@synapsestudios/lintofu 0.0.0-stage → 0.9.1

package/README.md

@@ -1,3 +1,152 @@
-# Temporary Holding Version
+# lintofu
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+An ESLint plugin for linting [OpenTofu](https://opentofu.org) configurations.
+
+> [!WARNING]
+> The parser depends on Go's [`syscall/js`](https://pkg.go.dev/syscall/js), which the Go team has declared experimental and exempt from the Go compatibility promise. A future Go release _may_ break the functionality of this plugin. `lintofu` will stay on `0.x` until `syscall/js` stabilizes or we replace it. See [ADR 0001](./docs/adr/0001-syscall-js-experimental.md).
+
+This is a pre-release and experimental ESLint plugin. 
+
+Published to npm as [`@synapsestudios/lintofu`](https://www.npmjs.com/package/@synapsestudios/lintofu).
+
+## Head striaght to the docs?
+
+The lintofu docs are located here: [synapsestudios.github.io/lintofu](https://synapsestudios.github.io/lintofu/) the frontend that represents the documentation located in [`docs/`](./docs).
+
+## What it is
+
+`lintofu` is an **ESLint language plugin** (the same mechanism that powers [`@eslint/json`](https://github.com/eslint/json) and [`@eslint/css`](https://github.com/eslint/css)). 
+
+It parses `.tf` and `.tofu` files using HashiCorp's own `hcl/v2` parser (compiled to WebAssembly) and exposes the AST to ESLint rules so you can enforce OpenTofu or Terraform coding conventions alongside the rest of your ESLint rules.
+
+### What it (is not)
+
+We (Synapse Studios) have been using this internally for a few months. This statement is to provide clarity on the kind of expectations you should have when engaging with it, we will accept contributions from the community, however, we can make no promises as to what kind of attention we will be able to give it when it comes to approving/reviewing/or otherwise engaging with community feedback. 
+
+This will be (for the foreseeable future) _best effort_ and sometimes we will be too busy to triage incoming pull requests or bug reports.
+
+### AI Disclosure
+
+To be clear, AI _has_ been used to help build this tool, but the specifications, features, rules, the way in which the plugin handles rule precedence, processing, and the like have _all_ been defined by humans clearly, with insight and scrutiny from a team of experienced DevOps engineers and Software Engineers in order to build something that isn't complete slop. We're tired of slop.
+
+## Scope
+
+`lintofu` asserts against syntactic problems, stylistic conventions, and some provider specific code smells. We provide a list of somewhat generic (but other times opinionated) set of core rules, listed in our [rules index](https://synapsestudios.github.io/lintofu/rules/), that you can take advantage of.
+
+### Our intentions for `lintofu`:
+
+We built lintofu as a stop-gap until feature rich fully fledged linting is available. You can read more about that from the [OpenTofu linting RFC](https://github.com/opentofu/opentofu/pull/3999). This isn't meant to be a complete replacement for what will soon be the linter implementation in OpenTofu, however, it _is_ meant to provide all of the necessary facilities and interfaces to build a comprehensive suite of assertions and rules at the same level.
+
+## Install
+
+### Pre-requisites
+
+Required versions:
+- Node >= `22.13` 
+- ESLint >= `9.x`
+
+### Setup
+
+```sh
+npm install --save-dev @synapsestudios/lintofu
+```
+
+If you installed it from GitHub Packages before, delete these lines from your `.npmrc`. While they're there, npm resolves every `@synapsestudios` package from GitHub Packages, which no longer gets new releases:
+
+```
+@synapsestudios:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}
+```
+
+## Supported versions
+
+We would like to have as broad of compatibility as possible, so our aim is to have full compatibility with the major cloud providers in which our rules are tested against, from the _last_ major version to the latest major version. 
+
+As this plugin ages, we expect to have to provide _some_ backwards compatibility with our rules that may target older providers' code smells, but our focus will be on moving the tool forwards with the rest of the ecosystem. Our full decision making record and rationale on this is defined in [ADR 0005](./docs/adr/0005-version-support-policy.md).
