@intentius/chant-lexicon-terraform 0.58.0 → 0.60.0

package/README.md

@@ -51,3 +51,12 @@ just docs
 - `src/lint/rules/`, source-level lint rules
 - `src/lint/post-synth/`, checks over the parsed roots (TF001 and up)
 - `src/lsp/`, LSP completions and hover
+
+## Acceptance evidence
+
+Four `describe` blocks run this lexicon against a real `terraform`, `tofu` or
+`choudoufu` binary, and each of them skips rather than fails when its
+dependency is absent. `src/__fixtures__/ACCEPTANCE.md` records, per block,
+what it proves, what gates it, the command that runs it, and the last binary
+and emulator it passed against with the date. Two of the four have never
+passed against anything, and that file says so.

package/dist/composites/terraform-adopt-op.d.ts

@@ -82,7 +82,7 @@
  */
 import { OpResource } from "@intentius/chant/op";
 export interface TerraformAdoptOpConfig {
-    /** Op name (kebab-case). `signalName` defaults to `approve-<name>`. */
+    /** Op name (kebab-case). `gateName` defaults to `approve-<name>`. */
     name: string;
     /** Key into the project's `terraform.roots`. Must be a live root: choudoufu, with a declared estate. */
     root: string;
@@ -92,7 +92,12 @@ export interface TerraformAdoptOpConfig {
      * sidecar, which is the usual case.
      */
     estate?: string;
-    /** Gate signal name. Default: `approve-<name>`, as `TerraformApplyOp` does. */
+    /** The gate's name. Default: `approve-<name>`, as `TerraformApplyOp` does. */
+    gateName?: string;
+    /**
+     * @deprecated The gate's name was `signalName` through 0.58.0 and is
+     * `gateName` since #2202, matching `TerraformApplyOp`. Removed in 0.60.0.
+     */
     signalName?: string;
     /** How long a recorded pending gate stays valid, as a duration string. Default: core's own (48h). */
     gateTimeout?: string;

package/dist/composites/terraform-adopt-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAO5E,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAiE1F"}
+{"version":3,"file":"terraform-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAO5E,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAiE1F"}

package/dist/composites/terraform-apply-op.d.ts

@@ -84,7 +84,7 @@ import { OpResource } from "@intentius/chant/op";
  */
 export type TerraformGateMode = "on-destroy" | "always" | "never";
 export interface TerraformApplyOpConfig {
-    /** Op name (kebab-case). `signalName` defaults to `approve-<name>`. */
+    /** Op name (kebab-case). `gateName` defaults to `approve-<name>`. */
     name: string;
     /** Key into the project's `terraform.roots`. The root carries dir, workspace, var files and backend config. */
     root: string;
@@ -96,7 +96,13 @@ export interface TerraformApplyOpConfig {
      * same phase.
      */
     gate?: TerraformGateMode;
-    /** Gate signal name. Default: `approve-<name>`, as `ApplyOp` does. */
+    /** The gate's name. Default: `approve-<name>`, as `ApplyOp` does. */
+    gateName?: string;
+    /**
+     * @deprecated The gate's name was `signalName` through 0.58.0 and is
+     * `gateName` since #2202 (`gate` is taken here by {@link TerraformGateMode}).
+     * Still read; removed in 0.60.0.
+     */
     signalName?: string;
     /** How long a recorded pending gate stays valid, as a duration string. Default: core's own (48h). */
     gateTimeout?: string;

package/dist/composites/terraform-apply-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform-apply-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-apply-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAW5E;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAiG1F"}
+{"version":3,"file":"terraform-apply-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-apply-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAW5E;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CA2G1F"}

