@dotzen/dotzen 0.0.1

package/dist/engine/evaluate.js

@@ -0,0 +1,590 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluate = evaluate;
+const model_1 = require("../hcl/model");
+const vocabulary_1 = require("../vocabulary");
+const PLAINTEXT_PROTOCOLS = new Set(['HTTP', 'TCP']);
+/**
+ * A resource reference embedded in an unresolved expression, e.g.
+ * `${aws_s3_bucket.data.id}` -> captures type `aws_s3_bucket`, name `data`.
+ * `var.`/`local.`/`data.` prefixes match too but never collide with a real
+ * resource address, so they are harmless in the index.
+ */
+const RESOURCE_REF = /\$\{\s*([a-z][a-z0-9_]*)\.([A-Za-z0-9_-]+)/;
+function buildAssociations(resources) {
+    const idx = new Map();
+    for (const res of resources) {
+        for (const [attr, v] of Object.entries(res.attributes)) {
+            if (v.kind !== 'unresolved')
+                continue;
+            const m = RESOURCE_REF.exec(v.expr);
+            if (!m)
+                continue;
+            const parentAddr = `${m[1]}.${m[2]}`;
+            const set = idx.get(parentAddr) ?? new Set();
+            set.add(`${res.type}|${attr}`);
+            idx.set(parentAddr, set);
+        }
+    }
+    return idx;
+}
+const assertNever = (x) => {
+    throw new Error(`unhandled condition: ${JSON.stringify(x)}`);
+};
+/**
+ * Whether a resource is in scope for a given condition of a rule. The
+ * base match is target-vs-type; denyIngress additionally reaches the
+ * decomposed ingress-rule resource (per-condition, so mustHaveTags on a
+ * security group does not).
+ */
+function inScope(condition, target, r) {
+    if (target.kind === 'all')
+        return true;
+    if (target.types.includes(r.type))
+        return true;
+    // Decomposed "child" resources are governed by a rule on their parent
+    // type: separate ingress-rule resources for denyIngress, separate
+    // bucket-acl resources for denyAcl (both are modern replacements for an
+    // inline block/argument).
+    if (condition.kind === 'denyIngress' &&
+        target.types.includes(vocabulary_1.AwsResource.SecurityGroup) &&
+        r.type === vocabulary_1.AwsResource.VpcSecurityGroupIngressRule)
+        return true;
+    return (condition.kind === 'denyAcl' &&
+        target.types.includes(vocabulary_1.AwsResource.S3Bucket) &&
+        r.type === vocabulary_1.AwsResource.S3BucketAcl);
+}
+/**
+ * Environment scoping is a filter, not a check: an env-scoped rule applies
+ * only to resources whose `environment` tag resolves to that environment.
+ * A resource with an absent/unresolved environment is skipped (fail-open) —
+ * pair env-scoped rules with a `mustHaveTags(Environment)` rule so every
+ * resource is forced to declare its environment (defense in depth, doc 04).
+ */
+function environmentMatches(rule, r) {
+    if (!rule.environment)
+        return true;
+    return (r.environment?.kind === 'literal' &&
+        r.environment.value === rule.environment);
+}
+const isLiteralNumber = (v) => v.kind === 'literal' && typeof v.value === 'number';
+const portInRange = (port, ing) => {
+    if (!isLiteralNumber(ing.fromPort) || !isLiteralNumber(ing.toPort))
+        return 'unknown';
+    return port >= ing.fromPort.value && port <= ing.toPort.value;
+};
+/**
+ * Shared port/CIDR check for deny-ingress and deny-egress (three-way):
+ * does any rule in `rules` open a targeted port to a targeted CIDR?
