@ploaness/governance 1.2.0 → 1.4.0

package/dist/checkov-check.d.ts

@@ -0,0 +1,9 @@
+/** A provider this harness has curated checks for, named as its resource types spell it. */
+export type CuratedProviderName = 'aws' | 'azurerm' | 'google' | 'digitalocean' | 'linode';
+/** One enabled check: the identifier checkov knows it by, its provider, and why the finding is refused. */
+export interface CheckovCheck {
+    readonly id: string;
+    readonly provider: CuratedProviderName;
+    readonly reason: string;
+}
+//# sourceMappingURL=checkov-check.d.ts.map

package/dist/checkov-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-check.d.ts","sourceRoot":"","sources":["../src/checkov-check.ts"],"names":[],"mappings":"AAGA,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,QAAQ,CAAA;AAE1F,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB"}

package/dist/checkov-check.js

@@ -0,0 +1,4 @@
+// The shape of one enabled checkov check, declared apart from the tables that list them and the policy
+// that reads them so that neither imports the other.
+export {};
+//# sourceMappingURL=checkov-check.js.map

package/dist/checkov-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-check.js","sourceRoot":"","sources":["../src/checkov-check.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,qDAAqD"}

package/dist/checkov-checks-aws.d.ts

@@ -0,0 +1,4 @@
+import type { CheckovCheck } from './checkov-check.js';
+/** The AWS checks enabled at error severity. */
+export declare const AWS_CHECKS: readonly CheckovCheck[];
+//# sourceMappingURL=checkov-checks-aws.d.ts.map

package/dist/checkov-checks-aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-aws.d.ts","sourceRoot":"","sources":["../src/checkov-checks-aws.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAItD,gDAAgD;AAChD,eAAO,MAAM,UAAU,EAAE,SAAS,YAAY,EAoH7C,CAAA"}

package/dist/checkov-checks-aws.js

@@ -0,0 +1,93 @@
+const aws = (id, reason) => ({ id, provider: 'aws', reason });
+/** The AWS checks enabled at error severity. */
+export const AWS_CHECKS = [
+    // Identity and access.
+    aws('CKV_AWS_274', 'a role, user or group carries AdministratorAccess, so one environment can destroy another'),
+    aws('CKV_AWS_275', 'the same administrator policy reached through a data source rather than an attachment'),
+    aws('CKV_AWS_1', 'a policy document grants every action on every resource'),
+    aws('CKV_AWS_49', 'a policy document names "*" as a statement action'),
+    aws('CKV_AWS_62', 'the same administrative grant written as an inline policy'),
+    aws('CKV_AWS_63', 'the same wildcard action written as an inline policy'),
+    aws('CKV2_AWS_40', 'a policy grants every IAM action, which is administrator access under another name'),
+    aws('CKV2_AWS_56', 'a principal carries IAMFullAccess'),
+    aws('CKV_AWS_283', 'a resource policy grants an action to every principal with no condition'),
+    aws('CKV_AWS_41', 'a long-lived access key is written into a provider block'),
+    aws('CKV_AWS_348', 'an access key is minted for the root user'),
+    aws('CKV_AWS_364', 'a service principal may invoke the function from any account, with no source ARN or account'),
+    aws('CKV_AWS_33', 'a key policy grants a wildcard principal with no condition'),
+    // Databases, caches and search.
+    aws('CKV_AWS_17', 'the database is reachable from the public internet'),
+    aws('CKV_AWS_16', 'the database instance stores its content unencrypted'),
+    aws('CKV_AWS_96', 'the database cluster stores its content unencrypted'),
+    aws('CKV_AWS_140', 'the global database cluster stores its content unencrypted'),
+    aws('CKV_AWS_211', 'the database pins a retired certificate authority bundle'),
+    aws('CKV_AWS_302', 'a database snapshot is shared with every AWS account'),
+    aws('CKV_AWS_74', 'the document database stores its content unencrypted'),
+    aws('CKV_AWS_90', 'the document database explicitly disables TLS'),
+    aws('CKV_AWS_44', 'the graph database stores its content unencrypted'),
+    aws('CKV_AWS_102', 'the graph database is reachable from the public internet'),
+    aws('CKV_AWS_64', 'the warehouse stores its content unencrypted'),
+    aws('CKV_AWS_87', 'the warehouse is reachable from the public internet, which is its default'),
+    aws('CKV_AWS_29', 'the cache stores its content unencrypted'),
+    aws('CKV_AWS_30', 'the cache accepts plaintext connections'),
+    aws('CKV_AWS_202', 'the in-memory database explicitly disables TLS'),
