@synapsestudios/lintofu 0.0.0-stage → 0.9.0

package/dist/rules/core/no-legacy-map-function.js

@@ -0,0 +1,90 @@
+import { literalStringValue } from './utils.js';
+const BARE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+// Splits alternating key,value arguments into pairs. Returns undefined when the
+// count is odd, any key is not a string literal, or two keys collide, marking
+// the call unsafe to rewrite automatically. Legacy `map` let a later duplicate
+// key win, but a `{ a = 1, a = 2 }` object literal is a parse error, so the fix
+// falls back to report-only when literal keys repeat.
+function pairArgs(args) {
+    if (args.length % 2 !== 0)
+        return undefined;
+    const pairs = [];
+    const seen = new Set();
+    for (let i = 0; i < args.length; i += 2) {
+        const keyExpr = args[i];
+        const valueExpr = args[i + 1];
+        if (!keyExpr || !valueExpr)
+            return undefined;
+        const key = literalStringValue(keyExpr);
+        if (key === undefined)
+            return undefined;
+        if (seen.has(key))
+            return undefined;
+        seen.add(key);
+        pairs.push({ key, value: valueExpr });
+    }
+    return pairs;
+}
+const rule = {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description: 'Flag the legacy `map(...)` function, removed in Terraform 0.15, in favor of a `{ key = value }` object literal.',
+            recommended: true,
+            severity: 'error',
+        },
+        messages: {
+            legacyMapFunction: 'The legacy `map(...)` function was removed in Terraform 0.15. Build the map with a `{ key = value }` object literal instead.',
+        },
+        schema: [],
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        // Byte ranges of variable `type` attribute expressions. `map(string)` there
+        // is a type constraint, not the legacy function, so any call inside one of
+        // these ranges is skipped. Block visitors run before their descendants, so
+        // the ranges are recorded before the inner call is visited.
+        const typeConstraintRanges = [];
+        return {
+            Block(node) {
+                if (node.kind !== 'variable')
+                    return;
+                for (const attr of node.body.attributes) {
+                    if (attr.name !== 'type')
+                        continue;
+                    typeConstraintRanges.push([
+                        attr.expression.range.start.offset,
+                        attr.expression.range.end.offset,
+                    ]);
+                }
+            },
+            FunctionCallExpr(node) {
+                if (node.name !== 'map')
+                    return;
+                const start = node.range.start.offset;
+                const end = node.range.end.offset;
+                const inTypeConstraint = typeConstraintRanges.some(([from, to]) => start >= from && end <= to);
+                if (inTypeConstraint)
+                    return;
+                const pairs = node.expandFinal ? undefined : pairArgs(node.args);
+                if (!pairs) {
+                    context.report({ node, messageId: 'legacyMapFunction' });
+                    return;
+                }
+                const entries = pairs.map(({ key, value }) => {
+                    const label = BARE_IDENTIFIER.test(key) ? key : JSON.stringify(key);
+                    return `${label} = ${sourceCode.getText(value)}`;
+                });
+                const object = entries.length === 0 ? '{}' : `{ ${entries.join(', ')} }`;
+                context.report({
+                    node,
+                    messageId: 'legacyMapFunction',
+                    fix: (fixer) => fixer.replaceText(node, object),
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-legacy-map-function.js.map

package/dist/rules/core/no-legacy-map-function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-legacy-map-function.js","sourceRoot":"","sources":["../../../src/rules/core/no-legacy-map-function.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAOnD,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,sDAAsD;AACtD,SAAS,QAAQ,CAAC,IAA2B;IAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC7C,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,IAAI,GAAgE;IACxE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,WAAW,EACT,iHAAiH;YACnH,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;SAClB;QACD,QAAQ,EAAE;YACR,iBAAiB,EACf,8HAA8H;SACjI;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,oBAAoB,GAAuB,EAAE,CAAC;QACpD,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBACxC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;wBAAE,SAAS;oBACnC,oBAAoB,CAAC,IAAI,CAAC;wBACxB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;wBAClC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM;qBACjC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,gBAAgB,CAAC,IAAI;gBACnB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO;gBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;gBACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAClC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAChD,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,CAC3C,CAAC;gBACF,IAAI,gBAAgB;oBAAE,OAAO;gBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBACzD,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;oBAC3C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACpE,OAAO,GAAG,KAAK,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnD,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5D,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,mBAAmB;oBAC9B,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-legacy-provider-proxy.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'legacyProviderProxy';
+}>;
+export default rule;
+//# sourceMappingURL=no-legacy-provider-proxy.d.ts.map

package/dist/rules/core/no-legacy-provider-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-legacy-provider-proxy.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-legacy-provider-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAA;CAAE,CAmCvE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-legacy-provider-proxy.js

