@dotzen/dotzen 0.0.1

package/dist/report/report.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requiresApproval = exports.hasBlocking = void 0;
+exports.reportExitCode = reportExitCode;
+exports.renderTerminal = renderTerminal;
+exports.renderJson = renderJson;
+exports.renderError = renderError;
+const vocabulary_1 = require("../vocabulary");
+const assertNever = (x) => {
+    throw new Error(`unhandled: ${JSON.stringify(x)}`);
+};
+const byEffect = (r, e) => r.violations.filter((v) => v.effect === e);
+// Tiny ANSI helper — no dependency (stay pure-JS, minimal deps).
+const ANSI = {
+    red: '\x1b[31m',
+    green: '\x1b[32m',
+    yellow: '\x1b[33m',
+    magenta: '\x1b[35m',
+    bold: '\x1b[1m',
+    reset: '\x1b[0m',
+};
+const makePaint = (color) => (text, ...codes) => color ? codes.join('') + text + ANSI.reset : text;
+/** A blocking violation fired (only Block fails the build). */
+const hasBlocking = (r) => r.violations.some((v) => v.effect === vocabulary_1.Effect.Block);
+exports.hasBlocking = hasBlocking;
+/** A require_approval rule fired — the pipeline must pause for sign-off. */
+const requiresApproval = (r) => r.violations.some((v) => v.effect === vocabulary_1.Effect.RequireApproval);
+exports.requiresApproval = requiresApproval;
+/**
+ * Only BLOCK violations fail the build (exit 1). Warnings and
+ * require_approval do not hard-fail — the pipeline proceeds (to a manual
+ * approval gate when approval is required). See doc 04.
+ */
+function reportExitCode(report) {
+    return (0, exports.hasBlocking)(report) ? 1 : 0;
+}
+function renderTerminal(report, opts = {}) {
+    const paint = makePaint(opts.color ?? false);
+    const lines = [];
+    const cne = report.couldNotEvaluate.length;
+    const section = (title, marker, tone, vs) => {
+        if (vs.length === 0)
+            return;
+        lines.push(paint(`── ${title.toUpperCase()} ──`, tone, ANSI.bold));
+        for (const v of vs) {
+            lines.push(`${paint(marker, tone)} ${v.resource}  (${v.file}:${v.line})`);
+            lines.push(`    ${v.message}`);
+            if (v.rationale)
+                lines.push(`    ↳ ${v.rationale}`);
+            if (v.approvers?.length)
+                lines.push(`    approvers: ${v.approvers.join(', ')}`);
+        }
+    };
+    // Most severe first.
+    section('blocking', '✗', ANSI.red, byEffect(report, vocabulary_1.Effect.Block));
+    section('approval required', '⏸', ANSI.yellow, byEffect(report, vocabulary_1.Effect.RequireApproval));
+    section('warnings', '‼', ANSI.yellow, byEffect(report, vocabulary_1.Effect.Warn));
+    if (report.couldNotEvaluate.length > 0) {
+        lines.push(paint('── COULD NOT EVALUATE ──', ANSI.magenta, ANSI.bold));
+        for (const u of report.couldNotEvaluate) {
+            lines.push(`${paint('?', ANSI.magenta)} ${u.resource}  (${u.file}:${u.line}): ${u.reason} (${u.ruleId})`);
+        }
+    }
+    lines.push('');
+    if (report.violations.length === 0) {
+        lines.push(`${paint('✓ passed', ANSI.green)} (${report.passed} checks, ${paint(`${cne} could not be evaluated`, ANSI.magenta)})`);
+    }
+    else {
+        const count = `${report.violations.length} violation(s)`;
+        const vmark = (0, exports.hasBlocking)(report)
+            ? paint(`✗ ${count}`, ANSI.red)
+            : paint(`⚠ ${count}`, ANSI.yellow);
+        lines.push(`${vmark}, ${paint(`${report.passed} passed`, ANSI.green)}, ${paint(`${cne} could not be evaluated`, ANSI.magenta)}`);
+        if ((0, exports.requiresApproval)(report))
+            lines.push(paint('⏸ approval required before apply (DOTZEN_REQUIRES_APPROVAL)', ANSI.yellow));
+    }
+    return lines.join('\n');
+}
+function renderJson(report) {
+    return JSON.stringify({ ...report, requiresApproval: (0, exports.requiresApproval)(report) }, null, 2);
+}
+/** Exhaustive over DotzenError.kind (doc 06). */
+function renderError(error) {
+    switch (error.kind) {
+        case 'ConfigNotFound':
+            return `✗ dotzen config not found: ${error.path}`;
+        case 'VersionMismatch':
+            return [
+                `✗ dotzen version mismatch`,
+                `  required: ${error.required} (from dotzen.json)`,
+                `  running:  ${error.running}`,
+                ``,
+                `  run: npx @dotzen/dotzen@${error.required} check`,
+            ].join('\n');
+        case 'SpecLoadFailed':
+            return `✗ could not load spec ${error.path}: ${error.detail}`;
+        case 'SpecInvalid':
+            return [
+                `✗ spec has invalid rules:`,
+                ...error.errors.map((e) => `  rule ${e.ruleIndex + 1}: ${e.problem}`),
+            ].join('\n');
+        case 'PathNotFound':
+            return `✗ terraform path not found: ${error.path}`;
+        case 'ParseFailed':
+            return `✗ failed to parse ${error.file}: ${error.detail}`;
+        default:
+            return assertNever(error);
+    }
+}