+ */
+function evalPortCidr(c, rules, direction) {
+    let sawUnknown = false;
+    for (const ing of rules) {
+        const portMatches = c.ports.map((p) => portInRange(p, ing));
+        if (portMatches.includes('unknown')) {
+            sawUnknown = true;
+            continue;
+        }
+        if (!portMatches.includes(true))
+            continue; // no targeted port on this rule
+        const literalCidrs = ing.cidrBlocks.filter((v) => v.kind === 'literal');
+        const hasUnresolvedCidr = ing.cidrBlocks.some((v) => v.kind === 'unresolved');
+        const matchedCidr = literalCidrs.find((v) => v.kind === 'literal' && c.from.includes(v.value));
+        if (matchedCidr && matchedCidr.kind === 'literal') {
+            return {
+                kind: 'violation',
+                detail: `port ${c.ports.join('/')} open to ${matchedCidr.value}`,
+            };
+        }
+        if (hasUnresolvedCidr)
+            sawUnknown = true;
+    }
+    if (sawUnknown)
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${direction} port or cidr is an unresolved reference`,
+        };
+    return { kind: 'pass' };
+}
+const evalDenyIngress = (c, r) => evalPortCidr(c, r.ingress, 'ingress');
+const evalDenyEgress = (c, r) => evalPortCidr(c, r.egress ?? [], 'egress');
+/** Evaluate one mustHaveTags condition (three-way). */
+function evalMustHaveTags(c, r) {
+    if (r.tags.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: 'tags are an unresolved reference',
+        };
+    const present = new Set(r.tags.keys);
+    const missing = c.tags.filter((t) => !present.has(t));
+    if (missing.length > 0)
+        return { kind: 'violation', detail: `missing tags: ${missing.join(', ')}` };
+    return { kind: 'pass' };
+}
+const isLiteralTrue = (v) => v?.kind === 'literal' && v.value === true;
+/**
+ * Boolean attribute must be true. An absent attribute counts as not-true
+ * (matches the AWS default of `false` for the attributes this targets,
+ * e.g. storage_encrypted); an unresolved value degrades to cannotEvaluate.
+ */
+function evalMustBeTrue(c, r) {
+    let sawUnknown = false;
+    const failing = [];
+    for (const attr of c.attrs) {
+        const v = r.attributes[attr];
+        if (v?.kind === 'unresolved') {
+            sawUnknown = true;
+            continue;
+        }
+        if (!isLiteralTrue(v))
+            failing.push(attr);
+    }
+    if (failing.length > 0)
+        return { kind: 'violation', detail: `must be true: ${failing.join(', ')}` };
+    if (sawUnknown)
+        return {
+            kind: 'cannotEvaluate',
+            reason: 'attribute is an unresolved reference',
+        };
+    return { kind: 'pass' };
+}
+const isLiteralFalse = (v) => v?.kind === 'literal' && v.value === false;
+/**
+ * Boolean attribute must be explicitly false. Absent counts as a
+ * violation — use for attributes whose insecure AWS default is `true`
+ * (e.g. EKS `vpc_config.endpoint_public_access`). Unresolved => cannot evaluate.
+ */
+function evalMustBeFalse(c, r) {
+    let sawUnknown = false;
+    const failing = [];
+    for (const attr of c.attrs) {
+        const v = r.attributes[attr];
+        if (v?.kind === 'unresolved') {
+            sawUnknown = true;
+            continue;
+        }
+        if (!isLiteralFalse(v))
+            failing.push(attr);
+    }
+    if (failing.length > 0)
+        return { kind: 'violation', detail: `must be false: ${failing.join(', ')}` };
+    if (sawUnknown)
+        return {
+            kind: 'cannotEvaluate',
+            reason: 'attribute is an unresolved reference',
+        };
+    return { kind: 'pass' };
+}
+/**
+ * AwsAttribute must be present. Absent is the violation; any value — literal
+ * or an unresolved reference — counts as set (so this never degrades to
+ * cannotEvaluate: presence is statically knowable).
