@veltrixsecops/app-sdk 3.2.0 → 3.5.1

package/dist/opentofu/index.cjs

@@ -0,0 +1,138 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/opentofu/index.ts
+var opentofu_exports = {};
+__export(opentofu_exports, {
+  FOUNDATION_KINDS: () => FOUNDATION_KINDS,
+  renderInfraVars: () => renderInfraVars,
+  validateInfraSpec: () => validateInfraSpec
+});
+module.exports = __toCommonJS(opentofu_exports);
+
+// src/opentofu/spec.ts
+var FOUNDATION_KINDS = [
+  "network",
+  "storage",
+  "secrets",
+  "tls",
+  "load-balancer",
+  "dns",
+  "license-file",
+  "hec"
+];
+
+// src/opentofu/render.ts
+function renderInfraVars(spec) {
+  const security_rules = (spec.securityRules ?? []).map((r) => ({
+    port: r.port,
+    protocol: r.protocol ?? "tcp",
+    sources: [...r.sources],
+    description: r.description ?? ""
+  }));
+  const load_balancer = spec.loadBalancer ? {
+    target_port: spec.loadBalancer.targetPort,
+    target_protocol: spec.loadBalancer.targetProtocol ?? "HTTP",
+    health_check_path: spec.loadBalancer.healthCheckPath,
+    health_check_matcher: spec.loadBalancer.healthCheckMatcher ?? "200-399",
+    health_check_protocol: spec.loadBalancer.healthCheckProtocol ?? "",
+    target_kinds: [...spec.loadBalancer.targetKinds],
+    listener_port: spec.loadBalancer.listenerPort ?? 443
+  } : null;
+  const waf_enabled = spec.waf ?? Boolean(spec.loadBalancer);
+  const alb_auth = {
+    enabled: spec.albAuth?.enabled ?? false,
+    user_pool_arn: spec.albAuth?.userPoolArn ?? "",
+    user_pool_client_id: spec.albAuth?.userPoolClientId ?? "",
+    user_pool_domain: spec.albAuth?.userPoolDomain ?? ""
+  };
+  return {
+    compute_kinds: spec.computeKinds ? [...spec.computeKinds] : [],
+    security_rules,
+    load_balancer,
+    dns_prefixes: { ...spec.dnsPrefixes },
+    waf_enabled,
+    alb_auth
+  };
+}
+
+// src/opentofu/validate.ts
+function validateInfraSpec(spec) {
+  const errors = [];
+  if (!Array.isArray(spec.securityRules) || spec.securityRules.length === 0) {
+    errors.push("securityRules must contain at least one rule.");
+  }
+  const validSources = /* @__PURE__ */ new Set(["self", "alb", "admin"]);
+  const usesAlbSource = (spec.securityRules ?? []).some(
+    (r) => (r.sources ?? []).includes("alb")
+  );
+  for (const r of spec.securityRules ?? []) {
+    if (typeof r.port !== "number" || r.port < 1 || r.port > 65535) {
+      errors.push(`securityRules: invalid port ${JSON.stringify(r.port)}.`);
+    }
+    if (!Array.isArray(r.sources) || r.sources.length === 0) {
+      errors.push(`securityRules[port ${r.port}]: sources must be non-empty.`);
+    }
+    for (const s of r.sources ?? []) {
+      if (!validSources.has(s)) {
+        errors.push(`securityRules[port ${r.port}]: unknown source "${s}" (expected self|alb|admin).`);
+      }
+    }
+  }
+  if (usesAlbSource && !spec.loadBalancer) {
+    errors.push('a securityRules entry uses source "alb" but no loadBalancer is declared.');
+  }
+  if (spec.loadBalancer) {
+    const lb = spec.loadBalancer;
+    if (typeof lb.targetPort !== "number") {
+      errors.push("loadBalancer.targetPort is required.");
+    }
+    if (!lb.healthCheckPath || !lb.healthCheckPath.startsWith("/")) {
