@dotzen/dotzen 0.0.4 → 0.1.1

package/dist/hcl/normalize.d.ts

@@ -4,11 +4,15 @@ export interface Hcl2JsonRoot {
     resource?: Record<string, Record<string, unknown[]>>;
     variable?: Record<string, unknown[]>;
     locals?: unknown[];
+    /** `module "x" { source = …, <inputs> }` → `{ x: [{ source, … }] }`. */
+    module?: Record<string, unknown[]>;
 }
 /** Resolved `var.*` / `local.*` values, keyed by reference, raw form. */
 export type Scope = Map<string, unknown>;
 /** Collect `variable` defaults and `locals` from all parsed files. */
 export declare function buildScope(roots: Hcl2JsonRoot[]): Scope;
+/** Follow a sole var/local reference to its raw resolved value (or undefined). */
+export declare function resolveRaw(raw: unknown, scope: Scope, depth?: number): unknown | undefined;
 /**
  * Adapter boundary (doc 06): parser output -> dotzen's own model.
  * The engine never sees `Hcl2JsonRoot`. `scope` resolves var/local refs.

package/dist/hcl/normalize.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildScope = buildScope;
+exports.resolveRaw = resolveRaw;
 exports.normalize = normalize;
 const vocabulary_1 = require("../vocabulary");
 const KNOWN_TYPES = new Set([
@@ -60,11 +61,28 @@ function buildScope(roots) {
 }
 function mapIngressObj(o, scope) {
     const oo = asObject(o);
-    const cidrs = Array.isArray(oo.cidr_blocks) ? oo.cidr_blocks : [];
+    const raw = oo.cidr_blocks;
+    let cidrBlocks;
+    if (Array.isArray(raw)) {
+        cidrBlocks = raw.map((c) => resolveValue(c, scope));
+    }
+    else if (typeof raw === 'string') {
+        // A whole-list reference, e.g. `cidr_blocks = var.allowed_cidrs`
+        // (common in modules). Follow it to a concrete list; if it can't be
+        // resolved, keep it as one unresolved element so the check honestly
+        // degrades to "could not evaluate" instead of silently passing.
+        const resolved = resolveRaw(raw, scope);
+        cidrBlocks = Array.isArray(resolved)
+            ? resolved.map((c) => resolveValue(c, scope))
+            : [{ kind: 'unresolved', expr: raw }];
+    }
+    else {
+        cidrBlocks = [];
+    }
     return {
         fromPort: resolveValue(oo.from_port, scope),
         toPort: resolveValue(oo.to_port, scope),
-        cidrBlocks: cidrs.map((c) => resolveValue(c, scope)),
+        cidrBlocks,
     };
 }
 /** Inline `<name> { ... }` blocks (name is 'ingress' or 'egress'). */

package/dist/hcl/parse.d.ts

@@ -8,6 +8,8 @@ import { NormalizedResource } from './model';
  * `projectRoot` (defaults to `dir`) so output is readable and portable —
  * and, for multi-root layouts, shows which root each finding came from.
  * A single `parseTf` call builds ONE scope, so calling it once per root
- * keeps each root's `var`/`local` values isolated.
+ * keeps each root's `var`/`local` values isolated. Local `module {}` calls
+ * are followed (doc 08), evaluating the module's resources with the
+ * caller's inputs threaded in as `var.*`.
  */
 export declare function parseTf(dir: string, projectRoot?: string, environmentOverride?: string): Promise<Result<NormalizedResource[], DotzenError>>;