package/dist/composites/terraform-watch-op.d.ts

@@ -51,16 +51,20 @@
  *
  * ## Findings reuse `reconcilePr`
  *
- * `issue` and `pull-request` call core's `reconcilePr` activity, the one place
- * in chant that shells to `gh issue create` / `gh pr create`, rather than
- * growing a second copy of those calls here.
+ * `issue`, `comment` and `pull-request` call core's `reconcilePr` activity,
+ * the one place in chant that shells to `gh`, rather than growing a second
+ * copy of those calls here.
  * That activity built its own change-set summary and had no way to be handed
  * one, so #2087 added a single field to it (`ReconcilePrArgs.body`), which is
  * what carries the `-no-color` plan through. Note that the pull-request mode
  * of `reconcilePr` regenerates chant TypeScript via `chant import`; a
  * terraform-native regeneration of HCL from live state is #2089, so
  * `findingMode: "issue"` is the mode with an end-to-end answer and
- * `"pull-request"` opens a PR whose body is the plan. On a live root #2089's
+ * `"pull-request"` opens a PR whose body is the plan. `"comment"` (#2231) is
+ * the mode for the plan-on-pull-request shape: the plan is posted onto the
+ * pull request that triggered the run and re-edited there on the next push,
+ * which is where a reviewer is already looking. It needs that trigger; a run
+ * without one fails the Report step by name rather than posting elsewhere. On a live root #2089's
  * question has a different answer rather than a pending one, and it is not
  * regeneration: see `TerraformAdoptOp`.
  *
@@ -80,6 +84,13 @@
  * // one-shot, local executor: chant run app-watch
  * export const { op } = TerraformWatchOp({ name: "app-watch", root: "app" });
  *
+ * // the plan as a sticky comment on the pull request that triggered the run
+ * export const { op } = TerraformWatchOp({
+ *   name: "app-plan",
+ *   root: "app",
+ *   findingMode: "comment",
+ * });
+ *
  * // nightly, opening an issue when the plan is non-empty
  * export const { op } = TerraformWatchOp({
  *   name: "app-watch",
@@ -102,8 +113,14 @@ import { OpResource } from "@intentius/chant/op";
  * What to do with a non-empty plan. A subset of core's `OpFindingMode`
  * (`packages/core/src/lexicon.ts`): `merge-request` is GitLab's spelling of
  * `pull-request` and is produced by the CI generator, not chosen here.
+ *
+ * `comment` (#2231) is the mode a plan-on-pull-request Op wants: the plan
+ * lands as one comment on the pull request that triggered the run and the
+ * next push edits that same comment. It needs a `pull_request` trigger on the
+ * `ScheduledOpSpec` the workflow is generated from, and the github generator
+ * refuses it by name on any other trigger.
  */
-export type TerraformFindingMode = "report" | "issue" | "pull-request";
+export type TerraformFindingMode = "report" | "issue" | "comment" | "pull-request";
 export interface TerraformWatchOpConfig {
     /** Op name (kebab-case). */
     name: string;
@@ -129,8 +146,14 @@ export interface TerraformWatchOpConfig {
      * Declared here rather than detected, because a composite is built by
      * `chant build` without reading a root module's `.tf` files. The activities
      * detect the estate at run time (`op/activities/live-detect.ts`), but by then
-     * the phases are already serialized. Setting this on a stock root fails at
-     * the first step, with choudoufu's own reason.
+     * the phases are already serialized.
+     *
+     * Two things check the answer against the root's real mode, since a wrong
+     * one is otherwise silent (#2216). This function refuses a mismatch outright
+     * when it can resolve the mode synchronously, which is a
+     * `chant.config.json` project (`op/resolve-root-mode.ts`); TF028
+     * (`lint/post-synth/tf028.ts`) reports the same mismatch off the parsed HCL
+     * for every project, `chant.config.ts` included.
      */
     live?: boolean;
     /**

package/dist/composites/terraform-watch-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform-watch-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-watch-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAEH,OAAO,EAAa,UAAU,EAAqB,MAAM,qBAAqB,CAAC;AAQ/E;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAEvE,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;;;;;;;;OAUG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAmF1F"}
+{"version":3,"file":"terraform-watch-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-watch-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AAEH,OAAO,EAAa,UAAU,EAAqB,MAAM,qBAAqB,CAAC;AAS/E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,CAAC;AAEnF,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CA8G1F"}

package/dist/hcl/parse.d.ts

@@ -205,6 +205,20 @@ export declare function parseTerraformRootDir(dir: string, root: string, hcl2jso
  * the same way `parseTerraformRootDir`'s callers exercise it against files.
  */
 export declare function parseTerraformRootContent(content: string, root: string, hcl2json?: Hcl2Json, modeOptions?: TerraformRootModeOptions): Promise<Map<string, Declarable>>;
+/** The root name an audit of the audited directory itself parses under. */
+export declare const AUDIT_ROOT_NAME = "audit-root";
+/**
+ * The root name one `chant audit` input parses under (#2217).
+ *
+ * A build names its roots from `terraform.roots`; an audit has no such
+ * config, so the name comes from the input's own path, which is the one thing
+ * that tells two discovered roots apart. `envs/prod` becomes `envs.prod`,
+ * because an entity key is `<root>/<address>` with the module chain between
+ * them and a `/` inside the root name would read as a module scope. The
+ * audited directory itself keeps the name {@link AUDIT_ROOT_NAME}, so a
+ * single-root audit reads the way it did before an input path was available.
+ */
+export declare function auditRootName(path?: string): string;
 /**
  * The module scope an entity key names: the part before the address.
  *