+      errors.push('loadBalancer.healthCheckPath must be an absolute path (start with "/").');
+    }
+    if (!Array.isArray(lb.targetKinds) || lb.targetKinds.length === 0) {
+      errors.push("loadBalancer.targetKinds must name at least one compute kind.");
+    }
+    const targetPortOpen = (spec.securityRules ?? []).some(
+      (r) => r.port === lb.targetPort && (r.sources ?? []).includes("alb")
+    );
+    if (!targetPortOpen) {
+      errors.push(
+        `loadBalancer.targetPort ${lb.targetPort} is not opened to source "alb" in securityRules \u2014 the ALB can't reach the web tier.`
+      );
+    }
+  }
+  if (spec.albAuth?.enabled) {
+    const a = spec.albAuth;
+    if (!a.userPoolArn || !a.userPoolClientId || !a.userPoolDomain) {
+      errors.push("albAuth.enabled requires userPoolArn, userPoolClientId and userPoolDomain.");
+    }
+    if (!spec.loadBalancer) {
+      errors.push("albAuth is set but there is no loadBalancer to attach it to.");
+    }
+  }
+  return errors;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  FOUNDATION_KINDS,
+  renderInfraVars,
+  validateInfraSpec
+});
+//# sourceMappingURL=index.cjs.map

package/dist/opentofu/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/opentofu/index.ts","../../src/opentofu/spec.ts","../../src/opentofu/render.ts","../../src/opentofu/validate.ts"],"sourcesContent":["// =============================================================================\n// @veltrixsecops/app-sdk/opentofu\n//\n// Declarative, tool-agnostic infrastructure for BYOI apps. An app ships an\n// InfraSpec (apps/<app>/infra/spec.ts); the SDK renders it into the generic\n// OpenTofu module's tfvars (sdk/opentofu/modules/<cloud>); the platform worker\n// applies it and runs the app's bring-up. No per-tool HCL, ever.\n// =============================================================================\n\nexport type {\n  InfraSpec,\n  SecurityRule,\n  SecuritySource,\n  LoadBalancerSpec,\n  StorageSpec,\n  AlbAuthSpec,\n  FoundationKind,\n} from './spec';\nexport { FOUNDATION_KINDS } from './spec';\n\nexport type {\n  AwsInfraVars,\n  AwsLoadBalancerVars,\n  AwsSecurityRuleVars,\n  AwsAlbAuthVars,\n} from './render';\nexport { renderInfraVars } from './render';\n\nexport { validateInfraSpec } from './validate';\n","// =============================================================================\n// InfraSpec — the declarative, tool-agnostic infrastructure contract.\n//\n// An app ships one of these in `apps/<app>/infra/spec.ts`. The SDK renders it\n// into the generic OpenTofu module's tfvars (see ./render). NOTHING in the\n// module is tool-specific: an app supplies all of its shape (roles, ports,\n// front-door, DNS, bring-up) as DATA here, so the same modules provision Splunk,\n// Security Onion, or any other BYOI tool without a line of per-tool HCL.\n//\n// Pairs with sdk/opentofu/modules/<cloud> (the generic HCL) and the platform\n// render+apply worker, which invokes the app's `bringup` entrypoint after apply.