+
+The parser wraps HashiCorp's `hcl/v2`, which parses HCL2, the syntax that shipped with Terraform 0.12. We _will not be supporting `hcl/v1` or Terraform versions that pre-date `0.12`.
+
+<!-- lintofu:support-matrix:start -->
+
+| Tool      | Versions       | Status      |
+| --------- | -------------- | ----------- |
+| OpenTofu  | 1.6 and newer  | supported   |
+| Terraform | 1.0 and newer  | supported   |
+| Terraform | 0.12 – 0.15    | best effort |
+| Terraform | 0.11 and older | unsupported |
+
+<!-- lintofu:support-matrix:end -->
+
+- **supported**: We focus on building rules that apply to these versions.
+- **best effort**: Some rules may target these specific versions and the gotchas associated with upgrading _from_ them, but we won't be writing rules that target specific syntax that is only applicable to these versions.
+- **unsupported**: The parser will reject these.
+
+<!-- lintofu:tested-versions:start -->
+
+## Tested provider versions
+
+Provider-specific rules are validated against these versions. This is a list located here: [`provider-versions.json`](./provider-versions.json) which defines which provider versions we test against in CI.
+
+- aws provider `v6.42.0`
+- cloudflare provider `v5.24.0`
+
+<!-- lintofu:tested-versions:end -->
+
+## Usage
+
+```js
+// eslint.config.js
+import lintofu from "@synapsestudios/lintofu";
+
+export default [lintofu.configs.recommended];
+```
+
+Or opt into specific rules and error statuses.
+
+```js
+// eslint.config.js
+import lintofu from "@synapsestudios/lintofu";
+
+export default [
+  {
+    files: ["**/*.tf", "**/*.tofu"],
+    plugins: { lintofu },
+    language: "lintofu/opentofu",
+    rules: {
+      "lintofu/documented-variables": "error",
+      "lintofu/required-providers-pinned": "error",
+    },
+  },
+];
+```
+
+## Rules
+
+Every rule's description, severity, category, recommended flag, and autofix support lives in the generated **[Rule index](https://synapsestudios.github.io/lintofu/rules/)** on the documentation site
+
+## Requesting a rule
+
+To suggest a new rule, open a [rule request](https://github.com/synapsestudios/lintofu/issues/new?template=rule-request.yml). The form asks for a snippet the rule should flag, the compliant form, a category, a suggested severity, whether an autofix seems possible, and any references. One of our maintainers will pick up your issue and approve it or reject it with a reason.
+
+## Parser services
+
+Rules can reach a lazily-built, cross-file index through
+`context.sourceCode.parserServices.projectIndex`. The `ProjectIndex` interface
+and its module-directory scope are documented in the developer guide:
+[on the site](https://synapsestudios.github.io/lintofu/developer-guide/parser-services)
+or [`docs/developer-guide/parser-services.md`](./docs/developer-guide/parser-services.md)
+in this repository.
+
+## Writing your own rule
+
+`lintofu` re-exports the rule-authoring types it uses internally, so a custom rule type-checks without reaching into private modules. We have an example of this [on the site](https://synapsestudios.github.io/lintofu/developer-guide/writing-a-rule) or [`docs/developer-guide/writing-a-rule.md`](./docs/developer-guide/writing-a-rule.md) in this repository.
+
+## Architecture
+
+The parser is Go: `github.com/hashicorp/hcl/v2/hclsyntax` compiled to
+WebAssembly. We have a simple ASCII representation of the architecture here [on the site](https://synapsestudios.github.io/lintofu/developer-guide/architecture) or [`docs/developer-guide/architecture.md`](./docs/developer-guide/architecture.md) in this repository.
+
+## Known limitations
+
+- **`.tf.json` / `.tofu.json` not supported.** The JSON form of HCL is not 1:1 with native syntax; see [hashicorp/hcl#627 for the rationale](https://github.com/hashicorp/hcl/issues/627).
+- **No TFLint custom-rule compatibility.** We are _considering_ adding `tflint` support so that users can import rules, but we haven't made a decision on whether or not it should happen.