package/dist/hcl/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,kFAAkF;QAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,qFAAqF;QACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,6DAA6D;QAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,kDAAkD;QAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;;;;;;;WAYG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC;;;;;;;WAOG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;QAClC,sEAAsE;QACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,uGAAuG;QACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;WAKG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC;;;;;;WAMG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACzD;AAED,mCAAmC;AACnC,eAAO,MAAM,cAAc,yBAAyB,CAAC;AACrD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,4FAA4F;AAC5F,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAE3C,2GAA2G;AAC3G,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACpI,MAAM,GAAE,MAAW,EACnB,IAAI,CAAC,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC7C,eAAe,CAqBjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,SAAY,GAAG,aAAa,EAAE,CAiB7F;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAI1E;AAsBD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CA6GlC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAUlC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAElC;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,kFAAkF;QAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,qFAAqF;QACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,6DAA6D;QAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,kDAAkD;QAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;;;;;;;WAYG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC;;;;;;;WAOG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;QAClC,sEAAsE;QACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,uGAAuG;QACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;WAKG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC;;;;;;WAMG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACzD;AAED,mCAAmC;AACnC,eAAO,MAAM,cAAc,yBAAyB,CAAC;AACrD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,4FAA4F;AAC5F,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAE3C,2GAA2G;AAC3G,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EACpI,MAAM,GAAE,MAAW,EACnB,IAAI,CAAC,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC7C,eAAe,CAqBjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,SAAY,GAAG,aAAa,EAAE,CAiB7F;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAI1E;AAsBD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CA6GlC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAUlC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAElC;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlD"}

package/dist/integrity.json

@@ -1,14 +1,14 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "708fe5c73583e3dae634d1b222678c040d2139995103aaf6f449be4488db7f62",
+    "manifest.json": "f525c4a58d5f0d1e9b6ab47756dc039e0fb7a82f2e471efebb0c93db9aa0ea8b",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
     "rules/blocks.ts": "d69f65c13b44ff425ccd465644f41c160e07b4c221bd60698d3ec84bf5d9cef8",
     "rules/module-source.ts": "147025cf53eba006473ddcb771bf7452928fc476e6daee10bbb86bcc7ee3848a",
     "rules/scope.ts": "a6d327d821f219c98a9d4ae6e6eed6325f3d3edf6286f3622b41be591d190dc8",
-    "rules/tf001.ts": "8c4e305f2fa49fc02d739495b9d1fa3b5ba4c1da8635475b93ec36bba508cee3",
+    "rules/tf001.ts": "1f07f0f9172a7ddb9c726ba4be1bea08e54e25701fbe59cc54c3cf4401aca999",
     "rules/tf002.ts": "27720fcb578cceb1bfff86849d46b0309276f5a88d092eddcb7d7b961d1f5cd8",
     "rules/tf003.ts": "7b705a08f03769f353910e524bb3f1b4cc844bcb620e240a9063288d0fd60802",
     "rules/tf004.ts": "59ef2108aa561cc6a40cd970fc54604be60872b51a035ed3bc3c53346a31d358",
@@ -22,7 +22,7 @@
     "rules/tf012.ts": "071d542786a1d5c19d485ab3e8fadb16210ba1c90a51843bf18b620cf99fe2a3",
     "rules/tf013.ts": "096c3e7e51a8a54fd4354f6a93dc1f3540e155ef5e6ef39407904465803aaa2c",
     "rules/tf014.ts": "c17d6c75fe0d38984a0108f4238667e9c069a0a761811d59f8ef9f67b5d8c5f3",
-    "rules/tf015.ts": "3b7933045d4c4c09810109582954a1c53f284a00f881e55900916f03afc4f987",
+    "rules/tf015.ts": "7190c71139f66ed0862725aead01b5eb3e6d366d1318a0506060b4c3d2417364",
     "rules/tf016.ts": "4dc8a815ee91bac7551bde90af0f5315bd8c03a0a090f19bd62ad305e0a06c93",
     "rules/tf017.ts": "1b11c1a21aca33f5e634732fd23b57ac4c2e02af9ef531890d88c401fa593832",
     "rules/tf018.ts": "188a56a73c53423ce4b653540cb4ab2b7aa64d10bb9bad090d392e2bfd821d0a",
@@ -32,8 +32,10 @@
     "rules/tf022.ts": "87483762b02e947aba94ec9b79fb9bf4dd6442287d602836306bc66b4a239a35",
     "rules/tf024.ts": "c0c101f913bd3d0fdb5403ee57888e80d8fc612e363f0eb43d7ae759ac1d5651",
     "rules/tf025.ts": "0c31be3885e940e2b3e9ac8e023067d8d6e2b42c04f628890405c9fc6db7d1ce",
-    "rules/tf026.ts": "db7c0f6669164dd439232708da03f0677a118504a83aec111051e60a967d95fb",
+    "rules/tf026.ts": "8cf1e61bc9563aa2d3c149f243ffa02ad4f183eebb672f861cd6c4e6fba1d310",
+    "rules/tf027.ts": "0a6062a230cdaa707f82b2353be4b34dff81322d24075d46f732a47bcef15893",
+    "rules/tf028.ts": "81ef95659c40ad1774c83e663473ed769143d894a4ba0517c3defa31f00ba723",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "4ea55eab06d2216269bf23fcf2d331ac4b59135ec80129ece6617f230f408126"
+  "composite": "bb5ab5b3b01e2194940123f31b4bec3eb979c9d393449baf03e181f4f65ba3ee"
 }