+ */
+function evalMustBeSet(c, r) {
+    const missing = c.attrs.filter((a) => r.attributes[a] === undefined);
+    if (missing.length > 0)
+        return { kind: 'violation', detail: `must be set: ${missing.join(', ')}` };
+    return { kind: 'pass' };
+}
+/** Boolean attribute must not be true (absent => not-true => pass). */
+function evalDenyWhenTrue(c, r) {
+    let sawUnknown = false;
+    const offending = [];
+    for (const attr of c.attrs) {
+        const v = r.attributes[attr];
+        if (v?.kind === 'unresolved') {
+            sawUnknown = true;
+            continue;
+        }
+        if (isLiteralTrue(v))
+            offending.push(attr);
+    }
+    if (offending.length > 0)
+        return {
+            kind: 'violation',
+            detail: `must not be true: ${offending.join(', ')}`,
+        };
+    if (sawUnknown)
+        return {
+            kind: 'cannotEvaluate',
+            reason: 'attribute is an unresolved reference',
+        };
+    return { kind: 'pass' };
+}
+/** Deny a public ACL. Absent `acl` => default private => pass. */
+function evalDenyAcl(c, r) {
+    const v = r.attributes.acl;
+    if (v === undefined)
+        return { kind: 'pass' };
+    if (v.kind === 'unresolved')
+        return { kind: 'cannotEvaluate', reason: 'acl is an unresolved reference' };
+    if (c.acls.includes(v.value))
+        return { kind: 'violation', detail: `acl is ${v.value}` };
+    return { kind: 'pass' };
+}
+/** AwsAttribute must equal a specific value (absent => not equal => violation). */
+function evalMustEqual(c, r) {
+    const v = r.attributes[c.attr];
+    if (v?.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} is an unresolved reference`,
+        };
+    if (v?.kind === 'literal' && String(v.value) === c.value)
+        return { kind: 'pass' };
+    return { kind: 'violation', detail: `${c.attr} must equal "${c.value}"` };
+}
+/** Numeric attribute must be >= min (absent/below => violation). */
+function evalMustBeAtLeast(c, r) {
+    const v = r.attributes[c.attr];
+    if (v?.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} is an unresolved reference`,
+        };
+    if (v?.kind === 'literal' && typeof v.value === 'number' && v.value >= c.min)
+        return { kind: 'pass' };
+    return { kind: 'violation', detail: `${c.attr} must be >= ${c.min}` };
+}
+/** Numeric attribute must be <= max (absent/above => violation). */
+function evalMustBeAtMost(c, r) {
+    const v = r.attributes[c.attr];
+    if (v?.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} is an unresolved reference`,
+        };
+    if (v?.kind === 'literal' && typeof v.value === 'number' && v.value <= c.max)
+        return { kind: 'pass' };
+    return { kind: 'violation', detail: `${c.attr} must be <= ${c.max}` };
+}
+/**
+ * Flag over-permissive IAM `Allow` statements:
+ *  - `Action: "*"` (full privileges) — sharpened to "full administrative
+ *    access" when paired with `Resource: "*"`;
+ *  - `NotAction` (allow everything EXCEPT a list) — an over-broad grant AWS
+ *    warns against, and a real least-privilege anti-pattern.
+ * A `jsonencode(...)`/variable policy is `unresolved` => could-not-evaluate.
+ */
+function evalDenyIamWildcard(_c, r) {
+    const p = r.policy;
+    if (!p)
+        return { kind: 'pass' }; // no inline policy document
+    if (p.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: 'IAM policy is not a literal JSON document (jsonencode/var)',
+        };
+    for (const s of p.statements) {
+        if (s.effect.toLowerCase() !== 'allow')
+            continue;
+        if (s.actions.includes('*'))
+            return {
+                kind: 'violation',
+                detail: s.resources.includes('*')
+                    ? 'Allow grants Action "*" on Resource "*" (full administrative access)'
+                    : 'Allow statement grants Action "*" (full privileges)',
+            };
+        if (s.notActions.length > 0)
+            return {
+                kind: 'violation',
+                detail: `Allow with NotAction grants everything except ${s.notActions.join(', ')}`,
+            };
+    }
+    return { kind: 'pass' };
+}
+const literalItems = (items) => items
+    .filter((i) => i.kind === 'literal')
+    .map((i) => i.value);
+const hasUnresolvedItem = (items) => items.some((i) => i.kind === 'unresolved');
+/** Flag a list attribute that contains any forbidden value (three-way). */
+function evalListContains(c, r) {
+    const l = r.lists?.[c.attr];
+    if (!l) {
+        // whole list may be an unresolved reference stored as a scalar
+        return r.attributes[c.attr]?.kind === 'unresolved'
+            ? {
+                kind: 'cannotEvaluate',
+                reason: `${c.attr} is an unresolved reference`,
+            }
+            : { kind: 'pass' }; // absent list -> nothing forbidden present
+    }
+    if (l.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} is an unresolved reference`,
+        };
