@dotzen/dotzen 0.0.1

package/dist/vocabulary/index.js

@@ -0,0 +1,235 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Approver = exports.Environment = exports.Acl = exports.HttpTokens = exports.EksLogType = exports.Protocol = exports.TlsPolicy = exports.AwsAttribute = exports.Tag = exports.Effect = exports.Cidr = exports.Port = exports.SqlSslMode = exports.OauthScope = exports.PrimitiveRole = exports.IamMember = exports.PublicAccessPreventionMode = exports.GcpAttribute = exports.GcpResource = exports.NetworkDefaultAction = exports.BuiltInRole = exports.SqlTlsVersion = exports.StorageTlsVersion = exports.AzureAttribute = exports.AzureResource = exports.ApiGatewayAuthorization = exports.Wildcard = exports.Block = exports.AwsResource = void 0;
+/**
+ * Closed vocabulary for every domain value (doc 02). No bare strings.
+ *
+ * NOTE: doc 02 specifies `const enum`. We use regular `enum` here because
+ * `const enum` cannot be inlined across files by the esbuild/Vitest
+ * transpiler under `isolatedModules`. Regular `enum` gives the identical
+ * typo-safety (a misspelled member is a compile error); only cross-file
+ * inlining differs, which is irrelevant here. See doc 02 note.
+ */
+var AwsResource;
+(function (AwsResource) {
+    AwsResource["SecurityGroup"] = "aws_security_group";
+    // The modern decomposed form of security-group ingress.
+    AwsResource["VpcSecurityGroupIngressRule"] = "aws_vpc_security_group_ingress_rule";
+    AwsResource["DbInstance"] = "aws_db_instance";
+    AwsResource["S3Bucket"] = "aws_s3_bucket";
+    // The modern decomposed form of an S3 bucket ACL (inline `acl` was
+    // deprecated in AWS provider v4).
+    AwsResource["S3BucketAcl"] = "aws_s3_bucket_acl";
+    AwsResource["S3BucketPublicAccessBlock"] = "aws_s3_bucket_public_access_block";
+    AwsResource["S3BucketPolicy"] = "aws_s3_bucket_policy";
+    AwsResource["EbsVolume"] = "aws_ebs_volume";
+    AwsResource["EfsFileSystem"] = "aws_efs_file_system";
+    AwsResource["KmsKey"] = "aws_kms_key";
+    AwsResource["Instance"] = "aws_instance";
+    AwsResource["DynamodbTable"] = "aws_dynamodb_table";
+    AwsResource["EcrRepository"] = "aws_ecr_repository";
+    AwsResource["IamPolicy"] = "aws_iam_policy";
+    AwsResource["IamRolePolicy"] = "aws_iam_role_policy";
+    AwsResource["EcsService"] = "aws_ecs_service";
+    AwsResource["EksCluster"] = "aws_eks_cluster";
+    AwsResource["Lb"] = "aws_lb";
+    AwsResource["LbListener"] = "aws_lb_listener";
+    AwsResource["EcsTaskDefinition"] = "aws_ecs_task_definition";
+    AwsResource["SecretsmanagerSecretVersion"] = "aws_secretsmanager_secret_version";
+    AwsResource["RdsCluster"] = "aws_rds_cluster";
+    AwsResource["RedshiftCluster"] = "aws_redshift_cluster";
+    AwsResource["ElasticacheReplicationGroup"] = "aws_elasticache_replication_group";
+    AwsResource["S3BucketServerSideEncryptionConfiguration"] = "aws_s3_bucket_server_side_encryption_configuration";
+    AwsResource["S3BucketVersioning"] = "aws_s3_bucket_versioning";
+    AwsResource["SecretsmanagerSecret"] = "aws_secretsmanager_secret";
+    AwsResource["SecretsmanagerSecretRotation"] = "aws_secretsmanager_secret_rotation";
+    AwsResource["Vpc"] = "aws_vpc";
+    AwsResource["FlowLog"] = "aws_flow_log";
+    AwsResource["Subnet"] = "aws_subnet";
+    AwsResource["Cloudtrail"] = "aws_cloudtrail";
+    AwsResource["IamAccountPasswordPolicy"] = "aws_iam_account_password_policy";
+    AwsResource["ApiGatewayMethod"] = "aws_api_gateway_method";
+    AwsResource["ApiGatewayStage"] = "aws_api_gateway_stage";
+    AwsResource["Apigatewayv2Stage"] = "aws_apigatewayv2_stage";
+})(AwsResource || (exports.AwsResource = AwsResource = {}));
+// Nested block names/paths, for `mustHaveBlock` / `denyBlockPresence`.