+    aws('CKV_AWS_47', 'the DynamoDB accelerator stores its content unencrypted'),
+    aws('CKV_AWS_239', 'the DynamoDB accelerator endpoint is plaintext'),
+    aws('CKV_AWS_5', 'the search domain stores its content unencrypted'),
+    aws('CKV_AWS_6', 'a multi-node search domain moves data between nodes in plaintext'),
+    aws('CKV_AWS_83', 'the search domain explicitly allows plain HTTP'),
+    aws('CKV_AWS_228', 'the search endpoint accepts TLS below 1.2, which is its default policy'),
+    aws('CKV_AWS_89', 'the migration instance is reachable from the public internet'),
+    aws('CKV2_AWS_49', 'a migration endpoint explicitly sets its SSL mode to none'),
+    // Storage.
+    aws('CKV_AWS_20', 'a bucket ACL grants public read, which serves unpublished media to anybody'),
+    aws('CKV_AWS_57', 'a bucket ACL grants public write, which is arbitrary upload to the site own origin'),
+    aws('CKV_AWS_70', 'a bucket policy names any principal, which is the policy spelling of the same exposure'),
+    aws('CKV_AWS_375', 'a bucket ACL grant gives full control or ACL reads to every user'),
+    aws('CKV2_AWS_43', 'a bucket ACL grant targets every authenticated AWS user'),
+    aws('CKV_AWS_19', 'the bucket stores uploads unencrypted'),
+    aws('CKV_AWS_53', 'the bucket does not block public ACLs'),
+    aws('CKV_AWS_54', 'the bucket does not block a public policy'),
+    aws('CKV_AWS_55', 'the bucket does not ignore public ACLs already set'),
+    aws('CKV_AWS_56', 'the bucket does not restrict public access at the account boundary'),
+    aws('CKV_AWS_392', 'an access point disables all four public-access blocks'),
+    aws('CKV_AWS_3', 'a volume stores its content unencrypted'),
+    aws('CKV_AWS_8', 'an instance root device stores its content unencrypted'),
+    aws('CKV_AWS_106', 'account default volume encryption is explicitly switched off'),
+    aws('CKV_AWS_42', 'the file system stores its content unencrypted'),
+    aws('CKV_AWS_97', 'a task mounts the file system without transit encryption'),
+    aws('CKV_AWS_204', 'an image block device is unencrypted'),
+    aws('CKV_AWS_235', 'an image copy is unencrypted'),
+    // Network.
+    aws('CKV_AWS_277', 'a security group admits every port from the whole internet'),
+    aws('CKV_AWS_100', 'a node group sets an SSH key with no source security group, which AWS opens to the world'),
+    aws('CKV_AWS_79', 'instance metadata v1 is enabled, so any request forgery becomes credential theft'),
+    aws('CKV_AWS_371', 'the notebook instance allows instance metadata v1'),
+    // Compute and build.
+    aws('CKV_AWS_210', 'a batch container runs privileged'),
+    aws('CKV_AWS_78', 'build artifact encryption is explicitly disabled'),
+    aws('CKV_AWS_386', 'an image lookup names no owner and a wildcard name, which is the substitution attack'),
+    aws('CKV_AWS_390', 'the cluster block on public access is switched off'),
+    // The edge.
+    aws('CKV_AWS_328', 'the load balancer runs request-desync mitigation in monitor mode only'),
+    aws('CKV_AWS_34', 'a cache behaviour serves the site over plain HTTP as well as HTTPS'),
+    aws('CKV2_AWS_54', 'an origin lists SSLv3 among its protocols'),
+    aws('CKV_AWS_308', 'a stage caches responses unencrypted'),
+    // Messaging.
+    aws('CKV_AWS_168', 'the queue policy is reachable from the internet'),
+    aws('CKV_AWS_169', 'the topic policy is reachable from the internet'),
+    aws('CKV_AWS_43', 'the stream stores records unencrypted'),
+    aws('CKV_AWS_240', 'the delivery stream stores records unencrypted'),
+    aws('CKV_AWS_291', 'the message brokers carry public IP addresses'),
+    aws('CKV_AWS_69', 'the message broker is reachable from the public internet'),
+    // Other services a project may reach for.
+    aws('CKV_AWS_32', 'the container registry policy is reachable from the internet'),
+    aws('CKV_AWS_167', 'the vault access policy is reachable from the internet'),
+    aws('CKV_AWS_303', 'a systems manager document is shared with every AWS account'),
+    aws('CKV_AWS_357', 'the transfer server enables plaintext FTP'),
+    aws('CKV_AWS_214', 'the API cache stores responses unencrypted'),
+    aws('CKV_AWS_215', 'the API cache moves responses in plaintext'),
+    aws('CKV_AWS_218', 'the search endpoint accepts TLS 1.0'),
+    aws('CKV_AWS_220', 'the search endpoint allows plain HTTP'),
+];
+//# sourceMappingURL=checkov-checks-aws.js.map