@@ -0,0 +1,43 @@
+import { literalStringValue } from './utils.js';
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flag empty `provider` blocks that exist only to declare an alias; replace with `configuration_aliases` in `required_providers`.',
+            recommended: true,
+            severity: 'error',
+        },
+        messages: {
+            legacyProviderProxy: 'Empty proxy `provider` block for alias `{{provider}}.{{alias}}`. Move the alias declaration into `terraform.required_providers` via `configuration_aliases = [{{provider}}.{{alias}}]`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'provider')
+                    return;
+                const provider = node.labels[0];
+                if (!provider)
+                    return;
+                if (node.body.blocks.length > 0)
+                    return;
+                const [aliasAttr, ...rest] = node.body.attributes;
+                if (!aliasAttr || rest.length > 0)
+                    return;
+                if (aliasAttr.name !== 'alias')
+                    return;
+                const alias = literalStringValue(aliasAttr.expression);
+                if (alias === undefined)
+                    return;
+                context.report({
+                    node,
+                    messageId: 'legacyProviderProxy',
+                    data: { provider, alias },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-legacy-provider-proxy.js.map

package/dist/rules/core/no-legacy-provider-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-legacy-provider-proxy.js","sourceRoot":"","sources":["../../../src/rules/core/no-legacy-provider-proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,IAAI,GAAkE;IAC1E,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,iIAAiI;YACnI,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;SAClB;QACD,QAAQ,EAAE;YACR,mBAAmB,EACjB,yLAAyL;SAC5L;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBACxC,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;gBAClD,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO;gBAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;oBAAE,OAAO;gBACvC,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;gBACvD,IAAI,KAAK,KAAK,SAAS;oBAAE,OAAO;gBAChC,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,qBAAqB;oBAChC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;iBAC1B,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-provider-version-constraint.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'providerVersionConstraint';
+}>;
+export default rule;
+//# sourceMappingURL=no-provider-version-constraint.d.ts.map

package/dist/rules/core/no-provider-version-constraint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-provider-version-constraint.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-provider-version-constraint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAG7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IACjC,UAAU,EAAE,2BAA2B,CAAC;CACzC,CA6BA,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-provider-version-constraint.js

@@ -0,0 +1,33 @@
+import { findAttribute } from './utils.js';
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag a `version` argument inside a `provider` block; declare the version in `terraform.required_providers` instead.',
+            recommended: true,
+            severity: 'warn',
+        },
+        messages: {
+            providerVersionConstraint: 'The `version` argument inside `provider "{{provider}}"` is deprecated and only takes effect when `terraform.required_providers` omits a constraint for this provider. Declare the version in `required_providers` instead.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'provider')
+                    return;
+                const versionAttr = findAttribute(node.body.attributes, 'version');
+                if (!versionAttr)
+                    return;
+                context.report({
+                    node: versionAttr,
+                    messageId: 'providerVersionConstraint',
+                    data: { provider: node.labels[0] ?? '<unnamed>' },
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-provider-version-constraint.js.map

package/dist/rules/core/no-provider-version-constraint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-provider-version-constraint.js","sourceRoot":"","sources":["../../../src/rules/core/no-provider-version-constraint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,IAAI,GAEL;IACH,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,qHAAqH;YACvH,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;SACjB;QACD,QAAQ,EAAE;YACR,yBAAyB,EACvB,4NAA4N;SAC/N;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;gBACnE,IAAI,CAAC,WAAW;oBAAE,OAAO;gBACzB,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE,2BAA2B;oBACtC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE;iBAClD,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-quoted-depends-on.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'quotedDependsOn';
+}>;
+export default rule;
+//# sourceMappingURL=no-quoted-depends-on.d.ts.map

package/dist/rules/core/no-quoted-depends-on.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-quoted-depends-on.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-quoted-depends-on.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAgB7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,iBAAiB,CAAA;CAAE,CAuCnE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-quoted-depends-on.js

