@intentius/chant 0.57.0 → 0.58.0

package/dist/audit/catalog.d.ts

@@ -16,6 +16,8 @@
  * over the small static core map (the cross-cutting COR/EXT ids). A drift-guard
  * test asserts the aggregate stays in sync with the lexicons' post-synth checks.
  */
+import type { Lineage } from "./prior-art.js";
+export { PRIOR_ART, applyLineage, lineageLabel, type Lineage, type LineageRelation, type PriorArtEntry, type PriorArtTool } from "./prior-art.js";
 export type Tier = "merge-worthy" | "report-only";
 /** deterministic = safe auto-fix/diff; guidance = report text only (needs judgment). */
 export type FixKind = "deterministic" | "guidance";
@@ -43,14 +45,42 @@ export interface RuleMeta {
     title: string;
     /** External backing so a finding isn't just chant's opinion. */
     authority?: Authority[];
+    /**
+     * Prior art: the open-source tools whose rules check the same condition
+     * (./prior-art.ts). Credit, not authority — never affects tier or category.
+     */
+    lineage?: Lineage[];
     /** One-line fix guidance (always present). */
     remediation: string;
     /**
      * False if the check reads the chant model (`ctx.entities`) rather than the
      * emitted YAML (`ctx.outputs`) — such a check won't fire on audited YAML.
-     * All current post-synth checks are output-based, so this is true.
+     * Most post-synth checks are output-based, but cpln, fly, fountain, k3s
+     * and render all ship model-based checks with this false.
      */
     yamlBased: boolean;
+    /**
+     * Retired ids this rule used to ship under (chant #2113). A rule id is
+     * public the day it ships. trivy's checks carry `id`, `long_id` and
+     * `aliases` for exactly this reason, so a rename or a scheme migration
+     * doesn't strand every existing reference to the old id. An alias resolves
+     * to this entry wherever a rule id is looked up by a human or a config.
+     * `canonicalRuleId()` (below) is the shared resolver; a `lint.rules` key
+     * and #2111's HCL suppression both go through it (or will, since #2111
+     * lands separately and is not touched by this change).
+     */
+    aliases?: string[];
+    /**
+     * Set when this rule is retired: `true`, or a string explaining what
+     * replaced it / why it no longer fires. A deprecated rule stays in the
+     * catalog rather than being deleted. trivy's `deprecated: true` field lets
+     * a ruleset retire a check without breaking every existing suppression or
+     * dashboard that still names it, so its id keeps resolving (via `aliases`
+     * on whichever rule superseded it, when there is one) and the rules page
+     * still lists it, greyed out, instead of the id going dark with no
+     * explanation.
+     */
+    deprecated?: boolean | string;
 }
 export declare const SCORECARD_TOKEN: Authority;
 export declare const GH_TOKEN: Authority;
@@ -74,6 +104,7 @@ export declare const CWE_DIR_LISTING: Authority;
 export declare const GIXY_ALIAS: Authority;
 export declare const NGINX_STUB_STATUS: Authority;
 export declare const CWE_HARDCODED_CREDS: Authority;
+export declare const HASHICORP_STYLE_GITIGNORE: Authority;
 export declare const CWE_CLEARTEXT: Authority;
 /**
  * Finding category per rule (#415). Curated: security rules are those that
@@ -102,6 +133,7 @@ export declare const RULE_CATALOG: Record<string, RuleMeta>;
 export declare function auditRule(id: string, tier: Tier, fixKind: FixKind, title: string, remediation: string, opts?: {
     authority?: Authority[];
     category?: Category;
+    lineage?: Lineage[];
 }): RuleMeta;
 /**
  * Resolve the effective audit catalog for a set of lexicons: core's static
@@ -115,6 +147,24 @@ export declare function auditRule(id: string, tier: Tier, fixKind: FixKind, titl
 export declare function resolveAuditCatalog(lexicons: string[]): Promise<Record<string, RuleMeta>>;
 /** Look up catalog metadata for a check id, if known. */
 export declare function ruleMeta(id: string): RuleMeta | undefined;
+/**
+ * Resolve a rule id to its canonical form against `catalog` (chant #2113). An
+ * id that is itself a key of `catalog` passes through unchanged (this covers
+ * the common case without scanning every entry's `aliases`); otherwise every
+ * entry's `aliases` is searched for a match, and the id it belongs to is
+ * returned. An id neither a key nor anyone's alias passes through unchanged
+ * too, since this is a best-effort resolver, not a validator, so an unknown
+ * id is a caller's problem, not this function's.
+ *
+ * Exported so a `lint.rules`/preset key that names an alias resolves to the
+ * rule that actually runs (see `resolveConfiguredSeverity`,
+ * `../lint/config.ts`), and so #2111's HCL suppression code can key an
+ * inline `# chant-ignore <id>` off the same resolution once it lands — that
+ * suppression mechanism does not exist yet in this worktree (#2111 is a
+ * separate, parallel issue), so this function is exported now for it to call
+ * later rather than being wired into it here.
+ */
+export declare function canonicalRuleId(id: string, catalog?: Record<string, RuleMeta>): string;
 /** Docs path for the audit rules reference (one anchor per rule id). */
 export declare const RULES_DOC_PATH = "/chant/lint-rules/audit-rules/";
 /** Absolute URL to a rule's entry in the audit rules reference. */

