@synapsestudios/lintofu 0.0.0-stage → 0.9.0

package/dist/rules/aws/utils.js

@@ -0,0 +1,17 @@
+import { findAttribute, literalStringValue } from '../core/utils.js';
+export function engineName(block) {
+    const attr = findAttribute(block.body.attributes, 'engine');
+    if (!attr)
+        return undefined;
+    return literalStringValue(attr.expression);
+}
+export function autoMinorUpgradeEnabled(block) {
+    const attr = findAttribute(block.body.attributes, 'auto_minor_version_upgrade');
+    if (!attr)
+        return true;
+    const expr = attr.expression;
+    if (expr.type !== 'LiteralValueExpr')
+        return false;
+    return expr.value !== false;
+}
+//# sourceMappingURL=utils.js.map

package/dist/rules/aws/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/rules/aws/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,UAAU,UAAU,CAAC,KAAY;IACrC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAY;IAClD,MAAM,IAAI,GAAG,aAAa,CACxB,KAAK,CAAC,IAAI,CAAC,UAAU,EACrB,4BAA4B,CAC7B,CAAC;IACF,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;AAC9B,CAAC"}

package/dist/rules/cloudflare/access-rule-country-block-requires-enterprise.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'countryBlockRequiresEnterprise' | 'invalidPlan';
+}>;
+export default rule;
+//# sourceMappingURL=access-rule-country-block-requires-enterprise.d.ts.map

package/dist/rules/cloudflare/access-rule-country-block-requires-enterprise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-rule-country-block-requires-enterprise.d.ts","sourceRoot":"","sources":["../../../src/rules/cloudflare/access-rule-country-block-requires-enterprise.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA6B7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,gCAAgC,GAAG,aAAa,CAAC;CAC9D,CAgDA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/cloudflare/access-rule-country-block-requires-enterprise.js

@@ -0,0 +1,66 @@
+import { findAttribute, literalAttributeValue, literalStringValue, objectItemKeyName, } from '../core/utils.js';
+import { entitlesCountryBlock, INVALID_PLAN_MESSAGE, readCloudflarePlan, } from './utils.js';
+function configurationTarget(block) {
+    const attr = findAttribute(block.body.attributes, 'configuration');
+    if (attr?.expression.type !== 'ObjectConsExpr')
+        return undefined;
+    const target = attr.expression.items.find((item) => objectItemKeyName(item) === 'target');
+    return target ? literalStringValue(target.valueExpr) : undefined;
+}
+function blocksByCountry(block) {
+    return (literalAttributeValue(block, 'mode') === 'block' &&
+        configurationTarget(block) === 'country');
+}
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flag a `cloudflare_access_rule` that blocks by country while `settings.lintofu.cloudflare.plan` is below Enterprise, the only plan Cloudflare allows it on.',
+            recommended: true,
+            severity: 'error',
+            category: 'cloudflare',
+            appliesTo: { cloudflare: '>=5.0.0' },
+        },
+        messages: {
+            countryBlockRequiresEnterprise: 'Blocking by country in a Cloudflare IP Access rule requires the Enterprise plan. The configured plan is "{{plan}}", so this resource fails at apply.',
+            invalidPlan: INVALID_PLAN_MESSAGE,
+        },
+        schema: [],
+    },
+    create(context) {
+        const setting = readCloudflarePlan(context.settings);
+        if (setting.state === 'invalid') {
+            return {
+                Body(node) {
+                    if (node !== context.sourceCode.ast)
+                        return;
+                    context.report({
+                        node,
+                        messageId: 'invalidPlan',
+                        data: { value: setting.value },
+                    });
+                },
+            };
+        }
+        if (setting.state === 'unset' || entitlesCountryBlock(setting.plan)) {
+            return {};
+        }
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'cloudflare_access_rule')
+                    return;
+                if (!blocksByCountry(node))
+                    return;
+                context.report({
+                    node,
+                    messageId: 'countryBlockRequiresEnterprise',
+                    data: { plan: setting.plan },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=access-rule-country-block-requires-enterprise.js.map