package/dist/checkov-checks-aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-aws.js","sourceRoot":"","sources":["../src/checkov-checks-aws.ts"],"names":[],"mappings":"AA0BA,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAE3F,gDAAgD;AAChD,MAAM,CAAC,MAAM,UAAU,GAA4B;IACjD,uBAAuB;IACvB,GAAG,CACD,aAAa,EACb,2FAA2F,CAC5F;IACD,GAAG,CACD,aAAa,EACb,uFAAuF,CACxF;IACD,GAAG,CAAC,WAAW,EAAE,yDAAyD,CAAC;IAC3E,GAAG,CAAC,YAAY,EAAE,mDAAmD,CAAC;IACtE,GAAG,CAAC,YAAY,EAAE,2DAA2D,CAAC;IAC9E,GAAG,CAAC,YAAY,EAAE,sDAAsD,CAAC;IACzE,GAAG,CACD,aAAa,EACb,oFAAoF,CACrF;IACD,GAAG,CAAC,aAAa,EAAE,mCAAmC,CAAC;IACvD,GAAG,CAAC,aAAa,EAAE,yEAAyE,CAAC;IAC7F,GAAG,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC7E,GAAG,CAAC,aAAa,EAAE,2CAA2C,CAAC;IAC/D,GAAG,CACD,aAAa,EACb,6FAA6F,CAC9F;IACD,GAAG,CAAC,YAAY,EAAE,4DAA4D,CAAC;IAC/E,gCAAgC;IAChC,GAAG,CAAC,YAAY,EAAE,oDAAoD,CAAC;IACvE,GAAG,CAAC,YAAY,EAAE,sDAAsD,CAAC;IACzE,GAAG,CAAC,YAAY,EAAE,qDAAqD,CAAC;IACxE,GAAG,CAAC,aAAa,EAAE,4DAA4D,CAAC;IAChF,GAAG,CAAC,aAAa,EAAE,0DAA0D,CAAC;IAC9E,GAAG,CAAC,aAAa,EAAE,sDAAsD,CAAC;IAC1E,GAAG,CAAC,YAAY,EAAE,sDAAsD,CAAC;IACzE,GAAG,CAAC,YAAY,EAAE,+CAA+C,CAAC;IAClE,GAAG,CAAC,YAAY,EAAE,mDAAmD,CAAC;IACtE,GAAG,CAAC,aAAa,EAAE,0DAA0D,CAAC;IAC9E,GAAG,CAAC,YAAY,EAAE,8CAA8C,CAAC;IACjE,GAAG,CAAC,YAAY,EAAE,2EAA2E,CAAC;IAC9F,GAAG,CAAC,YAAY,EAAE,0CAA0C,CAAC;IAC7D,GAAG,CAAC,YAAY,EAAE,yCAAyC,CAAC;IAC5D,GAAG,CAAC,aAAa,EAAE,gDAAgD,CAAC;IACpE,GAAG,CAAC,YAAY,EAAE,yDAAyD,CAAC;IAC5E,GAAG,CAAC,aAAa,EAAE,gDAAgD,CAAC;IACpE,GAAG,CAAC,WAAW,EAAE,kDAAkD,CAAC;IACpE,GAAG,CAAC,WAAW,EAAE,kEAAkE,CAAC;IACpF,GAAG,CAAC,YAAY,EAAE,gDAAgD,CAAC;IACnE,GAAG,CAAC,aAAa,EAAE,wEAAwE,CAAC;IAC5F,GAAG,CAAC,YAAY,EAAE,8DAA8D,CAAC;IACjF,GAAG,CAAC,aAAa,EAAE,2DAA2D,CAAC;IAC/E,WAAW;IACX,GAAG,CAAC,YAAY,EAAE,4EAA4E,CAAC;IAC/F,GAAG,CACD,YAAY,EACZ,oFAAoF,CACrF;IACD,GAAG,CACD,YAAY,EACZ,wFAAwF,CACzF;IACD,GAAG,CAAC,aAAa,EAAE,kEAAkE,CAAC;IACtF,GAAG,CAAC,aAAa,EAAE,yDAAyD,CAAC;IAC7E,GAAG,CAAC,YAAY,EAAE,uCAAuC,CAAC;IAC1D,GAAG,CAAC,YAAY,EAAE,uCAAuC,CAAC;IAC1D,GAAG,CAAC,YAAY,EAAE,2CAA2C,CAAC;IAC9D,GAAG,CAAC,YAAY,EAAE,oDAAoD,CAAC;IACvE,GAAG,CAAC,YAAY,EAAE,oEAAoE,CAAC;IACvF,GAAG,CAAC,aAAa,EAAE,wDAAwD,CAAC;IAC5E,GAAG,CAAC,WAAW,EAAE,yCAAyC,CAAC;IAC3D,GAAG,CAAC,WAAW,EAAE,wDAAwD,CAAC;IAC1E,GAAG,CAAC,aAAa,EAAE,8DAA8D,CAAC;IAClF,GAAG,CAAC,YAAY,EAAE,gDAAgD,CAAC;IACnE,GAAG,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC7E,GAAG,CAAC,aAAa,EAAE,sCAAsC,CAAC;IAC1D,GAAG,CAAC,aAAa,EAAE,8BAA8B,CAAC;IAClD,WAAW;IACX,GAAG,CAAC,aAAa,EAAE,4DAA4D,CAAC;IAChF,GAAG,CACD,aAAa,EACb,0FAA0F,CAC3F;IACD,GAAG,CACD,YAAY,EACZ,kFAAkF,CACnF;IACD,GAAG,CAAC,aAAa,EAAE,mDAAmD,CAAC;IACvE,qBAAqB;IACrB,GAAG,CAAC,aAAa,EAAE,mCAAmC,CAAC;IACvD,GAAG,CAAC,YAAY,EAAE,kDAAkD,CAAC;IACrE,GAAG,CACD,aAAa,EACb,sFAAsF,CACvF;IACD,GAAG,CAAC,aAAa,EAAE,oDAAoD,CAAC;IACxE,YAAY;IACZ,GAAG,CAAC,aAAa,EAAE,uEAAuE,CAAC;IAC3F,GAAG,CAAC,YAAY,EAAE,oEAAoE,CAAC;IACvF,GAAG,CAAC,aAAa,EAAE,2CAA2C,CAAC;IAC/D,GAAG,CAAC,aAAa,EAAE,sCAAsC,CAAC;IAC1D,aAAa;IACb,GAAG,CAAC,aAAa,EAAE,iDAAiD,CAAC;IACrE,GAAG,CAAC,aAAa,EAAE,iDAAiD,CAAC;IACrE,GAAG,CAAC,YAAY,EAAE,uCAAuC,CAAC;IAC1D,GAAG,CAAC,aAAa,EAAE,gDAAgD,CAAC;IACpE,GAAG,CAAC,aAAa,EAAE,+CAA+C,CAAC;IACnE,GAAG,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC7E,0CAA0C;IAC1C,GAAG,CAAC,YAAY,EAAE,8DAA8D,CAAC;IACjF,GAAG,CAAC,aAAa,EAAE,wDAAwD,CAAC;IAC5E,GAAG,CAAC,aAAa,EAAE,6DAA6D,CAAC;IACjF,GAAG,CAAC,aAAa,EAAE,2CAA2C,CAAC;IAC/D,GAAG,CAAC,aAAa,EAAE,4CAA4C,CAAC;IAChE,GAAG,CAAC,aAAa,EAAE,4CAA4C,CAAC;IAChE,GAAG,CAAC,aAAa,EAAE,qCAAqC,CAAC;IACzD,GAAG,CAAC,aAAa,EAAE,uCAAuC,CAAC;CAC5D,CAAA"}