package/dist/result/errors.d.ts

@@ -0,0 +1,27 @@
+/** The failure track: operational failures only (doc 06, Rule 1). */
+export interface RuleValidationError {
+    readonly ruleIndex: number;
+    readonly problem: string;
+}
+export type DotzenError = {
+    readonly kind: 'ConfigNotFound';
+    readonly path: string;
+} | {
+    readonly kind: 'VersionMismatch';
+    readonly required: string;
+    readonly running: string;
+} | {
+    readonly kind: 'SpecLoadFailed';
+    readonly path: string;
+    readonly detail: string;
+} | {
+    readonly kind: 'SpecInvalid';
+    readonly errors: RuleValidationError[];
+} | {
+    readonly kind: 'PathNotFound';
+    readonly path: string;
+} | {
+    readonly kind: 'ParseFailed';
+    readonly file: string;
+    readonly detail: string;
+};

package/dist/result/errors.js

@@ -0,0 +1,3 @@
+"use strict";
+/** The failure track: operational failures only (doc 06, Rule 1). */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/result/result.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Railway Oriented Programming core (doc 06). Hand-rolled, zero-dep.
+ * Operational failures ride the Err track; violations never do.
+ */
+export type Result<T, E> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: E;
+};
+export declare const ok: <T>(value: T) => Result<T, never>;
+export declare const err: <E>(error: E) => Result<never, E>;
+/** Railway combinator: transform the success value, pass errors through. */
+export declare function map<T, U, E>(r: Result<T, E>, f: (t: T) => U): Result<U, E>;
+/** Railway combinator: chain a fallible step, short-circuit on error. */
+export declare function andThen<T, U, E>(r: Result<T, E>, f: (t: T) => Result<U, E>): Result<U, E>;
+/**
+ * Fold combinator (NOT a railway): run all, accumulate every error.
+ * Used by spec loading so every invalid rule is reported at once.
+ */
+export declare function combineWithAllErrors<T, E>(results: Result<T, E>[]): Result<T[], E[]>;

package/dist/result/result.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Railway Oriented Programming core (doc 06). Hand-rolled, zero-dep.
+ * Operational failures ride the Err track; violations never do.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.err = exports.ok = void 0;
+exports.map = map;
+exports.andThen = andThen;
+exports.combineWithAllErrors = combineWithAllErrors;
+const ok = (value) => ({ ok: true, value });
+exports.ok = ok;
+const err = (error) => ({ ok: false, error });
+exports.err = err;
+/** Railway combinator: transform the success value, pass errors through. */
+function map(r, f) {
+    return r.ok ? (0, exports.ok)(f(r.value)) : r;
+}
+/** Railway combinator: chain a fallible step, short-circuit on error. */
+function andThen(r, f) {
+    return r.ok ? f(r.value) : r;
+}
+/**
+ * Fold combinator (NOT a railway): run all, accumulate every error.
+ * Used by spec loading so every invalid rule is reported at once.
+ */
+function combineWithAllErrors(results) {
+    const values = [];
+    const errors = [];
+    for (const r of results) {
+        if (r.ok)
+            values.push(r.value);
+        else
+            errors.push(r.error);
+    }
+    return errors.length > 0 ? (0, exports.err)(errors) : (0, exports.ok)(values);
+}