package/dist/audit/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/audit/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,IAAI,GAAG,cAAc,GAAG,aAAa,CAAC;AAElD,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,eAAe,GAAG,UAAU,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,YAAY,CAAC;AAEnF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAGD,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,QAAQ,EAAE,SAGtB,CAAC;AACF,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,SAG1B,CAAC;AACF,eAAO,MAAM,MAAM,EAAE,SAGpB,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,OAAO,EAAE,SAGrB,CAAC;AACF,eAAO,MAAM,OAAO,EAAE,SAGrB,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,SAGzB,CAAC;AACF,eAAO,MAAM,kBAAkB,EAAE,SAGhC,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,SAGzB,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,iBAAiB,EAAE,SAG/B,CAAC;AACF,eAAO,MAAM,mBAAmB,EAAE,SAGjC,CAAC;AACF,eAAO,MAAM,aAAa,EAAE,SAG3B,CAAC;AAsCF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAsClD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6FjD,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE,GACtD,QAAQ,CAGV;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAqB/F;AAED,yDAAyD;AACzD,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEzD;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAE/D,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/audit/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/I,MAAM,MAAM,IAAI,GAAG,cAAc,GAAG,aAAa,CAAC;AAElD,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,eAAe,GAAG,UAAU,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,YAAY,CAAC;AAEnF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC/B;AAGD,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,QAAQ,EAAE,SAGtB,CAAC;AACF,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,SAG1B,CAAC;AACF,eAAO,MAAM,MAAM,EAAE,SAGpB,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,OAAO,EAAE,SAGrB,CAAC;AACF,eAAO,MAAM,OAAO,EAAE,SAGrB,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,SAGzB,CAAC;AACF,eAAO,MAAM,kBAAkB,EAAE,SAGhC,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,SAGzB,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,iBAAiB,EAAE,SAG/B,CAAC;AACF,eAAO,MAAM,mBAAmB,EAAE,SAGjC,CAAC;AACF,eAAO,MAAM,yBAAyB,EAAE,SAGvC,CAAC;AACF,eAAO,MAAM,aAAa,EAAE,SAG3B,CAAC;AAuCF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0ClD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA4GjD,CAAC;AAKF;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,GAC3E,QAAQ,CAaV;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAwB/F;AAED,yDAAyD;AACzD,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEzD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAgB,GAAG,MAAM,CAMpG;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAE/D,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C"}