package/dist/checkov-checks-azure.d.ts

@@ -0,0 +1,4 @@
+import type { CheckovCheck } from './checkov-check.js';
+/** The Azure checks enabled at error severity. */
+export declare const AZURE_CHECKS: readonly CheckovCheck[];
+//# sourceMappingURL=checkov-checks-azure.d.ts.map

package/dist/checkov-checks-azure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-azure.d.ts","sourceRoot":"","sources":["../src/checkov-checks-azure.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAItD,kDAAkD;AAClD,eAAO,MAAM,YAAY,EAAE,SAAS,YAAY,EA4B/C,CAAA"}

package/dist/checkov-checks-azure.js

@@ -0,0 +1,32 @@
+const azure = (id, reason) => ({ id, provider: 'azurerm', reason });
+/** The Azure checks enabled at error severity. */
+export const AZURE_CHECKS = [
+    // Identity and registries.
+    azure('CKV_AZURE_39', 'a custom role grants every action, which is an owner written by hand'),
+    azure('CKV_AZURE_137', 'the container registry exposes a shared administrator credential'),
+    azure('CKV_AZURE_138', 'the container registry serves images to unauthenticated pulls'),
+    azure('CKV2_AZURE_30', 'the registry webhook posts to a plain-HTTP endpoint'),
+    // Databases.
+    azure('CKV_AZURE_11', 'a database firewall rule admits every IP address'),
+    azure('CKV2_AZURE_26', 'the PostgreSQL server admits every Azure tenant, or every address'),
+    azure('CKV2_AZURE_34', 'the SQL server admits every Azure tenant'),
+    azure('CKV2_AZURE_25', 'the SQL database explicitly stores its content unencrypted'),
+    // Storage.
+    azure('CKV_AZURE_34', 'the blob container serves its blobs anonymously'),
+    // Network.
+    azure('CKV_AZURE_9', 'a network security rule admits RDP from the whole internet'),
+    azure('CKV_AZURE_10', 'a network security rule admits SSH from the whole internet'),
+    // Compute.
+    azure('CKV_AZURE_149', 'the Linux virtual machine or scale set accepts password logins'),
+    azure('CKV_AZURE_5', 'the Kubernetes cluster runs without role-based access control'),
+    azure('CKV_AZURE_143', 'the Kubernetes nodes carry public IP addresses'),
+    azure('CKV_AZURE_246', 'the retired, unauthenticated HTTP application routing add-on is on'),
+    // Web.
+    azure('CKV_AZURE_14', 'the web app serves plain HTTP, which is its default'),
+    azure('CKV_AZURE_153', 'a deployment slot serves plain HTTP, which is its default'),
+    azure('CKV_AZURE_70', 'the function app serves plain HTTP, which is its default'),
+    azure('CKV_AZURE_15', 'the web app accepts TLS 1.0 or 1.1'),
+    azure('CKV_AZURE_145', 'the function app accepts TLS 1.0 or 1.1'),
+    azure('CKV_AZURE_72', 'the app exposes its remote-debugging endpoint'),
+];
+//# sourceMappingURL=checkov-checks-azure.js.map

package/dist/checkov-checks-azure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-azure.js","sourceRoot":"","sources":["../src/checkov-checks-azure.ts"],"names":[],"mappings":"AA6BA,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;AAEjG,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAA4B;IACnD,2BAA2B;IAC3B,KAAK,CAAC,cAAc,EAAE,sEAAsE,CAAC;IAC7F,KAAK,CAAC,eAAe,EAAE,kEAAkE,CAAC;IAC1F,KAAK,CAAC,eAAe,EAAE,+DAA+D,CAAC;IACvF,KAAK,CAAC,eAAe,EAAE,qDAAqD,CAAC;IAC7E,aAAa;IACb,KAAK,CAAC,cAAc,EAAE,kDAAkD,CAAC;IACzE,KAAK,CAAC,eAAe,EAAE,mEAAmE,CAAC;IAC3F,KAAK,CAAC,eAAe,EAAE,0CAA0C,CAAC;IAClE,KAAK,CAAC,eAAe,EAAE,4DAA4D,CAAC;IACpF,WAAW;IACX,KAAK,CAAC,cAAc,EAAE,iDAAiD,CAAC;IACxE,WAAW;IACX,KAAK,CAAC,aAAa,EAAE,4DAA4D,CAAC;IAClF,KAAK,CAAC,cAAc,EAAE,4DAA4D,CAAC;IACnF,WAAW;IACX,KAAK,CAAC,eAAe,EAAE,gEAAgE,CAAC;IACxF,KAAK,CAAC,aAAa,EAAE,+DAA+D,CAAC;IACrF,KAAK,CAAC,eAAe,EAAE,gDAAgD,CAAC;IACxE,KAAK,CAAC,eAAe,EAAE,oEAAoE,CAAC;IAC5F,OAAO;IACP,KAAK,CAAC,cAAc,EAAE,qDAAqD,CAAC;IAC5E,KAAK,CAAC,eAAe,EAAE,2DAA2D,CAAC;IACnF,KAAK,CAAC,cAAc,EAAE,0DAA0D,CAAC;IACjF,KAAK,CAAC,cAAc,EAAE,oCAAoC,CAAC;IAC3D,KAAK,CAAC,eAAe,EAAE,yCAAyC,CAAC;IACjE,KAAK,CAAC,cAAc,EAAE,+CAA+C,CAAC;CACvE,CAAA"}

package/dist/checkov-checks-google.d.ts

@@ -0,0 +1,6 @@
+import type { CheckovCheck } from './checkov-check.js';
+/** The Google Cloud checks enabled at error severity. */
+export declare const GOOGLE_CHECKS: readonly CheckovCheck[];
+/** The DigitalOcean and Linode checks enabled at error severity: the pinned image ships ten in all. */
+export declare const SMALL_CLOUD_CHECKS: readonly CheckovCheck[];
+//# sourceMappingURL=checkov-checks-google.d.ts.map

package/dist/checkov-checks-google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-google.d.ts","sourceRoot":"","sources":["../src/checkov-checks-google.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAItD,yDAAyD;AACzD,eAAO,MAAM,aAAa,EAAE,SAAS,YAAY,EAmChD,CAAA;AAED,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,EAAE,SAAS,YAAY,EAYrD,CAAA"}