package/dist/lint/audit-catalog.d.ts

@@ -4,8 +4,8 @@
  * Every post-synth check needs an entry or it contributes nothing to
  * `chant audit`, silently, and `packages/core/src/audit/catalog.test.ts` fails.
  *
- * TF001, TF024, TF025 and TF026 all read the chant model (`ctx.entities`),
- * never emitted output, so `yamlBased` is false for all four. Prior-art
+ * TF001 and TF024 through TF028 all read the chant model (`ctx.entities`),
+ * never emitted output, so `yamlBased` is false for all of them. Prior-art
  * lineage lives in ./audit-lineage.ts.
  */
 import type { RuleMeta } from "@intentius/chant/audit/catalog";

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAe1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAqQ1D,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAe1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6R1D,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -42,26 +42,37 @@
  * TF021) added `gcp-terraform-best-practices`, the last row of the table below
  * that no shipped rule had cited yet.
  *
+ * Each row's Sweep note says whether `scripts/prior-art-sweep.ts` can index the
+ * source and, when it cannot, why (#2219). Five of these are indexed as of
+ * 2026-09-07: the three tflint rulesets, tfsec and the Sentinel policy set,
+ * 311 upstream rule ids in `scripts/prior-art/snapshot.json`. The rest are
+ * prose or code, so the tools they credit are re-read by hand when their
+ * documents change.
+ *
  * | Key | Name | URL | Licence | Kind | Note |
  * |---|---|---|---|---|---|
- * | `tflint` | tflint | https://github.com/terraform-linters/tflint | MPL-2.0 (its `terraform` package is BUSL-1.1; binaries are bound by both) | scanner | The plugin host; ships no language rules of its own. |
- * | `tflint-ruleset-terraform` | tflint-ruleset-terraform | https://github.com/terraform-linters/tflint-ruleset-terraform | MPL-2.0 | scanner | The official language-level ruleset, bundled into tflint. |
- * | `tflint-ruleset-redeploy` | tflint-ruleset-redeploy | https://github.com/RedeployAB/tflint-ruleset-redeploy | 0BSD | scanner | Community ruleset; richest source of language-level rules outside the official set. |
- * | `tflint-ruleset-avm` | tflint-ruleset-avm | https://github.com/Azure/tflint-ruleset-avm | MIT | scanner | Azure Verified Modules conformance; two of its 33 rules are provider-agnostic. |
- * | `tfsec` | tfsec | https://github.com/aquasecurity/tfsec | MIT | scanner | Historical: not archived but effectively frozen (no release since 2025-05); its docs site 404s above v0.61.x, so cite pinned repository paths (`github.com/aquasecurity/tfsec/blob/master/docs/checks/...`), not the docs site. |
- * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. |
- * | `terraform-sentinel-policies` | HashiCorp reference Sentinel policies | https://github.com/hashicorp/terraform-sentinel-policies | MPL-2.0 | specification | HashiCorp's own example policy set; ships zero rules baked into HCP Terraform itself, so treat a cited policy as a documented pattern (`specification`) unless a future entry runs it as a real check (`scanner`); the `kind` union allows either. |
- * | `choudoufu` | choudoufu | https://github.com/INTENTIUS/choudoufu | MPL-2.0 | scanner | Its `internal/live/lint` package; experimental, AWS-only. |
- * | `hashicorp-style-guide` | HashiCorp Terraform style guide | https://developer.hashicorp.com/terraform/language/style | n/a | specification | |
- * | `gcp-terraform-best-practices` | Google Cloud Terraform best-practices series | https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure | n/a | specification | A multi-page series; cite the specific page's fragment. |
- * | `aws-terraform-prescriptive-guidance` | AWS prescriptive guidance for Terraform | https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/ | n/a | specification | |
+ * | `tflint` | tflint | https://github.com/terraform-linters/tflint | MPL-2.0 (its `terraform` package is BUSL-1.1; binaries are bound by both) | scanner | The plugin host; ships no language rules of its own. Sweep: not registered in `PRIOR_ART` (no rule cites it), so it is not swept. |
+ * | `tflint-ruleset-terraform` | tflint-ruleset-terraform | https://github.com/terraform-linters/tflint-ruleset-terraform | MPL-2.0 | scanner | The official language-level ruleset, bundled into tflint. Sweep: indexed from `docs/rules/README.md`, whose table links each rule's page (20 rules). |
+ * | `tflint-ruleset-redeploy` | tflint-ruleset-redeploy | https://github.com/RedeployAB/tflint-ruleset-redeploy | 0BSD | scanner | Community ruleset; richest source of language-level rules outside the official set. Sweep: indexed from `docs/rules/README.md`, same table shape (33 rules). |
+ * | `tflint-ruleset-avm` | tflint-ruleset-avm | https://github.com/Azure/tflint-ruleset-avm | MIT | scanner | Azure Verified Modules conformance; two of its 33 rules are provider-agnostic. Sweep: indexed from the repository-root `RULES.md`, since `docs/` holds pages for only two rules (33 rules). |