package/dist/audit/core.d.ts

@@ -64,6 +64,11 @@ export interface AuditFinding {
      * itself.
      */
     fingerprint?: string;
+    /** Carried verbatim from the producing `PostSynthDiagnostic.missing` (chant #2113) — see its doc comment. */
+    missing?: {
+        kind: string;
+        scope: string;
+    };
 }
 /**
  * Resolve the post-synth checks for a lexicon. Injectable so the core can be
@@ -74,8 +79,10 @@ export type ChecksProvider = (lexicon: AuditLexicon) => Promise<PostSynthCheck[]
  * Parse one classified file's content into the lexicon's entity graph — the
  * parse-to-graph half of the audit (#1567). The returned map is what
  * `ctx.entities` holds during a build, so entity-reading checks run unchanged.
+ * May return a `Promise` for a lexicon whose parser is inherently async (e.g.
+ * terraform's HCL parser); `auditLexicon`'s `entitiesFor` awaits it.
  */
-export type EntitiesParser = (content: string) => Map<string, Declarable>;
+export type EntitiesParser = (content: string) => Map<string, Declarable> | Promise<Map<string, Declarable>>;
 /**
  * Resolve the entities parser for a lexicon (its plugin's `auditEntities`,
  * when it ships one). Injectable so the core can be unit-tested without
@@ -90,6 +97,17 @@ export type EntitiesProvider = (lexicon: AuditLexicon) => Promise<EntitiesParser
 /** Thrown when a lexicon package the audit needs isn't installed. */
 export declare class MissingLexiconError extends Error {
 }
+/**
+ * Mutable out-param for the inline (`# chant-ignore*`) suppression count
+ * (chant #2111): `auditFiles`'s return type stays `AuditFinding[]` for every
+ * existing caller, so a caller that wants the count (`chant audit`'s CLI, for
+ * its summary line) passes this in and reads `.count` back afterward, rather
+ * than `auditFiles` growing a `{findings, suppressedCount}` shape that would
+ * touch every existing call site.
+ */
+export interface SuppressionStats {
+    count: number;
+}
 /**
  * Audit a set of CI files and return all findings. Pure with respect to the
  * filesystem and network — callers supply file contents.
@@ -97,6 +115,7 @@ export declare class MissingLexiconError extends Error {
 export declare function auditFiles(inputs: AuditInput[], opts?: {
     checksProvider?: ChecksProvider;
     entitiesProvider?: EntitiesProvider;
+    suppressionStats?: SuppressionStats;
 }): Promise<AuditFinding[]>;
 /** Label for findings that span more than one file (e.g. duplicate names). */
 export declare const CROSS_FILE = "(cross-file)";

package/dist/audit/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/audit/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,oBAAoB,CAAC;AAG3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,KAAK,GACL,QAAQ,GACR,KAAK,GACL,OAAO,GACP,KAAK,GACL,MAAM,GACN,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAElF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;AAa9F;;;;GAIG;AACH,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AA0DjD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAAE,EACpB,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,cAAc,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAO,GAClF,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzB;AAED,8EAA8E;AAC9E,eAAO,MAAM,UAAU,iBAAiB,CAAC"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/audit/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,oBAAoB,CAAC;AAIhG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,KAAK,GACL,QAAQ,GACR,KAAK,GACL,OAAO,GACP,KAAK,GACL,MAAM,GACN,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6GAA6G;IAC7G,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAE7G;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;AAa9F;;;;GAIG;AACH,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AA0DjD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAAE,EACpB,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,cAAc,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACvH,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzB;AAED,8EAA8E;AAC9E,eAAO,MAAM,UAAU,iBAAiB,CAAC"}

