@intentius/chant 0.57.0 → 0.59.0

package/dist/audit/catalog.d.ts

@@ -16,6 +16,8 @@
  * over the small static core map (the cross-cutting COR/EXT ids). A drift-guard
  * test asserts the aggregate stays in sync with the lexicons' post-synth checks.
  */
+import type { Lineage } from "./prior-art.js";
+export { PRIOR_ART, applyLineage, lineageLabel, type Lineage, type LineageRelation, type PriorArtEntry, type PriorArtTool } from "./prior-art.js";
 export type Tier = "merge-worthy" | "report-only";
 /** deterministic = safe auto-fix/diff; guidance = report text only (needs judgment). */
 export type FixKind = "deterministic" | "guidance";
@@ -43,14 +45,42 @@ export interface RuleMeta {
     title: string;
     /** External backing so a finding isn't just chant's opinion. */
     authority?: Authority[];
+    /**
+     * Prior art: the open-source tools whose rules check the same condition
+     * (./prior-art.ts). Credit, not authority — never affects tier or category.
+     */
+    lineage?: Lineage[];
     /** One-line fix guidance (always present). */
     remediation: string;
     /**
      * False if the check reads the chant model (`ctx.entities`) rather than the
      * emitted YAML (`ctx.outputs`) — such a check won't fire on audited YAML.
-     * All current post-synth checks are output-based, so this is true.
+     * Most post-synth checks are output-based, but cpln, fly, fountain, k3s
+     * and render all ship model-based checks with this false.
      */
     yamlBased: boolean;
+    /**
+     * Retired ids this rule used to ship under (chant #2113). A rule id is
+     * public the day it ships. trivy's checks carry `id`, `long_id` and
+     * `aliases` for exactly this reason, so a rename or a scheme migration
+     * doesn't strand every existing reference to the old id. An alias resolves
+     * to this entry wherever a rule id is looked up by a human or a config.
+     * `canonicalRuleId()` (below) is the shared resolver; a `lint.rules` key
+     * and #2111's HCL suppression both go through it (or will, since #2111
+     * lands separately and is not touched by this change).
+     */
+    aliases?: string[];
+    /**
+     * Set when this rule is retired: `true`, or a string explaining what
+     * replaced it / why it no longer fires. A deprecated rule stays in the
+     * catalog rather than being deleted. trivy's `deprecated: true` field lets
+     * a ruleset retire a check without breaking every existing suppression or
+     * dashboard that still names it, so its id keeps resolving (via `aliases`
+     * on whichever rule superseded it, when there is one) and the rules page
+     * still lists it, greyed out, instead of the id going dark with no
+     * explanation.
+     */
+    deprecated?: boolean | string;
 }
 export declare const SCORECARD_TOKEN: Authority;
 export declare const GH_TOKEN: Authority;
@@ -74,6 +104,7 @@ export declare const CWE_DIR_LISTING: Authority;
 export declare const GIXY_ALIAS: Authority;
 export declare const NGINX_STUB_STATUS: Authority;
 export declare const CWE_HARDCODED_CREDS: Authority;
+export declare const HASHICORP_STYLE_GITIGNORE: Authority;
 export declare const CWE_CLEARTEXT: Authority;
 /**
  * Finding category per rule (#415). Curated: security rules are those that
@@ -102,6 +133,7 @@ export declare const RULE_CATALOG: Record<string, RuleMeta>;
 export declare function auditRule(id: string, tier: Tier, fixKind: FixKind, title: string, remediation: string, opts?: {
     authority?: Authority[];
     category?: Category;
+    lineage?: Lineage[];
 }): RuleMeta;
 /**
  * Resolve the effective audit catalog for a set of lexicons: core's static
@@ -115,6 +147,24 @@ export declare function auditRule(id: string, tier: Tier, fixKind: FixKind, titl
 export declare function resolveAuditCatalog(lexicons: string[]): Promise<Record<string, RuleMeta>>;
 /** Look up catalog metadata for a check id, if known. */
 export declare function ruleMeta(id: string): RuleMeta | undefined;
+/**
+ * Resolve a rule id to its canonical form against `catalog` (chant #2113). An
+ * id that is itself a key of `catalog` passes through unchanged (this covers
+ * the common case without scanning every entry's `aliases`); otherwise every
+ * entry's `aliases` is searched for a match, and the id it belongs to is
+ * returned. An id neither a key nor anyone's alias passes through unchanged
+ * too, since this is a best-effort resolver, not a validator, so an unknown
+ * id is a caller's problem, not this function's.
+ *
+ * Exported so a `lint.rules`/preset key that names an alias resolves to the
+ * rule that actually runs (see `resolveConfiguredSeverity`,
+ * `../lint/config.ts`), and so #2111's HCL suppression code can key an
+ * inline `# chant-ignore <id>` off the same resolution once it lands — that
+ * suppression mechanism does not exist yet in this worktree (#2111 is a
+ * separate, parallel issue), so this function is exported now for it to call
+ * later rather than being wired into it here.
+ */
+export declare function canonicalRuleId(id: string, catalog?: Record<string, RuleMeta>): string;
 /** Docs path for the audit rules reference (one anchor per rule id). */
 export declare const RULES_DOC_PATH = "/chant/lint-rules/audit-rules/";
 /** Absolute URL to a rule's entry in the audit rules reference. */