package/dist/checkov-checks-google.js

@@ -0,0 +1,53 @@
+const google = (id, reason) => ({ id, provider: 'google', reason });
+/** The Google Cloud checks enabled at error severity. */
+export const GOOGLE_CHECKS = [
+    // Identity and keys.
+    google('CKV_GCP_41', 'a principal may act as every service account in the project'),
+    google('CKV_GCP_31', 'the virtual machine runs as the default compute account with every API'),
+    google('CKV_GCP_112', 'the KMS key can be used by anybody'),
+    google('CKV2_GCP_8', 'the whole key ring can be used by anybody'),
+    // Databases and caches.
+    google('CKV_GCP_11', 'the Cloud SQL instance admits every address on the internet'),
+    google('CKV_GCP_95', 'the Redis instance accepts unauthenticated connections'),
+    // Storage.
+    google('CKV_GCP_28', 'the bucket is readable or writable by anybody'),
+    google('CKV_GCP_29', 'the bucket honours per-object ACLs, so one object can be made public'),
+    google('CKV_GCP_114', 'the bucket can be made public by any later grant'),
+    // Network.
+    google('CKV_GCP_2', 'a firewall admits SSH from the whole internet'),
+    google('CKV_GCP_3', 'a firewall admits RDP from the whole internet'),
+    google('CKV_GCP_88', 'a firewall admits MySQL from the whole internet'),
+    google('CKV_GCP_75', 'a firewall admits FTP control from the whole internet'),
+    google('CKV_GCP_77', 'a firewall admits FTP data from the whole internet'),
+    google('CKV2_GCP_12', 'a firewall admits every port and protocol from the whole internet'),
+    google('CKV_GCP_27', 'the project gets the default network and its allow-from-anywhere rules'),
+    // Compute.
+    google('CKV_GCP_7', 'the cluster honours legacy ABAC, which bypasses RBAC'),
+    google('CKV_GCP_18', "the control plane's authorised network list is the whole internet"),
+    google('CKV_GCP_34', 'the virtual machine opts out of OS Login'),
+    google('CKV_GCP_35', 'the virtual machine exposes an interactive serial console'),
+    google('CKV2_GCP_10', 'the HTTP-triggered function answers plaintext HTTP'),
+    // The edge.
+    google('CKV_GCP_4', 'the TLS policy admits TLS 1.0 or 1.1, or a non-forward-secret cipher suite'),
+    google('CKV_GCP_17', 'DNSSEC signs the zone with RSASHA1'),
+    // Other services a project may reach for.
+    google('CKV_GCP_99', 'the topic can be published to or read by anybody'),
+    google('CKV_GCP_100', 'the table can be read by anybody'),
+    google('CKV_GCP_101', 'the image repository can be pulled by anybody'),
+    google('CKV_GCP_98', 'the cluster can be driven by anybody'),
+];
+/** The DigitalOcean and Linode checks enabled at error severity: the pinned image ships ten in all. */
+export const SMALL_CLOUD_CHECKS = [
+    { id: 'CKV_DIO_3', provider: 'digitalocean', reason: 'the Spaces bucket is world-readable' },
+    {
+        id: 'CKV_LIN_1',
+        provider: 'linode',
+        reason: 'a Linode API token is written into the provider block',
+    },
+    {
+        id: 'CKV_LIN_5',
+        provider: 'linode',
+        reason: "the firewall's default inbound action is allow, so every port not listed is open",
+    },
+];
+//# sourceMappingURL=checkov-checks-google.js.map

package/dist/checkov-checks-google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-google.js","sourceRoot":"","sources":["../src/checkov-checks-google.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;AAEjG,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAA4B;IACpD,qBAAqB;IACrB,MAAM,CAAC,YAAY,EAAE,6DAA6D,CAAC;IACnF,MAAM,CAAC,YAAY,EAAE,wEAAwE,CAAC;IAC9F,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;IAC3D,MAAM,CAAC,YAAY,EAAE,2CAA2C,CAAC;IACjE,wBAAwB;IACxB,MAAM,CAAC,YAAY,EAAE,6DAA6D,CAAC;IACnF,MAAM,CAAC,YAAY,EAAE,wDAAwD,CAAC;IAC9E,WAAW;IACX,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;IACrE,MAAM,CAAC,YAAY,EAAE,sEAAsE,CAAC;IAC5F,MAAM,CAAC,aAAa,EAAE,kDAAkD,CAAC;IACzE,WAAW;IACX,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;IACpE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;IACpE,MAAM,CAAC,YAAY,EAAE,iDAAiD,CAAC;IACvE,MAAM,CAAC,YAAY,EAAE,uDAAuD,CAAC;IAC7E,MAAM,CAAC,YAAY,EAAE,oDAAoD,CAAC;IAC1E,MAAM,CAAC,aAAa,EAAE,mEAAmE,CAAC;IAC1F,MAAM,CAAC,YAAY,EAAE,wEAAwE,CAAC;IAC9F,WAAW;IACX,MAAM,CAAC,WAAW,EAAE,sDAAsD,CAAC;IAC3E,MAAM,CAAC,YAAY,EAAE,mEAAmE,CAAC;IACzF,MAAM,CAAC,YAAY,EAAE,0CAA0C,CAAC;IAChE,MAAM,CAAC,YAAY,EAAE,2DAA2D,CAAC;IACjF,MAAM,CAAC,aAAa,EAAE,oDAAoD,CAAC;IAC3E,YAAY;IACZ,MAAM,CAAC,WAAW,EAAE,4EAA4E,CAAC;IACjG,MAAM,CAAC,YAAY,EAAE,oCAAoC,CAAC;IAC1D,0CAA0C;IAC1C,MAAM,CAAC,YAAY,EAAE,kDAAkD,CAAC;IACxE,MAAM,CAAC,aAAa,EAAE,kCAAkC,CAAC;IACzD,MAAM,CAAC,aAAa,EAAE,+CAA+C,CAAC;IACtE,MAAM,CAAC,YAAY,EAAE,sCAAsC,CAAC;CAC7D,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAA4B;IACzD,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,qCAAqC,EAAE;IAC5F;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,uDAAuD;KAChE;IACD;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kFAAkF;KAC3F;CACF,CAAA"}

package/dist/checkov-policy.d.ts

@@ -0,0 +1,63 @@
+import type { CheckovCheck } from './checkov-check.js';
+/** The checks enabled at error severity, each confirmed present in the pinned image. */
+export declare const CHECKOV_CHECKS: readonly CheckovCheck[];
+/**
+ * The value of checkov's `--check` flag.
+ *
+ * Read from the catalogue rather than written out, so the list that runs and the list that carries the
+ * reasons cannot drift. An empty value would run EVERY check rather than none, which is why the spec
+ * beside this asserts the catalogue is not empty.
+ * @returns the enabled identifiers, comma separated.
+ */
+export declare const checkovCheckList: () => string;
+/**
+ * How many checks checkov reports as failed.
+ * @param output the analyzer's output for a scan that found at least one resource.
+ * @returns the tally, or undefined when the output carries none - which a caller treats as a run that
+ * did not complete rather than as a clean one.
+ */
+export declare const failedCheckCount: (output: string) => number | undefined;
+/**
+ * The checks that can apply to a set of providers.
+ * @param providers provider names as the resource types spell them.
+ * @returns every enabled check bound to one of them.
+ */
+export declare const checksFor: (providers: readonly string[]) => readonly CheckovCheck[];
+/**
+ * Why a provider has no enabled check. The summary says which, rather than claiming checks that could
+ * not have run: a `--check` id bound to no resource in the tree matches nothing and raises no error, so
+ * without this the analyzer exits 0 over a cloud it never looked at.
+ */
+export type ProviderStanding = 'utility' | 'unsupported' | 'audited';
+/**
+ * Every provider this harness knows to have no enabled check, and why. A provider on neither this map
+ * nor the catalogue is refused: the harness cannot tell whether the analyzer covers it and does not
+ * guess. The `unsupported` entries were confirmed absent from the pinned image with `--list`, and are
+ * re-confirmed when the pin moves.
+ */
+export declare const PROVIDERS_WITHOUT_CHECKS: ReadonlyMap<string, ProviderStanding>;
+/** The providers a tree declares, sorted into what the gate does about each. */
+export interface ProviderClassification {
+    /** At least one enabled check binds to it. */
+    readonly curated: readonly string[];
+    readonly utility: readonly string[];
+    readonly unsupported: readonly string[];
+    readonly audited: readonly string[];
+    /** On no list; the gate refuses to guess. */
+    readonly unclassified: readonly string[];
+}
+/**
+ * The providers at least one enabled check binds to.
+ *
+ * Derived from the catalogue rather than declared beside it, so a cloud cannot be listed as curated
+ * with nothing enabled for it.
+ * @returns the provider names.
+ */
+export declare const curatedProviders: () => ReadonlySet<string>;
+/**
+ * Sort the providers a tree declares by what the gate does about each.
+ * @param detected provider names, in any order and with any repetition.
+ * @returns each provider once, in its standing, ordered so a report reads the same on every machine.
+ */
+export declare const classifyProviders: (detected: readonly string[]) => ProviderClassification;
+//# sourceMappingURL=checkov-policy.d.ts.map

