@synapsestudios/lintofu 0.0.0-stage → 0.9.0

package/README.md

@@ -1,3 +1,152 @@
-# Temporary Holding Version
+# lintofu
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An ESLint plugin for linting [OpenTofu](https://opentofu.org) configurations.
+
+> [!WARNING]
+> The parser depends on Go's [`syscall/js`](https://pkg.go.dev/syscall/js), which the Go team has declared experimental and exempt from the Go compatibility promise. A future Go release can break us. `lintofu` will stay on `0.x` until `syscall/js` stabilizes or we replace it. See [ADR 0001](./docs/adr/0001-syscall-js-experimental.md).
+
+Pre-1.0. API and rule set may change. Published to GitHub Packages under the `@synapsestudios` scope while it's being tested internally; a move to the public npm registry will follow.
+
+**Documentation:** [synapsestudios.github.io/lintofu](https://synapsestudios.github.io/lintofu/) covers the user guide, the developer guide, and the full rule index. The same pages are in [`docs/`](./docs), which is what resolves when reading this file from the npm tarball.
+
+## What it is
+
+`lintofu` is an **ESLint language plugin** (the same mechanism that powers [`@eslint/json`](https://github.com/eslint/json) and [`@eslint/css`](https://github.com/eslint/css)). It parses `.tf` and `.tofu` files using HashiCorp's own `hcl/v2` parser (compiled to WebAssembly) and exposes the AST to ESLint rules so you can enforce OpenTofu coding conventions alongside the rest of your ESLint rules.
+
+## Scope
+
+`lintofu` checks syntactic and stylistic conventions: documentation, pinning, and the structural patterns listed in the [rule index](./docs/rules/index.md). Its boundaries:
+
+- Semantic validation belongs to `tofu validate`. `lintofu` leaves that to OpenTofu.
+- Semantic and evaluated rules (type-checking, symbol resolution) belong to the future built-in linter described in the [OpenTofu linting RFC](https://github.com/opentofu/opentofu/pull/3999), which needs the full language runtime. `lintofu` stays on the syntactic and stylistic side, where ESLint's ecosystem already fits.
+- `lintofu` is a fresh ESLint-native tool. It shares no code with TFLint, which lacks OpenTofu-specific feature support.
+
+## Install
+
+```sh
+npm install --save-dev @synapsestudios/lintofu
+```
+
+The package lives in GitHub Packages, so consumers need an `.npmrc` that maps the `@synapsestudios` scope to the registry and supplies a token with `read:packages`:
+
+```
+@synapsestudios:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}
+```
+
+Requires Node ^20.19, ^22.13, or >=24 and ESLint ^9 || ^10.
+
+## Supported versions
+
+Providers: latest major plus one prior (AWS provider v6 and v5 today); older majors are best effort. Rules that only apply from a given provider major declare it in `meta.docs.appliesTo`. Full policy in [ADR 0005](./docs/adr/0005-version-support-policy.md).
+
+The parser wraps HashiCorp's `hcl/v2`, which parses HCL2, the syntax that shipped with Terraform 0.12. That sets a hard floor: Terraform 0.12 and newer parse, Terraform 0.11 and older (HCL1) do not. OpenTofu forked from Terraform 1.5, so every OpenTofu release is above the floor.
+
+Above the floor, the same ADR defines the per-generation status:
+
+<!-- lintofu:support-matrix:start -->
+
+| Tool      | Versions       | Status      |
+| --------- | -------------- | ----------- |
+| OpenTofu  | 1.6 and newer  | supported   |
+| Terraform | 1.0 and newer  | supported   |
+| Terraform | 0.12 – 0.15    | best effort |
+| Terraform | 0.11 and older | unsupported |
+
+<!-- lintofu:support-matrix:end -->
+
+- **supported**: generations the rules are written for; advice is kept valid for them as part of normal maintenance.
+- **best effort**: configurations parse and lint. Many rules exist specifically to flag upgrade hazards in these generations (legacy `list(...)`/`map(...)`, quoted type constraints, and friends), but we fix issues as they're reported rather than checking proactively.
+- **unsupported**: HCL1 syntax. The parser rejects these files.
