */
+export declare function parseTerraformRoots(configText: string, format: "ts" | "json"): Record<string, ResolvedTerraformRoot> | undefined;
+/**
+ * `terraform.roots`, resolved from the project config reachable from the
+ * document at `uri`. `undefined` when `uri` is not a `file://` URI, no
+ * `chant.config.*` is reachable by walking up from it, or the namespace
+ * declares no roots — every case where root-name completion has nothing
+ * honest to offer, so callers fall back to the option-key completions
+ * instead of fabricating a root list.
+ */
+export declare function resolveRootsForUri(uri: string): Record<string, ResolvedTerraformRoot> | undefined;
+/** Content of the open document up to (and a little past) the cursor line, mirroring core's `lexiconCompletions`. */
+export declare function contentUpToCursor(content: string, line: number): string;
+/**
+ * The name of the call whose parenthesized argument list holds the innermost
+ * unmatched `{` before the cursor — `TerraformApplyOp({ ↵ name: "x", ↵ <cursor>`
+ * and `terraformPlan("app", { ↵ <cursor>` both resolve to their call name,
+ * regardless of which positional argument the object is.
+ */
+export declare function enclosingCallName(text: string): string | undefined;
+/**
+ * The key of the innermost enclosing object literal, regardless of what
+ * encloses *that* — `compensate: { <cursor>` resolves to `"compensate"` even
+ * though the whole thing sits inside `TerraformApplyOp({ ... })`'s own
+ * argument object, which `enclosingKeyPath` would refuse to walk through (a
+ * call anywhere in the chain ends it there).
+ */
+export declare function innermostObjectKey(text: string): string | undefined;
+/**
+ * The chain of object-literal keys enclosing the cursor, outermost first —
+ * `["terraform", "roots", "app"]` inside `terraform: { roots: { app: { <cursor>` —
+ * for the plain-object contexts (`chant.config.ts`) that `enclosingCallName`
+ * does not cover, since there is no call there at all. A brace with no `key:`
+ * before it (the module's own `export default {`) contributes nothing to the
+ * path rather than ending it — only a `(` anywhere in the chain does, since
+ * `chant.config.ts` builds one object literal and calling anything
+ * mid-declaration is not a shape this needs to follow.
+ */
+export declare function enclosingKeyPath(text: string): string[] | undefined;
+//# sourceMappingURL=context.d.ts.map

package/dist/lsp/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/lsp/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AA8JD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,IAAI,GAAG,MAAM,GACpB,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,CAoCnD;AA0BD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,CAWjG;AAID,qHAAqH;AACrH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAYlE;AASD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnE;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CASnE"}

package/dist/lsp/hover.d.ts

@@ -0,0 +1,12 @@
+/**
+ * LSP hover for the terraform lexicon (#2088). See `./completions.ts`'s
+ * module doc for why this reads `chant.config.*` as text rather than a
+ * generated index, and completes/documents the same two things: a
+ * `terraform.roots` name (when the word under the cursor is quoted next to
+ * it, so an ordinary identifier never gets mistaken for a root) and one of
+ * the composite/builder option keys (`./option-keys.ts`), the latter needing
+ * no reachable config at all.
+ */
+import type { HoverContext, HoverInfo } from "@intentius/chant/lsp/types";
+export declare function hover(ctx: HoverContext): HoverInfo | undefined;
+//# sourceMappingURL=hover.d.ts.map

package/dist/lsp/hover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hover.d.ts","sourceRoot":"","sources":["../../src/lsp/hover.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AA6B1E,wBAAgB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAI9D"}