package/dist/audit/catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/audit/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,IAAI,GAAG,cAAc,GAAG,aAAa,CAAC;AAElD,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,eAAe,GAAG,UAAU,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,YAAY,CAAC;AAEnF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAGD,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,QAAQ,EAAE,SAGtB,CAAC;AACF,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,SAG1B,CAAC;AACF,eAAO,MAAM,MAAM,EAAE,SAGpB,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,OAAO,EAAE,SAGrB,CAAC;AACF,eAAO,MAAM,OAAO,EAAE,SAGrB,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,SAGzB,CAAC;AACF,eAAO,MAAM,kBAAkB,EAAE,SAGhC,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,SAGzB,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,iBAAiB,EAAE,SAG/B,CAAC;AACF,eAAO,MAAM,mBAAmB,EAAE,SAGjC,CAAC;AACF,eAAO,MAAM,aAAa,EAAE,SAG3B,CAAC;AAsCF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAsClD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6FjD,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE,GACtD,QAAQ,CAGV;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAqB/F;AAED,yDAAyD;AACzD,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEzD;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAE/D,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C"}
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/audit/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAE/I,MAAM,MAAM,IAAI,GAAG,cAAc,GAAG,aAAa,CAAC;AAElD,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,eAAe,GAAG,UAAU,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,YAAY,CAAC;AAEnF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC/B;AAGD,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,QAAQ,EAAE,SAGtB,CAAC;AACF,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,YAAY,EAAE,SAG1B,CAAC;AACF,eAAO,MAAM,MAAM,EAAE,SAGpB,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,OAAO,EAAE,SAGrB,CAAC;AACF,eAAO,MAAM,OAAO,EAAE,SAGrB,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,SAGzB,CAAC;AACF,eAAO,MAAM,kBAAkB,EAAE,SAGhC,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,cAAc,EAAE,SAG5B,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,SAAS,EAAE,SAGvB,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,gBAAgB,EAAE,SAG9B,CAAC;AACF,eAAO,MAAM,WAAW,EAAE,SAGzB,CAAC;AACF,eAAO,MAAM,eAAe,EAAE,SAG7B,CAAC;AACF,eAAO,MAAM,UAAU,EAAE,SAGxB,CAAC;AACF,eAAO,MAAM,iBAAiB,EAAE,SAG/B,CAAC;AACF,eAAO,MAAM,mBAAmB,EAAE,SAGjC,CAAC;AACF,eAAO,MAAM,yBAAyB,EAAE,SAGvC,CAAC;AACF,eAAO,MAAM,aAAa,EAAE,SAG3B,CAAC;AAuCF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0ClD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA4GjD,CAAC;AAKF;;;;;;;GAOG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,GAC3E,QAAQ,CAaV;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAwB/F;AAED,yDAAyD;AACzD,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEzD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAgB,GAAG,MAAM,CAMpG;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAE/D,mEAAmE;AACnE,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE7C"}