+var Block;
+(function (Block) {
+    Block["EncryptionConfig"] = "encryption_config";
+    // A GCP instance access_config (nested in network_interface) = public IP.
+    Block["NetworkInterfaceAccessConfig"] = "network_interface.access_config";
+    // GCP subnetwork VPC flow logs / storage bucket access logging.
+    Block["LogConfig"] = "log_config";
+    Block["Logging"] = "logging";
+    // AWS API Gateway stage access logging.
+    Block["AccessLogSettings"] = "access_log_settings";
+})(Block || (exports.Block = Block = {}));
+// Wildcard sentinel for list/value checks (e.g. an IAM/RBAC action of "*").
+var Wildcard;
+(function (Wildcard) {
+    Wildcard["All"] = "*";
+})(Wildcard || (exports.Wildcard = Wildcard = {}));
+// AWS API Gateway method authorization types. `NONE` = unauthenticated.
+var ApiGatewayAuthorization;
+(function (ApiGatewayAuthorization) {
+    ApiGatewayAuthorization["None"] = "NONE";
+})(ApiGatewayAuthorization || (exports.ApiGatewayAuthorization = ApiGatewayAuthorization = {}));
+// Multi-provider surface: the cloud-neutral engine (rules, conditions,
+// normalized model) accepts any provider's resource/attribute vocabulary
+// via these unions. Add a provider = add its module to the union here.
+var azure_1 = require("./azure");
+Object.defineProperty(exports, "AzureResource", { enumerable: true, get: function () { return azure_1.AzureResource; } });
+Object.defineProperty(exports, "AzureAttribute", { enumerable: true, get: function () { return azure_1.AzureAttribute; } });
+Object.defineProperty(exports, "StorageTlsVersion", { enumerable: true, get: function () { return azure_1.StorageTlsVersion; } });
+Object.defineProperty(exports, "SqlTlsVersion", { enumerable: true, get: function () { return azure_1.SqlTlsVersion; } });
+Object.defineProperty(exports, "BuiltInRole", { enumerable: true, get: function () { return azure_1.BuiltInRole; } });
+Object.defineProperty(exports, "NetworkDefaultAction", { enumerable: true, get: function () { return azure_1.NetworkDefaultAction; } });
+var gcp_1 = require("./gcp");
+Object.defineProperty(exports, "GcpResource", { enumerable: true, get: function () { return gcp_1.GcpResource; } });
+Object.defineProperty(exports, "GcpAttribute", { enumerable: true, get: function () { return gcp_1.GcpAttribute; } });
+Object.defineProperty(exports, "PublicAccessPreventionMode", { enumerable: true, get: function () { return gcp_1.PublicAccessPreventionMode; } });
+Object.defineProperty(exports, "IamMember", { enumerable: true, get: function () { return gcp_1.IamMember; } });
+Object.defineProperty(exports, "PrimitiveRole", { enumerable: true, get: function () { return gcp_1.PrimitiveRole; } });
+Object.defineProperty(exports, "OauthScope", { enumerable: true, get: function () { return gcp_1.OauthScope; } });
+Object.defineProperty(exports, "SqlSslMode", { enumerable: true, get: function () { return gcp_1.SqlSslMode; } });
+var Port;
+(function (Port) {
+    Port[Port["SSH"] = 22] = "SSH";
+    Port[Port["RDP"] = 3389] = "RDP";
+    Port[Port["Postgres"] = 5432] = "Postgres";
+    Port[Port["MySQL"] = 3306] = "MySQL";
+})(Port || (exports.Port = Port = {}));
+var Cidr;
+(function (Cidr) {
+    Cidr["Internet"] = "0.0.0.0/0";
+    Cidr["InternetV6"] = "::/0";
+})(Cidr || (exports.Cidr = Cidr = {}));
+var Effect;
+(function (Effect) {
+    Effect["Block"] = "block";
+    Effect["Warn"] = "warn";
+    Effect["RequireApproval"] = "require_approval";
+})(Effect || (exports.Effect = Effect = {}));
+var Tag;
+(function (Tag) {
+    Tag["Team"] = "team";
+    Tag["CostCenter"] = "cost_center";
+    Tag["Environment"] = "environment";
+    Tag["DataClassification"] = "data_classification";
+})(Tag || (exports.Tag = Tag = {}));
+var AwsAttribute;
+(function (AwsAttribute) {