package/dist/audit/discover.d.ts

@@ -21,6 +21,11 @@
  *     `detectTemplate` (which only knows Compose's `services:`) can't see them.
  *   - Helm charts are a directory BUNDLE keyed by `Chart.yaml`; the helm checks
  *     read `output.files`, so the whole chart is one AuditInput.
+ *   - Terraform is also a directory BUNDLE, keyed by that directory's own
+ *     `.tf` filenames, not recursively: a nested directory with its own
+ *     `.tf` files (e.g. `modules/foo`) is a separate root module and gets its
+ *     own AuditInput. `.tf` isn't YAML/JSON either, so `detectTemplate` can't
+ *     see it.
  *   - k8s `detectTemplate` matches any `apiVersion`+`kind`, including GCP Config
  *     Connector (`cnrm.cloud.google.com`) resources and fountain
  *     (`fountain.dev/v1`) manifests, so gcp and fountain must be tried first.
@@ -30,7 +35,7 @@
 import type { LexiconPlugin } from "../lexicon.js";
 import type { AuditInput, AuditLexicon } from "./core.js";
 /** Lexicons the auditor knows how to detect and run checks for. */
-export declare const AUDIT_LEXICONS: readonly ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain"];
+export declare const AUDIT_LEXICONS: readonly ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain", "terraform"];
 /**
  * Load the plugins used for detection. Each is loaded in isolation (no
  * cross-lexicon conflict aggregation — detection only reads `detectTemplate`),
@@ -79,11 +84,11 @@ export declare function isCandidatePath(path: string): boolean;
  * (path, filename, a few content markers) with no lexicon plugin involved.
  * Names the lexicon that would have claimed a file when that lexicon isn't
  * installed (#1623). Deliberately coarse: precision comes from the plugin's
- * `detectTemplate`, which is exactly what's missing in that case.
- * `terraform` is not an audit lexicon; `*.tf` is surfaced so the user learns
- * the audit never reads it (see `chant carve`).
+ * `detectTemplate`, which is exactly what's missing in that case. `terraform`
+ * is a lexicon like any other here: a `.tf` file hints at it by name, the
+ * same way `Chart.yaml` hints at helm.
  */
-export type LexiconHint = AuditLexicon | "terraform";
+export type LexiconHint = AuditLexicon;
 export declare function hintLexiconForFile(path: string, content: string): LexiconHint | undefined;
 /** A candidate file that looked like it belonged to a lexicon the audit did not have. */
 export interface UnclaimedFile {
@@ -100,9 +105,10 @@ export declare function unclaimedFiles(files: RepoFile[], inputs: AuditInput[],
  * Classify an in-memory set of repo files into per-lexicon audit inputs. Pure
  * (no fs, no network) so the local walk and the remote tree-fetch share exactly
  * one detection path. Each file maps to at most one lexicon: CI by path,
- * Dockerfiles by name, Helm charts as a bundle, everything else by the
- * precedence-ordered content detectors (delegating to each plugin's
- * `detectTemplate`). Lexicons whose plugin isn't provided are skipped.
+ * Dockerfiles by name, Helm charts and Terraform root modules as directory
+ * bundles, everything else by the precedence-ordered content detectors
+ * (delegating to each plugin's `detectTemplate`). Lexicons whose plugin isn't
+ * provided are skipped.
  */
 export declare function classifyFiles(files: RepoFile[], plugins: DetectPlugin[]): AuditInput[];
 /**

package/dist/audit/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,sGAAuG,CAAC;AAEnI;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AAgLD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASrD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAErD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAehH;AA0BD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAiCtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAEvF;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiB1D"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAIvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,mHAAoH,CAAC;AAEhJ;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AA8LD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASrD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC;AAEvC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAehH;AAiED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAoCtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAEvF;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CA8B1D"}

package/dist/audit/lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "./prior-art.js";
+export declare const coreAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=lineage.d.ts.map

package/dist/audit/lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.d.ts","sourceRoot":"","sources":["../../src/audit/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CA0FtD,CAAC"}

