@dotzen/dotzen 0.1.0 → 0.1.2

package/dist/hcl/normalize.js

@@ -306,8 +306,55 @@ function egressFor(block, scope) {
 // `=` (not `==`/`>=`/etc.) is HCL's attribute-assignment operator, so this
 // reliably picks up flat map keys inside a `merge(...)` argument.
 const OBJECT_KEY = /([A-Za-z_][A-Za-z0-9_-]*)\s*=(?!=)/g;
-// `var.x` / `local.y` reference tokens mentioned in an expression.
-const REF_TOKEN = /\b(var|local)\.([A-Za-z0-9_-]+)/g;
+// A whole argument that is exactly one `var.x` / `local.y` ref (optionally
+// `${…}`-wrapped). Only such TOP-LEVEL merge args contribute tag keys — refs
+// inside an object literal's *values* (e.g. `Ou = var.ou`) must not count.
+const ARG_REF = /^\$?\{?\s*(var|local)\.([A-Za-z0-9_-]+)\s*\}?$/;
+/** The substring inside the outermost `merge( … )`, or null if unbalanced. */
+function mergeInner(value) {
+    const m = /^merge\s*\(/.exec(value);
+    if (!m)
+        return null;
+    let depth = 0;
+    const start = m[0].length;
+    for (let i = start; i < value.length; i++) {
+        const c = value[i];
+        if (c === '(')
+            depth++;
+        else if (c === ')') {
+            if (depth === 0)
+                return value.slice(start, i);
+            depth--;
+        }
+    }
+    return null;
+}
+/** Split an argument list on top-level commas, respecting (), {}, [], quotes. */
+function splitTopLevelArgs(inner) {
+    const args = [];
+    let depth = 0;
+    let start = 0;
+    let quote = null;
+    for (let i = 0; i < inner.length; i++) {
+        const c = inner[i];
+        if (quote) {
+            if (c === quote && inner[i - 1] !== '\\')
+                quote = null;
+        }
+        else if (c === '"' || c === "'")
+            quote = c;
+        else if (c === '(' || c === '{' || c === '[')
+            depth++;
+        else if (c === ')' || c === '}' || c === ']')
+            depth--;
+        else if (c === ',' && depth === 0) {
+            args.push(inner.slice(start, i));
+            start = i + 1;
+        }
+    }
+    args.push(inner.slice(start));
+    return args.map((a) => a.trim()).filter((a) => a.length > 0);
+}
 /**
  * Keys known to be present on a tags value, and whether that set is
  * COMPLETE. Follows sole `var`/`local` references to their value, and
@@ -329,21 +376,50 @@ function tagKeys(value, scope, depth = 8) {
         const key = `${ref[1]}.${ref[2]}`;
         return scope.has(key) ? tagKeys(scope.get(key), scope, depth - 1) : null;
     }
-    if (/\bmerge\s*\(/.test(value)) {
-        // merge() only ever ADDS keys, so presence is monotonic. Collect the
-        // inline literal keys plus keys from any resolvable ref args; mark the
-        // set incomplete (a var/unresolved arg may contribute more).
-        const keys = new Set(value.match(OBJECT_KEY)?.map((m) => m.replace(/\s*=$/, '')) ?? []);
-        for (const [, kind, name] of value.matchAll(REF_TOKEN)) {
-            const scopeKey = `${kind}.${name}`;
-            if (depth > 0 && scope.has(scopeKey)) {
-                const sub = tagKeys(scope.get(scopeKey), scope, depth - 1);
-                if (sub)
+    // Only treat `merge(...)` as the TOP-LEVEL call (strip a `${…}` wrapper
+    // first). merge nested inside another function is opaque → could-not-eval.
+    const stripped = value.replace(/^\$\{/, '').replace(/\}$/, '').trim();
+    if (/^merge\s*\(/.test(stripped)) {
+        const inner = mergeInner(stripped);
+        if (inner === null)
+            return null;
+        // merge() only ADDS keys, so the result is COMPLETE iff every top-level
+        // argument is fully knowable: an object literal, or a ref that resolves
+        // to a complete map. An unresolvable ref or an opaque expression (e.g. a
+        // function call) means more keys could appear → PARTIAL, so a missing
+        // required tag degrades to could-not-evaluate rather than a false claim.
+        const keys = new Set();
+        let complete = true;
+        for (const arg of splitTopLevelArgs(inner)) {
+            const refMatch = ARG_REF.exec(arg);
+            if (arg.startsWith('{')) {
+                // Object literal: keys are the `ident =` pairs (tag maps are flat);
+                // the values — which may themselves mention refs — are irrelevant.
+                for (const m of arg.match(OBJECT_KEY) ?? [])
+                    keys.add(m.replace(/\s*=$/, ''));
+            }
+            else if (refMatch) {
+                const scopeKey = `${refMatch[1]}.${refMatch[2]}`;
+                const sub = depth > 0 && scope.has(scopeKey)
+                    ? tagKeys(scope.get(scopeKey), scope, depth - 1)
+                    : null;
+                if (sub === null) {
+                    complete = false; // unresolvable ref — could add unknown keys
+                }
+                else {
+                    // Proven-present keys count even from a partial sub (merge only
+                    // adds); a partial sub still means the whole set is incomplete.
                     for (const k of sub.keys)
                         keys.add(k);
+                    if (!sub.complete)
+                        complete = false;
+                }
+            }
+            else {
+                complete = false; // opaque arg (function call, etc.) may add keys
             }
         }
-        return { keys: [...keys], complete: false };
+        return { keys: [...keys], complete };
     }
     return null; // some other unresolvable expression
 }