\n// =============================================================================\n\n/** Where a security-group ingress rule may allow traffic from. */\nexport type SecuritySource =\n  | 'self' // peer nodes in this stack (the node SG referencing itself)\n  | 'alb' // the public ALB security group (only valid when loadBalancer is set)\n  | 'admin'; // the Veltrix control-plane / admin CIDR (var.admin_cidr)\n\n/** One security-group ingress rule: a port and who may reach it. */\nexport interface SecurityRule {\n  /** Destination port to open on the compute nodes. */\n  port: number;\n  /** IP protocol. Default 'tcp'. */\n  protocol?: 'tcp' | 'udp';\n  /** Origins allowed to reach `port`. At least one. */\n  sources: SecuritySource[];\n  /** Human-readable description (surfaced on the rule). */\n  description?: string;\n}\n\n/** Front-door ALB spec. Omit entirely for forwarder-only / headless tools. */\nexport interface LoadBalancerSpec {\n  /** Port the tool's web UI listens on behind the ALB (e.g. Splunk Web 8000). */\n  targetPort: number;\n  /** ALB→instance protocol. Default 'HTTP' (TLS terminates at the ALB). */\n  targetProtocol?: 'HTTP' | 'HTTPS';\n  /** Health-check path on the target (e.g. '/en-US/account/login'). */\n  healthCheckPath: string;\n  /** Health-check success matcher. Default '200-399'. */\n  healthCheckMatcher?: string;\n  /** Health-check protocol. Default = targetProtocol. */\n  healthCheckProtocol?: 'HTTP' | 'HTTPS';\n  /** Compute kinds that sit behind the ALB (e.g. ['search-head','standalone']). */\n  targetKinds: string[];\n  /** Public HTTPS listener port. Default 443. */\n  listenerPort?: number;\n}\n\n/** An object-storage bucket the tool needs (e.g. Splunk SmartStore, frozen). */\nexport interface StorageSpec {\n  /** Logical suffix for the bucket name (e.g. 'smartstore'). */\n  name: string;\n}\n\n/** Optional Cognito/OIDC MFA enforced at the ALB, in front of the tool's UI. */\nexport interface AlbAuthSpec {\n  enabled: boolean;\n  userPoolArn?: string;\n  userPoolClientId?: string;\n  userPoolDomain?: string;\n}\n\n/**\n * The complete declarative infra spec for one app. Everything tool-shaped is a\n * value here; the generic module reads these via tfvars.\n */\nexport interface InfraSpec {\n  /**\n   * Explicit compute kinds. When omitted, ANY plan item whose `kind` is not a\n   * generic FOUNDATION kind (see FOUNDATION_KINDS) is treated as compute — so an\n   * app's roles become compute automatically without listing them here.\n   */\n  computeKinds?: string[];\n\n  /** SG ingress rules: the tool's ports and who may reach each. */\n  securityRules: SecurityRule[];\n\n  /** ALB front-door. Omit for tools with no web UI. */\n  loadBalancer?: LoadBalancerSpec;\n\n  /**\n   * kind → DNS label prefix for per-node function FQDNs\n   * (e.g. { indexer: 'idx', 'search-head': 'sh', 'cluster-manager': 'mgmt' }).\n   * A kind absent from the map falls back to the kind string itself.\n   */\n  dnsPrefixes: Record<string, string>;\n\n  /** Object-storage buckets to create. Omit if the tool needs none. */\n  storage?: StorageSpec[];\n\n  /**\n   * Attach a WAFv2 web ACL (AWS-managed rule sets + IP rate limit) to the ALB.\n   * Defaults to true when `loadBalancer` is set; ignored otherwise.\n   */\n  waf?: boolean;\n\n  /** Optional ALB Cognito MFA. */\n  albAuth?: AlbAuthSpec;\n\n  /**\n   * Path, relative to the app's `infra/` dir, to the bring-up entrypoint the\n   * generic worker runs after `tofu apply` succeeds (config management +\n   * readiness gate). ALL tool-specific configuration lives behind this — e.g.