package/dist/spec/load.d.ts

@@ -0,0 +1,14 @@
+import { Result } from '../result/result';
+import { DotzenError } from '../result/errors';
+import { RuleBuilder, Rule } from './rule';
+/**
+ * Load `.zen/spec.ts` via a pure-JS runtime TypeScript loader (jiti) —
+ * decided in doc 06 §"Spec loading". This is the isolated seam; swapping
+ * the loader touches only this function.
+ */
+export declare function importSpecModule(specPath: string): Promise<Result<RuleBuilder[], DotzenError>>;
+/**
+ * Validate all rules, ACCUMULATING every problem (doc 06, Rule 3) rather
+ * than failing on the first invalid rule.
+ */
+export declare function loadSpec(builders: RuleBuilder[]): Result<Rule[], DotzenError>;

package/dist/spec/load.js

@@ -0,0 +1,78 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importSpecModule = importSpecModule;
+exports.loadSpec = loadSpec;
+const fs = __importStar(require("fs"));
+const jiti_1 = require("jiti");
+const result_1 = require("../result/result");
+/**
+ * Load `.zen/spec.ts` via a pure-JS runtime TypeScript loader (jiti) —
+ * decided in doc 06 §"Spec loading". This is the isolated seam; swapping
+ * the loader touches only this function.
+ */
+async function importSpecModule(specPath) {
+    if (!fs.existsSync(specPath))
+        return (0, result_1.err)({ kind: 'ConfigNotFound', path: specPath });
+    try {
+        const jiti = (0, jiti_1.createJiti)(__filename);
+        const mod = (await jiti.import(specPath));
+        const spec = mod.spec;
+        if (!Array.isArray(spec))
+            return (0, result_1.err)({
+                kind: 'SpecLoadFailed',
+                path: specPath,
+                detail: 'spec.ts must export a `spec` array of rules',
+            });
+        return (0, result_1.ok)(spec);
+    }
+    catch (e) {
+        return (0, result_1.err)({
+            kind: 'SpecLoadFailed',
+            path: specPath,
+            detail: e instanceof Error ? e.message : String(e),
+        });
+    }
+}
+/**
+ * Validate all rules, ACCUMULATING every problem (doc 06, Rule 3) rather
+ * than failing on the first invalid rule.
+ */
+function loadSpec(builders) {
+    const validated = (0, result_1.combineWithAllErrors)(builders.map((b, i) => b.validate(i)));
+    if (validated.ok)
+        return (0, result_1.ok)(validated.value);
+    return (0, result_1.err)({ kind: 'SpecInvalid', errors: validated.error.flat() });
+}

