@dotzen/dotzen 0.0.1

package/dist/hcl/normalize.d.ts

@@ -0,0 +1,16 @@
+import { NormalizedResource } from './model';
+/** hcl2json emits `{ resource: { type: { name: [block, ...] } } }`. */
+export interface Hcl2JsonRoot {
+    resource?: Record<string, Record<string, unknown[]>>;
+    variable?: Record<string, unknown[]>;
+    locals?: unknown[];
+}
+/** Resolved `var.*` / `local.*` values, keyed by reference, raw form. */
+export type Scope = Map<string, unknown>;
+/** Collect `variable` defaults and `locals` from all parsed files. */
+export declare function buildScope(roots: Hcl2JsonRoot[]): Scope;
+/**
+ * Adapter boundary (doc 06): parser output -> dotzen's own model.
+ * The engine never sees `Hcl2JsonRoot`. `scope` resolves var/local refs.
+ */
+export declare function normalize(parsed: Hcl2JsonRoot, file: string, rawText: string, scope?: Scope, environmentOverride?: string): NormalizedResource[];

package/dist/hcl/normalize.js

@@ -0,0 +1,462 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildScope = buildScope;
+exports.normalize = normalize;
+const vocabulary_1 = require("../vocabulary");
+const KNOWN_TYPES = new Set([
+    ...Object.values(vocabulary_1.AwsResource),
+    ...Object.values(vocabulary_1.AzureResource),
+    ...Object.values(vocabulary_1.GcpResource),
+]);
+const isInterpolated = (s) => s.includes('${');
+const asObject = (o) => o && typeof o === 'object' ? o : {};
+function toValue(raw) {
+    if (typeof raw === 'string' && isInterpolated(raw))
+        return { kind: 'unresolved', expr: raw };
+    if (typeof raw === 'string' ||
+        typeof raw === 'number' ||
+        typeof raw === 'boolean')
+        return { kind: 'literal', value: raw };
+    return { kind: 'unresolved', expr: JSON.stringify(raw) };
+}
+// A value that is *exactly* one `var.x` / `local.y` reference — the only
+// form we resolve. Compound interpolations (`"a-${var.x}"`) stay unresolved.
+const SOLE_REF = /^\$\{(var|local)\.([A-Za-z0-9_-]+)\}$/;
+/**
+ * Resolve a raw value against the scope. A sole `var`/`local` reference is
+ * followed (through local→var chains, depth-bounded) to its literal; a
+ * reference with no known value, or any non-sole-reference expression,
+ * stays unresolved — which correctly yields "could not evaluate".
+ */
+function resolveValue(raw, scope, depth = 8) {
+    if (typeof raw === 'string') {
+        const m = SOLE_REF.exec(raw);
+        if (m) {
+            const key = `${m[1]}.${m[2]}`;
+            if (depth > 0 && scope.has(key))
+                return resolveValue(scope.get(key), scope, depth - 1);
+            return { kind: 'unresolved', expr: raw };
+        }
+    }
+    return toValue(raw);
+}
+/** Collect `variable` defaults and `locals` from all parsed files. */
+function buildScope(roots) {
+    const scope = new Map();
+    for (const root of roots) {
+        for (const [name, blocks] of Object.entries(root.variable ?? {})) {
+            const b = asObject(Array.isArray(blocks) ? blocks[0] : undefined);
+            if ('default' in b)
+                scope.set(`var.${name}`, b.default);
+        }
+        if (Array.isArray(root.locals)) {
+            for (const block of root.locals) {
+                for (const [k, v] of Object.entries(asObject(block)))
+                    scope.set(`local.${k}`, v);
+            }
+        }
+    }
+    return scope;
+}
+function mapIngressObj(o, scope) {
+    const oo = asObject(o);
+    const cidrs = Array.isArray(oo.cidr_blocks) ? oo.cidr_blocks : [];
+    return {
+        fromPort: resolveValue(oo.from_port, scope),
+        toPort: resolveValue(oo.to_port, scope),
+        cidrBlocks: cidrs.map((c) => resolveValue(c, scope)),
+    };
+}
+/** Inline `<name> { ... }` blocks (name is 'ingress' or 'egress'). */
+function inlineBlocks(block, name, scope) {
+    const raw = block[name];