\n   * './bringup/ansible/site.yml' for Splunk. Omit for tools that are ready at\n   * boot (no post-provision configuration).\n   */\n  bringup?: string;\n}\n\n/**\n * Generic foundation kinds the module realizes as shared infra (not compute).\n * Any plan `kind` NOT in this set is compute. Kept in sync with the module's\n * `var.foundation_kinds` default.\n */\nexport const FOUNDATION_KINDS = [\n  'network',\n  'storage',\n  'secrets',\n  'tls',\n  'load-balancer',\n  'dns',\n  'license-file',\n  'hec',\n] as const;\n\nexport type FoundationKind = (typeof FOUNDATION_KINDS)[number];\n","// =============================================================================\n// render — turn an app's declarative InfraSpec into the generic OpenTofu\n// module's variable values (tfvars).\n//\n// The platform render+apply worker builds the BASE vars (app_id, customer_id,\n// plan, subnet_cidr, tags, region, ...) from the DeployRequest, and merges these\n// SPEC-derived vars on top. Field names are snake_case to match the HCL module\n// variables 1:1. Defaults mirror the module's `optional(...)` defaults, applied\n// here so the emitted tfvars are explicit and self-describing.\n// =============================================================================\n\nimport type { InfraSpec } from './spec';\n\n/** ALB spec as the module expects it (snake_case). */\nexport interface AwsLoadBalancerVars {\n  target_port: number;\n  target_protocol: 'HTTP' | 'HTTPS';\n  health_check_path: string;\n  health_check_matcher: string;\n  health_check_protocol: string; // \"\" => module falls back to target_protocol\n  target_kinds: string[];\n  listener_port: number;\n}\n\n/** One rendered SG ingress rule (snake_case). */\nexport interface AwsSecurityRuleVars {\n  port: number;\n  protocol: 'tcp' | 'udp';\n  sources: string[];\n  description: string;\n}\n\n/** Cognito MFA vars (snake_case), always present so `var.alb_auth.enabled` resolves. */\nexport interface AwsAlbAuthVars {\n  enabled: boolean;\n  user_pool_arn: string;\n  user_pool_client_id: string;\n  user_pool_domain: string;\n}\n\n/** The spec-derived subset of the generic AWS module's variables. */\nexport interface AwsInfraVars {\n  compute_kinds: string[];\n  security_rules: AwsSecurityRuleVars[];\n  load_balancer: AwsLoadBalancerVars | null;\n  dns_prefixes: Record<string, string>;\n  waf_enabled: boolean;\n  alb_auth: AwsAlbAuthVars;\n}\n\n/**\n * Render the spec-derived tfvars for the generic AWS module. Pure and\n * deterministic — no I/O, no clock, no randomness.\n */\nexport function renderInfraVars(spec: InfraSpec): AwsInfraVars {\n  const security_rules: AwsSecurityRuleVars[] = (spec.securityRules ?? []).map((r) => ({\n    port: r.port,\n    protocol: r.protocol ?? 'tcp',\n    sources: [...r.sources],\n    description: r.description ?? '',\n  }));\n\n  const load_balancer: AwsLoadBalancerVars | null = spec.loadBalancer\n    ? {\n        target_port: spec.loadBalancer.targetPort,\n        target_protocol: spec.loadBalancer.targetProtocol ?? 