package/dist/spec/rule.d.ts

@@ -0,0 +1,161 @@
+import { Port, Cidr, Effect, Tag, Acl, Environment, Approver, Block, AnyResource, AnyAttribute } from '../vocabulary';
+import { Result } from '../result/result';
+import { RuleValidationError } from '../result/errors';
+export type ResourceTarget = {
+    readonly kind: 'resource';
+    readonly types: AnyResource[];
+} | {
+    readonly kind: 'all';
+};
+/** Discriminated union so the engine dispatches one evaluator per kind. */
+export type Condition = {
+    readonly kind: 'denyIngress';
+    readonly ports: Port[];
+    readonly from: Cidr[];
+} | {
+    readonly kind: 'denyEgress';
+    readonly ports: Port[];
+    readonly from: Cidr[];
+} | {
+    readonly kind: 'mustHaveTags';
+    readonly tags: Tag[];
+} | {
+    readonly kind: 'mustBeTrue';
+    readonly attrs: AnyAttribute[];
+} | {
+    readonly kind: 'mustBeFalse';
+    readonly attrs: AnyAttribute[];
+} | {
+    readonly kind: 'mustBeSet';
+    readonly attrs: AnyAttribute[];
+} | {
+    readonly kind: 'denyWhenTrue';
+    readonly attrs: AnyAttribute[];
+} | {
+    readonly kind: 'denyAcl';
+    readonly acls: Acl[];
+} | {
+    readonly kind: 'mustEqual';
+    readonly attr: AnyAttribute;
+    readonly value: string;
+} | {
+    readonly kind: 'mustBeAtLeast';
+    readonly attr: AnyAttribute;
+    readonly min: number;
+} | {
+    readonly kind: 'mustBeAtMost';
+    readonly attr: AnyAttribute;
+    readonly max: number;
+} | {
+    readonly kind: 'denyIamWildcard';
+} | {
+    readonly kind: 'listContains';
+    readonly attr: AnyAttribute;
+    readonly values: string[];
+} | {
+    readonly kind: 'listMustInclude';
+    readonly attr: AnyAttribute;
+    readonly values: string[];
+} | {
+    readonly kind: 'denyValue';
+    readonly attr: AnyAttribute;
+    readonly values: string[];
+} | {
+    readonly kind: 'mustBeOneOf';
+    readonly attr: AnyAttribute;
+    readonly values: string[];
+} | {
+    readonly kind: 'denyPlaintextListener';
+} | {
+    readonly kind: 'denyPrivilegedContainers';
+} | {
+    readonly kind: 'denyLiteral';
+    readonly attrs: AnyAttribute[];
+} | {
+    readonly kind: 'mustHaveAssociated';
+    readonly childType: AnyResource;
+    readonly via: AnyAttribute;
+} | {
+    readonly kind: 'mustHaveBlock';
+    readonly block: Block;
+} | {
+    readonly kind: 'denyBlockPresence';
+    readonly block: Block;
+};
+export interface Rule {
+    readonly id: string;
+    readonly target: ResourceTarget;
+    /** If set, the rule applies only to resources in this environment. */
+    readonly environment?: Environment;
+    readonly conditions: Condition[];
+    readonly effect: Effect;
+    readonly message: string;
+    readonly rationale?: string;
+    /** For require_approval rules: who must sign off. */
+    readonly approvers?: Approver[];
+}
+/**
+ * The authored surface (doc 02). The builder IS the rule object;
+ * `validate()` (called by the engine on load) returns a normalized Rule
+ * on success or ACCUMULATES problems on failure (doc 06, ROP form).
+ */
+export declare class RuleBuilder {
+    private _target?;
+    private _environment?;
+    private _conditions;
+    private _effect;
+    private _message?;
+    private _rationale?;
+    private _approvers;
+    resource(...types: AnyResource[]): this;
+    allResources(): this;
+    environment(env: Environment): this;
+    denyIngress(...ports: Port[]): this;
+    denyEgress(...ports: Port[]): this;
+    mustHaveTags(...tags: Tag[]): this;
+    mustBeTrue(...attrs: AnyAttribute[]): this;
+    /** AnyAttribute must be explicitly false; absent counts as a violation
+     *  (use for attributes whose insecure AWS default is `true`). */
+    mustBeFalse(...attrs: AnyAttribute[]): this;
+    /** AnyAttribute must be present (any value); absent is the violation. */
+    mustBeSet(...attrs: AnyAttribute[]): this;
+    denyWhenTrue(...attrs: AnyAttribute[]): this;
+    denyAcl(...acls: Acl[]): this;
+    mustEqual(attr: AnyAttribute, value: string): this;
+    mustBeAtLeast(attr: AnyAttribute, min: number): this;
+    /** Numeric attribute must be <= max; absent/above is the violation. */
+    mustBeAtMost(attr: AnyAttribute, max: number): this;
+    /** Flag Allow statements that grant `Action: "*"` (full privileges). */
+    denyIamWildcard(): this;
+    /** Flag a list attribute that CONTAINS any of `values` (e.g. a public CIDR). */
+    listContains(attr: AnyAttribute, ...values: string[]): this;
+    /** Require a list attribute to INCLUDE all of `values` (e.g. audit log types). */
+    listMustInclude(attr: AnyAttribute, ...values: string[]): this;
+    /** Flag a scalar attribute whose value is one of `values` (e.g. a weak TLS policy). */
+    denyValue(attr: AnyAttribute, ...values: string[]): this;
+    /** Require a scalar attribute's value to be one of `values` (allowlist);
+     *  absent or any other value is the violation. */
+    mustBeOneOf(attr: AnyAttribute, ...values: string[]): this;
+    /** Flag a plaintext listener (HTTP/TCP) unless it redirects (default_action). */
+    denyPlaintextListener(): this;
+    /** Flag an ECS task definition with any privileged container. */
+    denyPrivilegedContainers(): this;
+    /** Flag a hardcoded literal where a reference is expected (e.g. a secret).
+     *  A `var`/`data` reference passes; a literal value is the violation. */
+    denyLiteral(...attrs: AnyAttribute[]): this;
+    /** Require a separate `childType` resource to reference this one via `via`
+     *  (e.g. an S3 bucket must have a matching server-side-encryption config). */
+    mustHaveAssociated(childType: AnyResource, via: AnyAttribute): this;
+    /** Require this resource to declare a given nested block (e.g. EKS
+     *  `encryption_config`). */
+    mustHaveBlock(block: Block): this;
+    /** Flag this resource if it declares a given nested block (e.g. a GCP
+     *  instance `network_interface.access_config` = a public IP). */
+    denyBlockPresence(block: Block): this;
+    onViolation(effect: Effect): this;
+    approvers(...names: Approver[]): this;
+    message(msg: string): this;
+    rationale(text: string): this;
+    validate(index: number): Result<Rule, RuleValidationError[]>;
+}
+export declare const rule: () => RuleBuilder;