+    return Array.isArray(raw) ? raw.map((i) => mapIngressObj(i, scope)) : [];
+}
+/** Follow a sole var/local reference to its raw resolved value (or undefined). */
+function resolveRaw(raw, scope, depth = 8) {
+    if (typeof raw === 'string') {
+        const m = SOLE_REF.exec(raw);
+        if (m) {
+            const key = `${m[1]}.${m[2]}`;
+            if (depth > 0 && scope.has(key))
+                return resolveRaw(scope.get(key), scope, depth - 1);
+            return undefined;
+        }
+        if (isInterpolated(raw))
+            return undefined; // compound expr / function call
+    }
+    return raw;
+}
+/** Substitute `<iterator>.value[.field]` references with the element value. */
+function substituteValue(v, iterator, el) {
+    if (typeof v === 'string') {
+        const it = escapeRegExp(iterator);
+        // eslint-disable-next-line security/detect-non-literal-regexp -- iterator escaped
+        const field = new RegExp(`^\\$\\{${it}\\.value\\.([A-Za-z0-9_-]+)\\}$`).exec(v);
+        if (field)
+            return asObject(el)[field[1]];
+        if (v === `\${${iterator}.value}`)
+            return el;
+        return v;
+    }
+    if (Array.isArray(v))
+        return v.map((x) => substituteValue(x, iterator, el));
+    return v;
+}
+const substituteIterator = (content, iterator, el) => {
+    const out = {};
+    for (const [k, v] of Object.entries(content))
+        out[k] = substituteValue(v, iterator, el);
+    return out;
+};
+/**
+ * `dynamic "ingress" { content { ... } }` blocks. When the `for_each`
+ * collection resolves (via scope) to a concrete list/map of literals, the
+ * block is EXPANDED — one ingress per element, with `<iterator>.value`
+ * references substituted — so it yields a definite verdict. When the
+ * collection cannot be resolved (a var without default, a `toset(...)` or
+ * other function call, `each.*`), the content is kept as-is with its
+ * values unresolved, correctly yielding "could not evaluate".
+ */
+function dynamicBlocks(block, name, scope) {
+    const dyn = block.dynamic;
+    if (!dyn || typeof dyn !== 'object')
+        return [];
+    const ing = dyn[name];
+    if (!Array.isArray(ing))
+        return [];
+    const out = [];
+    for (const d of ing) {
+        const dobj = asObject(d);
+        const contents = Array.isArray(dobj.content) ? dobj.content : [];
+        const iterator = typeof dobj.iterator === 'string' ? dobj.iterator : name;
+        const collection = resolveRaw(dobj.for_each, scope);
+        const elements = Array.isArray(collection)
+            ? collection
+            : collection && typeof collection === 'object'
+                ? Object.values(collection)
+                : undefined;
+        if (elements) {
+            for (const el of elements)
+                for (const c of contents)
+                    out.push(mapIngressObj(substituteIterator(asObject(c), iterator, el), scope));
+        }
+        else {
+            for (const c of contents)
+                out.push(mapIngressObj(c, scope));
+        }
+    }
+    return out;
+}
+/** A standalone `aws_vpc_security_group_ingress_rule` is itself one rule. */
+function ruleResourceIngress(block, scope) {
+    const cidrs = [];
+    if (block.cidr_ipv4 !== undefined)
+        cidrs.push(block.cidr_ipv4);
+    if (block.cidr_ipv6 !== undefined)
+        cidrs.push(block.cidr_ipv6);
+    return [
+        {
+            fromPort: resolveValue(block.from_port, scope),
+            toPort: resolveValue(block.to_port, scope),
+            cidrBlocks: cidrs.map((c) => resolveValue(c, scope)),
+        },
+    ];
+}
+/** A literal (non-interpolated) string, or undefined. */
+const litStr = (v) => typeof v === 'string' && !isInterpolated(v) ? v : undefined;
+// Azure "any source" sentinels — all mean the public internet. Normalized
+// to the CIDR the cloud-neutral `denyIngress` already recognizes.