package/dist/configs/category-recommended.d.ts

@@ -0,0 +1,3 @@
+import { type RuleWithDocs } from '../rules/types.js';
+export declare function buildCategoryRecommendedRules(rules: Record<string, RuleWithDocs>, category: string): Record<string, 'error' | 'warn'>;
+//# sourceMappingURL=category-recommended.d.ts.map

package/dist/configs/category-recommended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"category-recommended.d.ts","sourceRoot":"","sources":["../../src/configs/category-recommended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EACnC,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CASlC"}

package/dist/configs/category-recommended.js

@@ -0,0 +1,12 @@
+import { resolveRuleSeverity } from '../rules/types.js';
+export function buildCategoryRecommendedRules(rules, category) {
+    const out = {};
+    for (const [name, rule] of Object.entries(rules)) {
+        const docs = rule.meta?.docs;
+        if (docs?.recommended === true && docs.category === category) {
+            out[`lintofu/${name}`] = resolveRuleSeverity(docs);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=category-recommended.js.map

package/dist/configs/category-recommended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"category-recommended.js","sourceRoot":"","sources":["../../src/configs/category-recommended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAqB,MAAM,mBAAmB,CAAC;AAE3E,MAAM,UAAU,6BAA6B,CAC3C,KAAmC,EACnC,QAAgB;IAEhB,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7B,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC7D,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/configs/recommended.d.ts

@@ -0,0 +1,3 @@
+import { type RuleWithDocs } from '../rules/types.js';
+export declare function buildRecommendedRules(rules: Record<string, RuleWithDocs>): Record<string, 'error' | 'warn'>;
+//# sourceMappingURL=recommended.d.ts.map

package/dist/configs/recommended.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommended.d.ts","sourceRoot":"","sources":["../../src/configs/recommended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CASlC"}

package/dist/configs/recommended.js

@@ -0,0 +1,12 @@
+import { resolveRuleSeverity } from '../rules/types.js';
+export function buildRecommendedRules(rules) {
+    const out = {};
+    for (const [name, rule] of Object.entries(rules)) {
+        const docs = rule.meta?.docs;
+        if (docs?.recommended === true) {
+            out[`lintofu/${name}`] = resolveRuleSeverity(docs);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=recommended.js.map