package/dist/vocabulary/index.d.ts

@@ -32,6 +32,7 @@ export declare enum AwsResource {
     EcsTaskDefinition = "aws_ecs_task_definition",
     SecretsmanagerSecretVersion = "aws_secretsmanager_secret_version",
     RdsCluster = "aws_rds_cluster",
+    RdsClusterInstance = "aws_rds_cluster_instance",
     RedshiftCluster = "aws_redshift_cluster",
     ElasticacheReplicationGroup = "aws_elasticache_replication_group",
     S3BucketServerSideEncryptionConfiguration = "aws_s3_bucket_server_side_encryption_configuration",

package/dist/vocabulary/index.js

@@ -37,6 +37,7 @@ var AwsResource;
     AwsResource["EcsTaskDefinition"] = "aws_ecs_task_definition";
     AwsResource["SecretsmanagerSecretVersion"] = "aws_secretsmanager_secret_version";
     AwsResource["RdsCluster"] = "aws_rds_cluster";
+    AwsResource["RdsClusterInstance"] = "aws_rds_cluster_instance";
     AwsResource["RedshiftCluster"] = "aws_redshift_cluster";
     AwsResource["ElasticacheReplicationGroup"] = "aws_elasticache_replication_group";
     AwsResource["S3BucketServerSideEncryptionConfiguration"] = "aws_s3_bucket_server_side_encryption_configuration";

package/package.json

@@ -1,74 +1,74 @@
-{
-  "name": "@dotzen/dotzen",
-  "version": "0.1.0",
-  "description": "Prose as Code — governance for AI-generated Terraform (AWS, Azure, GCP).",
-  "license": "MIT",
-  "keywords": [
-    "terraform",
-    "hcl",
-    "governance",
-    "policy-as-code",
-    "iac",
-    "security",
-    "cis",
-    "compliance",
-    "aws",
-    "azure",
-    "gcp"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://gitlab.com/governance-tools/dotzen.git",
-    "directory": "packages/cli"
-  },
-  "homepage": "https://gitlab.com/governance-tools/dotzen#readme",
-  "bugs": {
-    "url": "https://gitlab.com/governance-tools/dotzen/-/issues"
-  },
-  "bin": {
-    "dotzen": "./bin/dotzen.js"
-  },
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    }
-  },
-  "files": [
-    "dist",
-    "bin"
-  ],
-  "engines": {
-    "node": ">=18"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run src",
-    "test:integration": "vitest run tests",
-    "coverage": "vitest run --coverage",
-    "lint": "eslint .",
-    "format:check": "prettier --check .",
-    "format": "prettier --write .",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "@cdktf/hcl2json": "^0.21.0",
-    "jiti": "^2.4.2"
-  },
-  "devDependencies": {
-    "@types/node": "^22.10.5",
-    "@vitest/coverage-v8": "^4.1.10",
-    "eslint": "^9.17.0",
-    "eslint-plugin-security": "^3.0.1",
-    "prettier": "^3.4.2",
-    "typescript": "^5.7.2",
-    "typescript-eslint": "^8.19.0",
-    "vitest": "^4.1.10"
-  }
-}
+{
+  "name": "@dotzen/dotzen",
+  "version": "0.1.2",
+  "description": "Prose as Code — governance for AI-generated Terraform (AWS, Azure, GCP).",
+  "license": "MIT",
+  "keywords": [
+    "terraform",
+    "hcl",
+    "governance",
+    "policy-as-code",
+    "iac",
+    "security",
+    "cis",
+    "compliance",
+    "aws",
+    "azure",
+    "gcp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/governance-tools/dotzen.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://gitlab.com/governance-tools/dotzen#readme",
+  "bugs": {
+    "url": "https://gitlab.com/governance-tools/dotzen/-/issues"
+  },
+  "bin": {
+    "dotzen": "./bin/dotzen.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "bin"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run src",
+    "test:integration": "vitest run tests",
+    "coverage": "vitest run --coverage",
+    "lint": "eslint .",
+    "format:check": "prettier --check .",
+    "format": "prettier --write .",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@cdktf/hcl2json": "^0.21.0",
+    "jiti": "^2.4.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^9.17.0",
+    "eslint-plugin-security": "^3.0.1",
+    "prettier": "^3.4.2",
+    "typescript": "^5.7.2",
+    "typescript-eslint": "^8.19.0",
+    "vitest": "^4.1.10"
+  }
+}