+ * | `tfsec` | tfsec | https://github.com/aquasecurity/tfsec | MIT | scanner | Historical: not archived but effectively frozen (no release since 2025-05); its docs site 404s above v0.61.x, so cite pinned repository paths (`github.com/aquasecurity/tfsec/blob/master/docs/checks/...`), not the docs site. Sweep: indexed from the root `rules.md` on `master`, a flat table of all 152 check ids, because `docs/checks` nests a directory per provider, service and check. |
+ * | `trivy-checks` | trivy-checks | https://github.com/aquasecurity/trivy-checks | MIT (not the trivy scanner's own Apache-2.0; cite the checks repo's licence, not the engine's) | scanner | Where tfsec's rules live today (tfsec -> defsec -> trivy + trivy-checks). Cite rules by `long_id` (stable, human-readable); `AVD-*` ids are aliases now. Sweep: not registered in `PRIOR_ART` (no rule cites it yet) and its `long_id`s live in Rego metadata under `checks/<kind>/<provider>/<service>/`, with no flat index. |
+ * | `terraform-sentinel-policies` | HashiCorp reference Sentinel policies | https://github.com/hashicorp/terraform-sentinel-policies | MPL-2.0 | specification | HashiCorp's own example policy set; ships zero rules baked into HCP Terraform itself, so treat a cited policy as a documented pattern (`specification`) unless a future entry runs it as a real check (`scanner`); the `kind` union allows either. Sweep: indexed by listing the five per-cloud directories, whose `.sentinel` filenames are the policy ids credits cite (73 policies); the repository publishes no index page. |
+ * | `choudoufu` | choudoufu | https://github.com/INTENTIUS/choudoufu | MPL-2.0 | scanner | Its `internal/live/lint` package; experimental, AWS-only. Sweep: unsweepable, its rule ids are Go constants in `internal/live/lint/issue.go` and it publishes no rule index. |
+ * | `hashicorp-style-guide` | HashiCorp Terraform style guide | https://developer.hashicorp.com/terraform/language/style | n/a | specification | Sweep: unsweepable, one prose page of recommendations with no rule ids; a credit quotes the sentence and links its fragment. |
+ * | `gcp-terraform-best-practices` | Google Cloud Terraform best-practices series | https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure | n/a | specification | A multi-page series; cite the specific page's fragment. Sweep: unsweepable, prose across several pages with no rule ids. |
+ * | `aws-terraform-prescriptive-guidance` | AWS prescriptive guidance for Terraform | https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/ | n/a | specification | Sweep: unsweepable, a prose guide whose sections carry headings rather than rule ids. |
  *
  * Deliberately excluded, per the survey: Terrascan and regula (both archived,
  * do not build on dead projects); Snyk IaC (a product, not a rule source);
  * semgrep (no SPDX id: its engine is LGPL-2.1 but its rules ship under the
  * proprietary Semgrep Rules License v1.0, which forbids redistribution; cite
  * it by name in prose if a rule's idea comes from it, never register it in
- * `PRIOR_ART` with an SPDX licence).
+ * `PRIOR_ART` with an SPDX licence). TF008 credits semgrep by name under that
+ * rule, so `PRIOR_ART` does carry the entry, with the licence spelled out
+ * rather than as an SPDX id. Sweep: unsweepable, the registry publishes no
+ * index and a rule id is the path of its YAML file under
+ * `terraform/<provider>/<category>/`, which no single directory listing covers.
  *
  * TF024 (#2103, live root declares a backend/cloud block) credits choudoufu's
  * own `RuleStateBackend`, `internal/live/lint/issue.go` of
@@ -83,6 +94,22 @@
  * activities/kubectl.ts`'s `ApplyDeleteMode`, `packages/core/src/op/
  * activities/apply.ts`'s `DeleteMode`), applied here to a tool that does not
  * itself carry the concept. Ship with no lineage rather than invent a credit.
+ *
+ * TF027 (#2216, a live root's `policy` block setting `undeclared_untagged =
+ * "delete"`) does have one: choudoufu's `RulePolicyScope`
+ * (`internal/live/lint/policy.go`) refuses the same assignment, and issue #67
+ * there makes it a lint refusal rather than a default. The relation is
+ * `extends`, because choudoufu refuses it only when no `scope` block narrows
+ * the purge, while chant refuses it either way: a `scope` block bounds an
+ * account-wide sweep to a service, type or region, and every resource inside
+ * that boundary is still one this estate never marked. "Bounded" is not
+ * "owned", and owning it is the condition chant applies.
+ *
+ * TF028 (#2216, a live root watched by a `TerraformWatchOp` built without
+ * `live: true`) has no entry. It reads a chant Op's own configuration against
+ * a root's mode, and no surveyed tool has an Op model to read: choudoufu lints
+ * HCL, and every tflint ruleset, tfsec/trivy-checks and the Sentinel policies
+ * do the same. There is nothing upstream to credit.
  */
 import type { Lineage } from "@intentius/chant/audit/catalog";
 export declare const terraformAuditLineage: Record<string, Lineage[]>;