package/dist/spec/rule.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = exports.RuleBuilder = void 0;
+const vocabulary_1 = require("../vocabulary");
+const result_1 = require("../result/result");
+/**
+ * The authored surface (doc 02). The builder IS the rule object;
+ * `validate()` (called by the engine on load) returns a normalized Rule
+ * on success or ACCUMULATES problems on failure (doc 06, ROP form).
+ */
+class RuleBuilder {
+    _target;
+    _environment;
+    _conditions = [];
+    _effect = vocabulary_1.Effect.Block;
+    _message;
+    _rationale;
+    _approvers = [];
+    resource(...types) {
+        this._target = { kind: 'resource', types };
+        return this;
+    }
+    allResources() {
+        this._target = { kind: 'all' };
+        return this;
+    }
+    environment(env) {
+        this._environment = env;
+        return this;
+    }
+    denyIngress(...ports) {
+        this._conditions.push({
+            kind: 'denyIngress',
+            ports,
+            from: [vocabulary_1.Cidr.Internet, vocabulary_1.Cidr.InternetV6],
+        });
+        return this;
+    }
+    denyEgress(...ports) {
+        this._conditions.push({
+            kind: 'denyEgress',
+            ports,
+            from: [vocabulary_1.Cidr.Internet, vocabulary_1.Cidr.InternetV6],
+        });
+        return this;
+    }
+    mustHaveTags(...tags) {
+        this._conditions.push({ kind: 'mustHaveTags', tags });
+        return this;
+    }
+    mustBeTrue(...attrs) {
+        this._conditions.push({ kind: 'mustBeTrue', attrs });
+        return this;
+    }
+    /** AnyAttribute must be explicitly false; absent counts as a violation
+     *  (use for attributes whose insecure AWS default is `true`). */
+    mustBeFalse(...attrs) {
+        this._conditions.push({ kind: 'mustBeFalse', attrs });
+        return this;
+    }
+    /** AnyAttribute must be present (any value); absent is the violation. */
+    mustBeSet(...attrs) {
+        this._conditions.push({ kind: 'mustBeSet', attrs });
+        return this;
+    }
+    denyWhenTrue(...attrs) {
+        this._conditions.push({ kind: 'denyWhenTrue', attrs });
+        return this;
+    }
+    denyAcl(...acls) {
+        this._conditions.push({ kind: 'denyAcl', acls });
+        return this;
+    }
+    mustEqual(attr, value) {
+        this._conditions.push({ kind: 'mustEqual', attr, value });
+        return this;
+    }
+    mustBeAtLeast(attr, min) {
+        this._conditions.push({ kind: 'mustBeAtLeast', attr, min });
+        return this;
+    }
+    /** Numeric attribute must be <= max; absent/above is the violation. */
+    mustBeAtMost(attr, max) {
+        this._conditions.push({ kind: 'mustBeAtMost', attr, max });
+        return this;
+    }
+    /** Flag Allow statements that grant `Action: "*"` (full privileges). */
+    denyIamWildcard() {
+        this._conditions.push({ kind: 'denyIamWildcard' });
+        return this;
+    }
+    /** Flag a list attribute that CONTAINS any of `values` (e.g. a public CIDR). */
+    listContains(attr, ...values) {
+        this._conditions.push({ kind: 'listContains', attr, values });
+        return this;
+    }
+    /** Require a list attribute to INCLUDE all of `values` (e.g. audit log types). */
+    listMustInclude(attr, ...values) {
+        this._conditions.push({ kind: 'listMustInclude', attr, values });
+        return this;
+    }
+    /** Flag a scalar attribute whose value is one of `values` (e.g. a weak TLS policy). */
+    denyValue(attr, ...values) {
+        this._conditions.push({ kind: 'denyValue', attr, values });
+        return this;
+    }
+    /** Require a scalar attribute's value to be one of `values` (allowlist);
+     *  absent or any other value is the violation. */
+    mustBeOneOf(attr, ...values) {
+        this._conditions.push({ kind: 'mustBeOneOf', attr, values });
+        return this;
+    }
+    /** Flag a plaintext listener (HTTP/TCP) unless it redirects (default_action). */
+    denyPlaintextListener() {