package/dist/audit/core.d.ts

@@ -21,6 +21,7 @@
  */
 import type { Severity } from "../lint/rule.js";
 import type { PostSynthCheck } from "../lint/post-synth.js";
+import type { AuditEntitiesInput } from "../lexicon.js";
 import type { Declarable } from "../declarable.js";
 /**
  * The lexicon whose post-synth checks run against an audited file. Any lexicon
@@ -43,6 +44,16 @@ export interface AuditInput {
      * — checks that read `output.files` (helm, docker) see the whole bundle.
      */
     files?: Record<string, string>;
+    /**
+     * Absolute directory this input's files were read from, set by discovery on
+     * a local walk for the inputs whose `path` names a directory (#2217). It
+     * reaches a lexicon's `auditEntities` as `AuditEntitiesInput.dir`, which is
+     * what lets terraform follow a root module's local `module` calls. Undefined
+     * for a remote tree fetch and for a single-file input.
+     */
+    dir?: string;
+    /** Absolute path of the audited root, when discovery walked one (#2217). The boundary `dir` may read within. */
+    baseDir?: string;
 }
 /** A finding produced by a post-synth check against an audited file. */
 export interface AuditFinding {
@@ -64,6 +75,11 @@ export interface AuditFinding {
      * itself.
      */
     fingerprint?: string;
+    /** Carried verbatim from the producing `PostSynthDiagnostic.missing` (chant #2113) — see its doc comment. */
+    missing?: {
+        kind: string;
+        scope: string;
+    };
 }
 /**
  * Resolve the post-synth checks for a lexicon. Injectable so the core can be
@@ -74,8 +90,15 @@ export type ChecksProvider = (lexicon: AuditLexicon) => Promise<PostSynthCheck[]
  * Parse one classified file's content into the lexicon's entity graph — the
  * parse-to-graph half of the audit (#1567). The returned map is what
  * `ctx.entities` holds during a build, so entity-reading checks run unchanged.
+ * May return a `Promise` for a lexicon whose parser is inherently async (e.g.
+ * terraform's HCL parser); `auditLexicon`'s `entitiesFor` awaits it.
+ *
+ * The second argument carries the input's discovery facts (its path, and the
+ * directory it was read from on a local walk), so a lexicon whose unit of
+ * parsing is a directory can name its scope after that directory and read the
+ * directories it references (#2217).
  */
-export type EntitiesParser = (content: string) => Map<string, Declarable>;
+export type EntitiesParser = (content: string, input?: AuditEntitiesInput) => Map<string, Declarable> | Promise<Map<string, Declarable>>;
 /**
  * Resolve the entities parser for a lexicon (its plugin's `auditEntities`,
  * when it ships one). Injectable so the core can be unit-tested without
@@ -90,6 +113,17 @@ export type EntitiesProvider = (lexicon: AuditLexicon) => Promise<EntitiesParser
 /** Thrown when a lexicon package the audit needs isn't installed. */
 export declare class MissingLexiconError extends Error {
 }
+/**
+ * Mutable out-param for the inline (`# chant-ignore*`) suppression count
+ * (chant #2111): `auditFiles`'s return type stays `AuditFinding[]` for every
+ * existing caller, so a caller that wants the count (`chant audit`'s CLI, for
+ * its summary line) passes this in and reads `.count` back afterward, rather
+ * than `auditFiles` growing a `{findings, suppressedCount}` shape that would
+ * touch every existing call site.
+ */
+export interface SuppressionStats {
+    count: number;
+}
 /**
  * Audit a set of CI files and return all findings. Pure with respect to the
  * filesystem and network — callers supply file contents.
@@ -97,6 +131,7 @@ export declare class MissingLexiconError extends Error {
 export declare function auditFiles(inputs: AuditInput[], opts?: {
     checksProvider?: ChecksProvider;
     entitiesProvider?: EntitiesProvider;
+    suppressionStats?: SuppressionStats;
 }): Promise<AuditFinding[]>;
 /** Label for findings that span more than one file (e.g. duplicate names). */
 export declare const CROSS_FILE = "(cross-file)";

package/dist/audit/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/audit/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAoB,MAAM,oBAAoB,CAAC;AAG3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,KAAK,GACL,QAAQ,GACR,KAAK,GACL,OAAO,GACP,KAAK,GACL,MAAM,GACN,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAElF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;AAa9F;;;;GAIG;AACH,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AA0DjD;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAAE,EACpB,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,cAAc,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAO,GAClF,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzB;AAED,8EAA8E;AAC9E,eAAO,MAAM,UAAU,iBAAiB,CAAC"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../src/audit/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,oBAAoB,CAAC;AAGhG,OAAO,KAAK,EAAE,kBAAkB,EAAiB,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,KAAK,GACL,QAAQ,GACR,KAAK,GACL,OAAO,GACP,KAAK,GACL,MAAM,GACN,UAAU,GACV,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gHAAgH;IAChH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6GAA6G;IAC7G,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,kBAAkB,KACvB,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;AAa9F;;;;GAIG;AACH,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AA0DjD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,UAAU,EAAE,EACpB,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,cAAc,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;CAAO,GACvH,OAAO,CAAC,YAAY,EAAE,CAAC,CAqBzB;AAED,8EAA8E;AAC9E,eAAO,MAAM,UAAU,iBAAiB,CAAC"}