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAoP3D,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CA0R3D,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA2BvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA0B3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA6BvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA4B3C,CAAC"}

package/dist/lint/post-synth/tf001.d.ts

@@ -1,12 +1,25 @@
 /**
  * TF001: a root module keeps its state on local disk.
  *
- * A `terraform` block with no `backend "<type>"` and no `cloud {}` falls back
- * to the local backend, which puts `terraform.tfstate` in the working
- * directory. That file holds every attribute of every managed resource,
- * secrets included, and it is not shared, not locked, and not versioned. The
- * first apply from a second machine or a CI runner starts from an empty state
- * and proposes to create the estate again.
+ * Two ways a root gets there, and this reports both (#2218). A `terraform`
+ * block with no `backend "<type>"` and no `cloud {}` falls back to the local
+ * backend implicitly. A `backend "local"` block asks for the same backend by
+ * name. Either way `terraform.tfstate` lands in the working directory, and
+ * that file holds every attribute of every managed resource, secrets
+ * included, and it is not shared, not locked, and not versioned. The first
+ * apply from a second machine or a CI runner starts from an empty state and
+ * proposes to create the estate again.
+ *
+ * So the rule reads the backend block's TYPE LABEL rather than its presence:
+ * the id means "no remote backend", which is what its name, its message and
+ * its page have always argued. `cloud {}` counts as remote (it is Terraform
+ * Cloud / HCP state, held off the machine and locked). Every other backend
+ * type is taken as remote without a list to maintain, since `local` is the
+ * only backend Terraform ships that writes to the working directory.
+ *
+ * A root that keeps local state on purpose says so with a
+ * `# chant-ignore-block: TF001` on the line above its `terraform` block
+ * (chant #2111), which is what the three shipped examples do.
  *
  * One diagnostic per root, fired from the root's `terraform` block. A root
  * with no `terraform` block at all is not flagged: it declares no version
@@ -31,5 +44,26 @@ import { type BlockBody } from "../../hcl/parse.js";
  * this reads through it rather than re-deriving presence by hand.
  */
 export declare function hasBlock(body: BlockBody, key: string): boolean;
+/** The one backend type that writes state to the working directory. */
+export declare const LOCAL_BACKEND = "local";
+/**
+ * The type labels of the `backend` blocks in a `terraform` block body.
+ *
+ * `backend` takes one label, so hcl2json nests it one level deeper than an
+ * unlabelled block: `backend "s3" { bucket = "b" }` is
+ * `{ backend: { s3: [{ bucket: "b" }] } }`, where `cloud { ... }` is just
+ * `{ cloud: [{ ... }] }`. The keys of that inner object are the labels, which
+ * is the only place the type survives the parse. A malformed body that puts
+ * an array or a scalar under `backend` yields no labels, and the caller then
+ * treats the root as having no remote backend, the same verdict a missing
+ * block gets.
+ */
+export declare function backendTypes(body: BlockBody): string[];
+/**
+ * Whether the body configures state somewhere other than the working
+ * directory: any `backend` block whose type is not `local`, or a `cloud`
+ * block.
+ */
+export declare function hasRemoteBackend(body: BlockBody): boolean;
 export declare const tf001: PostSynthCheck;
 //# sourceMappingURL=tf001.d.ts.map

