@skaleagents/swarm 0.6.1 → 0.6.3

package/dist/iac/parse.d.ts

@@ -1,4 +1,4 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes";
+export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi";
 export type Path = (string | number)[];
 export type Location = {
     line: number;
@@ -22,4 +22,5 @@ export declare class ScanInputError extends Error {
 export declare function object(value: unknown): Record<string, unknown>;
 export declare function array(value: unknown): unknown[];
 export declare function looksLikeIac(content: string): boolean;
+export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;

package/dist/iac/parse.js

@@ -37,11 +37,20 @@ export function looksLikeIac(content) {
     }
     return (/^\s*(?:resource|module|terraform|variable|provider)\s+["{]/m.test(content) ||
         /^\s*(?:["']?Resources["']?\s*:|apiVersion\s*:)/m.test(content) ||
-        /^\s*\{\s*"(?:resource|Resources|apiVersion|AWSTemplateFormatVersion)"\s*:/.test(content));
+        /^\s*\{\s*"(?:resource|Resources|apiVersion|AWSTemplateFormatVersion)"\s*:/.test(content) ||
+        looksLikePulumiYaml(content));
+}
+export function looksLikePulumiYaml(content) {
+    return (/^\s*resources\s*:/m.test(content) &&
+        /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
 }
 export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
+    if (requested !== "terraform" &&
+        /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content)) {
+        throw new ScanInputError("Pulumi TypeScript, Python, and Go programs are not parsed yet. Submit Pulumi YAML.");
+    }
     const warnings = [];
     const resources = [];
     const isHcl = (requested === "terraform" && !content.trimStart().startsWith("{")) ||
@@ -142,13 +151,22 @@ export function parseIac(content, requested = "auto") {
             continue;
         checkShape(data);
         const root = object(data);
-        const detected = root.Resources
-            ? "cloudformation"
-            : root.apiVersion && root.kind
-                ? "kubernetes"
-                : root.resource
-                    ? "terraform"
-                    : undefined;
+        const pulumiResources = pulumiResourceMap(root);
+        let detected;
+        if (requested === "pulumi" || (requested === "auto" && pulumiResources)) {
+            if (!pulumiResources)
+                throw new ScanInputError("Pulumi YAML requires a resources mapping. Each resource needs a type token. Pulumi TypeScript, Python, and Go programs are not parsed yet.");
+            detected = "pulumi";
+        }
+        else {
+            detected = root.Resources
+                ? "cloudformation"
+                : root.apiVersion && root.kind
+                    ? "kubernetes"
+                    : root.resource
+                        ? "terraform"
+                        : undefined;
+        }
         format ??= detected;
         if (!format || (detected && detected !== format))
             throw new ScanInputError("Input format is unsupported or mixed. Submit one IaC format per scan.");
@@ -170,7 +188,13 @@ export function parseIac(content, requested = "auto") {
                 },
             });
         };
-        if (format === "cloudformation") {
+        if (format === "pulumi") {
+            for (const [name, raw] of Object.entries(pulumiResources ?? {})) {
+                const value = object(raw);
+                add(name, String(value.type), value, ["resources", name]);
+            }
+        }
+        else if (format === "cloudformation") {
             if (!root.Resources ||
                 Array.isArray(root.Resources) ||
                 typeof root.Resources !== "object")
@@ -227,13 +251,24 @@ export function parseIac(content, requested = "auto") {
         }
     }
     if (!format)
-        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, or Kubernetes.");
+        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, or Pulumi YAML.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
     if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
         warnings.push("Intrinsic functions and expressions are not evaluated. Only literal configuration is checked.");
     return { format, resources, warnings };
 }
+function pulumiResourceMap(root) {
+    const resources = object(root.resources);
+    const entries = Object.entries(resources);
+    if (entries.length > 0 &&
+        entries.every(([, raw]) => {
+            const type = object(raw).type;
+            return typeof type === "string" && type.includes(":");
+        }))
+        return resources;
+    return undefined;
+}
 function escapeRegex(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }

package/dist/iac/rules.js

@@ -242,15 +242,23 @@ function walk(value, visit, path = []) {
 }
 function checkCloud(resource, resources, format, check) {
     const tf = format === "terraform";
-    const value = tf ? resource.value : object(resource.value.Properties);
-    const prefix = tf ? [] : ["Properties"];
-    const property = (hcl, cfn) => value[tf ? hcl : cfn];
-    const path = (hcl, cfn) => [...prefix, tf ? hcl : cfn];
+    const pulumi = format === "pulumi";
+    const value = tf
+        ? resource.value
+        : pulumi
+            ? object(resource.value.properties)
+            : object(resource.value.Properties);
+    const prefix = tf ? [] : pulumi ? ["properties"] : ["Properties"];
+    const property = (hcl, cfn) => value[tf || pulumi ? hcl : cfn];
+    const path = (hcl, cfn) => [
+        ...prefix,
+        tf || pulumi ? hcl : cfn,
+    ];
     walk(value, (key, child, at, parent) => {
         const isIngress = !at.some((part) => /^(?:egress|SecurityGroupEgress)$/i.test(String(part))) &&
             !/egress/i.test(resource.type) &&
             value.type !== "egress";
-        if (/^(?:cidr_blocks|ipv6_cidr_blocks|cidr_ipv4|cidr_ipv6|CidrIp|CidrIpv6)$/.test(key) &&
+        if (/^(?:cidr_blocks|ipv6_cidr_blocks|cidr_ipv4|cidr_ipv6|cidrBlocks|ipv6CidrBlocks|cidrBlock|CidrIp|CidrIpv6)$/.test(key) &&
             isIngress) {
             check("NET001", array(child).some((cidr) => cidr === "0.0.0.0/0" || cidr === "::/0"), [...prefix, ...at]);
         }

package/dist/server.js

@@ -71,12 +71,13 @@ export function createServer(remote = false) {
                 "terraform",
                 "cloudformation",
                 "kubernetes",
+                "pulumi",
                 "application",
                 "auto",
             ])
                 .optional()
                 .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, application, auto"),
+                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, application, auto"),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         const botHints = fetchPublicBotHints();
@@ -123,7 +124,7 @@ export function createServer(remote = false) {
             description: (name === "scan_iac_stub"
                 ? "Compatibility alias for scan_iac; runs the full scanner. "
                 : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, or Kubernetes manifests. Check security, reliability and cost rules with resource locations and remediation.",
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, or Pulumi YAML. Check security, reliability and cost rules with resource locations and remediation. Pulumi TypeScript, Python, and Go programs are not parsed yet.",
             annotations: {
                 readOnlyHint: true,
                 destructiveHint: false,
@@ -131,9 +132,9 @@ export function createServer(remote = false) {
             },
             _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
             inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, or Kubernetes YAML/JSON"),
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, or Pulumi YAML"),
                 format: z
-                    .enum(["terraform", "cloudformation", "kubernetes", "auto"])
+                    .enum(["terraform", "cloudformation", "kubernetes", "pulumi", "auto"])
                     .default("auto"),
                 ...filters,
             },

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.1";
+export declare const VERSION = "0.6.3";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.1";
+export const VERSION = "0.6.3";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "private": false,
   "publishConfig": {
     "access": "public"