package/dist/configs/recommended.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recommended.js","sourceRoot":"","sources":["../../src/configs/recommended.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAqB,MAAM,mBAAmB,CAAC;AAE3E,MAAM,UAAU,qBAAqB,CACnC,KAAmC;IAEnC,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7B,IAAI,IAAI,EAAE,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,198 @@
+import type { Plugin } from '@eslint/core';
+import { OpenTofuLanguage } from './language.js';
+interface TierConfig {
+    plugins: Record<string, Plugin>;
+    files: string[];
+    language: string;
+    rules: Record<string, 'error' | 'warn'>;
+}
+/**
+ * the lintofu eslint plugin: `meta`, the `lintofu/opentofu` language,
+ * every bundled rule, and the generated `recommended` and
+ * `<provider>/recommended` configs.
+ */
+declare const plugin: {
+    /** plugin name and version eslint reports. */
+    meta: {
+        name: string;
+        version: string;
+    };
+    /**
+     * the opentofu/terraform hcl language implementation; select it with
+     * `language: 'lintofu/opentofu'`.
+     */
+    languages: {
+        opentofu: OpenTofuLanguage;
+    };
+    /** every bundled rule, keyed by rule name. */
+    rules: {
+        'documented-variables': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingDescription";
+        }>;
+        'no-reserved-variable-names': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "reservedName";
+        }>;
+        'documented-outputs': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingDescription";
+        }>;
+        'required-providers-pinned': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "unpinnedProvider";
+        }>;
+        'provider-source-required': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingSource" | "legacyStringForm";
+        }>;
+        'module-source-pinned': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "unpinnedSource";
+        }>;
+        'prefer-bare-expression': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "preferBareExpression";
+        }>;
+        'no-legacy-list-function': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyListFunction";
+        }>;
+        'no-legacy-map-function': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyMapFunction";
+        }>;
+        'no-bool-as-count': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "boolAsCount";
+        }>;
+        'no-legacy-provider-proxy': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyProviderProxy";
+        }>;
+        'no-template-provider': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "useTemplatefile" | "useCloudinitProvider" | "archivedTemplateProvider";
+        }>;
+        'no-terraform-env-reference': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "terraformEnvReference";
+        }>;
+        'no-quoted-type-constraints': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "quotedTypeConstraint";
+        }>;
+        'no-splat-bracket-index': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "splatBracketIndex";
+        }>;
+        'remote-state-outputs-prefix': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingOutputsPrefix";
+        }>;
+        'no-external-refs-in-destroy-provisioner': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "disallowedReference";
+        }>;
+        'no-legacy-ignore-changes-wildcard': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyIgnoreChangesWildcard";
+        }>;
+        'no-legacy-count-attribute': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyCountAttribute";
+        }>;
+        'no-iam-role-inline-policies': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "inlinePolicy" | "managedPolicyArns";
+        }>;
+        'no-legacy-security-group-rules': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacySecurityGroupRule";
+        }>;
+        'no-mixed-security-group-rule-forms': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "mixedForms";
+        }>;
+        'no-pinned-minor-with-auto-upgrade': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "pinnedMinorWithAutoUpgrade";
+        }>;
+        'no-aurora-pinned-minor-with-auto-upgrade': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "pinnedMinorWithAutoUpgrade";
+        }>;
+        'no-iam-policy-attachment': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "iamPolicyAttachment";
+        }>;
+        'no-s3-bucket-inline-config': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "inlineConfig";
+        }>;
+        'no-legacy-dot-index': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "dotIndex" | "dotSplat";
+        }>;
+        'no-legacy-lookup': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "legacyLookup";
+        }>;
+        'no-quoted-depends-on': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "quotedDependsOn";
+        }>;
+        'no-quoted-provider-reference': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "quotedProviderReference";
+        }>;
+        'no-quoted-ignore-changes': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "quotedIgnoreChanges";
+        }>;
+        'no-empty-list-equality': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "emptyListEquality";
+        }>;
+        'no-winrm-connection': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "winrmConnection";
+        }>;
+        'typed-variables': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingType";
+        }>;
+        'no-eip-vpc-attribute': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "eipVpcAttribute";
+        }>;
+        'no-instance-cpu-count-attributes': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "cpuCountAttribute";
+        }>;
+        'required-version-declared': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingRequiredVersion";
+        }>;
+        'no-duplicate-map-keys': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "duplicateMapKey";
+        }>;
