@dotzen/dotzen 0.0.4 → 0.1.0

package/dist/hcl/normalize.d.ts

@@ -4,11 +4,15 @@ export interface Hcl2JsonRoot {
     resource?: Record<string, Record<string, unknown[]>>;
     variable?: Record<string, unknown[]>;
     locals?: unknown[];
+    /** `module "x" { source = …, <inputs> }` → `{ x: [{ source, … }] }`. */
+    module?: Record<string, unknown[]>;
 }
 /** Resolved `var.*` / `local.*` values, keyed by reference, raw form. */
 export type Scope = Map<string, unknown>;
 /** Collect `variable` defaults and `locals` from all parsed files. */
 export declare function buildScope(roots: Hcl2JsonRoot[]): Scope;
+/** Follow a sole var/local reference to its raw resolved value (or undefined). */
+export declare function resolveRaw(raw: unknown, scope: Scope, depth?: number): unknown | undefined;
 /**
  * Adapter boundary (doc 06): parser output -> dotzen's own model.
  * The engine never sees `Hcl2JsonRoot`. `scope` resolves var/local refs.

package/dist/hcl/normalize.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildScope = buildScope;
+exports.resolveRaw = resolveRaw;
 exports.normalize = normalize;
 const vocabulary_1 = require("../vocabulary");
 const KNOWN_TYPES = new Set([
@@ -60,11 +61,28 @@ function buildScope(roots) {
 }
 function mapIngressObj(o, scope) {
     const oo = asObject(o);
-    const cidrs = Array.isArray(oo.cidr_blocks) ? oo.cidr_blocks : [];
+    const raw = oo.cidr_blocks;
+    let cidrBlocks;
+    if (Array.isArray(raw)) {
+        cidrBlocks = raw.map((c) => resolveValue(c, scope));
+    }
+    else if (typeof raw === 'string') {
+        // A whole-list reference, e.g. `cidr_blocks = var.allowed_cidrs`
+        // (common in modules). Follow it to a concrete list; if it can't be
+        // resolved, keep it as one unresolved element so the check honestly
+        // degrades to "could not evaluate" instead of silently passing.
+        const resolved = resolveRaw(raw, scope);
+        cidrBlocks = Array.isArray(resolved)
+            ? resolved.map((c) => resolveValue(c, scope))
+            : [{ kind: 'unresolved', expr: raw }];
+    }
+    else {
+        cidrBlocks = [];
+    }
     return {
         fromPort: resolveValue(oo.from_port, scope),
         toPort: resolveValue(oo.to_port, scope),
-        cidrBlocks: cidrs.map((c) => resolveValue(c, scope)),
+        cidrBlocks,
     };
 }
 /** Inline `<name> { ... }` blocks (name is 'ingress' or 'egress'). */

package/dist/hcl/parse.d.ts

@@ -8,6 +8,8 @@ import { NormalizedResource } from './model';
  * `projectRoot` (defaults to `dir`) so output is readable and portable —
  * and, for multi-root layouts, shows which root each finding came from.
  * A single `parseTf` call builds ONE scope, so calling it once per root
- * keeps each root's `var`/`local` values isolated.
+ * keeps each root's `var`/`local` values isolated. Local `module {}` calls
+ * are followed (doc 08), evaluating the module's resources with the
+ * caller's inputs threaded in as `var.*`.
  */
 export declare function parseTf(dir: string, projectRoot?: string, environmentOverride?: string): Promise<Result<NormalizedResource[], DotzenError>>;