package/dist/checkov-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-policy.d.ts","sourceRoot":"","sources":["../src/checkov-policy.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAKtD,wFAAwF;AACxF,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAKjD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,QAAO,MACqC,CAAA;AAMzE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAG1D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,WAAW,SAAS,MAAM,EAAE,KAAG,SAAS,YAAY,EACe,CAAA;AAE7F;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAoCzE,CAAA;AAEF,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAO,WAAW,CAAC,MAAM,CACwB,CAAA;AAQ9E;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,SAAS,MAAM,EAAE,KAAG,sBAc/D,CAAA"}

package/dist/checkov-policy.js

@@ -0,0 +1,105 @@
+import { AWS_CHECKS } from './checkov-checks-aws.js';
+import { AZURE_CHECKS } from './checkov-checks-azure.js';
+import { GOOGLE_CHECKS, SMALL_CLOUD_CHECKS } from './checkov-checks-google.js';
+/** The checks enabled at error severity, each confirmed present in the pinned image. */
+export const CHECKOV_CHECKS = [
+    ...AWS_CHECKS,
+    ...AZURE_CHECKS,
+    ...GOOGLE_CHECKS,
+    ...SMALL_CLOUD_CHECKS,
+];
+/**
+ * The value of checkov's `--check` flag.
+ *
+ * Read from the catalogue rather than written out, so the list that runs and the list that carries the
+ * reasons cannot drift. An empty value would run EVERY check rather than none, which is why the spec
+ * beside this asserts the catalogue is not empty.
+ * @returns the enabled identifiers, comma separated.
+ */
+export const checkovCheckList = () => CHECKOV_CHECKS.map((check) => check.id).join(',');
+// The tally checkov prints after a scan. Its compact output spends several lines on each failed check
+// and a few on headers, so counting lines would report defects that are not there.
+const FAILED_CHECKS = /Failed checks: (?<count>\d+)/;
+/**
+ * How many checks checkov reports as failed.
+ * @param output the analyzer's output for a scan that found at least one resource.
+ * @returns the tally, or undefined when the output carries none - which a caller treats as a run that
+ * did not complete rather than as a clean one.
+ */
+export const failedCheckCount = (output) => {
+    const count = FAILED_CHECKS.exec(output)?.groups?.['count'];
+    return count === undefined ? undefined : Number(count);
+};
+/**
+ * The checks that can apply to a set of providers.
+ * @param providers provider names as the resource types spell them.
+ * @returns every enabled check bound to one of them.
+ */
+export const checksFor = (providers) => CHECKOV_CHECKS.filter((check) => providers.includes(check.provider));
+/**
+ * Every provider this harness knows to have no enabled check, and why. A provider on neither this map
+ * nor the catalogue is refused: the harness cannot tell whether the analyzer covers it and does not
+ * guess. The `unsupported` entries were confirmed absent from the pinned image with `--list`, and are
+ * re-confirmed when the pin moves.
+ */
+export const PROVIDERS_WITHOUT_CHECKS = new Map([
+    // Declares no cloud resource, so there is nothing for an analyzer to judge.
+    ['random', 'utility'],
+    ['null', 'utility'],
+    ['local', 'utility'],
+    ['tls', 'utility'],
+    ['time', 'utility'],
+    ['archive', 'utility'],
+    ['external', 'utility'],
+    ['http', 'utility'],
+    ['template', 'utility'],
+    ['cloudinit', 'utility'],
+    ['terraform', 'utility'],
+    // The pinned image ships no check for these. A project on one of them is judged by the pattern
+    // rules alone, and the summary says so.
+    ['hcloud', 'unsupported'],
+    ['cloudflare', 'unsupported'],
+    ['vercel', 'unsupported'],
+    ['fly', 'unsupported'],
+    ['render', 'unsupported'],
+    ['scaleway', 'unsupported'],
+    ['ovh', 'unsupported'],
+    ['vultr', 'unsupported'],
+    ['upcloud', 'unsupported'],
+    ['exoscale', 'unsupported'],
+    ['mongodbatlas', 'unsupported'],
+    ['neon', 'unsupported'],
+    ['helm', 'unsupported'],
+    // Azure's sibling providers. `azapi` binds no check at all. `azuread` binds exactly one,
+    // `CKV_AZURE_249`, whose regular expression over an OIDC subject rejects a value that arrives through
+    // a variable - so it failed the rubric, and nothing is enabled for the provider.
+    ['azapi', 'unsupported'],
+    ['azuread', 'audited'],
+]);
+/**
+ * The providers at least one enabled check binds to.
+ *
+ * Derived from the catalogue rather than declared beside it, so a cloud cannot be listed as curated
+ * with nothing enabled for it.
+ * @returns the provider names.
+ */
+export const curatedProviders = () => new Set(CHECKOV_CHECKS.map((check) => check.provider));
+const standingOf = (provider, curated) => curated.has(provider) ? 'curated' : (PROVIDERS_WITHOUT_CHECKS.get(provider) ?? 'unclassified');
+/**
+ * Sort the providers a tree declares by what the gate does about each.
+ * @param detected provider names, in any order and with any repetition.
+ * @returns each provider once, in its standing, ordered so a report reads the same on every machine.
+ */
+export const classifyProviders = (detected) => {
+    const curated = curatedProviders();
+    const unique = [...new Set(detected)].toSorted((left, right) => left.localeCompare(right));
+    const standing = (wanted) => unique.filter((provider) => standingOf(provider, curated) === wanted);
+    return {
+        curated: standing('curated'),
+        utility: standing('utility'),
+        unsupported: standing('unsupported'),
+        audited: standing('audited'),
+        unclassified: standing('unclassified'),
+    };
+};
+//# sourceMappingURL=checkov-policy.js.map