package/dist/lsp/option-keys.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The option keys a `*.op.ts` or `chant.config.ts` author types against this
+ * lexicon's config schema (`../config.ts`), its composite
+ * (`../composites/terraform-apply-op.ts`) and its four builders
+ * (`../op/builders.ts`, `../op/activities/terraform.ts`). A fixed table, not
+ * read from any generated registry — there is no upstream schema here (see
+ * `plugin.ts`'s module doc), so this is the same set of fields those files
+ * already document in their own TSDoc, restated once for the editor.
+ */
+export interface OptionKey {
+    key: string;
+    detail: string;
+}
+/** `TerraformConfig`'s own top-level keys (`terraform: { <here> }`). */
+export declare const CONFIG_NAMESPACE_KEYS: OptionKey[];
+/** `TerraformRootConfig`'s keys — one entry of `terraform.roots.<name>: { <here> }`. */
+export declare const ROOT_ENTRY_KEYS: OptionKey[];
+/** `TerraformApplyOpConfig`'s keys (`TerraformApplyOp({ <here> })`). */
+export declare const APPLY_OP_KEYS: OptionKey[];
+/** `compensate`'s own shape when it is an object: `compensate: { <here> }`. */
+export declare const COMPENSATE_KEYS: OptionKey[];
+/** `terraformInit(root, { <here> })`'s opts — `TerraformInitArgs` minus `root`, plus step opts. */
+export declare const INIT_OPTS_KEYS: OptionKey[];
+/** `terraformPlan(root, { <here> })`'s opts — `TerraformPlanArgs` minus `root`, plus step opts. */
+export declare const PLAN_OPTS_KEYS: OptionKey[];
+/** `terraformApply(root, { <here> })`'s opts — `TerraformApplyArgs` minus `root`, plus step opts. */
+export declare const APPLY_OPTS_KEYS: OptionKey[];
+/** `terraformShow(root, { <here> })`'s opts — `TerraformShowArgs` minus `root`, plus step opts. */
+export declare const SHOW_OPTS_KEYS: OptionKey[];
+/** Every builder call name mapped to its opts table, for completion inside `(root, { <here> })`. */
+export declare const BUILDER_OPTS_BY_CALL: Record<string, OptionKey[]>;
+/** Every option key across every table, keyed by name, for hover lookup. Last writer wins on a name shared across tables (`cwd`, `planFile`) — the detail text is the same fact restated per activity, so any one of them is a correct hover. */
+export declare const ALL_OPTION_KEYS: Map<string, string>;
+//# sourceMappingURL=option-keys.d.ts.map

package/dist/lsp/option-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAKtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAItC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}

package/dist/manifest.json

@@ -0,0 +1,6 @@
+{
+  "name": "terraform",
+  "version": "0.57.0",
+  "chantVersion": ">=0.1.0",
+  "namespace": "Terraform"
+}

package/dist/meta.json

@@ -0,0 +1 @@
+{}

package/dist/okf/index.md

@@ -0,0 +1,8 @@
+---
+okf_version: '0.2'
+---
+
+# Rules
+
+* [TF001](/rules/TF001.md) - Root module declares no remote backend
+* [TF101](/rules/TF101.md) - terraformApply's planFile must reference a preceding terraformPlan step.

package/dist/okf/rules/TF001.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF001
+description: Root module declares no remote backend
+id: TF001
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Root module declares no remote backend

package/dist/okf/rules/TF101.md

@@ -0,0 +1,11 @@
+---
+type: lint-rule
+title: TF101
+description: terraformApply's planFile must reference a preceding terraformPlan step.
+id: TF101
+severity: error
+category: correctness
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+terraformApply's planFile must reference a preceding terraformPlan step.

package/dist/op/activities/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * terraform Op activities — resolved by the core activity registry when a
+ * project's `chant.config.ts` lists the `terraform` lexicon. `loadActivities`
+ * (`packages/core/src/op/activity-registry.ts`) imports
+ * `@intentius/chant-lexicon-terraform/op/activities` and keys every exported
+ * function by its name, so there is no plugin member to register:
+ *
+ *   - terraformInit — `init` with the root's `backendConfig`.
+ *   - terraformPlan — `plan -detailed-exitcode -out=<planFile>`, plus both
+ *     `show` renders of the written plan.
+ *   - terraformApply — `apply <planFile>`, a saved plan only.
+ *   - terraformShow — state, or a saved plan, as JSON and as text.
+ *
+ * The module is dependency-light on purpose: it shells out to the configured
+ * binary and reads the `terraform` config namespace, and never touches the
+ * lexicon's HCL parse or serializer, so a Temporal worker loads it cheaply.
+ * The pure command and environment builders are exported alongside the
+ * activities because they are what the tests assert on.
+ */
+export { terraformInit, terraformPlan, terraformApply, terraformShow, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, terraformEnvironment, terraformBinary, countPlanChanges, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, } from "./terraform.js";
+export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformShowResult, PlanChangeCounts, } from "./terraform.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,aAAa,CAAC"}