package/dist/hcl/parse.js

@@ -44,27 +44,16 @@ function findTfFiles(dir) {
     return entries.filter((e) => e.endsWith('.tf')).map((e) => path.join(dir, e));
 }
 const toPosix = (p) => p.split(path.sep).join('/');
-/**
- * Read a terraform directory, parse each .tf via the official parser
- * (hcl2json / WASM), and normalize into dotzen's model. Async because
- * the WASM parser is async. Reported file paths are made relative to
- * `projectRoot` (defaults to `dir`) so output is readable and portable —
- * and, for multi-root layouts, shows which root each finding came from.
- * A single `parseTf` call builds ONE scope, so calling it once per root
- * keeps each root's `var`/`local` values isolated.
- */
-async function parseTf(dir, projectRoot = dir, environmentOverride) {
+/** Parse every `.tf` under `dir` (no normalization). */
+async function parseDir(dir) {
     if (!fs.existsSync(dir))
         return (0, result_1.err)({ kind: 'PathNotFound', path: dir });
-    const files = findTfFiles(dir);
-    // Pass 1: parse every file (variables/locals may live in a different
-    // file from the resources that reference them).
-    const parsedFiles = [];
-    for (const file of files) {
+    const out = [];
+    for (const file of findTfFiles(dir)) {
         const text = fs.readFileSync(file, 'utf8');
         try {
             const parsed = (await (0, hcl2json_1.parse)(path.basename(file), text));
-            parsedFiles.push({ file, text, parsed });
+            out.push({ file, text, parsed });
         }
         catch (e) {
             return (0, result_1.err)({
@@ -74,12 +63,91 @@ async function parseTf(dir, projectRoot = dir, environmentOverride) {
             });
         }
     }
-    // Pass 2: build the cross-file var/local scope, then normalize with it.
-    const scope = (0, normalize_1.buildScope)(parsedFiles.map((p) => p.parsed));
+    return (0, result_1.ok)(out);
+}
+// Keys on a `module` block that are meta, not `var` inputs (doc 08).
+const MODULE_META = new Set([
+    'source',
+    'version',
+    'count',
+    'for_each',
+    'providers',
+    'depends_on',
+    'lifecycle',
+]);
+// A local relative source we can follow (doc 08 v1: local sources only).
+const isLocalSource = (s) => typeof s === 'string' && (s.startsWith('./') || s.startsWith('../'));
+/**
+ * Module-following (doc 08). For each local `module { source, <inputs> }`
+ * call in the caller's files, parse the module dir and normalize its
+ * resources with a scope = the module's own defaults/locals overlaid with
+ * the caller's inputs (resolved in the caller's scope) as `var.*`. This is
+ * what turns caller-`var` values (cidrs, tags) into concrete verdicts.
+ * v1: local sources, single level, no count/for_each.
+ */
+async function followModules(callerFiles, rootDir, projectRoot, callerScope, environmentOverride) {
+    const rootRel = toPosix(path.relative(projectRoot, rootDir));
+    const out = [];
+    for (const { file, parsed } of callerFiles) {
+        for (const [, calls] of Object.entries(parsed.module ?? {})) {
+            for (const raw of Array.isArray(calls) ? calls : []) {
+                const block = (raw ?? {});
+                if (!isLocalSource(block.source))
+                    continue; // remote → not followed
+                const moduleDir = path.resolve(path.dirname(file), block.source);
+                // Confine to the scanned project; never escape it.
+                if (path.relative(projectRoot, moduleDir).startsWith('..'))
+                    continue;
+                // eslint-disable-next-line security/detect-non-literal-fs-filename -- moduleDir confined to projectRoot above
+                if (!fs.existsSync(moduleDir))
+                    continue;
+                const parsedModule = await parseDir(moduleDir);
+                if (!parsedModule.ok)
+                    return parsedModule;
+                // Module scope: its own defaults/locals, then caller inputs win.
+                const moduleScope = (0, normalize_1.buildScope)(parsedModule.value.map((f) => f.parsed));
+                for (const [name, value] of Object.entries(block)) {
+                    if (MODULE_META.has(name))
+                        continue;
+                    const resolved = (0, normalize_1.resolveRaw)(value, callerScope);
+                    moduleScope.set(`var.${name}`, resolved !== undefined ? resolved : value);
+                }
+                for (const m of parsedModule.value) {
+                    const modRel = toPosix(path.relative(projectRoot, m.file));
+                    const trace = rootRel ? `${rootRel} › ${modRel}` : modRel;
+                    out.push(...(0, normalize_1.normalize)(m.parsed, trace, m.text, moduleScope, environmentOverride));
+                }
+            }
+        }
+    }
+    return (0, result_1.ok)(out);
+}
+/**
+ * Read a terraform directory, parse each .tf via the official parser
+ * (hcl2json / WASM), and normalize into dotzen's model. Async because
+ * the WASM parser is async. Reported file paths are made relative to
+ * `projectRoot` (defaults to `dir`) so output is readable and portable —
+ * and, for multi-root layouts, shows which root each finding came from.
+ * A single `parseTf` call builds ONE scope, so calling it once per root
+ * keeps each root's `var`/`local` values isolated. Local `module {}` calls
+ * are followed (doc 08), evaluating the module's resources with the
+ * caller's inputs threaded in as `var.*`.
+ */
+async function parseTf(dir, projectRoot = dir, environmentOverride) {
+    const parsedFiles = await parseDir(dir);
+    if (!parsedFiles.ok)
+        return parsedFiles;
+    // Build the cross-file var/local scope, then normalize direct resources.
+    const scope = (0, normalize_1.buildScope)(parsedFiles.value.map((p) => p.parsed));
     const resources = [];
-    for (const { file, text, parsed } of parsedFiles) {
+    for (const { file, text, parsed } of parsedFiles.value) {
         const rel = toPosix(path.relative(projectRoot, file));
         resources.push(...(0, normalize_1.normalize)(parsed, rel, text, scope, environmentOverride));
     }
+    // Follow local module calls, threading caller inputs into their vars.
+    const followed = await followModules(parsedFiles.value, dir, projectRoot, scope, environmentOverride);
+    if (!followed.ok)
+        return followed;
+    resources.push(...followed.value);
     return (0, result_1.ok)(resources);
 }