package/dist/rules/cloudflare/access-rule-country-block-requires-enterprise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-rule-country-block-requires-enterprise.js","sourceRoot":"","sources":["../../../src/rules/cloudflare/access-rule-country-block-requires-enterprise.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,SAAS,mBAAmB,CAAC,KAAY;IACvC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACnE,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CACvC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAC/C,CAAC;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,KAAY;IACnC,OAAO,CACL,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,OAAO;QAChD,mBAAmB,CAAC,KAAK,CAAC,KAAK,SAAS,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAEL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,6JAA6J;YAC/J,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;SACrC;QACD,QAAQ,EAAE;YACR,8BAA8B,EAC5B,sJAAsJ;YACxJ,WAAW,EAAE,oBAAoB;SAClC;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO;gBACL,IAAI,CAAC,IAAI;oBACP,IAAI,IAAI,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;wBAAE,OAAO;oBAC5C,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,aAAa;wBACxB,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;qBAC/B,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,wBAAwB;oBAAE,OAAO;gBACxD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;oBAAE,OAAO;gBACnC,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,gCAAgC;oBAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;iBAC7B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/cloudflare/dns-record-requires-managed-by-annotation.d.ts

@@ -0,0 +1,10 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    RuleOptions: [{
+        comment?: string;
+        tag?: string;
+    }?];
+    MessageIds: 'missingComment' | 'missingTag' | 'invalidPlan';
+}>;
+export default rule;
+//# sourceMappingURL=dns-record-requires-managed-by-annotation.d.ts.map

package/dist/rules/cloudflare/dns-record-requires-managed-by-annotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-record-requires-managed-by-annotation.d.ts","sourceRoot":"","sources":["../../../src/rules/cloudflare/dns-record-requires-managed-by-annotation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAuC7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,WAAW,EAAE,CAAC;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACnD,UAAU,EAAE,gBAAgB,GAAG,YAAY,GAAG,aAAa,CAAC;CAC7D,CA+EA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/cloudflare/dns-record-requires-managed-by-annotation.js

@@ -0,0 +1,104 @@
+import { findAttribute, findLiteralMismatch, literalStringValue, } from '../core/utils.js';
+import { entitlesDnsRecordTags, INVALID_PLAN_MESSAGE, readCloudflarePlan, } from './utils.js';
+const DEFAULT_COMMENT = 'Managed by terraform';
+const DEFAULT_TAG = 'managed-by:terraform';
+// Cloudflare compares tag names without case and tag values with case.
+function tagsMatch(candidate, tag) {
+    const [candidateName, ...candidateValue] = candidate.split(':');
+    const [tagName, ...tagValue] = tag.split(':');
+    return (candidateName?.toLowerCase() === tagName?.toLowerCase() &&
+        candidateValue.join(':') === tagValue.join(':'));
+}
+function findMissingTag(block, tag) {
+    const attr = findAttribute(block.body.attributes, 'tags');
+    if (!attr)
+        return block;
+    if (attr.expression.type !== 'TupleConsExpr')
+        return undefined;
+    const values = attr.expression.exprs.map(literalStringValue);
+    if (values.some((value) => value !== undefined && tagsMatch(value, tag))) {
+        return undefined;
+    }
+    return values.includes(undefined) ? undefined : attr;
+}
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Require a `cloudflare_dns_record` to carry the configured `comment`, plus the configured tag when `settings.lintofu.cloudflare.plan` is Pro or higher, so the record shows it is managed by Terraform.',
+            recommended: true,
+            severity: 'warn',
+            category: 'cloudflare',
+            appliesTo: { cloudflare: '>=5.0.0' },
+        },
+        messages: {
+            missingComment: 'Set the DNS record `comment` to "{{comment}}" to mark it as managed by Terraform.',
+            missingTag: 'Add "{{tag}}" to the DNS record `tags` to mark it as managed by Terraform. The configured "{{plan}}" plan supports DNS record tags.',
+            invalidPlan: INVALID_PLAN_MESSAGE,
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    comment: {
+                        type: 'string',
+                        description: 'The exact `comment` that marks a DNS record as managed by Terraform.',
+                    },
+                    tag: {
+                        type: 'string',
+                        description: 'The `name:value` tag that marks a DNS record as managed by Terraform. The name matches without case and the value with case.',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+        defaultOptions: [{ comment: DEFAULT_COMMENT, tag: DEFAULT_TAG }],
+    },
+    create(context) {
+        const comment = context.options[0]?.comment ?? DEFAULT_COMMENT;
+        const tag = context.options[0]?.tag ?? DEFAULT_TAG;
+        const setting = readCloudflarePlan(context.settings);
+        const tagPlan = setting.state === 'valid' && entitlesDnsRecordTags(setting.plan)
+            ? setting.plan
+            : undefined;
+        return {
+            Body(node) {
+                if (setting.state !== 'invalid')
+                    return;
+                if (node !== context.sourceCode.ast)
+                    return;
+                context.report({
+                    node,
+                    messageId: 'invalidPlan',
+                    data: { value: setting.value },
+                });
+            },
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'cloudflare_dns_record')
+                    return;
+                const commentMismatch = findLiteralMismatch(node, 'comment', comment);
+                if (commentMismatch) {
+                    context.report({
+                        node: commentMismatch,
+                        messageId: 'missingComment',
+                        data: { comment },
+                    });
+                }
+                if (tagPlan === undefined)
+                    return;
+                const missingTag = findMissingTag(node, tag);
+                if (missingTag) {
+                    context.report({
+                        node: missingTag,
+                        messageId: 'missingTag',
+                        data: { tag, plan: tagPlan },
+                    });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=dns-record-requires-managed-by-annotation.js.map