@@ -0,0 +1,55 @@
+import { findAttribute, literalStringValue } from './utils.js';
+// depends_on is a meta-argument only on these block kinds; elsewhere an
+// attribute named depends_on is a plain value that must not be rewritten.
+const KINDS = new Set(['resource', 'data', 'module', 'output']);
+// A single resource/module address: a root identifier followed by attribute
+// steps, numeric indexes, or quoted-key indexes. Anything else (a literal with
+// spaces, an operator, etc.) is not a bare reference and gets no fix. Each group
+// iteration starts with a fixed `.` or `[`, and the two `[` branches diverge on
+// their next character, so the outer `*` cannot match the same input two ways.
+const REFERENCE = 
+// eslint-disable-next-line security/detect-unsafe-regex
+/^[A-Za-z_][A-Za-z0-9_-]*(\.[A-Za-z_][A-Za-z0-9_-]*|\[[0-9]+\]|\["[^"\\]*"\])*$/;
+const rule = {
+    meta: {
+        type: 'suggestion',
+        fixable: 'code',
+        docs: {
+            description: 'Disallow quoted references in `depends_on`; use bare references.',
+            recommended: true,
+            severity: 'warn',
+        },
+        messages: {
+            quotedDependsOn: 'Quoted reference in `depends_on` is deprecated. Use a bare reference, e.g. `[aws_instance.example]`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (!KINDS.has(node.kind))
+                    return;
+                const attr = findAttribute(node.body.attributes, 'depends_on');
+                if (attr?.expression.type !== 'TupleConsExpr')
+                    return;
+                for (const el of attr.expression.exprs) {
+                    // literalStringValue returns a string only for an all-literal
+                    // TemplateExpr, so bare references and the `"${ref}"` form (owned by
+                    // prefer-bare-expression) both fall through untouched.
+                    const value = literalStringValue(el);
+                    if (value === undefined)
+                        continue;
+                    context.report({
+                        node: el,
+                        messageId: 'quotedDependsOn',
+                        fix: REFERENCE.test(value)
+                            ? (fixer) => fixer.replaceText(el, value)
+                            : undefined,
+                    });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-quoted-depends-on.js.map

package/dist/rules/core/no-quoted-depends-on.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-quoted-depends-on.js","sourceRoot":"","sources":["../../../src/rules/core/no-quoted-depends-on.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/D,wEAAwE;AACxE,0EAA0E;AAC1E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhE,4EAA4E;AAC5E,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,SAAS;AACb,wDAAwD;AACxD,gFAAgF,CAAC;AAEnF,MAAM,IAAI,GAA8D;IACtE,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,WAAW,EACT,kEAAkE;YACpE,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;SACjB;QACD,QAAQ,EAAE;YACR,eAAe,EACb,sGAAsG;SACzG;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAClC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;gBAC/D,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,KAAK,eAAe;oBAAE,OAAO;gBACtD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;oBACvC,8DAA8D;oBAC9D,qEAAqE;oBACrE,uDAAuD;oBACvD,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAClC,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,EAAE;wBACR,SAAS,EAAE,iBAAiB;wBAC5B,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;4BACxB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;4BACzC,CAAC,CAAC,SAAS;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-quoted-ignore-changes.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'quotedIgnoreChanges';
+}>;
+export default rule;
+//# sourceMappingURL=no-quoted-ignore-changes.d.ts.map

package/dist/rules/core/no-quoted-ignore-changes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-quoted-ignore-changes.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-quoted-ignore-changes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAY7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,qBAAqB,CAAA;CAAE,CAqDvE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-quoted-ignore-changes.js