package/package.json

@@ -1,74 +1,74 @@
-{
-  "name": "@dotzen/dotzen",
-  "version": "0.0.4",
-  "description": "Prose as Code — governance for AI-generated Terraform (AWS, Azure, GCP).",
-  "license": "MIT",
-  "keywords": [
-    "terraform",
-    "hcl",
-    "governance",
-    "policy-as-code",
-    "iac",
-    "security",
-    "cis",
-    "compliance",
-    "aws",
-    "azure",
-    "gcp"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://gitlab.com/governance-tools/dotzen.git",
-    "directory": "packages/cli"
-  },
-  "homepage": "https://gitlab.com/governance-tools/dotzen#readme",
-  "bugs": {
-    "url": "https://gitlab.com/governance-tools/dotzen/-/issues"
-  },
-  "bin": {
-    "dotzen": "./bin/dotzen.js"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist",
-    "bin"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run src",
-    "test:integration": "vitest run tests",
-    "coverage": "vitest run --coverage",
-    "lint": "eslint .",
-    "format:check": "prettier --check .",
-    "format": "prettier --write .",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "@cdktf/hcl2json": "^0.21.0",
-    "jiti": "^2.4.2"
-  },
-  "devDependencies": {
-    "@types/node": "^22.10.5",
-    "@vitest/coverage-v8": "^4.1.10",
-    "eslint": "^9.17.0",
-    "eslint-plugin-security": "^3.0.1",
-    "prettier": "^3.4.2",
-    "typescript": "^5.7.2",
-    "typescript-eslint": "^8.19.0",
-    "vitest": "^4.1.10"
-  }
-}
+{
+  "name": "@dotzen/dotzen",
+  "version": "0.1.0",
+  "description": "Prose as Code — governance for AI-generated Terraform (AWS, Azure, GCP).",
+  "license": "MIT",
+  "keywords": [
+    "terraform",
+    "hcl",
+    "governance",
+    "policy-as-code",
+    "iac",
+    "security",
+    "cis",
+    "compliance",
+    "aws",
+    "azure",
+    "gcp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/governance-tools/dotzen.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://gitlab.com/governance-tools/dotzen#readme",
+  "bugs": {
+    "url": "https://gitlab.com/governance-tools/dotzen/-/issues"
+  },
+  "bin": {
+    "dotzen": "./bin/dotzen.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "bin"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run src",
+    "test:integration": "vitest run tests",
+    "coverage": "vitest run --coverage",
+    "lint": "eslint .",
+    "format:check": "prettier --check .",
+    "format": "prettier --write .",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@cdktf/hcl2json": "^0.21.0",
+    "jiti": "^2.4.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^9.17.0",
+    "eslint-plugin-security": "^3.0.1",
+    "prettier": "^3.4.2",
+    "typescript": "^5.7.2",
+    "typescript-eslint": "^8.19.0",
+    "vitest": "^4.1.10"
+  }
+}