+    const found = literalItems(l.items).find((v) => c.values.includes(v));
+    if (found !== undefined)
+        return {
+            kind: 'violation',
+            detail: `${c.attr} contains "${String(found)}"`,
+        };
+    if (hasUnresolvedItem(l.items))
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} has an unresolved element`,
+        };
+    return { kind: 'pass' };
+}
+/** Require a list attribute to include all of `values` (three-way). */
+function evalListMustInclude(c, r) {
+    const l = r.lists?.[c.attr];
+    if (!l)
+        return r.attributes[c.attr]?.kind === 'unresolved'
+            ? {
+                kind: 'cannotEvaluate',
+                reason: `${c.attr} is an unresolved reference`,
+            }
+            : {
+                kind: 'violation',
+                detail: `${c.attr} must include ${c.values.join(', ')}`,
+            };
+    if (l.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} is an unresolved reference`,
+        };
+    const present = literalItems(l.items);
+    const missing = c.values.filter((v) => !present.includes(v));
+    if (missing.length === 0)
+        return { kind: 'pass' };
+    if (hasUnresolvedItem(l.items))
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} has an unresolved element`,
+        };
+    return {
+        kind: 'violation',
+        detail: `${c.attr} must include ${missing.join(', ')}`,
+    };
+}
+/** Flag a scalar attribute whose literal value is in a forbidden set. */
+function evalDenyValue(c, r) {
+    const v = r.attributes[c.attr];
+    if (v === undefined)
+        return { kind: 'pass' }; // absent
+    if (v.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} is an unresolved reference`,
+        };
+    if (c.values.includes(String(v.value)))
+        return { kind: 'violation', detail: `${c.attr} is "${String(v.value)}"` };
+    return { kind: 'pass' };
+}
+/**
+ * Allowlist: the attribute's literal value must be one of `values`. Absent
+ * or any other value is a violation (mirror of denyValue); unresolved =>
+ * cannot evaluate.
+ */
+function evalMustBeOneOf(c, r) {
+    const v = r.attributes[c.attr];
+    if (v?.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: `${c.attr} is an unresolved reference`,
+        };
+    if (v?.kind === 'literal' && c.values.includes(String(v.value)))
+        return { kind: 'pass' };
+    return {
+        kind: 'violation',
+        detail: `${c.attr} must be one of ${c.values.join(', ')}`,
+    };
+}
+/**
+ * Flag a plaintext listener (`protocol` HTTP/TCP) — unless it exists only
+ * to redirect to HTTPS (`default_action.type = "redirect"`), the standard
+ * safe pattern. Absent/unresolved protocol => pass / could-not-evaluate.
+ */
+function evalDenyPlaintextListener(_c, r) {
+    const proto = r.attributes.protocol;
+    if (proto === undefined)
+        return { kind: 'pass' };
+    if (proto.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: 'listener protocol is an unresolved reference',
+        };
+    if (!PLAINTEXT_PROTOCOLS.has(String(proto.value)))
+        return { kind: 'pass' };
+    const action = r.attributes['default_action.type'];
+    if (action?.kind === 'literal' && action.value === 'redirect')
+        return { kind: 'pass' }; // HTTP->HTTPS redirect is fine
+    return {
+        kind: 'violation',
+        detail: `plaintext listener (protocol ${String(proto.value)})`,
+    };
+}
+/**
+ * Flag an ECS task definition with a privileged container. Parses the
+ * literal-JSON `container_definitions`; a `jsonencode(...)`/variable value
+ * degrades to could-not-evaluate.
+ */
+function evalDenyPrivilegedContainers(_c, r) {
+    const c = r.containers;
+    if (!c)
+        return { kind: 'pass' };
+    if (c.kind === 'unresolved')
+        return {
+            kind: 'cannotEvaluate',
+            reason: 'container_definitions is not a literal JSON array (jsonencode/var)',
+        };
+    const priv = c.containers.find((x) => x.privileged);
+    if (priv)
+        return { kind: 'violation', detail: `privileged container "${priv.name}"` };
+    return { kind: 'pass' };
+}
+/**
+ * Flag a hardcoded literal where a reference belongs (e.g. a secret).
+ * Inverts the usual semantics: a *literal* is the violation; an
+ * *unresolved* reference (var/data) is the desired state and passes;
+ * absent passes (nothing set here).
+ */
+function evalDenyLiteral(c, r) {
+    const offending = c.attrs.filter((a) => r.attributes[a]?.kind === 'literal');
+    if (offending.length > 0)
+        return {
+            kind: 'violation',
+            detail: `hardcoded value — use a reference: ${offending.join(', ')}`,
+        };
+    return { kind: 'pass' };
+}
+/**
+ * Cross-resource: pass iff some resource of `childType` references this one
+ * through its `via` attribute. Association is by resource reference
+ * (`bucket = aws_s3_bucket.x.id`), the idiomatic Terraform wiring; a child
+ * that points at its parent by a literal name would not be linked.