package/dist/rules/cloudflare/dns-record-requires-managed-by-annotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-record-requires-managed-by-annotation.js","sourceRoot":"","sources":["../../../src/rules/cloudflare/dns-record-requires-managed-by-annotation.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C,uEAAuE;AACvE,SAAS,SAAS,CAAC,SAAiB,EAAE,GAAW;IAC/C,MAAM,CAAC,aAAa,EAAE,GAAG,cAAc,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,CACL,aAAa,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,WAAW,EAAE;QACvD,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,KAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,MAAM,IAAI,GAGL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,wMAAwM;YAC1M,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;SACrC;QACD,QAAQ,EAAE;YACR,cAAc,EACZ,mFAAmF;YACrF,UAAU,EACR,qIAAqI;YACvI,WAAW,EAAE,oBAAoB;SAClC;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,OAAO,EAAE;wBACP,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,sEAAsE;qBACzE;oBACD,GAAG,EAAE;wBACH,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,8HAA8H;qBACjI;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;QACD,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;KACjE;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC;QACnD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,OAAO,GACX,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9D,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,SAAS,CAAC;QAChB,OAAO;YACL,IAAI,CAAC,IAAI;gBACP,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;oBAAE,OAAO;gBACxC,IAAI,IAAI,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG;oBAAE,OAAO;gBAC5C,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,aAAa;oBACxB,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;iBAC/B,CAAC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,uBAAuB;oBAAE,OAAO;gBACvD,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACtE,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,eAAe;wBACrB,SAAS,EAAE,gBAAgB;wBAC3B,IAAI,EAAE,EAAE,OAAO,EAAE;qBAClB,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO;gBAClC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,UAAU,EAAE,CAAC;oBACf,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,UAAU;wBAChB,SAAS,EAAE,YAAY;wBACvB,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;qBAC7B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/cloudflare/ruleset-requires-managed-by-description.d.ts

@@ -0,0 +1,9 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    RuleOptions: [{
+        description?: string;
+    }?];
+    MessageIds: 'missingDescription';
+}>;
+export default rule;
+//# sourceMappingURL=ruleset-requires-managed-by-description.d.ts.map

package/dist/rules/cloudflare/ruleset-requires-managed-by-description.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleset-requires-managed-by-description.d.ts","sourceRoot":"","sources":["../../../src/rules/cloudflare/ruleset-requires-managed-by-description.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAK7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,WAAW,EAAE,CAAC;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACzC,UAAU,EAAE,oBAAoB,CAAC;CAClC,CA8CA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/cloudflare/ruleset-requires-managed-by-description.js

@@ -0,0 +1,52 @@
+import { findLiteralMismatch, literalAttributeValue } from '../core/utils.js';
+const DEFAULT_DESCRIPTION = 'Managed by terraform';
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Require a `cloudflare_ruleset` to set its top-level `description` to the configured marker, so the ruleset shows it is managed by Terraform.',
+            recommended: true,
+            severity: 'warn',
+            category: 'cloudflare',
+        },
+        messages: {
+            missingDescription: 'Set the ruleset `description` to "{{description}}" to mark it as managed by Terraform.',
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    description: {
+                        type: 'string',
+                        description: 'The exact top-level `description` that marks a ruleset as managed by Terraform.',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+        defaultOptions: [{ description: DEFAULT_DESCRIPTION }],
+    },
+    create(context) {
+        const description = context.options[0]?.description ?? DEFAULT_DESCRIPTION;
+        return {
+            Block(node) {
+                if (node.kind !== 'resource')
+                    return;
+                if (node.labels[0] !== 'cloudflare_ruleset')
+                    return;
+                if (literalAttributeValue(node, 'kind') === 'managed')
+                    return;
+                const mismatch = findLiteralMismatch(node, 'description', description);
+                if (!mismatch)
+                    return;
+                context.report({
+                    node: mismatch,
+                    messageId: 'missingDescription',
+                    data: { description },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=ruleset-requires-managed-by-description.js.map