+        'no-provider-version-constraint': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "providerVersionConstraint";
+        }>;
+        'no-db-instance-name-attribute': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "dbInstanceName";
+        }>;
+        'no-eks-addon-resolve-conflicts': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "resolveConflicts";
+        }>;
+        'no-api-gateway-deployment-stage-args': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "deploymentStageArg";
+        }>;
+        'no-s3-bucket-object': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "deprecatedS3BucketObject";
+        }>;
+        'no-hardcoded-provider-credentials': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "hardcodedCredential";
+        }>;
+        'no-deprecated-lambda-runtime': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "deprecatedRuntime";
+        }>;
+        'acm-certificate-create-before-destroy-required': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "missingCreateBeforeDestroy";
+        }>;
+        'access-rule-country-block-requires-enterprise': import("./types.js").OpenTofuRuleDefinition<{
+            MessageIds: "countryBlockRequiresEnterprise" | "invalidPlan";
+        }>;
+        'ruleset-requires-managed-by-description': import("./types.js").OpenTofuRuleDefinition<{
+            RuleOptions: [{
+                description?: string;
+            }?];
+            MessageIds: "missingDescription";
+        }>;
+        'dns-record-requires-managed-by-annotation': import("./types.js").OpenTofuRuleDefinition<{
+            RuleOptions: [{
+                comment?: string;
+                tag?: string;
+            }?];
+            MessageIds: "missingComment" | "missingTag" | "invalidPlan";
+        }>;
+    };
+    configs: {
+        "aws/recommended": TierConfig;
+        "cloudflare/recommended": TierConfig;
+        /**
+         * every rule with `recommended: true`, at its declared severity
+         * (error when the rule omits one). preconfigured for `.tf` and
+         * `.tofu` files.
+         */
+        recommended: TierConfig;
+    };
+};
+export default plugin;
+export { OpenTofuLanguage } from './language.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAejD,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;CACzC;AAkBD;;;;GAIG;AACH,QAAA,MAAM,MAAM;IACV,8CAA8C;;;;;IAK9C;;;OAGG;;;;IAIH,8CAA8C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAvD9B,CAAC;;;;;;uBAsClB,CAAD;mBAAa,CAAC;;;;;;;;QAoBV;;;;WAIG;;;CASN,CAAC;AAMF,eAAe,MAAM,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,65 @@
+import { buildCategoryRecommendedRules } from './configs/category-recommended.js';
+import { buildRecommendedRules } from './configs/recommended.js';
+import { OpenTofuLanguage } from './language.js';
+import { initialize } from './parser/index.js';
+import { rules } from './rules/index.js';
+// ESLint's Language.parse contract is sync; this top-level await blocks
+// the plugin export until the WASM parser is ready. ESLint's config loader
+// uses dynamic import which awaits TLA, so consumers don't see the boot.
+await initialize();
+const TOFU_FILES = ['**/*.tf', '**/*.tofu'];
+const PROVIDER_CATEGORIES = ['aws', 'cloudflare'];
+function tierConfig(tierRules) {
+    return {
+        plugins: {},
+        files: TOFU_FILES,
+        language: 'lintofu/opentofu',
+        rules: tierRules,
+    };
+}
+const providerConfigs = Object.fromEntries(PROVIDER_CATEGORIES.map((category) => [
+    `${category}/recommended`,
+    tierConfig(buildCategoryRecommendedRules(rules, category)),
+]));
+/**
+ * the lintofu eslint plugin: `meta`, the `lintofu/opentofu` language,
+ * every bundled rule, and the generated `recommended` and
+ * `<provider>/recommended` configs.
+ */
+const plugin = {
+    /** plugin name and version eslint reports. */
+    meta: {
+        name: 'lintofu',
+        version: '0.0.0',
+    },
+    /**
+     * the opentofu/terraform hcl language implementation; select it with
+     * `language: 'lintofu/opentofu'`.
+     */
+    languages: {
+        opentofu: new OpenTofuLanguage(),
+    },
+    /** every bundled rule, keyed by rule name. */
+    rules,
+    configs: {
+        /**
+         * every rule with `recommended: true`, at its declared severity
+         * (error when the rule omits one). preconfigured for `.tf` and
+         * `.tofu` files.
+         */
+        recommended: tierConfig(buildRecommendedRules(rules)),
+        /**
+         * one `<provider>/recommended` config per provider category, holding
+         * the recommended rules of that category. same file coverage as
+         * `recommended`.
+         */
+        ...providerConfigs,
+    },
+};
+for (const config of Object.values(plugin.configs)) {
+    config.plugins = { lintofu: plugin };
+}
+export default plugin;
+export { OpenTofuLanguage } from './language.js';
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,MAAM,UAAU,EAAE,CAAC;AAEnB,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAE5C,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,YAAY,CAAU,CAAC;AAW3D,SAAS,UAAU,CAAC,SAA2C;IAC7D,OAAO;QACL,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,kBAAkB;QAC5B,KAAK,EAAE,SAAS;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CACxC,mBAAmB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpC,GAAG,QAAQ,cAAc;IACzB,UAAU,CAAC,6BAA6B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;CAC3D,CAAC,CACsD,CAAC;AAE3D;;;;GAIG;AACH,MAAM,MAAM,GAAG;IACb,8CAA8C;IAC9C,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,OAAO;KACjB;IACD;;;OAGG;IACH,SAAS,EAAE;QACT,QAAQ,EAAE,IAAI,gBAAgB,EAAE;KACjC;IACD,8CAA8C;IAC9C,KAAK;IACL,OAAO,EAAE;QACP;;;;WAIG;QACH,WAAW,EAAE,UAAU,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACrD;;;;WAIG;QACH,GAAG,eAAe;KACnB;CACF,CAAC;AAEF,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,MAAM,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,eAAe,MAAM,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,cAAc,YAAY,CAAC"}