package/dist/audit/prior-art.d.ts

@@ -0,0 +1,385 @@
+/**
+ * Prior art for chant's audit rules.
+ *
+ * Most of what `chant audit` checks has been checked before by a dedicated
+ * open-source tool: zizmor and poutine for GitHub Actions, hadolint for
+ * Dockerfiles, cfn-lint and cfn_nag for CloudFormation, kube-linter and
+ * kube-score for Kubernetes manifests, gitleaks for secrets, and so on. chant's
+ * rules were written independently against the emitted output, but the ideas
+ * are shared, and the people who wrote them down first deserve the credit.
+ *
+ * A rule declares its lineage as `Lineage[]` on its `RuleMeta` entry: which
+ * tool, which upstream rule, where it is documented, and how the two relate.
+ * `PRIOR_ART` is the registry those entries key into, so a tool is named,
+ * linked and licensed once. The audit rules reference renders both, the
+ * markdown and HTML reports credit the tool beside the finding, and the SARIF
+ * and JSON outputs carry the entries verbatim for consumers.
+ *
+ * Lineage is credit, not authority. `authority` (./catalog.ts) is a standard
+ * or vendor document that says a finding matters; lineage is a tool that
+ * checks the same condition. The two are independent: a rule may have either,
+ * both, or neither, and lineage never changes a rule's category or tier.
+ */
+/** How a chant rule relates to the upstream check it credits. */
+export type LineageRelation = 
+/** Same condition, same scope. */
+"equivalent"
+/** The core condition is shared; one side is narrower or broader, or a different dialect of the same control. */
+ | "overlaps"
+/** chant checks a strict superset of the upstream check. */
+ | "extends";
+/** One credit: an upstream tool's rule that checks what this chant rule checks. */
+export interface Lineage {
+    /** A key of {@link PRIOR_ART}. */
+    tool: PriorArtTool;
+    /** The upstream rule id or check name, in the tool's own vocabulary (e.g. `template-injection`, `DL3007`, `CKV_AWS_18`). Omitted when the tool has no per-rule ids. */
+    rule?: string;
+    /** Where the upstream rule is documented. */
+    url: string;
+    relation: LineageRelation;
+}
+/** A tool (or, for a few families, a vendor validator) that chant's rules credit. */
+export interface PriorArtEntry {
+    name: string;
+    url: string;
+    /** SPDX identifier where confirmed, else "unverified" or "n/a" for documentation. */
+    license: string;
+    /** What kind of thing this is, so the rendered credit is honest about it. */
+    kind: "scanner" | "vendor-validator" | "specification";
+}
+/**
+ * The registry of prior art. Keys are the slugs `Lineage.tool` uses. Populated
+ * from the per-family research recorded in the PR that introduced lineage; the
+ * prior-art sweep (scripts/prior-art-sweep.ts) reads the same table.
+ */
+export declare const PRIOR_ART: {
+    readonly checkov: {
+        readonly name: "Checkov";
+        readonly url: "https://www.checkov.io/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly kics: {
+        readonly name: "KICS";
+        readonly url: "https://docs.kics.io/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly zizmor: {
+        readonly name: "zizmor";
+        readonly url: "https://docs.zizmor.sh/";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "cfn-nag": {
+        readonly name: "cfn_nag";
+        readonly url: "https://github.com/stelligent/cfn_nag";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "gitlab-docs": {
+        readonly name: "GitLab CI/CD YAML reference";
+        readonly url: "https://docs.gitlab.com/ci/yaml/";
+        readonly license: "CC-BY-SA-4.0";
+        readonly kind: "specification";
+    };
+    readonly "guard-rules-registry": {
+        readonly name: "AWS Guard Rules Registry";
+        readonly url: "https://github.com/aws-cloudformation/aws-guard-rules-registry";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly polaris: {
+        readonly name: "Fairwinds Polaris";
+        readonly url: "https://polaris.docs.fairwinds.com/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "kube-linter": {
+        readonly name: "KubeLinter";
+        readonly url: "https://github.com/stackrox/kube-linter";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "kube-score": {
+        readonly name: "kube-score";
+        readonly url: "https://github.com/zegl/kube-score";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "psrule-azure": {
+        readonly name: "PSRule for Azure";
+        readonly url: "https://azure.github.io/PSRule.Rules.Azure/";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "gcp-policy-library": {
+        readonly name: "Google Cloud Policy Library";
+        readonly url: "https://github.com/GoogleCloudPlatform/policy-library";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly poutine: {
+        readonly name: "poutine";
+        readonly url: "https://boostsecurityio.github.io/poutine/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly scorecard: {
+        readonly name: "OpenSSF Scorecard";
+        readonly url: "https://github.com/ossf/scorecard";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "cfn-lint": {
+        readonly name: "cfn-lint";
+        readonly url: "https://github.com/aws-cloudformation/cfn-lint";
+        readonly license: "MIT-0";
+        readonly kind: "scanner";
+    };
+    readonly "controlplane-docs": {
+        readonly name: "Control Plane reference documentation";
+        readonly url: "https://docs.controlplane.com";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly gitleaks: {
+        readonly name: "gitleaks";
+        readonly url: "https://github.com/gitleaks/gitleaks";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly octoscan: {
+        readonly name: "octoscan";
+        readonly url: "https://github.com/synacktiv/octoscan";
+        readonly license: "GPL-3.0";
+        readonly kind: "scanner";
+    };
+    readonly "detect-secrets": {
+        readonly name: "detect-secrets";
+        readonly url: "https://github.com/Yelp/detect-secrets";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly actionlint: {
+        readonly name: "actionlint";
+        readonly url: "https://github.com/rhysd/actionlint";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly trufflehog: {
+        readonly name: "TruffleHog";
+        readonly url: "https://github.com/trufflesecurity/trufflehog";
+        readonly license: "AGPL-3.0";
+        readonly kind: "scanner";
+    };
+    readonly "gixy-ng": {
+        readonly name: "gixy-ng (maintained Gixy fork)";
+        readonly url: "https://github.com/dvershinin/gixy";
+        readonly license: "MPL-2.0";
+        readonly kind: "scanner";
+    };
+    readonly kubesec: {
+        readonly name: "kubesec";
+        readonly url: "https://kubesec.io/";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly datree: {
+        readonly name: "Datree";
+        readonly url: "https://hub.datree.io/built-in-rules";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "helm-lint": {