package/dist/checkov-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-policy.js","sourceRoot":"","sources":["../src/checkov-policy.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAE9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAA4B;IACrD,GAAG,UAAU;IACb,GAAG,YAAY;IACf,GAAG,aAAa;IAChB,GAAG,kBAAkB;CACtB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE,CAC3C,cAAc,CAAC,GAAG,CAAC,CAAC,KAAmB,EAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAEzE,sGAAsG;AACtG,mFAAmF;AACnF,MAAM,aAAa,GAAW,8BAA8B,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAsB,EAAE;IACrE,MAAM,KAAK,GAAuB,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAA;IAC/E,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxD,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,SAA4B,EAA2B,EAAE,CACjF,cAAc,CAAC,MAAM,CAAC,CAAC,KAAmB,EAAW,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;AAS7F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA0C,IAAI,GAAG,CAGpF;IACA,4EAA4E;IAC5E,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,CAAC,OAAO,EAAE,SAAS,CAAC;IACpB,CAAC,KAAK,EAAE,SAAS,CAAC;IAClB,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,UAAU,EAAE,SAAS,CAAC;IACvB,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,CAAC,UAAU,EAAE,SAAS,CAAC;IACvB,CAAC,WAAW,EAAE,SAAS,CAAC;IACxB,CAAC,WAAW,EAAE,SAAS,CAAC;IACxB,+FAA+F;IAC/F,wCAAwC;IACxC,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzB,CAAC,YAAY,EAAE,aAAa,CAAC;IAC7B,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzB,CAAC,KAAK,EAAE,aAAa,CAAC;IACtB,CAAC,QAAQ,EAAE,aAAa,CAAC;IACzB,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3B,CAAC,KAAK,EAAE,aAAa,CAAC;IACtB,CAAC,OAAO,EAAE,aAAa,CAAC;IACxB,CAAC,SAAS,EAAE,aAAa,CAAC;IAC1B,CAAC,UAAU,EAAE,aAAa,CAAC;IAC3B,CAAC,cAAc,EAAE,aAAa,CAAC;IAC/B,CAAC,MAAM,EAAE,aAAa,CAAC;IACvB,CAAC,MAAM,EAAE,aAAa,CAAC;IACvB,yFAAyF;IACzF,sGAAsG;IACtG,iFAAiF;IACjF,CAAC,OAAO,EAAE,aAAa,CAAC;IACxB,CAAC,SAAS,EAAE,SAAS,CAAC;CACvB,CAAC,CAAA;AAaF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAwB,EAAE,CACxD,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,KAAmB,EAAU,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;AAE9E,MAAM,UAAU,GAAG,CACjB,QAAgB,EAChB,OAA4B,EACE,EAAE,CAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,CAAA;AAEhG;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAA2B,EAA0B,EAAE;IACvF,MAAM,OAAO,GAAwB,gBAAgB,EAAE,CAAA;IACvD,MAAM,MAAM,GAAsB,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAC/D,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CACnE,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,MAAoC,EAAqB,EAAE,CAC3E,MAAM,CAAC,MAAM,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAA;IACxF,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC5B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC5B,WAAW,EAAE,QAAQ,CAAC,aAAa,CAAC;QACpC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC;QAC5B,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC;KACvC,CAAA;AACH,CAAC,CAAA"}