+
+These statuses are policy commitments, not CI results: no workflow runs real OpenTofu or Terraform binaries yet. This table is maintained by hand and will be replaced by generated output once the version test harness exists.
+
+<!-- lintofu:tested-versions:start -->
+
+## Tested provider versions
+
+Provider-specific rules are validated against these versions. [`provider-versions.json`](./provider-versions.json) is the source of truth; edit it and run `npm run docs:versions` to update this section. CI fails if the two drift.
+
+- aws provider v6.42.0
+- cloudflare provider v5.24.0
+
+<!-- lintofu:tested-versions:end -->
+
+## Usage
+
+```js
+// eslint.config.js
+import lintofu from "@synapsestudios/lintofu";
+
+export default [lintofu.configs.recommended];
+```
+
+Or wire up manually for full control:
+
+```js
+// eslint.config.js
+import lintofu from "@synapsestudios/lintofu";
+
+export default [
+  {
+    files: ["**/*.tf", "**/*.tofu"],
+    plugins: { lintofu },
+    language: "lintofu/opentofu",
+    rules: {
+      "lintofu/documented-variables": "error",
+      "lintofu/required-providers-pinned": "error",
+    },
+  },
+];
+```
+
+## Rules
+
+Every rule's description, severity, category, recommended flag, and autofix
+support lives in the generated rule index:
+
+- **[Rule index](https://synapsestudios.github.io/lintofu/rules/)** on the
+  documentation site
+- [`docs/rules/index.md`](./docs/rules/index.md) in this repository, the same
+  content, which resolves here today while the site is still private
+
+The index is generated from each rule's `meta.docs` by `npm run docs:rules`, and
+CI fails on a rule with no docs page or a stale index, so it cannot drift from
+the rules that actually ship.
+
+## Requesting a rule
+
+To suggest a new rule, open a [rule request](https://github.com/synapsestudios/lintofu/issues/new?template=rule-request.yml). The form asks for a snippet the rule should flag, the compliant form, a category, a suggested severity, whether an autofix seems possible, and any references. A maintainer turns the request into a rule issue from there.
+
+## Parser services
+
+Rules can reach a lazily-built, cross-file index through
+`context.sourceCode.parserServices.projectIndex`. The `ProjectIndex` interface
+and its module-directory scope are documented in the developer guide:
+[on the site](https://synapsestudios.github.io/lintofu/developer-guide/parser-services)
+or [`docs/developer-guide/parser-services.md`](./docs/developer-guide/parser-services.md)
+in this repository.
+
+## Writing your own rule
+
+`lintofu` re-exports the rule-authoring types it uses internally, so a custom
+rule type-checks without reaching into private modules. The worked example is in
+the developer guide:
+[on the site](https://synapsestudios.github.io/lintofu/developer-guide/writing-a-rule)
+or [`docs/developer-guide/writing-a-rule.md`](./docs/developer-guide/writing-a-rule.md)
+in this repository.
+
+## Architecture
+
+The parser is Go: `github.com/hashicorp/hcl/v2/hclsyntax` compiled to
+WebAssembly. The full picture is in the developer guide:
+[on the site](https://synapsestudios.github.io/lintofu/developer-guide/architecture)
+or [`docs/developer-guide/architecture.md`](./docs/developer-guide/architecture.md)
+in this repository.
+
+## Known limitations
+
+- **Experimental dependency on `syscall/js`.** See [ADR 0001](./docs/adr/0001-syscall-js-experimental.md). The project inherits its experimental status from Go's WASM JS interop package. Pinning a Go version in CI is the mitigation.
+- **`.tf.json` / `.tofu.json` not supported.** The JSON form of HCL is not 1:1 with native syntax; see [hashicorp/hcl#627 for the rationale](https://github.com/hashicorp/hcl/issues/627).
+- **No TFLint custom-rule compatibility.** An opinionated migration example may land later; a general compatibility layer is not planned for early releases.
+- **Performance is unprofiled.** Go+WASM boot costs ~100ms per ESLint process; per-file parse is sub-millisecond after boot.