@@ -0,0 +1,63 @@
+import { findAttribute, literalStringValue } from './utils.js';
+// A valid attribute path can be unquoted safely: a bare identifier followed by
+// any number of `.attr`, `[0]`, or `["key"]` steps. Anything else (an
+// interpolation, a `*` wildcard, whitespace) is left quoted. Each group
+// iteration starts with a fixed `.` or `[`, and the two `[` branches diverge on
+// their next character, so the outer `*` cannot match the same input two ways.
+const ATTRIBUTE_PATH = 
+// eslint-disable-next-line security/detect-unsafe-regex
+/^[A-Za-z_][A-Za-z0-9_-]*(\.[A-Za-z_][A-Za-z0-9_-]*|\[[0-9]+\]|\["[^"\\]*"\])*$/;
+const rule = {
+    meta: {
+        type: 'suggestion',
+        fixable: 'code',
+        docs: {
+            description: 'Disallow quoted references in a `lifecycle` `ignore_changes` list; use bare attribute references.',
+            recommended: true,
+            severity: 'warn',
+        },
+        messages: {
+            quotedIgnoreChanges: 'Quoted reference in `ignore_changes` is deprecated. Use a bare attribute reference, e.g. `[ami, tags]`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'lifecycle')
+                    return;
+                const attr = findAttribute(node.body.attributes, 'ignore_changes');
+                if (!attr)
+                    return;
+                const expr = attr.expression;
+                if (expr.type !== 'TupleConsExpr')
+                    return;
+                // The single-element `["*"]` form belongs to
+                // no-legacy-ignore-changes-wildcard.
+                const only = expr.exprs[0];
+                if (expr.exprs.length === 1 &&
+                    only !== undefined &&
+                    literalStringValue(only) === '*') {
+                    return;
+                }
+                for (const el of expr.exprs) {
+                    // literalStringValue returns a string only for an all-literal
+                    // TemplateExpr, so bare references, interpolated elements, and the
+                    // `"${ref}"` form all fall through untouched.
+                    const value = literalStringValue(el);
+                    if (value === undefined)
+                        continue;
+                    context.report({
+                        node: el,
+                        messageId: 'quotedIgnoreChanges',
+                        fix: ATTRIBUTE_PATH.test(value)
+                            ? (fixer) => fixer.replaceText(el, value)
+                            : undefined,
+                    });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-quoted-ignore-changes.js.map

package/dist/rules/core/no-quoted-ignore-changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-quoted-ignore-changes.js","sourceRoot":"","sources":["../../../src/rules/core/no-quoted-ignore-changes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/D,+EAA+E;AAC/E,sEAAsE;AACtE,wEAAwE;AACxE,gFAAgF;AAChF,+EAA+E;AAC/E,MAAM,cAAc;AAClB,wDAAwD;AACxD,gFAAgF,CAAC;AAEnF,MAAM,IAAI,GAAkE;IAC1E,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,WAAW,EACT,mGAAmG;YACrG,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;SACjB;QACD,QAAQ,EAAE;YACR,mBAAmB,EACjB,yGAAyG;SAC5G;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;oBAAE,OAAO;gBACtC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;oBAAE,OAAO;gBAE1C,6CAA6C;gBAC7C,qCAAqC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3B,IACE,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;oBACvB,IAAI,KAAK,SAAS;oBAClB,kBAAkB,CAAC,IAAI,CAAC,KAAK,GAAG,EAChC,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBAC5B,8DAA8D;oBAC9D,mEAAmE;oBACnE,8CAA8C;oBAC9C,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAClC,OAAO,CAAC,MAAM,CAAC;wBACb,IAAI,EAAE,EAAE;wBACR,SAAS,EAAE,qBAAqB;wBAChC,GAAG,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;4BAC7B,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC;4BACzC,CAAC,CAAC,SAAS;qBACd,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-quoted-provider-reference.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'quotedProviderReference';
+}>;
+export default rule;
+//# sourceMappingURL=no-quoted-provider-reference.d.ts.map

package/dist/rules/core/no-quoted-provider-reference.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-quoted-provider-reference.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-quoted-provider-reference.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAW7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,yBAAyB,CAAA;CAAE,CAkEzE,CAAC;AAEJ,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-quoted-provider-reference.js