'HTTP',\n        health_check_path: spec.loadBalancer.healthCheckPath,\n        health_check_matcher: spec.loadBalancer.healthCheckMatcher ?? '200-399',\n        health_check_protocol: spec.loadBalancer.healthCheckProtocol ?? '',\n        target_kinds: [...spec.loadBalancer.targetKinds],\n        listener_port: spec.loadBalancer.listenerPort ?? 443,\n      }\n    : null;\n\n  // WAF defaults ON when there is a load balancer, OFF otherwise (the module\n  // ignores it without an ALB, but keep the emitted value honest).\n  const waf_enabled = spec.waf ?? Boolean(spec.loadBalancer);\n\n  const alb_auth: AwsAlbAuthVars = {\n    enabled: spec.albAuth?.enabled ?? false,\n    user_pool_arn: spec.albAuth?.userPoolArn ?? '',\n    user_pool_client_id: spec.albAuth?.userPoolClientId ?? '',\n    user_pool_domain: spec.albAuth?.userPoolDomain ?? '',\n  };\n\n  return {\n    compute_kinds: spec.computeKinds ? [...spec.computeKinds] : [],\n    security_rules,\n    load_balancer,\n    dns_prefixes: { ...spec.dnsPrefixes },\n    waf_enabled,\n    alb_auth,\n  };\n}\n","// =============================================================================\n// validateInfraSpec — cheap, dependency-free checks that catch the InfraSpec\n// mistakes the OpenTofu module can't (or would only surface at apply time).\n// Returns a list of human-readable errors; empty === valid.\n// =============================================================================\n\nimport type { InfraSpec } from './spec';\n\nexport function validateInfraSpec(spec: InfraSpec): string[] {\n  const errors: string[] = [];\n\n  if (!Array.isArray(spec.securityRules) || spec.securityRules.length === 0) {\n    errors.push('securityRules must contain at least one rule.');\n  }\n\n  const validSources = new Set(['self', 'alb', 'admin']);\n  const usesAlbSource = (spec.securityRules ?? []).some((r) =>\n    (r.sources ?? []).includes('alb'),\n  );\n\n  for (const r of spec.securityRules ?? []) {\n    if (typeof r.port !== 'number' || r.port < 1 || r.port > 65535) {\n      errors.push(`securityRules: invalid port ${JSON.stringify(r.port)}.`);\n    }\n    if (!Array.isArray(r.sources) || r.sources.length === 0) {\n      errors.push(`securityRules[port ${r.port}]: sources must be non-empty.`);\n    }\n    for (const s of r.sources ?? []) {\n      if (!validSources.has(s)) {\n        errors.push(`securityRules[port ${r.port}]: unknown source \"${s}\" (expected self|alb|admin).`);\n      }\n    }\n  }\n\n  // \"alb\" sources are meaningless without a load balancer.\n  if (usesAlbSource && !spec.loadBalancer) {\n    errors.push('a securityRules entry uses source \"alb\" but no loadBalancer is declared.');\n  }\n\n  if (spec.loadBalancer) {\n    const lb = spec.loadBalancer;\n    if (typeof lb.targetPort !== 'number') {\n      errors.push('loadBalancer.targetPort is required.');\n    }\n    if (!lb.healthCheckPath || !lb.healthCheckPath.startsWith('/')) {\n      errors.push('loadBalancer.healthCheckPath must be an absolute path (start with \"/\").');\n    }\n    if (!Array.isArray(lb.targetKinds) || lb.targetKinds.length === 0) {\n      errors.push('loadBalancer.targetKinds must name at least one compute kind.');\n    }\n    // The web tier must be reachable from the ALB.