+    AwsAttribute["StorageEncrypted"] = "storage_encrypted";
+    AwsAttribute["PubliclyAccessible"] = "publicly_accessible";
+    AwsAttribute["MultiAz"] = "multi_az";
+    AwsAttribute["DeletionProtection"] = "deletion_protection";
+    AwsAttribute["IamDatabaseAuthenticationEnabled"] = "iam_database_authentication_enabled";
+    // Encryption at rest (aws_ebs_volume, aws_efs_file_system)
+    AwsAttribute["Encrypted"] = "encrypted";
+    // aws_kms_key
+    AwsAttribute["EnableKeyRotation"] = "enable_key_rotation";
+    // aws_s3_bucket_public_access_block
+    AwsAttribute["BlockPublicAcls"] = "block_public_acls";
+    AwsAttribute["BlockPublicPolicy"] = "block_public_policy";
+    AwsAttribute["IgnorePublicAcls"] = "ignore_public_acls";
+    AwsAttribute["RestrictPublicBuckets"] = "restrict_public_buckets";
+    AwsAttribute["BackupRetentionPeriod"] = "backup_retention_period";
+    // Nested-block attributes are addressed with a dotted path (the engine
+    // flattens `block { attr = ... }` to `block.attr`).
+    AwsAttribute["HttpTokens"] = "metadata_options.http_tokens";
+    AwsAttribute["ServerSideEncryptionEnabled"] = "server_side_encryption.enabled";
+    AwsAttribute["PointInTimeRecoveryEnabled"] = "point_in_time_recovery.enabled";
+    AwsAttribute["ImageScanOnPush"] = "image_scanning_configuration.scan_on_push";
+    // EC2 instance
+    AwsAttribute["RootBlockDeviceEncrypted"] = "root_block_device.encrypted";
+    AwsAttribute["AssociatePublicIpAddress"] = "associate_public_ip_address";
+    // ECS / EKS / ELB
+    AwsAttribute["AssignPublicIp"] = "network_configuration.assign_public_ip";
+    AwsAttribute["EndpointPublicAccess"] = "vpc_config.endpoint_public_access";
+    AwsAttribute["AccessLogsEnabled"] = "access_logs.enabled";
+    AwsAttribute["DropInvalidHeaderFields"] = "drop_invalid_header_fields";
+    // List-valued (EKS)
+    AwsAttribute["PublicAccessCidrs"] = "vpc_config.public_access_cidrs";
+    AwsAttribute["EnabledClusterLogTypes"] = "enabled_cluster_log_types";
+    // ALB / NLB listener
+    AwsAttribute["SslPolicy"] = "ssl_policy";
+    AwsAttribute["Protocol"] = "protocol";
+    // Secret-bearing attributes (must be a reference, never a literal)
+    AwsAttribute["SecretString"] = "secret_string";
+    AwsAttribute["Password"] = "password";
+    AwsAttribute["MasterPassword"] = "master_password";
+    AwsAttribute["AuthToken"] = "auth_token";
+    // Cross-resource association keys (child -> parent, for mustHaveAssociated)
+    AwsAttribute["Bucket"] = "bucket";
+    AwsAttribute["SecretId"] = "secret_id";
+    AwsAttribute["VpcId"] = "vpc_id";
+    // VPC subnet exposure
+    AwsAttribute["MapPublicIpOnLaunch"] = "map_public_ip_on_launch";
+    AwsAttribute["AssignIpv6AddressOnCreation"] = "assign_ipv6_address_on_creation";
+    // CloudTrail (audit logging)
+    AwsAttribute["IsMultiRegionTrail"] = "is_multi_region_trail";
+    AwsAttribute["EnableLogFileValidation"] = "enable_log_file_validation";
+    AwsAttribute["KmsKeyId"] = "kms_key_id";
+    // IAM account password policy
+    AwsAttribute["MinimumPasswordLength"] = "minimum_password_length";
+    AwsAttribute["RequireSymbols"] = "require_symbols";
+    AwsAttribute["RequireNumbers"] = "require_numbers";
+    AwsAttribute["RequireUppercaseCharacters"] = "require_uppercase_characters";
+    AwsAttribute["RequireLowercaseCharacters"] = "require_lowercase_characters";
+    AwsAttribute["PasswordReusePrevention"] = "password_reuse_prevention";
+    AwsAttribute["MaxPasswordAge"] = "max_password_age";
+    // API Gateway
+    AwsAttribute["Authorization"] = "authorization";
+    AwsAttribute["XrayTracingEnabled"] = "xray_tracing_enabled";
+})(AwsAttribute || (exports.AwsAttribute = AwsAttribute = {}));
+// Known weak ELB TLS policies (permit TLS 1.0/1.1). Use with `denyValue`.