+const AZURE_ANY_SOURCE = new Set(['*', 'Internet', '0.0.0.0/0']);
+/** Parse a port spec ("22", "*", "80-90") to a pair (Azure + GCP share this). */
+function parsePortRange(r) {
+    if (r === '*')
+        return { from: 0, to: 65535 };
+    const dash = r.split('-');
+    if (dash.length === 2) {
+        const a = Number(dash[0]);
+        const b = Number(dash[1]);
+        if (Number.isFinite(a) && Number.isFinite(b))
+            return { from: a, to: b };
+        return undefined;
+    }
+    const n = Number(r);
+    return Number.isFinite(n) ? { from: n, to: n } : undefined;
+}
+/**
+ * Map one Azure NSG rule to the cloud-neutral ingress model. Only
+ * `Inbound` + `Allow` rules are ingress; a `*`/`Internet` source becomes
+ * `0.0.0.0/0` so the shared `denyIngress` condition works unchanged.
+ */
+function azureRuleToIngress(o, scope) {
+    if (litStr(o.direction) !== 'Inbound' || litStr(o.access) !== 'Allow')
+        return [];
+    const srcRaw = o.source_address_prefixes ?? o.source_address_prefix;
+    const sources = (Array.isArray(srcRaw) ? srcRaw : [srcRaw]).filter((s) => s !== undefined);
+    const cidrBlocks = sources.map((s) => {
+        const v = resolveValue(s, scope);
+        return v.kind === 'literal' &&
+            typeof v.value === 'string' &&
+            AZURE_ANY_SOURCE.has(v.value)
+            ? { kind: 'literal', value: '0.0.0.0/0' }
+            : v;
+    });
+    const portRaw = o.destination_port_ranges ?? o.destination_port_range;
+    const ports = Array.isArray(portRaw) ? portRaw : [portRaw];
+    return ports.map((p) => {
+        const s = litStr(p);
+        const pair = s !== undefined ? parsePortRange(s) : undefined;
+        if (pair)
+            return {
+                fromPort: { kind: 'literal', value: pair.from },
+                toPort: { kind: 'literal', value: pair.to },
+                cidrBlocks,
+            };
+        const un = resolveValue(p, scope);
+        return { fromPort: un, toPort: un, cidrBlocks };
+    });
+}
+/**
+ * Map a `google_compute_firewall` to the cloud-neutral ingress model. Only
+ * INGRESS direction (the default) counts; each `allow { protocol, ports }`
+ * block becomes ingress rules over `source_ranges`. An allow block with no
+ * ports means every port (0–65535).
+ */
+function gcpFirewallToIngress(block, scope) {
+    const direction = litStr(block.direction) ?? 'INGRESS';
+    if (direction !== 'INGRESS')
+        return [];
+    const srcRaw = Array.isArray(block.source_ranges) ? block.source_ranges : [];
+    const cidrBlocks = srcRaw.map((s) => resolveValue(s, scope));
+    const allows = Array.isArray(block.allow) ? block.allow : [];
+    const out = [];
+    for (const a of allows) {
+        const ao = asObject(a);
+        const ports = Array.isArray(ao.ports) ? ao.ports : [];
+        if (ports.length === 0) {
+            out.push({
+                fromPort: { kind: 'literal', value: 0 },
+                toPort: { kind: 'literal', value: 65535 },
+                cidrBlocks,
+            });
+            continue;
+        }
+        for (const p of ports) {
+            const s = litStr(p);
+            const pair = s !== undefined ? parsePortRange(s) : undefined;
+            if (pair)
+                out.push({
+                    fromPort: { kind: 'literal', value: pair.from },
+                    toPort: { kind: 'literal', value: pair.to },
+                    cidrBlocks,
+                });
+            else {
+                const un = resolveValue(p, scope);
+                out.push({ fromPort: un, toPort: un, cidrBlocks });
+            }
+        }
+    }
+    return out;
+}
+function ingressFor(type, block, scope) {
+    if (!block)
+        return [];
+    if (type === vocabulary_1.AwsResource.VpcSecurityGroupIngressRule)
+        return ruleResourceIngress(block, scope);
+    if (type === vocabulary_1.AzureResource.NetworkSecurityRule)
+        return azureRuleToIngress(block, scope);
+    if (type === vocabulary_1.AzureResource.NetworkSecurityGroup) {
+        const rules = Array.isArray(block.security_rule) ? block.security_rule : [];
+        return rules.flatMap((r) => azureRuleToIngress(asObject(r), scope));
+    }
+    if (type === vocabulary_1.GcpResource.ComputeFirewall)
+        return gcpFirewallToIngress(block, scope);
+    return [
+        ...inlineBlocks(block, 'ingress', scope),
+        ...dynamicBlocks(block, 'ingress', scope),
+    ];
+}
+function egressFor(block, scope) {
+    if (!block)
+        return [];
+    return [
+        ...inlineBlocks(block, 'egress', scope),
+        ...dynamicBlocks(block, 'egress', scope),
+    ];
+}
+/**
+ * Tags: a literal map gives us the present keys; a `${...}` expression
+ * (var/merge/local) is unresolved; an absent block is resolved-but-empty
+ * (the literal AI-generated case — no tags written means none present).