package/dist/lint/post-synth/tf001.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tf001.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf001.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjE;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,eAAO,MAAM,KAAK,EAAE,cAyCnB,CAAC"}
+{"version":3,"file":"tf001.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf001.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjE;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAK9D;AAED,uEAAuE;AACvE,eAAO,MAAM,aAAa,UAAU,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,EAAE,CAMtD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAGzD;AAED,eAAO,MAAM,KAAK,EAAE,cAmDnB,CAAC"}

package/dist/lint/post-synth/tf015.d.ts

@@ -2,8 +2,9 @@
  * TF015: a `backend` or `cloud` block inside a child module.
  *
  * Scope: child modules only. This is TF001's mirror image. TF001 wants a root
- * module to declare a backend, because a root without one keeps its state on
- * local disk. A child module must declare neither: state belongs to the root,
+ * module to declare a REMOTE backend, because a root without one keeps its
+ * state on local disk. A child module must declare neither: state belongs to
+ * the root,
  * one state per root however many modules it calls, and Terraform says so
  * directly, "A backend block can only appear in the root module" and the
  * same for `cloud`. Depending on the version, the block is ignored with a
@@ -15,6 +16,14 @@
  * along. The rest of that block is fine to keep: `required_version` and
  * `required_providers` are meaningful in a child module and are not reported
  * here.
+ *
+ * Label-blind on purpose (#2218). TF001 had to start reading the backend
+ * block's type label, since `local` is the state placement it warns about
+ * rather than a cure for it. Nothing of the sort applies here: what a child
+ * module may not do is name a backend at all, `local` included, and
+ * Terraform's own refusal ("A backend block can only appear in the root
+ * module") does not read the label either. `hasBlock` is the right test, and
+ * the `positive` fixture's child declares `backend "local"` for that reason.
  */
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
 export declare const tf015: PostSynthCheck;

package/dist/lint/post-synth/tf015.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tf015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}
+{"version":3,"file":"tf015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAM1C,eAAO,MAAM,KAAK,EAAE,cAiCnB,CAAC"}

package/dist/lint/post-synth/tf026.d.ts

@@ -17,5 +17,12 @@
  * the same entity TF024 and TF025 fire from.
  */
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { type BlockBody } from "../../hcl/parse.js";
+/**
+ * The `policy { }` block nested in a `live { }` block's body, hcl2json's own
+ * "one block, wrapped in an array" shape. Exported for TF027 (`./tf027.ts`),
+ * which reads the other quadrant of the same block.
+ */
+export declare function policyBlockOf(liveBody: BlockBody): BlockBody | undefined;
 export declare const tf026: PostSynthCheck;
 //# sourceMappingURL=tf026.d.ts.map

package/dist/lint/post-synth/tf026.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tf026.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf026.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAe1C,eAAO,MAAM,KAAK,EAAE,cAyCnB,CAAC"}
+{"version":3,"file":"tf026.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf026.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAK5D;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAKxE;AAED,eAAO,MAAM,KAAK,EAAE,cAyCnB,CAAC"}