+ */
+function evalMustHaveAssociated(c, r, ctx) {
+    const key = `${c.childType}|${c.via}`;
+    if (ctx.associations.get((0, model_1.address)(r))?.has(key))
+        return { kind: 'pass' };
+    return {
+        kind: 'violation',
+        detail: `no associated ${c.childType} (referencing this via ${c.via})`,
+    };
+}
+/**
+ * Whether a resource declares a given nested block. Prefers the recorded
+ * block paths (which capture even empty blocks); falls back to the flattened
+ * dotted keys so hand-built resources without `blocks` still work.
+ */
+function hasBlock(block, r) {
+    if (r.blocks?.includes(block))
+        return true;
+    const prefix = `${block}.`;
+    return (Object.keys(r.attributes).some((k) => k.startsWith(prefix)) ||
+        Object.keys(r.lists ?? {}).some((k) => k.startsWith(prefix)));
+}
+/** Same-resource: pass iff the resource declares the given nested block. */
+function evalMustHaveBlock(c, r) {
+    return hasBlock(c.block, r)
+        ? { kind: 'pass' }
+        : { kind: 'violation', detail: `missing ${c.block} block` };
+}
+/** Same-resource: flag iff the resource declares the given nested block. */
+function evalDenyBlockPresence(c, r) {
+    return hasBlock(c.block, r)
+        ? { kind: 'violation', detail: `${c.block} block must not be declared` }
+        : { kind: 'pass' };
+}
+/** Exhaustive dispatch: a new condition kind is a compile error (Layer 4). */
+function evalCondition(c, r, ctx) {
+    switch (c.kind) {
+        case 'denyIngress':
+            return evalDenyIngress(c, r);
+        case 'denyEgress':
+            return evalDenyEgress(c, r);
+        case 'mustHaveTags':
+            return evalMustHaveTags(c, r);
+        case 'mustBeTrue':
+            return evalMustBeTrue(c, r);
+        case 'mustBeFalse':
+            return evalMustBeFalse(c, r);
+        case 'mustBeSet':
+            return evalMustBeSet(c, r);
+        case 'denyWhenTrue':
+            return evalDenyWhenTrue(c, r);
+        case 'denyAcl':
+            return evalDenyAcl(c, r);
+        case 'mustEqual':
+            return evalMustEqual(c, r);
+        case 'mustBeAtLeast':
+            return evalMustBeAtLeast(c, r);
+        case 'mustBeAtMost':
+            return evalMustBeAtMost(c, r);
+        case 'denyIamWildcard':
+            return evalDenyIamWildcard(c, r);
+        case 'listContains':
+            return evalListContains(c, r);
+        case 'listMustInclude':
+            return evalListMustInclude(c, r);
+        case 'denyValue':
+            return evalDenyValue(c, r);
+        case 'mustBeOneOf':
+            return evalMustBeOneOf(c, r);
+        case 'denyPlaintextListener':
+            return evalDenyPlaintextListener(c, r);
+        case 'denyPrivilegedContainers':
+            return evalDenyPrivilegedContainers(c, r);
+        case 'denyLiteral':
+            return evalDenyLiteral(c, r);
+        case 'mustHaveAssociated':
+            return evalMustHaveAssociated(c, r, ctx);
+        case 'mustHaveBlock':
+            return evalMustHaveBlock(c, r);
+        case 'denyBlockPresence':
+            return evalDenyBlockPresence(c, r);
+        default:
+            return assertNever(c);
+    }
+}
+/**
+ * TOTAL: always returns a CheckReport (doc 06, Rule 4). Folds over
+ * rules x conditions x in-scope resources (Rule 3), accumulating.