package/dist/configs/category-recommended.d.ts

@@ -0,0 +1,3 @@
+import { type RuleWithDocs } from '../rules/types.js';
+export declare function buildCategoryRecommendedRules(rules: Record<string, RuleWithDocs>, category: string): Record<string, 'error' | 'warn'>;
+//# sourceMappingURL=category-recommended.d.ts.map

package/dist/configs/category-recommended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"category-recommended.d.ts","sourceRoot":"","sources":["../../src/configs/category-recommended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EACnC,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CASlC"}

package/dist/configs/category-recommended.js

@@ -0,0 +1,12 @@
+import { resolveRuleSeverity } from '../rules/types.js';
+export function buildCategoryRecommendedRules(rules, category) {
+    const out = {};
+    for (const [name, rule] of Object.entries(rules)) {
+        const docs = rule.meta?.docs;
+        if (docs?.recommended === true && docs.category === category) {
+            out[`lintofu/${name}`] = resolveRuleSeverity(docs);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=category-recommended.js.map

package/dist/configs/category-recommended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"category-recommended.js","sourceRoot":"","sources":["../../src/configs/category-recommended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAqB,MAAM,mBAAmB,CAAC;AAE3E,MAAM,UAAU,6BAA6B,CAC3C,KAAmC,EACnC,QAAgB;IAEhB,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7B,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC7D,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/configs/recommended.d.ts

@@ -0,0 +1,3 @@
+import { type RuleWithDocs } from '../rules/types.js';
+export declare function buildRecommendedRules(rules: Record<string, RuleWithDocs>): Record<string, 'error' | 'warn'>;
+//# sourceMappingURL=recommended.d.ts.map

package/dist/configs/recommended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommended.d.ts","sourceRoot":"","sources":["../../src/configs/recommended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CASlC"}

package/dist/configs/recommended.js

@@ -0,0 +1,12 @@
+import { resolveRuleSeverity } from '../rules/types.js';
+export function buildRecommendedRules(rules) {
+    const out = {};
+    for (const [name, rule] of Object.entries(rules)) {
+        const docs = rule.meta?.docs;
+        if (docs?.recommended === true) {
+            out[`lintofu/${name}`] = resolveRuleSeverity(docs);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=recommended.js.map