package/dist/rules/cloudflare/ruleset-requires-managed-by-description.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleset-requires-managed-by-description.js","sourceRoot":"","sources":["../../../src/rules/cloudflare/ruleset-requires-managed-by-description.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAEnD,MAAM,IAAI,GAGL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,8IAA8I;YAChJ,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,YAAY;SACvB;QACD,QAAQ,EAAE;YACR,kBAAkB,EAChB,wFAAwF;SAC3F;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,WAAW,EAAE;wBACX,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,iFAAiF;qBACpF;iBACF;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;QACD,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;KACvD;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,mBAAmB,CAAC;QAC3E,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB;oBAAE,OAAO;gBACpD,IAAI,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,SAAS;oBAAE,OAAO;gBAC9D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;gBACvE,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,oBAAoB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE;iBACtB,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/cloudflare/utils.d.ts

@@ -0,0 +1,17 @@
+import type { SettingsConfig } from '@eslint/core';
+export declare const CLOUDFLARE_PLANS: readonly ["free", "pro", "business", "enterprise"];
+export declare const INVALID_PLAN_MESSAGE = "Unrecognized Cloudflare plan \"{{value}}\" in `settings.lintofu.cloudflare.plan`. Accepted values are `free`, `pro`, `business`, and `enterprise`.";
+export type CloudflarePlan = (typeof CLOUDFLARE_PLANS)[number];
+export type PlanSetting = {
+    state: 'unset';
+} | {
+    state: 'valid';
+    plan: CloudflarePlan;
+} | {
+    state: 'invalid';
+    value: string;
+};
+export declare function readCloudflarePlan(settings: SettingsConfig): PlanSetting;
+export declare function entitlesCountryBlock(plan: CloudflarePlan): boolean;
+export declare function entitlesDnsRecordTags(plan: CloudflarePlan): boolean;
+//# sourceMappingURL=utils.d.ts.map

package/dist/rules/cloudflare/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/rules/cloudflare/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,eAAO,MAAM,gBAAgB,oDAKnB,CAAC;AAEX,eAAO,MAAM,oBAAoB,uJACmH,CAAC;AAErJ,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,MAAM,MAAM,WAAW,GACnB;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAClB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACxC;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBxC,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,GAAG,WAAW,CAKxE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAElE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAEnE"}

package/dist/rules/cloudflare/utils.js

@@ -0,0 +1,37 @@
+import { lintofuSettings, objectSetting } from '../core/utils.js';
+export const CLOUDFLARE_PLANS = [
+    'free',
+    'pro',
+    'business',
+    'enterprise',
+];
+export const INVALID_PLAN_MESSAGE = 'Unrecognized Cloudflare plan "{{value}}" in `settings.lintofu.cloudflare.plan`. Accepted values are `free`, `pro`, `business`, and `enterprise`.';
+function isCloudflarePlan(value) {
+    return (typeof value === 'string' &&
+        CLOUDFLARE_PLANS.includes(value));
+}
+function describeSetting(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean') {
+        return String(value);
+    }
+    if (typeof value === 'object')
+        return JSON.stringify(value);
+    return typeof value;
+}
+export function readCloudflarePlan(settings) {
+    const plan = objectSetting(lintofuSettings(settings).cloudflare).plan;
+    if (plan === undefined)
+        return { state: 'unset' };
+    if (isCloudflarePlan(plan))
+        return { state: 'valid', plan };
+    return { state: 'invalid', value: describeSetting(plan) };
+}
+export function entitlesCountryBlock(plan) {
+    return plan === 'enterprise';
+}
+export function entitlesDnsRecordTags(plan) {
+    return plan !== 'free';
+}
+//# sourceMappingURL=utils.js.map