+        readonly name: "helm lint";
+        readonly url: "https://helm.sh/docs/helm/helm_lint/";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly "cedar-validator": {
+        readonly name: "Cedar policy validator";
+        readonly url: "https://docs.cedarpolicy.com/policies/validation.html";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly "flux-docs": {
+        readonly name: "Flux Kustomization API reference";
+        readonly url: "https://fluxcd.io/flux/components/kustomize/kustomizations/";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly hadolint: {
+        readonly name: "hadolint";
+        readonly url: "https://github.com/hadolint/hadolint";
+        readonly license: "GPL-3.0";
+        readonly kind: "scanner";
+    };
+    readonly "agent-audit": {
+        readonly name: "agent-audit";
+        readonly url: "https://github.com/piiiico/agent-audit";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "arm-ttk": {
+        readonly name: "ARM Template Toolkit (arm-ttk)";
+        readonly url: "https://github.com/Azure/arm-ttk";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "bicep-linter": {
+        readonly name: "Bicep linter";
+        readonly url: "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/linter";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "cedar-cli": {
+        readonly name: "Cedar CLI";
+        readonly url: "https://github.com/cedar-policy/cedar/tree/main/cedar-policy-cli";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly dockle: {
+        readonly name: "Dockle";
+        readonly url: "https://github.com/goodwithtech/dockle";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "mcp-audit": {
+        readonly name: "mcp-audit (APIsec)";
+        readonly url: "https://github.com/apisec-inc/mcp-audit";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly "render-docs": {
+        readonly name: "Render Blueprint YAML reference";
+        readonly url: "https://render.com/docs/blueprint-spec";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "agent-scan": {
+        readonly name: "Snyk Agent Scan (formerly mcp-scan)";
+        readonly url: "https://github.com/invariantlabs-ai/mcp-scan";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "cedar-docs": {
+        readonly name: "Cedar policy language reference";
+        readonly url: "https://docs.cedarpolicy.com/policies/json-format.html";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "cedar-policy-crate": {
+        readonly name: "cedar-policy crate (PolicySet loader)";
+        readonly url: "https://docs.rs/cedar-policy/latest/cedar_policy/";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly "chart-testing": {
+        readonly name: "chart-testing (ct)";
+        readonly url: "https://github.com/helm/chart-testing";
+        readonly license: "Apache-2.0";
+        readonly kind: "vendor-validator";
+    };
+    readonly "fly-docs": {
+        readonly name: "Fly Machines API reference";
+        readonly url: "https://fly.io/docs/machines/api/machines-resource/";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly gixy: {
+        readonly name: "Gixy";
+        readonly url: "https://github.com/yandex/gixy";
+        readonly license: "MPL-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "kube-bench": {
+        readonly name: "kube-bench";
+        readonly url: "https://github.com/aquasecurity/kube-bench";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly pluto: {
+        readonly name: "Pluto";
+        readonly url: "https://github.com/FairwindsOps/pluto";
+        readonly license: "Apache-2.0";
+        readonly kind: "scanner";
+    };
+    readonly choudoufu: {
+        readonly name: "choudoufu";
+        readonly url: "https://github.com/INTENTIUS/choudoufu";
+        readonly license: "MPL-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "tflint-ruleset-terraform": {
+        readonly name: "tflint-ruleset-terraform";
+        readonly url: "https://github.com/terraform-linters/tflint-ruleset-terraform";
+        readonly license: "MPL-2.0";
+        readonly kind: "scanner";
+    };
+    readonly "terraform-sentinel-policies": {
+        readonly name: "HashiCorp reference Sentinel policies";
+        readonly url: "https://github.com/hashicorp/terraform-sentinel-policies";
+        readonly license: "MPL-2.0";
+        readonly kind: "specification";
+    };
+    readonly "hashicorp-style-guide": {
+        readonly name: "HashiCorp Terraform style guide";
+        readonly url: "https://developer.hashicorp.com/terraform/language/style";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "aws-terraform-prescriptive-guidance": {
+        readonly name: "AWS prescriptive guidance for Terraform";
+        readonly url: "https://docs.aws.amazon.com/prescriptive-guidance/latest/terraform-aws-provider-best-practices/";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "gcp-terraform-best-practices": {
+        readonly name: "Google Cloud Terraform best-practices series";
+        readonly url: "https://docs.cloud.google.com/docs/terraform/best-practices/general-style-structure";
+        readonly license: "n/a";
+        readonly kind: "specification";
+    };
+    readonly "tflint-ruleset-redeploy": {
+        readonly name: "tflint-ruleset-redeploy";
+        readonly url: "https://github.com/RedeployAB/tflint-ruleset-redeploy";
+        readonly license: "0BSD";
+        readonly kind: "scanner";
+    };
+    readonly "tflint-ruleset-avm": {
+        readonly name: "tflint-ruleset-avm (Azure Verified Modules)";
+        readonly url: "https://github.com/Azure/tflint-ruleset-avm";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly tfsec: {
+        readonly name: "tfsec";
+        readonly url: "https://github.com/aquasecurity/tfsec";
+        readonly license: "MIT";
+        readonly kind: "scanner";
+    };
+    readonly semgrep: {
+        readonly name: "Semgrep Registry rules";
+        readonly url: "https://github.com/semgrep/semgrep-rules";
+        readonly license: "Semgrep Rules License v1.0 (proprietary, not an SPDX id)";
+        readonly kind: "scanner";
+    };
+};
+export type PriorArtTool = keyof typeof PRIOR_ART;
+/**
+ * Attach lineage to a catalog in place. A lexicon keeps its lineage in a
+ * sibling `audit-lineage.ts` (one `Record<ruleId, Lineage[]>`) and calls this
+ * once at the bottom of its `audit-catalog.ts`, so the prose metadata and the
+ * credits stay next to each other but the credits can be regenerated by the
+ * prior-art sweep without touching the rule text. Throws at module load if the
+ * lineage names a rule the catalog does not have: a stale id is a bug, not a
+ * silent no-op.
+ */
+export declare function applyLineage<T extends {
+    id: string;
+    lineage?: Lineage[];
+}>(catalog: Record<string, T>, lineage: Record<string, Lineage[]>): void;
+/** Render one lineage entry as "tool rule (relation)" for prose contexts. */
+export declare function lineageLabel(l: Lineage): string;
+//# sourceMappingURL=prior-art.d.ts.map