package/dist/configs/recommended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommended.js","sourceRoot":"","sources":["../../src/configs/recommended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAqB,MAAM,mBAAmB,CAAC;AAE3E,MAAM,UAAU,qBAAqB,CACnC,KAAmC;IAEnC,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7B,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,198 @@
+import type { Plugin } from '@eslint/core';
+import { OpenTofuLanguage } from './language.js';
+interface TierConfig {
+    plugins: Record<string, Plugin>;
+    files: string[];
+    language: string;
+    rules: Record<string, 'error' | 'warn'>;
+}
+/**
+ * the lintofu eslint plugin: `meta`, the `lintofu/opentofu` language,
+ * every bundled rule, and the generated `recommended` and
+ * `<provider>/recommended` configs.
+ */
+declare const plugin: {
+    /** plugin name and version eslint reports. */
+    meta: {
+        name: string;
+        version: string;
+    };
+    /**
+     * the opentofu/terraform hcl language implementation; select it with
+     * `language: 'lintofu/opentofu'`.
+     */
+    languages: {
+        opentofu: OpenTofuLanguage;
+    };
+    /** every bundled rule, keyed by rule name. */
+    rules: {
+        'documented-variables': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingDescription";
+        }>;
+        'no-reserved-variable-names': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "reservedName";
+        }>;
+        'documented-outputs': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingDescription";
+        }>;
+        'required-providers-pinned': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "unpinnedProvider";
+        }>;
+        'provider-source-required': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingSource" | "legacyStringForm";
+        }>;
+        'module-source-pinned': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "unpinnedSource";
+        }>;
+        'prefer-bare-expression': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "preferBareExpression";
+        }>;
+        'no-legacy-list-function': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyListFunction";
+        }>;
+        'no-legacy-map-function': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyMapFunction";
+        }>;
+        'no-bool-as-count': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "boolAsCount";
+        }>;
+        'no-legacy-provider-proxy': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyProviderProxy";
+        }>;
+        'no-template-provider': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "useTemplatefile" | "useCloudinitProvider" | "archivedTemplateProvider";
+        }>;
+        'no-terraform-env-reference': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "terraformEnvReference";
+        }>;
+        'no-quoted-type-constraints': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "quotedTypeConstraint";
+        }>;
+        'no-splat-bracket-index': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "splatBracketIndex";
+        }>;
+        'remote-state-outputs-prefix': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingOutputsPrefix";
+        }>;
+        'no-external-refs-in-destroy-provisioner': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "disallowedReference";
+        }>;
+        'no-legacy-ignore-changes-wildcard': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyIgnoreChangesWildcard";
+        }>;
+        'no-legacy-count-attribute': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyCountAttribute";
+        }>;
+        'no-iam-role-inline-policies': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "inlinePolicy" | "managedPolicyArns";
+        }>;
+        'no-legacy-security-group-rules': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacySecurityGroupRule";
+        }>;
+        'no-mixed-security-group-rule-forms': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "mixedForms";
+        }>;
+        'no-pinned-minor-with-auto-upgrade': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "pinnedMinorWithAutoUpgrade";
+        }>;
+        'no-aurora-pinned-minor-with-auto-upgrade': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "pinnedMinorWithAutoUpgrade";
+        }>;
+        'no-iam-policy-attachment': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "iamPolicyAttachment";
+        }>;
+        'no-s3-bucket-inline-config': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "inlineConfig";
+        }>;
+        'no-legacy-dot-index': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "dotIndex" | "dotSplat";
+        }>;
+        'no-legacy-lookup': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyLookup";
+        }>;
+        'no-quoted-depends-on': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "quotedDependsOn";
+        }>;
+        'no-quoted-provider-reference': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "quotedProviderReference";
+        }>;
+        'no-quoted-ignore-changes': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "quotedIgnoreChanges";
+        }>;
+        'no-empty-list-equality': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "emptyListEquality";
+        }>;
+        'no-winrm-connection': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "winrmConnection";
+        }>;
+        'typed-variables': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingType";
+        }>;
+        'no-eip-vpc-attribute': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "eipVpcAttribute";
+        }>;
+        'no-instance-cpu-count-attributes': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "cpuCountAttribute";
+        }>;
+        'required-version-declared': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingRequiredVersion";
+        }>;
+        'no-duplicate-map-keys': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "duplicateMapKey";
+        }>;