+var TlsPolicy;
+(function (TlsPolicy) {
+    TlsPolicy["Legacy2015"] = "ELBSecurityPolicy-2015-05";
+    TlsPolicy["Tls10"] = "ELBSecurityPolicy-TLS-1-0-2015-04";
+    TlsPolicy["Tls11"] = "ELBSecurityPolicy-TLS-1-1-2017-01";
+})(TlsPolicy || (exports.TlsPolicy = TlsPolicy = {}));
+// Listener protocols (for `denyValue` on plaintext).
+var Protocol;
+(function (Protocol) {
+    Protocol["Http"] = "HTTP";
+    Protocol["Https"] = "HTTPS";
+    Protocol["Tcp"] = "TCP";
+    Protocol["Tls"] = "TLS";
+})(Protocol || (exports.Protocol = Protocol = {}));
+// EKS control-plane log types (for `listMustInclude`).
+var EksLogType;
+(function (EksLogType) {
+    EksLogType["Api"] = "api";
+    EksLogType["Audit"] = "audit";
+    EksLogType["Authenticator"] = "authenticator";
+    EksLogType["ControllerManager"] = "controllerManager";
+    EksLogType["Scheduler"] = "scheduler";
+})(EksLogType || (exports.EksLogType = EksLogType = {}));
+// Closed value set for EC2 instance metadata tokens (IMDSv1 vs IMDSv2).
+var HttpTokens;
+(function (HttpTokens) {
+    HttpTokens["Optional"] = "optional";
+    HttpTokens["Required"] = "required";
+})(HttpTokens || (exports.HttpTokens = HttpTokens = {}));
+var Acl;
+(function (Acl) {
+    Acl["Private"] = "private";
+    Acl["PublicRead"] = "public-read";
+    Acl["PublicReadWrite"] = "public-read-write";
+})(Acl || (exports.Acl = Acl = {}));
+var Environment;
+(function (Environment) {
+    Environment["Development"] = "development";
+    Environment["Staging"] = "staging";
+    Environment["Production"] = "production";
+})(Environment || (exports.Environment = Environment = {}));
+// Org-defined approval groups/roles. Enum-backed like every other domain
+// value so a typo'd approver is a compile error, not a misrouted approval.
+var Approver;
+(function (Approver) {
+    Approver["PlatformTeam"] = "platform-team";
+    Approver["SecurityArchitect"] = "security-architect";
+    Approver["FinOps"] = "finops";
+    Approver["SRE"] = "sre";
+})(Approver || (exports.Approver = Approver = {}));

package/package.json

@@ -0,0 +1,74 @@
+{
+  "name": "@dotzen/dotzen",
+  "version": "0.0.1",
+  "description": "Prose as Code — governance for AI-generated Terraform (AWS, Azure, GCP).",
+  "license": "MIT",
+  "keywords": [
+    "terraform",
+    "hcl",
+    "governance",
+    "policy-as-code",
+    "iac",
+    "security",
+    "cis",
+    "compliance",
+    "aws",
+    "azure",
+    "gcp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/governance-tools/dotzen.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://gitlab.com/governance-tools/dotzen#readme",
+  "bugs": {
+    "url": "https://gitlab.com/governance-tools/dotzen/-/issues"
+  },
+  "bin": {
+    "dotzen": "./bin/dotzen.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "bin"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run src",
+    "test:integration": "vitest run tests",
+    "coverage": "vitest run --coverage",
+    "lint": "eslint .",
+    "format:check": "prettier --check .",
+    "format": "prettier --write .",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@cdktf/hcl2json": "^0.21.0",
+    "jiti": "^2.4.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^9.17.0",
+    "eslint-plugin-security": "^3.0.1",
+    "prettier": "^3.4.2",
+    "typescript": "^5.7.2",
+    "typescript-eslint": "^8.19.0",
+    "vitest": "^4.1.10"
+  }
+}