package/dist/rules/cloudflare/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/rules/cloudflare/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM;IACN,KAAK;IACL,UAAU;IACV,YAAY;CACJ,CAAC;AAEX,MAAM,CAAC,MAAM,oBAAoB,GAC/B,kJAAkJ,CAAC;AASrJ,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IACzD,MAAM,IAAI,GAAG,aAAa,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClD,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5D,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,OAAO,IAAI,KAAK,YAAY,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAoB;IACxD,OAAO,IAAI,KAAK,MAAM,CAAC;AACzB,CAAC"}

package/dist/rules/core/documented-outputs.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'missingDescription';
+}>;
+export default rule;
+//# sourceMappingURL=documented-outputs.d.ts.map

package/dist/rules/core/documented-outputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documented-outputs.d.ts","sourceRoot":"","sources":["../../../src/rules/core/documented-outputs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAA;CAAE,CAoCtE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/documented-outputs.js

@@ -0,0 +1,41 @@
+import { blockLabel, checkDescription } from './utils.js';
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require every `output` block to have a `description`.',
+            recommended: true,
+            severity: 'error',
+        },
+        messages: {
+            missingDescription: 'Output `{{name}}` is missing a `description` attribute.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'output')
+                    return;
+                const label = blockLabel(node);
+                const check = checkDescription(node);
+                if (check.status === 'missing') {
+                    context.report({
+                        node,
+                        messageId: 'missingDescription',
+                        data: { name: label },
+                    });
+                }
+                else if (check.status === 'empty') {
+                    context.report({
+                        node: check.attr,
+                        messageId: 'missingDescription',
+                        data: { name: label },
+                    });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=documented-outputs.js.map

package/dist/rules/core/documented-outputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documented-outputs.js","sourceRoot":"","sources":["../../../src/rules/core/documented-outputs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,IAAI,GAAiE;IACzE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,uDAAuD;YACpE,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;SAClB;QACD,QAAQ,EAAE;YACR,kBAAkB,EAChB,yDAAyD;SAC5D;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO;gBACnC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC/B,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;qBACtB,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACpC,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/documented-variables.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'missingDescription';
+}>;
+export default rule;
+//# sourceMappingURL=documented-variables.d.ts.map

package/dist/rules/core/documented-variables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documented-variables.d.ts","sourceRoot":"","sources":["../../../src/rules/core/documented-variables.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,oBAAoB,CAAA;CAAE,CAoCtE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/documented-variables.js

@@ -0,0 +1,41 @@
+import { blockLabel, checkDescription } from './utils.js';
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require every `variable` block to have a `description`.',
+            recommended: true,
+            severity: 'error',
+        },
+        messages: {
+            missingDescription: 'Variable `{{name}}` is missing a `description` attribute.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'variable')
+                    return;
+                const label = blockLabel(node);
+                const check = checkDescription(node);
+                if (check.status === 'missing') {
+                    context.report({
+                        node,
+                        messageId: 'missingDescription',
+                        data: { name: label },
+                    });
+                }
+                else if (check.status === 'empty') {
+                    context.report({
+                        node: check.attr,
+                        messageId: 'missingDescription',
+                        data: { name: label },
+                    });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=documented-variables.js.map

package/dist/rules/core/documented-variables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documented-variables.js","sourceRoot":"","sources":["../../../src/rules/core/documented-variables.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,IAAI,GAAiE;IACzE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,yDAAyD;YACtE,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;SAClB;QACD,QAAQ,EAAE;YACR,kBAAkB,EAChB,2DAA2D;SAC9D;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC/B,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC/B,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI;wBACJ,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;qBACtB,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACpC,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,SAAS,EAAE,oBAAoB;wBAC/B,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/module-source-pinned.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'unpinnedSource';
+}>;
+export default rule;
+//# sourceMappingURL=module-source-pinned.d.ts.map

package/dist/rules/core/module-source-pinned.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-source-pinned.d.ts","sourceRoot":"","sources":["../../../src/rules/core/module-source-pinned.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAS7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,gBAAgB,CAAA;CAAE,CAoClE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/module-source-pinned.js