+        'no-provider-version-constraint': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "providerVersionConstraint";
+        }>;
+        'no-db-instance-name-attribute': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "dbInstanceName";
+        }>;
+        'no-eks-addon-resolve-conflicts': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "resolveConflicts";
+        }>;
+        'no-api-gateway-deployment-stage-args': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "deploymentStageArg";
+        }>;
+        'no-s3-bucket-object': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "deprecatedS3BucketObject";
+        }>;
+        'no-hardcoded-provider-credentials': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "hardcodedCredential";
+        }>;
+        'no-deprecated-lambda-runtime': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "deprecatedRuntime";
+        }>;
+        'acm-certificate-create-before-destroy-required': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingCreateBeforeDestroy";
+        }>;
+        'access-rule-country-block-requires-enterprise': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "countryBlockRequiresEnterprise" | "invalidPlan";
+        }>;
+        'ruleset-requires-managed-by-description': import("./types.js").OpenTofuRuleDefinition<{
+            RuleOptions: [{
+                description?: string;
+            }?];
+            MessageIds: "missingDescription";
+        }>;
+        'dns-record-requires-managed-by-annotation': import("./types.js").OpenTofuRuleDefinition<{
+            RuleOptions: [{
+                comment?: string;
+                tag?: string;
+            }?];
+            MessageIds: "missingComment" | "missingTag" | "invalidPlan";
+        }>;
+    };
+    configs: {
+        "aws/recommended": TierConfig;
+        "cloudflare/recommended": TierConfig;
+        /**
+         * every rule with `recommended: true`, at its declared severity
+         * (error when the rule omits one). preconfigured for `.tf` and
+         * `.tofu` files.
+         */
+        recommended: TierConfig;
+    };
+};
+export default plugin;
+export { OpenTofuLanguage } from './language.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAejD,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;CACzC;AAkBD;;;;GAIG;AACH,QAAA,MAAM,MAAM;IACV,8CAA8C;;;;;IAK9C;;;OAGG;;;;IAIH,8CAA8C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAvD9B,CAAC;;;;;;uBAsClB,CAAD;mBAAa,CAAC;;;;;;;;QAoBV;;;;WAIG;;;CASN,CAAC;AAMF,eAAe,MAAM,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,65 @@
+import { buildCategoryRecommendedRules } from './configs/category-recommended.js';
+import { buildRecommendedRules } from './configs/recommended.js';
+import { OpenTofuLanguage } from './language.js';
+import { initialize } from './parser/index.js';
+import { rules } from './rules/index.js';
+// ESLint's Language.parse contract is sync; this top-level await blocks
+// the plugin export until the WASM parser is ready. ESLint's config loader
+// uses dynamic import which awaits TLA, so consumers don't see the boot.
+await initialize();
+const TOFU_FILES = ['**/*.tf', '**/*.tofu'];
+const PROVIDER_CATEGORIES = ['aws', 'cloudflare'];
+function tierConfig(tierRules) {
+    return {
+        plugins: {},
+        files: TOFU_FILES,
+        language: 'lintofu/opentofu',
+        rules: tierRules,
+    };
+}
+const providerConfigs = Object.fromEntries(PROVIDER_CATEGORIES.map((category) => [
+    `${category}/recommended`,
+    tierConfig(buildCategoryRecommendedRules(rules, category)),
+]));
+/**
+ * the lintofu eslint plugin: `meta`, the `lintofu/opentofu` language,
+ * every bundled rule, and the generated `recommended` and
+ * `<provider>/recommended` configs.
+ */
+const plugin = {
+    /** plugin name and version eslint reports. */
+    meta: {
+        name: 'lintofu',
+        version: '0.0.0',
+    },
+    /**
+     * the opentofu/terraform hcl language implementation; select it with
+     * `language: 'lintofu/opentofu'`.
+     */
+    languages: {
+        opentofu: new OpenTofuLanguage(),
+    },
+    /** every bundled rule, keyed by rule name. */
+    rules,
+    configs: {
+        /**
+         * every rule with `recommended: true`, at its declared severity
+         * (error when the rule omits one). preconfigured for `.tf` and
+         * `.tofu` files.
+         */
+        recommended: tierConfig(buildRecommendedRules(rules)),
+        /**
+         * one `<provider>/recommended` config per provider category, holding
+         * the recommended rules of that category. same file coverage as
+         * `recommended`.
+         */
+        ...providerConfigs,
+    },
+};
+for (const config of Object.values(plugin.configs)) {
+    config.plugins = { lintofu: plugin };
+}
+export default plugin;
+export { OpenTofuLanguage } from './language.js';
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,UAAU,EAAE,CAAC;AAEnB,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAE5C,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,YAAY,CAAU,CAAC;AAW3D,SAAS,UAAU,CAAC,SAA2C;IAC7D,OAAO;QACL,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,kBAAkB;QAC5B,KAAK,EAAE,SAAS;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CACxC,mBAAmB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpC,GAAG,QAAQ,cAAc;IACzB,UAAU,CAAC,6BAA6B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;CAC3D,CAAC,CACsD,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,GAAG;IACb,8CAA8C;IAC9C,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;KACjB;IACD;;;OAGG;IACH,SAAS,EAAE;QACT,QAAQ,EAAE,IAAI,gBAAgB,EAAE;KACjC;IACD,8CAA8C;IAC9C,KAAK;IACL,OAAO,EAAE;QACP;;;;WAIG;QACH,WAAW,EAAE,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrD;;;;WAIG;QACH,GAAG,eAAe;KACnB;CACF,CAAC;AAEF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,MAAM,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,eAAe,MAAM,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,cAAc,YAAY,CAAC"}