package/dist/audit/prior-art.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prior-art.d.ts","sourceRoot":"","sources":["../../src/audit/prior-art.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,iEAAiE;AACjE,MAAM,MAAM,eAAe;AACzB,kCAAkC;AAChC,YAAY;AACd,iHAAiH;GAC/G,UAAU;AACZ,4DAA4D;GAC1D,SAAS,CAAC;AAEd,mFAAmF;AACnF,MAAM,WAAW,OAAO;IACtB,kCAAkC;IAClC,IAAI,EAAE,YAAY,CAAC;IACnB,uKAAuK;IACvK,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,IAAI,EAAE,SAAS,GAAG,kBAAkB,GAAG,eAAe,CAAC;CACxD;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkE4B,CAAC;AAEnD,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,SAAS,CAAC;AAElD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,EACxE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,GACjC,IAAI,CAMN;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAG/C"}

package/dist/audit/proof.d.ts

@@ -46,6 +46,22 @@ export declare function extractUnpinnedActions(content: string): Array<{
 }>;
 /** Extract unpinned `image:` references (deduped) from CI YAML. */
 export declare function extractUnpinnedImages(content: string): string[];
+/** One `name = "${expr}"` line, split into the parts the fix reassembles. */
+export interface InterpolationOnlyLine {
+    /** The attribute's name. */
+    name: string;
+    /** The expression inside the interpolation, without the `${` and `}`. */
+    expr: string;
+    /** The same line with the quotes and the `${}` taken off. */
+    unwrapped: string;
+}
+/**
+ * Parse a line whose whole value is one interpolation. Exported because a rule
+ * and its fix have to agree on what counts: the terraform lexicon's TF016
+ * check calls this over a block's source text, and `unwrapInterpolations`
+ * below rewrites exactly the lines it accepts.
+ */
+export declare function interpolationOnlyLine(line: string): InterpolationOnlyLine | undefined;
 /**
  * Produce a deterministic fix + diff for a finding, if one is mechanical.
  * Returns `applied: false` with guidance for non-deterministic findings.