package/dist/environment-coherence.d.ts

@@ -1,5 +1,5 @@
 /** Where a variable was declared, for a message that names the two places rather than one. */
-export type EnvironmentOrigin = 'application' | 'compose';
+export type EnvironmentOrigin = 'application' | 'compose' | 'dockerfile';
 /** An environment variable declared in one place and absent from another it has to reach. */
 export interface EnvironmentViolation {
     readonly name: string;
@@ -11,6 +11,18 @@ export interface WorkflowFile {
     readonly file: string;
     readonly content: string;
 }
+/** A Dockerfile, as the rule needs it: what to call it in a finding, and what it declares. */
+export interface DockerfileSource {
+    readonly file: string;
+    readonly content: string;
+}
+/** One member's image build: the files whose reads it inlines, and the Dockerfiles that build it. */
+export interface ImageBuild {
+    /** Contents of the validated module and the framework configuration, where the member has them. */
+    readonly sources: readonly string[];
+    /** Every Dockerfile that builds this member. Empty when the member ships no image. */
+    readonly dockerfiles: readonly DockerfileSource[];
+}
 /** Inputs for {@link findEnvironmentViolations}, already read so the core stays pure. */
 export interface EnvironmentInputs {
     /** The contents of every validated environment module the repository holds, one per member. */
@@ -21,6 +33,8 @@ export interface EnvironmentInputs {
     readonly composeSources: readonly string[];
     /** Every workflow the repository ships. Only the verifying ones are judged. */
     readonly workflows: readonly WorkflowFile[];
+    /** One entry per member: what its build inlines, and the images that must declare it. */
+    readonly builds: readonly ImageBuild[];
 }
 /**
  * The module a Payload project reads `process.env` in, which is the only module ploaness exempts from
@@ -43,6 +57,15 @@ export declare const ENVIRONMENT_READ_EXEMPTIONS: readonly string[];
  * `.env.sample` has documented its variables just as well as one using `.env.example`.
  */
 export declare const ENVIRONMENT_EXAMPLE_FILES: readonly string[];
+/**
+ * The framework configuration a member may hold at its own root.
+ *
+ * It is evaluated during the image build, so a variable it reads is one the build has to be given - and
+ * it sits outside `sourceRoots`, which is why the `process.env` ban never reached it and why this rule
+ * has to. Every spelling present is read, unlike the example files above, because a project ships one
+ * and reading all of them cannot produce two answers that disagree.
+ */
+export declare const BUILD_CONFIGURATION_FILES: readonly string[];
 /**
  * The variables an application reads out of its validated environment module.
  * @param source the contents of that module.
@@ -61,6 +84,22 @@ export declare const documentedEnvironmentNames: (example: string) => readonly s
  * @returns each name once, sorted.
  */
 export declare const interpolatedEnvironmentNames: (compose: string) => readonly string[];
+/**
+ * The variables a file's reads inline into the image at build time.
+ * @param source the contents of a validated environment module or a framework configuration.
+ * @returns each name once, sorted.
+ */
+export declare const inlinedEnvironmentNames: (source: string) => readonly string[];
+/**
+ * The build arguments a Dockerfile declares, in every stage and under either spelling.
+ *
+ * Every stage, because `ARG` scope is per stage and which stage runs the build is not a fact this text
+ * can establish. Reading the file as one namespace can only ACCEPT a declaration that sits in the wrong
+ * stage; resolving stages by guessing which `RUN` is the build would REJECT correct files.
+ * @param dockerfile the Dockerfile body.
+ * @returns each name once, sorted.
+ */
+export declare const declaredBuildArguments: (dockerfile: string) => readonly string[];
 /**
  * The variables a workflow supplies, by any means and at any nesting depth.
  * @param workflow the contents of the workflow file.
@@ -73,15 +112,30 @@ export declare const workflowSuppliedNames: (workflow: string) => readonly strin
  * @returns true when the workflow invokes verification or a single gate.
  */
 export declare const isVerifyingWorkflow: (workflow: string) => boolean;
+/**
+ * The Dockerfiles that build one member: those inside its own directory, and - for the member at the
+ * repository root - those no other member owns.
+ * @param memberPath the member's repo-relative path, `.` at the repository root.
+ * @param everyMemberPath every governed member's path.
+ * @param dockerfiles every Dockerfile the repository tracks.
+ * @returns the Dockerfiles that build this member, in the order given.
+ */
+export declare const dockerfilesBuilding: (memberPath: string, everyMemberPath: readonly string[], dockerfiles: readonly DockerfileSource[]) => readonly DockerfileSource[];
 /**
  * Every environment variable declared in one place and absent from another it has to reach.
  *
- * Three containments, each one-directional. What the application reads must be documented. What a
+ * Four containments, each one-directional. What the application reads must be documented. What a
  * compose file interpolates must be documented, because `docker compose config` reads the example file
- * a developer copied. And what a compose file interpolates must be supplied by every workflow that
- * verifies, because a workflow has no copied file to interpolate from.
+ * a developer copied. What a compose file interpolates must be supplied by every workflow that
+ * verifies, because a workflow has no copied file to interpolate from. And what a build inlines must be
+ * declared as an `ARG`, because docker discards a `--build-arg` the Dockerfile never named and warns
+ * rather than failing - so the value is absent from the image and nothing says so.
+ *
+ * The inlined names feed the Dockerfile containment ALONE. Joining them to the example-file rule would
+ * report a member that documents its public variables in its own example file rather than the
+ * repository's, which is where they belong and where this reader does not look.
  * @param inputs the files, already read.
- * @returns the violations, sorted by name within each rule. An empty array means the four places agree.
+ * @returns the violations, sorted by name within each rule. An empty array means the five places agree.
  */
 export declare const findEnvironmentViolations: (inputs: EnvironmentInputs) => readonly EnvironmentViolation[];
 //# sourceMappingURL=environment-coherence.d.ts.map

package/dist/environment-coherence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment-coherence.d.ts","sourceRoot":"","sources":["../src/environment-coherence.ts"],"names":[],"mappings":"AAEA,8FAA8F;AAC9F,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,SAAS,CAAA;AAEzD,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAA;CAC5C;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAiC,CAAA;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAGxD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAItD,CAAA;AA4CD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,MAAM,EAChB,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,MAAM,KAAG,SAAS,MAAM,EAClB,CAAA;AAE1D;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,MAAM,KAAG,SAAS,MAAM,EACjB,CAAA;AAE7D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,SAAS,MAAM,EAIpE,CAAA;AAEJ;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,MAAM,KAAG,OAC4B,CAAA;AA+BnF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GACpC,QAAQ,iBAAiB,KACxB,SAAS,oBAAoB,EAkC/B,CAAA"}
+{"version":3,"file":"environment-coherence.d.ts","sourceRoot":"","sources":["../src/environment-coherence.ts"],"names":[],"mappings":"AAIA,8FAA8F;AAC9F,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,CAAA;AAExE,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,8FAA8F;AAC9F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,qGAAqG;AACrG,MAAM,WAAW,UAAU;IACzB,mGAAmG;IACnG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAClD;AAED,yFAAyF;AACzF,MAAM,WAAW,iBAAiB;IAChC,+FAA+F;IAC/F,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,SAAS,YAAY,EAAE,CAAA;IAC3C,yFAAyF;IACzF,QAAQ,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,CAAA;CACvC;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAiC,CAAA;AAE5E;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAGxD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAItD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAItD,CAAA;AAgED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,MAAM,EAChB,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,MAAM,KAAG,SAAS,MAAM,EAClB,CAAA;AAE1D;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,MAAM,KAAG,SAAS,MAAM,EACjB,CAAA;AAE7D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,MAAM,EAIpE,CAAA;AAQJ;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,YAAY,MAAM,KAAG,SAAS,MAAM,EAMxE,CAAA;AAEH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,KAAG,SAAS,MAAM,EAIpE,CAAA;AAEJ;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,MAAM,KAAG,OAC4B,CAAA;AAcnF;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAC9B,YAAY,MAAM,EAClB,iBAAiB,SAAS,MAAM,EAAE,EAClC,aAAa,SAAS,gBAAgB,EAAE,KACvC,SAAS,gBAAgB,EAIzB,CAAA;AA6DH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,GACpC,QAAQ,iBAAiB,KACxB,SAAS,oBAAoB,EAqC/B,CAAA"}