package/dist/language.d.ts

@@ -0,0 +1,34 @@
+import type { File, Language, LanguageContext, OkParseResult, ParseResult } from '@eslint/core';
+import { type Body } from './parser/index.js';
+import { OpenTofuSourceCode } from './source-code.js';
+/**
+ * The eslint Language implementation for opentofu/terraform hcl. The plugin
+ * registers it as `lintofu/opentofu`.
+ */
+export declare class OpenTofuLanguage implements Language {
+    readonly fileType: "text";
+    /** 1-indexed lines. */
+    readonly lineStart: 1;
+    /** 1-indexed columns. */
+    readonly columnStart: 1;
+    readonly nodeTypeKey = "type";
+    /**
+     * No-op. The Language interface requires this method even when there are
+     * no options to validate.
+     */
+    validateLanguageOptions(_languageOptions: unknown): void;
+    /**
+     * Parses hcl. Parser diagnostics with severity 'error' fail the parse;
+     * warnings do not. Comments ride on the parse result's open index
+     * signature and are read back in {@link OpenTofuLanguage.createSourceCode};
+     * they are not part of the ast.
+     */
+    parse(file: File, _context: LanguageContext): ParseResult<Body>;
+    /**
+     * Builds the {@link OpenTofuSourceCode} rules receive as
+     * `context.sourceCode`. The module directory is the dirname of the file's
+     * physical path, which scopes the project index.
+     */
+    createSourceCode(file: File, parseResult: OkParseResult<Body>, _context: LanguageContext): OpenTofuSourceCode;
+}
+//# sourceMappingURL=language.d.ts.map

package/dist/language.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"language.d.ts","sourceRoot":"","sources":["../src/language.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,IAAI,EACJ,QAAQ,EACR,eAAe,EACf,aAAa,EACb,WAAW,EACZ,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,IAAI,EAA2B,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,QAAQ,CAAC,QAAQ,EAAG,MAAM,CAAU;IACpC,uBAAuB;IACvB,QAAQ,CAAC,SAAS,EAAG,CAAC,CAAU;IAChC,yBAAyB;IACzB,QAAQ,CAAC,WAAW,EAAG,CAAC,CAAU;IAClC,QAAQ,CAAC,WAAW,UAAU;IAE9B;;;OAGG;IAEH,uBAAuB,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAExD;;;;;OAKG;IACH,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC;IAwB/D;;;;OAIG;IACH,gBAAgB,CACd,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,EAChC,QAAQ,EAAE,eAAe,GACxB,kBAAkB;CActB"}