+        this._conditions.push({ kind: 'denyPlaintextListener' });
+        return this;
+    }
+    /** Flag an ECS task definition with any privileged container. */
+    denyPrivilegedContainers() {
+        this._conditions.push({ kind: 'denyPrivilegedContainers' });
+        return this;
+    }
+    /** Flag a hardcoded literal where a reference is expected (e.g. a secret).
+     *  A `var`/`data` reference passes; a literal value is the violation. */
+    denyLiteral(...attrs) {
+        this._conditions.push({ kind: 'denyLiteral', attrs });
+        return this;
+    }
+    /** Require a separate `childType` resource to reference this one via `via`
+     *  (e.g. an S3 bucket must have a matching server-side-encryption config). */
+    mustHaveAssociated(childType, via) {
+        this._conditions.push({ kind: 'mustHaveAssociated', childType, via });
+        return this;
+    }
+    /** Require this resource to declare a given nested block (e.g. EKS
+     *  `encryption_config`). */
+    mustHaveBlock(block) {
+        this._conditions.push({ kind: 'mustHaveBlock', block });
+        return this;
+    }
+    /** Flag this resource if it declares a given nested block (e.g. a GCP
+     *  instance `network_interface.access_config` = a public IP). */
+    denyBlockPresence(block) {
+        this._conditions.push({ kind: 'denyBlockPresence', block });
+        return this;
+    }
+    onViolation(effect) {
+        this._effect = effect;
+        return this;
+    }
+    approvers(...names) {
+        this._approvers = names;
+        return this;
+    }
+    message(msg) {
+        this._message = msg;
+        return this;
+    }
+    rationale(text) {
+        this._rationale = text;
+        return this;
+    }
+    validate(index) {
+        const problems = [];
+        const fail = (problem) => problems.push({ ruleIndex: index, problem });
+        const hasTarget = this._target &&
+            (this._target.kind === 'all' || this._target.types.length > 0);
+        if (!this._message)
+            fail('missing .message()');
+        if (!hasTarget)
+            fail('missing .resource() or .allResources()');
+        if (this._conditions.length === 0)
+            fail('no conditions');
+        if (problems.length > 0)
+            return (0, result_1.err)(problems);
+        return (0, result_1.ok)({
+            id: `rule-${index + 1}`,
+            target: this._target,
+            environment: this._environment,
+            conditions: this._conditions,
+            effect: this._effect,
+            message: this._message,
+            rationale: this._rationale,
+            approvers: this._approvers.length > 0 ? this._approvers : undefined,
+        });
+    }
+}
+exports.RuleBuilder = RuleBuilder;
+const rule = () => new RuleBuilder();
+exports.rule = rule;

package/dist/version/config.d.ts

@@ -0,0 +1,29 @@
+import { Result } from '../result/result';
+import { DotzenError } from '../result/errors';
+/**
+ * A Terraform root: a bare path, or a path with a declared `environment`
+ * so `.environment(X)` rule scoping is folder-driven (not tag-dependent).
+ */
+export type TerraformRoot = string | {
+    readonly path: string;
+    readonly environment?: string;
+};
+export interface DotzenConfig {
+    readonly version?: string;
+    readonly spec: string;
+    /** One Terraform root, or several (each evaluated with its own scope). */
+    readonly terraform: TerraformRoot | TerraformRoot[];
+}
+/** Resolved config plus the directory it was found in (for relative paths). */
+export interface LoadedConfig {
+    readonly config: DotzenConfig;
+    readonly baseDir: string;
+}
+export declare function readDotzenJson(cwd: string): Result<LoadedConfig, DotzenError>;
+/**
+ * The first thing the CLI does. Refuse to run on a version mismatch
+ * (doc 03 / engine-dev skill). No pin configured => proceed.
+ */
+export declare function enforceVersion<T extends {
+    version?: string;
+}>(config: T, running: string): Result<T, DotzenError>;