@@ -0,0 +1,69 @@
+import { findAttribute, literalStringValue } from './utils.js';
+// A bare provider reference is `aws` or `aws.west`: an identifier, optionally
+// followed by dotted attribute steps. A providers-map key takes the same shape,
+// since a bare qualified key such as `aws.alt` is legal. Each step starts with a
+// distinct char after `.`, so there is no backtracking ambiguity.
+const REFERENCE = 
+// eslint-disable-next-line security/detect-unsafe-regex
+/^[A-Za-z_][A-Za-z0-9_-]*(\.[A-Za-z_][A-Za-z0-9_-]*)*$/;
+const rule = {
+    meta: {
+        type: 'suggestion',
+        fixable: 'code',
+        docs: {
+            description: 'Disallow quoted provider references in `provider` arguments and module `providers` maps; use a bare traversal.',
+            recommended: true,
+            severity: 'warn',
+        },
+        messages: {
+            quotedProviderReference: 'Quoted provider reference is deprecated. Use a bare traversal, e.g. `aws.west`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        // `target` is the node to report and replace (it spans the quotes); `read`
+        // is the expression to pull the literal string from. For a quoted map key
+        // the two differ: the key arrives as an ObjectConsKeyExpr wrapping the
+        // literal TemplateExpr, and the wrapper's span includes the quotes.
+        function reportQuoted(target, read, pattern) {
+            const value = literalStringValue(read);
+            if (value === undefined)
+                return;
+            context.report({
+                node: target,
+                messageId: 'quotedProviderReference',
+                fix: pattern.test(value)
+                    ? (fixer) => fixer.replaceText(target, value)
+                    : undefined,
+            });
+        }
+        return {
+            Block(node) {
+                // resource, data, and import blocks all take a `provider` argument.
+                if (node.kind === 'resource' ||
+                    node.kind === 'data' ||
+                    node.kind === 'import') {
+                    const attr = findAttribute(node.body.attributes, 'provider');
+                    if (attr)
+                        reportQuoted(attr.expression, attr.expression, REFERENCE);
+                    return;
+                }
+                if (node.kind === 'module') {
+                    const attr = findAttribute(node.body.attributes, 'providers');
+                    if (attr?.expression.type !== 'ObjectConsExpr')
+                        return;
+                    const object = attr.expression;
+                    for (const item of object.items) {
+                        const keyInner = item.keyExpr.type === 'ObjectConsKeyExpr'
+                            ? item.keyExpr.wrapped
+                            : item.keyExpr;
+                        reportQuoted(item.keyExpr, keyInner, REFERENCE);
+                        reportQuoted(item.valueExpr, item.valueExpr, REFERENCE);
+                    }
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-quoted-provider-reference.js.map

package/dist/rules/core/no-quoted-provider-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-quoted-provider-reference.js","sourceRoot":"","sources":["../../../src/rules/core/no-quoted-provider-reference.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/D,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,kEAAkE;AAClE,MAAM,SAAS;AACb,wDAAwD;AACxD,uDAAuD,CAAC;AAE1D,MAAM,IAAI,GACR;IACE,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,WAAW,EACT,gHAAgH;YAClH,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;SACjB;QACD,QAAQ,EAAE;YACR,uBAAuB,EACrB,iFAAiF;SACpF;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,oEAAoE;QACpE,SAAS,YAAY,CACnB,MAAkB,EAClB,IAAgB,EAChB,OAAe;YAEf,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,OAAO,CAAC,MAAM,CAAC;gBACb,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,yBAAyB;gBACpC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;oBACtB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC;oBAC7C,CAAC,CAAC,SAAS;aACd,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,oEAAoE;gBACpE,IACE,IAAI,CAAC,IAAI,KAAK,UAAU;oBACxB,IAAI,CAAC,IAAI,KAAK,MAAM;oBACpB,IAAI,CAAC,IAAI,KAAK,QAAQ,EACtB,CAAC;oBACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;oBAC7D,IAAI,IAAI;wBAAE,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC3B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;oBAC9D,IAAI,IAAI,EAAE,UAAU,CAAC,IAAI,KAAK,gBAAgB;wBAAE,OAAO;oBACvD,MAAM,MAAM,GAAmB,IAAI,CAAC,UAAU,CAAC;oBAC/C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;wBAChC,MAAM,QAAQ,GACZ,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,mBAAmB;4BACvC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;4BACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;wBACnB,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;wBAChD,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;oBAC1D,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEJ,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-quoted-type-constraints.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'quotedTypeConstraint';
+}>;
+export default rule;
+//# sourceMappingURL=no-quoted-type-constraints.d.ts.map