+ */
+function evaluate(rules, resources) {
+    const violations = [];
+    const couldNotEvaluate = [];
+    let passed = 0;
+    const ctx = { associations: buildAssociations(resources) };
+    for (const rule of rules) {
+        for (const resource of resources) {
+            if (!environmentMatches(rule, resource))
+                continue;
+            for (const condition of rule.conditions) {
+                if (!inScope(condition, rule.target, resource))
+                    continue;
+                const outcome = evalCondition(condition, resource, ctx);
+                switch (outcome.kind) {
+                    case 'violation':
+                        violations.push({
+                            ruleId: rule.id,
+                            message: rule.message,
+                            rationale: rule.rationale,
+                            effect: rule.effect,
+                            resource: (0, model_1.address)(resource),
+                            file: resource.file,
+                            line: resource.line,
+                            approvers: rule.approvers,
+                        });
+                        break;
+                    case 'cannotEvaluate':
+                        couldNotEvaluate.push({
+                            ruleId: rule.id,
+                            resource: (0, model_1.address)(resource),
+                            file: resource.file,
+                            line: resource.line,
+                            reason: outcome.reason,
+                        });
+                        break;
+                    case 'pass':
+                        passed += 1;
+                        break;
+                }
+            }
+        }
+    }
+    return { violations, passed, couldNotEvaluate };
+}

package/dist/hcl/model.d.ts

@@ -0,0 +1,91 @@
+import { AnyResource } from '../vocabulary';
+/**
+ * dotzen's own resource model. The engine only ever sees this — never the
+ * parser's raw output (doc 06). Unresolvable expressions are explicit,
+ * which is what feeds the `couldNotEvaluate` outcome.
+ */
+export type NormalizedValue = {
+    readonly kind: 'literal';
+    readonly value: string | number | boolean;
+} | {
+    readonly kind: 'unresolved';
+    readonly expr: string;
+};
+export interface IngressRule {
+    readonly fromPort: NormalizedValue;
+    readonly toPort: NormalizedValue;
+    readonly cidrBlocks: NormalizedValue[];
+}
+/**
+ * Tags are either statically knowable (a literal map, so we know which
+ * keys are present) or unresolved (e.g. `tags = var.tags` / `merge(...)`),
+ * which must degrade to "could not evaluate" rather than a false verdict.
+ */
+export type TagsInfo = {
+    readonly kind: 'resolved';
+    readonly keys: string[];
+} | {
+    readonly kind: 'unresolved';
+};
+/** One IAM policy statement (from a parsed literal-JSON policy document). */
+export interface PolicyStatement {
+    readonly effect: string;
+    readonly actions: string[];
+    readonly resources: string[];
+    /** `NotAction` entries — an Allow with NotAction is an over-broad grant. */
+    readonly notActions: string[];
+}
+/**
+ * An IAM `policy` argument: parsed when it is a literal JSON document
+ * (heredoc / inline string); `unresolved` when it is a `jsonencode(...)`
+ * expression, a variable, or malformed — which must degrade to "could not
+ * evaluate" rather than a guess.
+ */
+export type PolicyInfo = {
+    readonly kind: 'parsed';
+    readonly statements: PolicyStatement[];
+} | {
+    readonly kind: 'unresolved';
+};
+/** A list-valued attribute (array of scalars), for `listContains`/`listMustInclude`. */
+export type ListInfo = {
+    readonly kind: 'resolved';
+    readonly items: NormalizedValue[];
+} | {
+    readonly kind: 'unresolved';
+};
+/** One ECS container (from a parsed literal-JSON `container_definitions`). */
+export interface ContainerDef {
+    readonly name: string;
+    readonly privileged: boolean;
+}
+export type ContainerInfo = {
+    readonly kind: 'parsed';
+    readonly containers: ContainerDef[];
+} | {
+    readonly kind: 'unresolved';
+};
+export interface NormalizedResource {
+    readonly type: AnyResource;
+    readonly name: string;
+    readonly file: string;
+    readonly line: number;
+    readonly ingress: IngressRule[];
+    /** Egress rules (security groups). Optional — absent means none. */
+    readonly egress?: IngressRule[];
+    readonly tags: TagsInfo;
+    /** Scalar attributes (nested blocks flattened to dotted keys). */
+    readonly attributes: Record<string, NormalizedValue>;
+    /** List-valued attributes (arrays of scalars), by dotted key. */
+    readonly lists?: Record<string, ListInfo>;
+    /** Dotted paths of every nested block declared (even empty ones), for
+     *  `mustHaveBlock` / `denyBlockPresence`. */
+    readonly blocks?: string[];
+    /** Resolved value of the `environment` tag, if present — used for rule scoping. */
+    readonly environment?: NormalizedValue;
+    /** Parsed IAM `policy` document, if the resource has one. */
+    readonly policy?: PolicyInfo;
+    /** Parsed ECS `container_definitions`, if the resource has them. */
+    readonly containers?: ContainerInfo;
+}
+export declare const address: (r: NormalizedResource) => string;

package/dist/hcl/model.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.address = void 0;
+const address = (r) => `${r.type}.${r.name}`;
+exports.address = address;