package/dist/lint/post-synth/tf027.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TF027: a live root's `policy` block sets `undeclared_untagged = "delete"`.
+ *
+ * The `undeclared_untagged` quadrant covers a live resource this estate never
+ * marked and the configuration does not declare, a resource chant does not
+ * own. `"delete"` there is account-scoped reconciliation: choudoufu compares
+ * the configuration against everything a `scope` block reaches and removes
+ * what is not in it. chant never proposes deleting a resource it does not
+ * own, and neither does an Op it generates, so the setting is refused on any
+ * live root the project builds, scoped or not. Narrowing the estate's own
+ * ownership answer (`undeclared_tagged`, which TF026 checks against
+ * `delete: "never"`) is the setting to reach for instead.
+ *
+ * `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`) makes the
+ * same refusal when it builds, but only for a project on a `chant.config.json`
+ * whose root it can resolve synchronously (#2216): a `chant.config.ts` is
+ * project-authored code that `resolveRootModeSync` will not evaluate, so the
+ * composite reads the root as stock and never asks the policy question. This
+ * check reads `props.mode` off the parsed HCL instead, which the build stamps
+ * on every entity whatever the config file is written in, so it is the
+ * refusal that actually fires. It also fires for a live root with no apply Op
+ * at all, since the setting is a statement about the estate rather than about
+ * one Op.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity,
+ * the same entity TF024, TF025 and TF026 fire from.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf027: PostSynthCheck;
+//# sourceMappingURL=tf027.d.ts.map

package/dist/lint/post-synth/tf027.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf027.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf027.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAK1C,eAAO,MAAM,KAAK,EAAE,cAoCnB,CAAC"}

package/dist/lint/post-synth/tf028.d.ts

@@ -0,0 +1,33 @@
+/**
+ * TF028: a live root is watched by a `TerraformWatchOp` built in stock mode.
+ *
+ * `TerraformWatchOp`'s `live` flag is declared, not detected: a composite is
+ * built by `chant build` without reading a root module's `.tf` files, so the
+ * Op author says which shape the Plan phase takes and, until #2216, nothing
+ * checked the answer against the root. Leaving it off a live root is silent
+ * and lossy. `live: true` swaps the Plan step for `choudoufuLivePlan`, whose
+ * single read of the live system answers three questions (drift, how many
+ * live resources sit at a declared identity carrying no marker, and how many
+ * of those an exact content match makes claimable); a stock `terraformPlan`
+ * step answers the first alone, so the watch reports drift and stays quiet
+ * about every unowned and adoptable resource in the estate.
+ *
+ * The check runs over the whole built graph because that is where both halves
+ * of the question are: the root's mode is stamped on every parsed entity by
+ * the build (`props.mode`, #2103), and the Op is a `Chant::Op` entity carrying
+ * the composite's own labels. `TerraformWatchOp` itself cross-checks the flag
+ * where it can (`../../op/resolve-root-mode.ts`), but that read is a
+ * `chant.config.json`-only one, so on a `chant.config.ts` project, which is
+ * every project in this repository, this check is what actually fires.
+ *
+ * Read off the labels the composite stamps rather than off the emitted step,
+ * since a stock `terraformPlan -out` step against a live root is correct in
+ * `TerraformApplyOp`: choudoufu v0.13.0 accepts `plan -out` and re-plans
+ * against the file at apply (#2157), so the apply Op builds one shape for
+ * both kinds of root and the step alone says nothing about a mistake.
+ *
+ * One diagnostic per Op, fired from the Op's entity.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+export declare const tf028: PostSynthCheck;
+//# sourceMappingURL=tf028.d.ts.map

package/dist/lint/post-synth/tf028.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf028.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf028.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAuB1C,eAAO,MAAM,KAAK,EAAE,cAqCnB,CAAC"}

package/dist/lsp/option-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAMtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAWpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}
+{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAMtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/okf/index.md

@@ -29,4 +29,6 @@ okf_version: '0.2'
 * [TF024](/rules/TF024.md) - Live root declares a backend or cloud block, which choudoufu refuses
 * [TF025](/rules/TF025.md) - Live root references a non-default terraform.workspace, which choudoufu refuses
 * [TF026](/rules/TF026.md) - Live root declares delete: "never" but its policy leaves undeclared_tagged at "delete"
+* [TF027](/rules/TF027.md) - Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own
+* [TF028](/rules/TF028.md) - A live root is watched by a TerraformWatchOp built without live: true
 * [TF101](/rules/TF101.md) - terraformApply's planFile must reference a preceding terraformPlan step.

package/dist/okf/rules/TF027.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF027
+description: Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own
+id: TF027
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own

package/dist/okf/rules/TF028.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF028
+description: 'A live root is watched by a TerraformWatchOp built without live: true'
+id: TF028
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+A live root is watched by a TerraformWatchOp built without live: true