+ */
+function tagsOf(block) {
+    const t = block?.tags;
+    if (t === undefined)
+        return { kind: 'resolved', keys: [] };
+    if (typeof t === 'string' && isInterpolated(t))
+        return { kind: 'unresolved' };
+    if (t && typeof t === 'object' && !Array.isArray(t))
+        return { kind: 'resolved', keys: Object.keys(t) };
+    return { kind: 'unresolved' };
+}
+/** Resolved value of the `environment` tag (for rule scoping), if present. */
+function environmentOf(block, scope) {
+    const t = block?.tags;
+    if (!t || typeof t !== 'object' || Array.isArray(t))
+        return undefined;
+    const env = t.environment;
+    return env === undefined ? undefined : resolveValue(env, scope);
+}
+// Blocks handled elsewhere (ingress/egress) or as tags — not attributes.
+const NON_ATTR_BLOCKS = new Set(['ingress', 'egress', 'dynamic', 'tags']);
+// hcl2json represents a nested block as an array of one object.
+const isNestedBlock = (v) => Array.isArray(v) &&
+    v.length > 0 &&
+    typeof v[0] === 'object' &&
+    v[0] !== null &&
+    !Array.isArray(v[0]);
+/**
+ * Extract scalar attributes and list-valued attributes from a block,
+ * recursing through nested blocks and flattening to dotted keys
+ * (`vpc_config { public_access_cidrs = [...] }` -> list
+ * `vpc_config.public_access_cidrs`; `metadata_options { http_tokens = x }`
+ * -> attribute `metadata_options.http_tokens`). Maps (tags) are skipped;
+ * ingress/egress/dynamic are handled elsewhere.
+ */
+function collect(prefix, obj, scope, out) {
+    for (const [k, v] of Object.entries(obj)) {
+        if (v === null)
+            continue;
+        if (prefix === '' && NON_ATTR_BLOCKS.has(k))
+            continue;
+        const key = prefix ? `${prefix}.${k}` : k;
+        if (isNestedBlock(v)) {
+            out.blocks.push(key); // record the block path (even if empty)
+            collect(key, v[0], scope, out);
+        }
+        else if (Array.isArray(v)) {
+            out.lists[key] = {
+                kind: 'resolved',
+                items: v.map((x) => resolveValue(x, scope)),
+            };
+        }
+        else if (typeof v !== 'object') {
+            out.attributes[key] = resolveValue(v, scope);
+        }
+    }
+}
+function extractAttrs(block, scope) {
+    const out = { attributes: {}, lists: {}, blocks: [] };
+    if (block)
+        collect('', block, scope, out);
+    return out;
+}
+const toStrList = (v) => {
+    if (typeof v === 'string')
+        return [v];
+    if (Array.isArray(v))
+        return v.filter((x) => typeof x === 'string');
+    return [];
+};
+/**
+ * Parse an IAM `policy` argument. A literal JSON document (heredoc/inline
+ * string) is parsed into statements; a `jsonencode(...)` expression, a
+ * variable, or malformed JSON is `unresolved` (=> "could not evaluate").
+ */
+function policyOf(block) {
+    const raw = block?.policy;
+    if (typeof raw !== 'string')
+        return undefined; // no inline JSON policy
+    if (isInterpolated(raw))
+        return { kind: 'unresolved' }; // jsonencode/var/...