package/dist/hcl/parse.js

@@ -44,27 +44,16 @@ function findTfFiles(dir) {
     return entries.filter((e) => e.endsWith('.tf')).map((e) => path.join(dir, e));
 }
 const toPosix = (p) => p.split(path.sep).join('/');
-/**
- * Read a terraform directory, parse each .tf via the official parser
- * (hcl2json / WASM), and normalize into dotzen's model. Async because
- * the WASM parser is async. Reported file paths are made relative to
- * `projectRoot` (defaults to `dir`) so output is readable and portable —
- * and, for multi-root layouts, shows which root each finding came from.
- * A single `parseTf` call builds ONE scope, so calling it once per root
- * keeps each root's `var`/`local` values isolated.
- */
-async function parseTf(dir, projectRoot = dir, environmentOverride) {
+/** Parse every `.tf` under `dir` (no normalization). */
+async function parseDir(dir) {
     if (!fs.existsSync(dir))
         return (0, result_1.err)({ kind: 'PathNotFound', path: dir });
-    const files = findTfFiles(dir);
-    // Pass 1: parse every file (variables/locals may live in a different
-    // file from the resources that reference them).
-    const parsedFiles = [];
-    for (const file of files) {
+    const out = [];
+    for (const file of findTfFiles(dir)) {
         const text = fs.readFileSync(file, 'utf8');
         try {
             const parsed = (await (0, hcl2json_1.parse)(path.basename(file), text));
-            parsedFiles.push({ file, text, parsed });
+            out.push({ file, text, parsed });
         }
         catch (e) {
             return (0, result_1.err)({
@@ -74,12 +63,91 @@ async function parseTf(dir, projectRoot = dir, environmentOverride) {
             });
         }
     }
-    // Pass 2: build the cross-file var/local scope, then normalize with it.
-    const scope = (0, normalize_1.buildScope)(parsedFiles.map((p) => p.parsed));
+    return (0, result_1.ok)(out);
+}
+// Keys on a `module` block that are meta, not `var` inputs (doc 08).
+const MODULE_META = new Set([
+    'source',
+    'version',
+    'count',
+    'for_each',
+    'providers',
+    'depends_on',
+    'lifecycle',
+]);
+// A local relative source we can follow (doc 08 v1: local sources only).
+const isLocalSource = (s) => typeof s === 'string' && (s.startsWith('./') || s.startsWith('../'));
+/**
+ * Module-following (doc 08). For each local `module { source, <inputs> }`
+ * call in the caller's files, parse the module dir and normalize its
+ * resources with a scope = the module's own defaults/locals overlaid with
+ * the caller's inputs (resolved in the caller's scope) as `var.*`. This is
+ * what turns caller-`var` values (cidrs, tags) into concrete verdicts.
+ * v1: local sources, single level, no count/for_each.
+ */
+async function followModules(callerFiles, rootDir, projectRoot, callerScope, environmentOverride) {
+    const rootRel = toPosix(path.relative(projectRoot, rootDir));
+    const out = [];
+    for (const { file, parsed } of callerFiles) {
+        for (const [, calls] of Object.entries(parsed.module ?? {})) {
+            for (const raw of Array.isArray(calls) ? calls : []) {
+                const block = (raw ?? {});
+                if (!isLocalSource(block.source))
+                    continue; // remote → not followed
+                const moduleDir = path.resolve(path.dirname(file), block.source);
+                // Confine to the scanned project; never escape it.
+                if (path.relative(projectRoot, moduleDir).startsWith('..'))
+                    continue;
+                // eslint-disable-next-line security/detect-non-literal-fs-filename -- moduleDir confined to projectRoot above
+                if (!fs.existsSync(moduleDir))
+                    continue;
+                const parsedModule = await parseDir(moduleDir);
+                if (!parsedModule.ok)
+                    return parsedModule;
+                // Module scope: its own defaults/locals, then caller inputs win.
+                const moduleScope = (0, normalize_1.buildScope)(parsedModule.value.map((f) => f.parsed));
+                for (const [name, value] of Object.entries(block)) {
+                    if (MODULE_META.has(name))
+                        continue;
+                    const resolved = (0, normalize_1.resolveRaw)(value, callerScope);
+                    moduleScope.set(`var.${name}`, resolved !== undefined ? resolved : value);
+                }
+                for (const m of parsedModule.value) {
+                    const modRel = toPosix(path.relative(projectRoot, m.file));
+                    const trace = rootRel ? `${rootRel} › ${modRel}` : modRel;
+                    out.push(...(0, normalize_1.normalize)(m.parsed, trace, m.text, moduleScope, environmentOverride));
+                }
+            }
+        }
+    }
+    return (0, result_1.ok)(out);
+}
+/**
+ * Read a terraform directory, parse each .tf via the official parser
+ * (hcl2json / WASM), and normalize into dotzen's model. Async because
+ * the WASM parser is async. Reported file paths are made relative to
+ * `projectRoot` (defaults to `dir`) so output is readable and portable —
+ * and, for multi-root layouts, shows which root each finding came from.
+ * A single `parseTf` call builds ONE scope, so calling it once per root
+ * keeps each root's `var`/`local` values isolated. Local `module {}` calls
+ * are followed (doc 08), evaluating the module's resources with the
+ * caller's inputs threaded in as `var.*`.
+ */
+async function parseTf(dir, projectRoot = dir, environmentOverride) {
+    const parsedFiles = await parseDir(dir);
+    if (!parsedFiles.ok)
+        return parsedFiles;
+    // Build the cross-file var/local scope, then normalize direct resources.
+    const scope = (0, normalize_1.buildScope)(parsedFiles.value.map((p) => p.parsed));
     const resources = [];
-    for (const { file, text, parsed } of parsedFiles) {
+    for (const { file, text, parsed } of parsedFiles.value) {
         const rel = toPosix(path.relative(projectRoot, file));
         resources.push(...(0, normalize_1.normalize)(parsed, rel, text, scope, environmentOverride));
     }
+    // Follow local module calls, threading caller inputs into their vars.
+    const followed = await followModules(parsedFiles.value, dir, projectRoot, scope, environmentOverride);
+    if (!followed.ok)
+        return followed;
+    resources.push(...followed.value);
     return (0, result_1.ok)(resources);
 }

package/dist/vocabulary/index.d.ts

@@ -32,6 +32,7 @@ export declare enum AwsResource {
     EcsTaskDefinition = "aws_ecs_task_definition",
     SecretsmanagerSecretVersion = "aws_secretsmanager_secret_version",
     RdsCluster = "aws_rds_cluster",
+    RdsClusterInstance = "aws_rds_cluster_instance",
     RedshiftCluster = "aws_redshift_cluster",
     ElasticacheReplicationGroup = "aws_elasticache_replication_group",
     S3BucketServerSideEncryptionConfiguration = "aws_s3_bucket_server_side_encryption_configuration",

package/dist/vocabulary/index.js

@@ -37,6 +37,7 @@ var AwsResource;
     AwsResource["EcsTaskDefinition"] = "aws_ecs_task_definition";
     AwsResource["SecretsmanagerSecretVersion"] = "aws_secretsmanager_secret_version";
     AwsResource["RdsCluster"] = "aws_rds_cluster";
+    AwsResource["RdsClusterInstance"] = "aws_rds_cluster_instance";
     AwsResource["RedshiftCluster"] = "aws_redshift_cluster";
     AwsResource["ElasticacheReplicationGroup"] = "aws_elasticache_replication_group";
     AwsResource["S3BucketServerSideEncryptionConfiguration"] = "aws_s3_bucket_server_side_encryption_configuration";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotzen/dotzen",
-  "version": "0.0.4",
+  "version": "0.1.1",
   "description": "Prose as Code — governance for AI-generated Terraform (AWS, Azure, GCP).",
   "license": "MIT",
   "keywords": [