@@ -0,0 +1,47 @@
+import { blockLabel, findAttribute, literalStringValue } from './utils.js';
+function isPinnedSource(source, hasVersion) {
+    if (source.startsWith('./') || source.startsWith('../'))
+        return true;
+    if (source.includes('?ref='))
+        return true;
+    return hasVersion;
+}
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require module sources to be pinned via `?ref=`, a `version` attribute, or a local path.',
+            recommended: true,
+            severity: 'error',
+        },
+        messages: {
+            unpinnedSource: 'Module `{{name}}` source is not pinned; add a `version` attribute or use a `?ref=` git URL.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'module')
+                    return;
+                const sourceAttr = findAttribute(node.body.attributes, 'source');
+                if (!sourceAttr)
+                    return;
+                const source = literalStringValue(sourceAttr.expression);
+                if (source === undefined)
+                    return;
+                const hasVersion = !!findAttribute(node.body.attributes, 'version');
+                if (isPinnedSource(source, hasVersion))
+                    return;
+                const label = blockLabel(node);
+                context.report({
+                    node: sourceAttr,
+                    messageId: 'unpinnedSource',
+                    data: { name: label },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=module-source-pinned.js.map

package/dist/rules/core/module-source-pinned.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-source-pinned.js","sourceRoot":"","sources":["../../../src/rules/core/module-source-pinned.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE3E,SAAS,cAAc,CAAC,MAAc,EAAE,UAAmB;IACzD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,IAAI,GAA6D;IACrE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,0FAA0F;YAC5F,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;SAClB;QACD,QAAQ,EAAE;YACR,cAAc,EACZ,6FAA6F;SAChG;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO;gBACnC,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACjE,IAAI,CAAC,UAAU;oBAAE,OAAO;gBACxB,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBACzD,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO;gBAEjC,MAAM,UAAU,GAAG,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;gBACpE,IAAI,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC;oBAAE,OAAO;gBAE/C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,UAAU;oBAChB,SAAS,EAAE,gBAAgB;oBAC3B,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;iBACtB,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-bool-as-count.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'boolAsCount';
+}>;
+export default rule;
+//# sourceMappingURL=no-bool-as-count.d.ts.map

package/dist/rules/core/no-bool-as-count.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-bool-as-count.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-bool-as-count.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA6B7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,aAAa,CAAA;CAAE,CA0C/D,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-bool-as-count.js

@@ -0,0 +1,69 @@
+import { findAttribute } from './utils.js';
+const COUNT_BLOCK_KINDS = new Set(['resource', 'data', 'module']);
+const BOOL_BINARY_OPS = new Set([
+    'equal',
+    'notEqual',
+    'greaterThan',
+    'greaterThanOrEqual',
+    'lessThan',
+    'lessThanOrEqual',
+    'logicalAnd',
+    'logicalOr',
+]);
+function unwrapParens(expr) {
+    return expr.type === 'ParenthesesExpr' ? unwrapParens(expr.expression) : expr;
+}
+function isProvableBool(expr) {
+    const inner = unwrapParens(expr);
+    if (inner.type === 'LiteralValueExpr')
+        return typeof inner.value === 'boolean';
+    if (inner.type === 'UnaryOpExpr')
+        return inner.op === 'logicalNot';
+    if (inner.type === 'BinaryOpExpr')
+        return BOOL_BINARY_OPS.has(inner.op);
+    return false;
+}
+const rule = {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description: 'Flag a `count` meta-argument set to a boolean; Terraform 0.12 removed bool-to-number coercion.',
+            recommended: true,
+            severity: 'error',
+        },
+        messages: {
+            boolAsCount: '`count` is set to a boolean value. Terraform 0.12 removed automatic bool-to-number coercion. Use a numeric conditional such as `count = var.enabled ? 1 : 0`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (!COUNT_BLOCK_KINDS.has(node.kind))
+                    return;
+                const count = findAttribute(node.body.attributes, 'count');
+                if (!count)
+                    return;
+                const expr = count.expression;
+                if (!isProvableBool(expr))
+                    return;
+                context.report({
+                    node: expr,
+                    messageId: 'boolAsCount',
+                    fix: (fixer) => {
+                        const inner = unwrapParens(expr);
+                        if (inner.type === 'LiteralValueExpr' &&
+                            typeof inner.value === 'boolean') {
+                            return fixer.replaceText(expr, inner.value ? '1' : '0');
+                        }
+                        const text = context.sourceCode.getText(inner);
+                        return fixer.replaceText(expr, `(${text}) ? 1 : 0`);
+                    },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-bool-as-count.js.map