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch {
+        return { kind: 'unresolved' };
+    }
+    const stmtRaw = asObject(doc).Statement;
+    const list = Array.isArray(stmtRaw) ? stmtRaw : stmtRaw ? [stmtRaw] : [];
+    const statements = list.map((s) => {
+        const so = asObject(s);
+        return {
+            effect: typeof so.Effect === 'string' ? so.Effect : '',
+            actions: toStrList(so.Action),
+            resources: toStrList(so.Resource),
+            notActions: toStrList(so.NotAction),
+        };
+    });
+    return { kind: 'parsed', statements };
+}
+/** Parse ECS `container_definitions` (a literal-JSON array of containers). */
+function containersOf(block) {
+    const raw = block?.container_definitions;
+    if (typeof raw !== 'string')
+        return undefined;
+    if (isInterpolated(raw))
+        return { kind: 'unresolved' }; // jsonencode/var
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch {
+        return { kind: 'unresolved' };
+    }
+    const arr = Array.isArray(doc) ? doc : [];
+    const containers = arr.map((c) => {
+        const co = asObject(c);
+        return {
+            name: typeof co.name === 'string' ? co.name : '',
+            privileged: co.privileged === true,
+        };
+    });
+    return { kind: 'parsed', containers };
+}
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/** Best-effort line of a `resource "type" "name"` block via text scan. */
+function findLine(text, type, name) {
+    const lines = text.split(/\r?\n/);
+    // eslint-disable-next-line security/detect-non-literal-regexp -- inputs escaped above
+    const needle = new RegExp(`resource\\s+"${escapeRegExp(type)}"\\s+"${escapeRegExp(name)}"`);
+    for (let i = 0; i < lines.length; i++) {
+        if (needle.test(lines[i] ?? ''))
+            return i + 1;
+    }
+    return 1;
+}
+/**
+ * Adapter boundary (doc 06): parser output -> dotzen's own model.
+ * The engine never sees `Hcl2JsonRoot`. `scope` resolves var/local refs.
+ */
+function normalize(parsed, file, rawText, scope = new Map(), environmentOverride) {
+    const out = [];
+    const byType = parsed.resource ?? {};
+    for (const [type, byName] of Object.entries(byType)) {
+        if (!KNOWN_TYPES.has(type))
+            continue;
+        for (const [name, blocks] of Object.entries(byName)) {
+            const block = (Array.isArray(blocks) ? blocks[0] : blocks);
+            const extracted = extractAttrs(block, scope);
+            out.push({
+                type: type,
+                name,
+                file,
+                line: findLine(rawText, type, name),
+                ingress: ingressFor(type, block, scope),
+                egress: egressFor(block, scope),
+                tags: tagsOf(block),
+                attributes: extracted.attributes,
+                lists: extracted.lists,
+                blocks: extracted.blocks,
+                policy: policyOf(block),
+                containers: containersOf(block),
+                // A root's declared environment wins over the resource's own tag.
+                environment: environmentOverride !== undefined
+                    ? { kind: 'literal', value: environmentOverride }
+                    : environmentOf(block, scope),
+            });
+        }
+    }
+    return out;
+}

package/dist/hcl/parse.d.ts

@@ -0,0 +1,13 @@
+import { Result } from '../result/result';
+import { DotzenError } from '../result/errors';
+import { NormalizedResource } from './model';
+/**
+ * Read a terraform directory, parse each .tf via the official parser
+ * (hcl2json / WASM), and normalize into dotzen's model. Async because
+ * the WASM parser is async. Reported file paths are made relative to
+ * `projectRoot` (defaults to `dir`) so output is readable and portable —
+ * and, for multi-root layouts, shows which root each finding came from.
+ * A single `parseTf` call builds ONE scope, so calling it once per root
+ * keeps each root's `var`/`local` values isolated.
+ */
+export declare function parseTf(dir: string, projectRoot?: string, environmentOverride?: string): Promise<Result<NormalizedResource[], DotzenError>>;

package/dist/hcl/parse.js

@@ -0,0 +1,85 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTf = parseTf;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const hcl2json_1 = require("@cdktf/hcl2json");
+const result_1 = require("../result/result");
+const normalize_1 = require("./normalize");
+function findTfFiles(dir) {
+    const entries = fs.readdirSync(dir, { recursive: true });
+    return entries.filter((e) => e.endsWith('.tf')).map((e) => path.join(dir, e));
+}
+const toPosix = (p) => p.split(path.sep).join('/');
+/**
+ * Read a terraform directory, parse each .tf via the official parser
+ * (hcl2json / WASM), and normalize into dotzen's model. Async because
+ * the WASM parser is async. Reported file paths are made relative to
+ * `projectRoot` (defaults to `dir`) so output is readable and portable —
+ * and, for multi-root layouts, shows which root each finding came from.