package/dist/language.d.ts

@@ -0,0 +1,34 @@
+import type { File, Language, LanguageContext, OkParseResult, ParseResult } from '@eslint/core';
+import { type Body } from './parser/index.js';
+import { OpenTofuSourceCode } from './source-code.js';
+/**
+ * The eslint Language implementation for opentofu/terraform hcl. The plugin
+ * registers it as `lintofu/opentofu`.
+ */
+export declare class OpenTofuLanguage implements Language {
+    readonly fileType: "text";
+    /** 1-indexed lines. */
+    readonly lineStart: 1;
+    /** 1-indexed columns. */
+    readonly columnStart: 1;
+    readonly nodeTypeKey = "type";
+    /**
+     * No-op. The Language interface requires this method even when there are
+     * no options to validate.
+     */
+    validateLanguageOptions(_languageOptions: unknown): void;
+    /**
+     * Parses hcl. Parser diagnostics with severity 'error' fail the parse;
+     * warnings do not. Comments ride on the parse result's open index
+     * signature and are read back in {@link OpenTofuLanguage.createSourceCode};
+     * they are not part of the ast.
+     */
+    parse(file: File, _context: LanguageContext): ParseResult<Body>;
+    /**
+     * Builds the {@link OpenTofuSourceCode} rules receive as
+     * `context.sourceCode`. The module directory is the dirname of the file's
+     * physical path, which scopes the project index.
+     */
+    createSourceCode(file: File, parseResult: OkParseResult<Body>, _context: LanguageContext): OpenTofuSourceCode;
+}
+//# sourceMappingURL=language.d.ts.map

package/dist/language.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"language.d.ts","sourceRoot":"","sources":["../src/language.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,IAAI,EACJ,QAAQ,EACR,eAAe,EACf,aAAa,EACb,WAAW,EACZ,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,IAAI,EAA2B,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,QAAQ;IAC/C,QAAQ,CAAC,QAAQ,EAAG,MAAM,CAAU;IACpC,uBAAuB;IACvB,QAAQ,CAAC,SAAS,EAAG,CAAC,CAAU;IAChC,yBAAyB;IACzB,QAAQ,CAAC,WAAW,EAAG,CAAC,CAAU;IAClC,QAAQ,CAAC,WAAW,UAAU;IAE9B;;;OAGG;IAEH,uBAAuB,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI;IAExD;;;;;OAKG;IACH,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC;IAwB/D;;;;OAIG;IACH,gBAAgB,CACd,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,EAChC,QAAQ,EAAE,eAAe,GACxB,kBAAkB;CActB"}