package/dist/rules/core/no-quoted-type-constraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-quoted-type-constraints.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-quoted-type-constraints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAmB7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,sBAAsB,CAAA;CAAE,CAoCxE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-quoted-type-constraints.js

@@ -0,0 +1,55 @@
+import { findAttribute, literalStringValue } from './utils.js';
+// The legacy `"list"`, `"map"`, and `"set"` forms meant a collection of
+// strings, so their unquoted keyword takes an explicit `string` element type.
+// `"object"` and `"tuple"` have no bare keyword form (they require a type
+// argument), so they are flagged without a fix.
+const REPLACEMENTS = {
+    string: 'string',
+    number: 'number',
+    bool: 'bool',
+    any: 'any',
+    list: 'list(string)',
+    map: 'map(string)',
+    set: 'set(string)',
+};
+const FLAGGED = new Set([...Object.keys(REPLACEMENTS), 'object', 'tuple']);
+const rule = {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description: 'Disallow quoted type constraints in `variable` blocks; use the unquoted type keyword.',
+            recommended: true,
+            severity: 'error',
+        },
+        messages: {
+            quotedTypeConstraint: 'Quoted type constraint `"{{name}}"` is not allowed as of Terraform 0.15. Use the unquoted type keyword instead.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'variable')
+                    return;
+                const attr = findAttribute(node.body.attributes, 'type');
+                if (!attr)
+                    return;
+                const value = literalStringValue(attr.expression);
+                if (value === undefined || !FLAGGED.has(value))
+                    return;
+                const replacement = REPLACEMENTS[value];
+                context.report({
+                    node: attr.expression,
+                    messageId: 'quotedTypeConstraint',
+                    data: { name: value },
+                    fix: replacement
+                        ? (fixer) => fixer.replaceText(attr.expression, replacement)
+                        : undefined,
+                });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-quoted-type-constraints.js.map

package/dist/rules/core/no-quoted-type-constraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-quoted-type-constraints.js","sourceRoot":"","sources":["../../../src/rules/core/no-quoted-type-constraints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/D,wEAAwE;AACxE,8EAA8E;AAC9E,0EAA0E;AAC1E,gDAAgD;AAChD,MAAM,YAAY,GAA2B;IAC3C,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,cAAc;IACpB,GAAG,EAAE,aAAa;IAClB,GAAG,EAAE,aAAa;CACnB,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E,MAAM,IAAI,GAAmE;IAC3E,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,MAAM;QACf,IAAI,EAAE;YACJ,WAAW,EACT,uFAAuF;YACzF,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;SAClB;QACD,QAAQ,EAAE;YACR,oBAAoB,EAClB,iHAAiH;SACpH;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBACzD,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAClB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAClD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAO;gBACvD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACxC,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI,EAAE,IAAI,CAAC,UAAU;oBACrB,SAAS,EAAE,sBAAsB;oBACjC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;oBACrB,GAAG,EAAE,WAAW;wBACd,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;wBAC5D,CAAC,CAAC,SAAS;iBACd,CAAC,CAAC;YACL,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-reserved-variable-names.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'reservedName';
+}>;
+export default rule;
+//# sourceMappingURL=no-reserved-variable-names.d.ts.map

package/dist/rules/core/no-reserved-variable-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-reserved-variable-names.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-reserved-variable-names.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAgB7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,cAAc,CAAA;CAAE,CA0BhE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-reserved-variable-names.js