+ * A single `parseTf` call builds ONE scope, so calling it once per root
+ * keeps each root's `var`/`local` values isolated.
+ */
+async function parseTf(dir, projectRoot = dir, environmentOverride) {
+    if (!fs.existsSync(dir))
+        return (0, result_1.err)({ kind: 'PathNotFound', path: dir });
+    const files = findTfFiles(dir);
+    // Pass 1: parse every file (variables/locals may live in a different
+    // file from the resources that reference them).
+    const parsedFiles = [];
+    for (const file of files) {
+        const text = fs.readFileSync(file, 'utf8');
+        try {
+            const parsed = (await (0, hcl2json_1.parse)(path.basename(file), text));
+            parsedFiles.push({ file, text, parsed });
+        }
+        catch (e) {
+            return (0, result_1.err)({
+                kind: 'ParseFailed',
+                file,
+                detail: e instanceof Error ? e.message : String(e),
+            });
+        }
+    }
+    // Pass 2: build the cross-file var/local scope, then normalize with it.
+    const scope = (0, normalize_1.buildScope)(parsedFiles.map((p) => p.parsed));
+    const resources = [];
+    for (const { file, text, parsed } of parsedFiles) {
+        const rel = toPosix(path.relative(projectRoot, file));
+        resources.push(...(0, normalize_1.normalize)(parsed, rel, text, scope, environmentOverride));
+    }
+    return (0, result_1.ok)(resources);
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+/** Public DSL surface — what `.zen/spec.ts` imports. */
+export { rule, RuleBuilder } from './spec/rule';
+export { AwsResource, Port, Cidr, Effect, Tag, AwsAttribute, Acl, Environment, Approver, HttpTokens, EksLogType, TlsPolicy, Protocol, Block, Wildcard, ApiGatewayAuthorization, AzureResource, AzureAttribute, StorageTlsVersion, SqlTlsVersion, BuiltInRole, NetworkDefaultAction, GcpResource, GcpAttribute, PublicAccessPreventionMode, IamMember, PrimitiveRole, OauthScope, SqlSslMode, } from './vocabulary';

package/dist/index.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SqlSslMode = exports.OauthScope = exports.PrimitiveRole = exports.IamMember = exports.PublicAccessPreventionMode = exports.GcpAttribute = exports.GcpResource = exports.NetworkDefaultAction = exports.BuiltInRole = exports.SqlTlsVersion = exports.StorageTlsVersion = exports.AzureAttribute = exports.AzureResource = exports.ApiGatewayAuthorization = exports.Wildcard = exports.Block = exports.Protocol = exports.TlsPolicy = exports.EksLogType = exports.HttpTokens = exports.Approver = exports.Environment = exports.Acl = exports.AwsAttribute = exports.Tag = exports.Effect = exports.Cidr = exports.Port = exports.AwsResource = exports.RuleBuilder = exports.rule = void 0;
+/** Public DSL surface — what `.zen/spec.ts` imports. */
+var rule_1 = require("./spec/rule");
+Object.defineProperty(exports, "rule", { enumerable: true, get: function () { return rule_1.rule; } });
+Object.defineProperty(exports, "RuleBuilder", { enumerable: true, get: function () { return rule_1.RuleBuilder; } });
+var vocabulary_1 = require("./vocabulary");
+Object.defineProperty(exports, "AwsResource", { enumerable: true, get: function () { return vocabulary_1.AwsResource; } });
+Object.defineProperty(exports, "Port", { enumerable: true, get: function () { return vocabulary_1.Port; } });
+Object.defineProperty(exports, "Cidr", { enumerable: true, get: function () { return vocabulary_1.Cidr; } });
+Object.defineProperty(exports, "Effect", { enumerable: true, get: function () { return vocabulary_1.Effect; } });
+Object.defineProperty(exports, "Tag", { enumerable: true, get: function () { return vocabulary_1.Tag; } });
+Object.defineProperty(exports, "AwsAttribute", { enumerable: true, get: function () { return vocabulary_1.AwsAttribute; } });