package/dist/audit/discover.d.ts

@@ -21,6 +21,12 @@
  *     `detectTemplate` (which only knows Compose's `services:`) can't see them.
  *   - Helm charts are a directory BUNDLE keyed by `Chart.yaml`; the helm checks
  *     read `output.files`, so the whole chart is one AuditInput.
+ *   - Terraform is also a directory BUNDLE, keyed by that directory's own
+ *     `.tf` filenames, not recursively: a nested directory with its own
+ *     `.tf` files (e.g. `modules/foo`) is its own AuditInput, UNLESS another
+ *     directory's `.tf` calls it as a local module, in which case it is a
+ *     child module of that root and is parsed as part of it (#2217). `.tf`
+ *     isn't YAML/JSON either, so `detectTemplate` can't see it.
  *   - k8s `detectTemplate` matches any `apiVersion`+`kind`, including GCP Config
  *     Connector (`cnrm.cloud.google.com`) resources and fountain
  *     (`fountain.dev/v1`) manifests, so gcp and fountain must be tried first.
@@ -30,7 +36,7 @@
 import type { LexiconPlugin } from "../lexicon.js";
 import type { AuditInput, AuditLexicon } from "./core.js";
 /** Lexicons the auditor knows how to detect and run checks for. */
-export declare const AUDIT_LEXICONS: readonly ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain"];
+export declare const AUDIT_LEXICONS: readonly ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain", "terraform"];
 /**
  * Load the plugins used for detection. Each is loaded in isolation (no
  * cross-lexicon conflict aggregation — detection only reads `detectTemplate`),
@@ -79,11 +85,11 @@ export declare function isCandidatePath(path: string): boolean;
  * (path, filename, a few content markers) with no lexicon plugin involved.
  * Names the lexicon that would have claimed a file when that lexicon isn't
  * installed (#1623). Deliberately coarse: precision comes from the plugin's
- * `detectTemplate`, which is exactly what's missing in that case.
- * `terraform` is not an audit lexicon; `*.tf` is surfaced so the user learns
- * the audit never reads it (see `chant carve`).
+ * `detectTemplate`, which is exactly what's missing in that case. `terraform`
+ * is a lexicon like any other here: a `.tf` file hints at it by name, the
+ * same way `Chart.yaml` hints at helm.
  */
-export type LexiconHint = AuditLexicon | "terraform";
+export type LexiconHint = AuditLexicon;
 export declare function hintLexiconForFile(path: string, content: string): LexiconHint | undefined;
 /** A candidate file that looked like it belonged to a lexicon the audit did not have. */
 export interface UnclaimedFile {
@@ -96,15 +102,26 @@ export interface UnclaimedFile {
  * installed lexicon declined is that plugin's call, not a coverage gap.
  */
 export declare function unclaimedFiles(files: RepoFile[], inputs: AuditInput[], plugins: DetectPlugin[]): UnclaimedFile[];
+/** Where a set of classified files came from, when they came from a local walk (#2217). */
+export interface ClassifyOptions {
+    /**
+     * Absolute path of the directory that was walked. Travels onto the inputs
+     * whose `path` names a directory, so a lexicon's `auditEntities` can read
+     * the files that directory references (terraform's local module calls).
+     * Omit for an in-memory or fetched file set: there is no directory to read.
+     */
+    baseDir?: string;
+}
 /**
  * Classify an in-memory set of repo files into per-lexicon audit inputs. Pure
  * (no fs, no network) so the local walk and the remote tree-fetch share exactly
  * one detection path. Each file maps to at most one lexicon: CI by path,
- * Dockerfiles by name, Helm charts as a bundle, everything else by the
- * precedence-ordered content detectors (delegating to each plugin's
- * `detectTemplate`). Lexicons whose plugin isn't provided are skipped.
+ * Dockerfiles by name, Helm charts and Terraform root modules as directory
+ * bundles, everything else by the precedence-ordered content detectors
+ * (delegating to each plugin's `detectTemplate`). Lexicons whose plugin isn't
+ * provided are skipped.
  */
-export declare function classifyFiles(files: RepoFile[], plugins: DetectPlugin[]): AuditInput[];
+export declare function classifyFiles(files: RepoFile[], plugins: DetectPlugin[], opts?: ClassifyOptions): AuditInput[];
 /**
  * Local discovery: one filesystem walk, candidate-filtered, read into memory,
  * then handed to the shared `classifyFiles`. Detection is skipped for any

package/dist/audit/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,sGAAuG,CAAC;AAEnI;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AAgLD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASrD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAErD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAehH;AA0BD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAiCtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAEvF;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiB1D"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/audit/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAIvD,mEAAmE;AACnE,eAAO,MAAM,cAAc,mHAAoH,CAAC;AAEhJ;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAmB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAe1G;AA8LD,wGAAwG;AACxG,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAKvE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASrD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC;AAEvC,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBzF;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,aAAa,EAAE,CAehH;AAgKD,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,GAAE,eAAoB,GAAG,UAAU,EAAE,CAqClH;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,UAAU,EAAE,CAEvF;AAED,4GAA4G;AAC5G,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CA8B1D"}

package/dist/audit/lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "./prior-art.js";
+export declare const coreAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=lineage.d.ts.map

package/dist/audit/lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lineage.d.ts","sourceRoot":"","sources":["../../src/audit/lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CA0FtD,CAAC"}