@@ -0,0 +1,41 @@
+import { blockLabel } from './utils.js';
+// Reserved by OpenTofu because they collide with module meta-arguments; a
+// `variable` block may not use any of them as its name.
+const RESERVED_VARIABLE_NAMES = new Set([
+    'source',
+    'version',
+    'providers',
+    'count',
+    'for_each',
+    'lifecycle',
+    'depends_on',
+    'locals',
+]);
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `variable` blocks named after an OpenTofu reserved meta-argument.',
+            recommended: true,
+            severity: 'error',
+        },
+        messages: {
+            reservedName: 'Variable name `{{name}}` is reserved by OpenTofu and cannot be used.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            Block(node) {
+                if (node.kind !== 'variable')
+                    return;
+                const name = blockLabel(node);
+                if (RESERVED_VARIABLE_NAMES.has(name)) {
+                    context.report({ node, messageId: 'reservedName', data: { name } });
+                }
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-reserved-variable-names.js.map

package/dist/rules/core/no-reserved-variable-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-reserved-variable-names.js","sourceRoot":"","sources":["../../../src/rules/core/no-reserved-variable-names.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,0EAA0E;AAC1E,wDAAwD;AACxD,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,QAAQ;IACR,SAAS;IACT,WAAW;IACX,OAAO;IACP,UAAU;IACV,WAAW;IACX,YAAY;IACZ,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,IAAI,GAA2D;IACnE,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EACT,4EAA4E;YAC9E,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,OAAO;SAClB;QACD,QAAQ,EAAE;YACR,YAAY,EACV,sEAAsE;SACzE;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,KAAK,CAAC,IAAI;gBACR,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO;gBACrC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-splat-bracket-index.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'splatBracketIndex';
+}>;
+export default rule;
+//# sourceMappingURL=no-splat-bracket-index.d.ts.map

package/dist/rules/core/no-splat-bracket-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-splat-bracket-index.d.ts","sourceRoot":"","sources":["../../../src/rules/core/no-splat-bracket-index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAE7D,QAAA,MAAM,IAAI,EAAE,sBAAsB,CAAC;IAAE,UAAU,EAAE,mBAAmB,CAAA;CAAE,CA2BrE,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-splat-bracket-index.js

@@ -0,0 +1,30 @@
+const rule = {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag a constant index applied to a splat result, a pre-0.12 artifact; index the resource first instead.',
+            recommended: true,
+            severity: 'warn',
+        },
+        messages: {
+            splatBracketIndex: 'Indexing a splat result with a constant is a pre-0.12 artifact. Index the collection first, e.g. `aws_instance.example[0].id`.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            // A constant index on a splat parses as a RelativeTraversalExpr whose
+            // source is the SplatExpr and whose first step is a TraverseIndex; a
+            // non-constant index lands in an IndexExpr instead and is left alone.
+            RelativeTraversalExpr(node) {
+                if (node.source.type !== 'SplatExpr')
+                    return;
+                if (node.traversal[0]?.type !== 'TraverseIndex')
+                    return;
+                context.report({ node, messageId: 'splatBracketIndex' });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-splat-bracket-index.js.map

package/dist/rules/core/no-splat-bracket-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-splat-bracket-index.js","sourceRoot":"","sources":["../../../src/rules/core/no-splat-bracket-index.ts"],"names":[],"mappings":"AAEA,MAAM,IAAI,GAAgE;IACxE,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE;YACJ,WAAW,EACT,yGAAyG;YAC3G,WAAW,EAAE,IAAI;YACjB,QAAQ,EAAE,MAAM;SACjB;QACD,QAAQ,EAAE;YACR,iBAAiB,EACf,gIAAgI;SACnI;QACD,MAAM,EAAE,EAAE;KACX;IACD,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,qBAAqB,CAAC,IAAI;gBACxB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW;oBAAE,OAAO;gBAC7C,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,eAAe;oBAAE,OAAO;gBACxD,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/core/no-template-provider.d.ts

@@ -0,0 +1,6 @@
+import type { OpenTofuRuleDefinition } from '../../types.js';
+declare const rule: OpenTofuRuleDefinition<{
+    MessageIds: 'useTemplatefile' | 'useCloudinitProvider' | 'archivedTemplateProvider';
+}>;
+export default rule;
+//# sourceMappingURL=no-template-provider.d.ts.map