+Object.defineProperty(exports, "Acl", { enumerable: true, get: function () { return vocabulary_1.Acl; } });
+Object.defineProperty(exports, "Environment", { enumerable: true, get: function () { return vocabulary_1.Environment; } });
+Object.defineProperty(exports, "Approver", { enumerable: true, get: function () { return vocabulary_1.Approver; } });
+Object.defineProperty(exports, "HttpTokens", { enumerable: true, get: function () { return vocabulary_1.HttpTokens; } });
+Object.defineProperty(exports, "EksLogType", { enumerable: true, get: function () { return vocabulary_1.EksLogType; } });
+Object.defineProperty(exports, "TlsPolicy", { enumerable: true, get: function () { return vocabulary_1.TlsPolicy; } });
+Object.defineProperty(exports, "Protocol", { enumerable: true, get: function () { return vocabulary_1.Protocol; } });
+Object.defineProperty(exports, "Block", { enumerable: true, get: function () { return vocabulary_1.Block; } });
+Object.defineProperty(exports, "Wildcard", { enumerable: true, get: function () { return vocabulary_1.Wildcard; } });
+Object.defineProperty(exports, "ApiGatewayAuthorization", { enumerable: true, get: function () { return vocabulary_1.ApiGatewayAuthorization; } });
+Object.defineProperty(exports, "AzureResource", { enumerable: true, get: function () { return vocabulary_1.AzureResource; } });
+Object.defineProperty(exports, "AzureAttribute", { enumerable: true, get: function () { return vocabulary_1.AzureAttribute; } });
+Object.defineProperty(exports, "StorageTlsVersion", { enumerable: true, get: function () { return vocabulary_1.StorageTlsVersion; } });
+Object.defineProperty(exports, "SqlTlsVersion", { enumerable: true, get: function () { return vocabulary_1.SqlTlsVersion; } });
+Object.defineProperty(exports, "BuiltInRole", { enumerable: true, get: function () { return vocabulary_1.BuiltInRole; } });
+Object.defineProperty(exports, "NetworkDefaultAction", { enumerable: true, get: function () { return vocabulary_1.NetworkDefaultAction; } });
+Object.defineProperty(exports, "GcpResource", { enumerable: true, get: function () { return vocabulary_1.GcpResource; } });
+Object.defineProperty(exports, "GcpAttribute", { enumerable: true, get: function () { return vocabulary_1.GcpAttribute; } });
+Object.defineProperty(exports, "PublicAccessPreventionMode", { enumerable: true, get: function () { return vocabulary_1.PublicAccessPreventionMode; } });
+Object.defineProperty(exports, "IamMember", { enumerable: true, get: function () { return vocabulary_1.IamMember; } });
+Object.defineProperty(exports, "PrimitiveRole", { enumerable: true, get: function () { return vocabulary_1.PrimitiveRole; } });
+Object.defineProperty(exports, "OauthScope", { enumerable: true, get: function () { return vocabulary_1.OauthScope; } });
+Object.defineProperty(exports, "SqlSslMode", { enumerable: true, get: function () { return vocabulary_1.SqlSslMode; } });

package/dist/report/report.d.ts

@@ -0,0 +1,18 @@
+import { CheckReport } from '../engine/evaluate';
+import { DotzenError } from '../result/errors';
+/** A blocking violation fired (only Block fails the build). */
+export declare const hasBlocking: (r: CheckReport) => boolean;
+/** A require_approval rule fired — the pipeline must pause for sign-off. */
+export declare const requiresApproval: (r: CheckReport) => boolean;
+/**
+ * Only BLOCK violations fail the build (exit 1). Warnings and
+ * require_approval do not hard-fail — the pipeline proceeds (to a manual
+ * approval gate when approval is required). See doc 04.
+ */
+export declare function reportExitCode(report: CheckReport): 0 | 1;
+export declare function renderTerminal(report: CheckReport, opts?: {
+    color?: boolean;
+}): string;
+export declare function renderJson(report: CheckReport): string;
+/** Exhaustive over DotzenError.kind (doc 06). */
+export declare function renderError(error: DotzenError): string;