package/dist/language.js

@@ -0,0 +1,72 @@
+import { dirname, isAbsolute, resolve } from 'node:path';
+import { parseSync } from './parser/index.js';
+import { OpenTofuSourceCode } from './source-code.js';
+/**
+ * The eslint Language implementation for opentofu/terraform hcl. The plugin
+ * registers it as `lintofu/opentofu`.
+ */
+export class OpenTofuLanguage {
+    fileType = 'text';
+    /** 1-indexed lines. */
+    lineStart = 1;
+    /** 1-indexed columns. */
+    columnStart = 1;
+    nodeTypeKey = 'type';
+    /**
+     * No-op. The Language interface requires this method even when there are
+     * no options to validate.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-empty-function
+    validateLanguageOptions(_languageOptions) { }
+    /**
+     * Parses hcl. Parser diagnostics with severity 'error' fail the parse;
+     * warnings do not. Comments ride on the parse result's open index
+     * signature and are read back in {@link OpenTofuLanguage.createSourceCode};
+     * they are not part of the ast.
+     */
+    parse(file, _context) {
+        const text = typeof file.body === 'string'
+            ? file.body
+            : new TextDecoder().decode(file.body);
+        const result = parseSync(text, { filename: file.path });
+        const errors = result.diagnostics.filter((d) => d.severity === 'error');
+        if (errors.length > 0) {
+            return {
+                ok: false,
+                errors: errors.map((d) => ({
+                    message: d.summary,
+                    line: d.range.start.line,
+                    column: d.range.start.column,
+                    endLine: d.range.end.line,
+                    endColumn: d.range.end.column,
+                })),
+            };
+        }
+        return { ok: true, ast: result.ast, comments: result.comments };
+    }
+    /**
+     * Builds the {@link OpenTofuSourceCode} rules receive as
+     * `context.sourceCode`. The module directory is the dirname of the file's
+     * physical path, which scopes the project index.
+     */
+    createSourceCode(file, parseResult, _context) {
+        const text = typeof file.body === 'string'
+            ? file.body
+            : new TextDecoder().decode(file.body);
+        const moduleDir = deriveModuleDir(file.physicalPath);
+        const comments = parseResult.comments ?? [];
+        return new OpenTofuSourceCode({
+            text,
+            ast: parseResult.ast,
+            comments,
+            moduleDir,
+        });
+    }
+}
+function deriveModuleDir(filePath) {
+    if (!filePath)
+        return undefined;
+    const abs = isAbsolute(filePath) ? filePath : resolve(filePath);
+    return dirname(abs);
+}
+//# sourceMappingURL=language.js.map

package/dist/language.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"language.js","sourceRoot":"","sources":["../src/language.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAA2B,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IAClB,QAAQ,GAAG,MAAe,CAAC;IACpC,uBAAuB;IACd,SAAS,GAAG,CAAU,CAAC;IAChC,yBAAyB;IAChB,WAAW,GAAG,CAAU,CAAC;IACzB,WAAW,GAAG,MAAM,CAAC;IAE9B;;;OAGG;IACH,gEAAgE;IAChE,uBAAuB,CAAC,gBAAyB,IAAS,CAAC;IAE3D;;;;;OAKG;IACH,KAAK,CAAC,IAAU,EAAE,QAAyB;QACzC,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAExD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACzB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;oBACxB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;oBAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI;oBACzB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM;iBAC9B,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClE,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CACd,IAAU,EACV,WAAgC,EAChC,QAAyB;QAEzB,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAI,WAAW,CAAC,QAAkC,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,kBAAkB,CAAC;YAC5B,IAAI;YACJ,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,QAAQ;YACR,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,eAAe,CAAC,QAA4B;IACnD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC"}

package/dist/parser/index.d.ts

@@ -0,0 +1,10 @@
+import type { ParseResult } from './types.js';
+export type * from './types.js';
+export declare function initialize(): Promise<void>;
+export declare function parseSync(source: string, opts?: {
+    filename?: string;
+}): ParseResult;
+export declare function parse(source: string, opts?: {
+    filename?: string;
+}): Promise<ParseResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/parser/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,mBAAmB,YAAY,CAAC;AAwChC,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAEhD;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,WAAW,CAUb;AAED,wBAAsB,KAAK,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,WAAW,CAAC,CAGtB"}