package/dist/language.js

@@ -0,0 +1,72 @@
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { parseSync } from './parser/index.js';
+import { OpenTofuSourceCode } from './source-code.js';
+/**
+ * The eslint Language implementation for opentofu/terraform hcl. The plugin
+ * registers it as `lintofu/opentofu`.
+ */
+export class OpenTofuLanguage {
+    fileType = 'text';
+    /** 1-indexed lines. */
+    lineStart = 1;
+    /** 1-indexed columns. */
+    columnStart = 1;
+    nodeTypeKey = 'type';
+    /**
+     * No-op. The Language interface requires this method even when there are
+     * no options to validate.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    validateLanguageOptions(_languageOptions) { }
+    /**
+     * Parses hcl. Parser diagnostics with severity 'error' fail the parse;
+     * warnings do not. Comments ride on the parse result's open index
+     * signature and are read back in {@link OpenTofuLanguage.createSourceCode};
+     * they are not part of the ast.
+     */
+    parse(file, _context) {
+        const text = typeof file.body === 'string'
+            ? file.body
+            : new TextDecoder().decode(file.body);
+        const result = parseSync(text, { filename: file.path });
+        const errors = result.diagnostics.filter((d) => d.severity === 'error');
+        if (errors.length > 0) {
+            return {
+                ok: false,
+                errors: errors.map((d) => ({
+                    message: d.summary,
+                    line: d.range.start.line,
+                    column: d.range.start.column,
+                    endLine: d.range.end.line,
+                    endColumn: d.range.end.column,
+                })),
+            };
+        }
+        return { ok: true, ast: result.ast, comments: result.comments };
+    }
+    /**
+     * Builds the {@link OpenTofuSourceCode} rules receive as
+     * `context.sourceCode`. The module directory is the dirname of the file's
+     * physical path, which scopes the project index.
+     */
+    createSourceCode(file, parseResult, _context) {
+        const text = typeof file.body === 'string'
+            ? file.body
+            : new TextDecoder().decode(file.body);
+        const moduleDir = deriveModuleDir(file.physicalPath);
+        const comments = parseResult.comments ?? [];
+        return new OpenTofuSourceCode({
+            text,
+            ast: parseResult.ast,
+            comments,
+            moduleDir,
+        });
+    }
+}
+function deriveModuleDir(filePath) {
+    if (!filePath)
+        return undefined;
+    const abs = isAbsolute(filePath) ? filePath : resolve(filePath);
+    return dirname(abs);
+}
+//# sourceMappingURL=language.js.map

package/dist/language.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"language.js","sourceRoot":"","sources":["../src/language.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAA2B,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAClB,QAAQ,GAAG,MAAe,CAAC;IACpC,uBAAuB;IACd,SAAS,GAAG,CAAU,CAAC;IAChC,yBAAyB;IAChB,WAAW,GAAG,CAAU,CAAC;IACzB,WAAW,GAAG,MAAM,CAAC;IAE9B;;;OAGG;IACH,gEAAgE;IAChE,uBAAuB,CAAC,gBAAyB,IAAS,CAAC;IAE3D;;;;;OAKG;IACH,KAAK,CAAC,IAAU,EAAE,QAAyB;QACzC,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;oBACxB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;oBAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI;oBACzB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM;iBAC9B,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CACd,IAAU,EACV,WAAgC,EAChC,QAAyB;QAEzB,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAI,WAAW,CAAC,QAAkC,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,kBAAkB,CAAC;YAC5B,IAAI;YACJ,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC"}

package/dist/parser/index.d.ts

@@ -0,0 +1,10 @@
+import type { ParseResult } from './types.js';
+export type * from './types.js';
+export declare function initialize(): Promise<void>;
+export declare function parseSync(source: string, opts?: {
+    filename?: string;
+}): ParseResult;
+export declare function parse(source: string, opts?: {
+    filename?: string;
+}): Promise<ParseResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/parser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,mBAAmB,YAAY,CAAC;AAwChC,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhD;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,WAAW,CAUb;AAED,wBAAsB,KAAK,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,WAAW,CAAC,CAGtB"}