\n    const targetPortOpen = (spec.securityRules ?? []).some(\n      (r) => r.port === lb.targetPort && (r.sources ?? []).includes('alb'),\n    );\n    if (!targetPortOpen) {\n      errors.push(\n        `loadBalancer.targetPort ${lb.targetPort} is not opened to source \"alb\" in securityRules — the ALB can't reach the web tier.`,\n      );\n    }\n  }\n\n  if (spec.albAuth?.enabled) {\n    const a = spec.albAuth;\n    if (!a.userPoolArn || !a.userPoolClientId || !a.userPoolDomain) {\n      errors.push('albAuth.enabled requires userPoolArn, userPoolClientId and userPoolDomain.');\n    }\n    if (!spec.loadBalancer) {\n      errors.push('albAuth is set but there is no loadBalancer to attach it to.');\n    }\n  }\n\n  return errors;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmHO,IAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACtEO,SAAS,gBAAgB,MAA+B;AAC7D,QAAM,kBAAyC,KAAK,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IACnF,MAAM,EAAE;AAAA,IACR,UAAU,EAAE,YAAY;AAAA,IACxB,SAAS,CAAC,GAAG,EAAE,OAAO;AAAA,IACtB,aAAa,EAAE,eAAe;AAAA,EAChC,EAAE;AAEF,QAAM,gBAA4C,KAAK,eACnD;AAAA,IACE,aAAa,KAAK,aAAa;AAAA,IAC/B,iBAAiB,KAAK,aAAa,kBAAkB;AAAA,IACrD,mBAAmB,KAAK,aAAa;AAAA,IACrC,sBAAsB,KAAK,aAAa,sBAAsB;AAAA,IAC9D,uBAAuB,KAAK,aAAa,uBAAuB;AAAA,IAChE,cAAc,CAAC,GAAG,KAAK,aAAa,WAAW;AAAA,IAC/C,eAAe,KAAK,aAAa,gBAAgB;AAAA,EACnD,IACA;AAIJ,QAAM,cAAc,KAAK,OAAO,QAAQ,KAAK,YAAY;AAEzD,QAAM,WAA2B;AAAA,IAC/B,SAAS,KAAK,SAAS,WAAW;AAAA,IAClC,eAAe,KAAK,SAAS,eAAe;AAAA,IAC5C,qBAAqB,KAAK,SAAS,oBAAoB;AAAA,IACvD,kBAAkB,KAAK,SAAS,kBAAkB;AAAA,EACpD;AAEA,SAAO;AAAA,IACL,eAAe,KAAK,eAAe,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC;AAAA,IAC7D;AAAA,IACA;AAAA,IACA,cAAc,EAAE,GAAG,KAAK,YAAY;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACF;;;ACrFO,SAAS,kBAAkB,MAA2B;AAC3D,QAAM,SAAmB,CAAC;AAE1B,MAAI,CAAC,MAAM,QAAQ,KAAK,aAAa,KAAK,KAAK,cAAc,WAAW,GAAG;AACzE,WAAO,KAAK,+CAA+C;AAAA,EAC7D;AAEA,QAAM,eAAe,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AACrD,QAAM,iBAAiB,KAAK,iBAAiB,CAAC,GAAG;AAAA,IAAK,CAAC,OACpD,EAAE,WAAW,CAAC,GAAG,SAAS,KAAK;AAAA,EAClC;AAEA,aAAW,KAAK,KAAK,iBAAiB,CAAC,GAAG;AACxC,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,KAAK,EAAE,OAAO,OAAO;AAC9D,aAAO,KAAK,+BAA+B,KAAK,UAAU,EAAE,IAAI,CAAC,GAAG;AAAA,IACtE;AACA,QAAI,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK,EAAE,QAAQ,WAAW,GAAG;AACvD,aAAO,KAAK,sBAAsB,EAAE,IAAI,+BAA+B;AAAA,IACzE;AACA,eAAW,KAAK,EAAE,WAAW,CAAC,GAAG;AAC/B,UAAI,CAAC,aAAa,IAAI,CAAC,GAAG;AACxB,eAAO,KAAK,sBAAsB,EAAE,IAAI,sBAAsB,CAAC,8BAA8B;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AAGA,MAAI,iBAAiB,CAAC,KAAK,cAAc;AACvC,WAAO,KAAK,0EAA0E;AAAA,EACxF;AAEA,MAAI,KAAK,cAAc;AACrB,UAAM,KAAK,KAAK;AAChB,QAAI,OAAO,GAAG,eAAe,UAAU;AACrC,aAAO,KAAK,sCAAsC;AAAA,IACpD;AACA,QAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,gBAAgB,WAAW,GAAG,GAAG;AAC9D,aAAO,KAAK,yEAAyE;AAAA,IACvF;AACA,QAAI,CAAC,MAAM,QAAQ,GAAG,WAAW,KAAK,GAAG,YAAY,WAAW,GAAG;AACjE,aAAO,KAAK,+DAA+D;AAAA,IAC7E;AAEA,UAAM,kBAAkB,KAAK,iBAAiB,CAAC,GAAG;AAAA,MAChD,CAAC,MAAM,EAAE,SAAS,GAAG,eAAe,EAAE,WAAW,CAAC,GAAG,SAAS,KAAK;AAAA,IACrE;AACA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL,2BAA2B,GAAG,UAAU;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,SAAS;AACzB,UAAM,IAAI,KAAK;AACf,QAAI,CAAC,EAAE,eAAe,CAAC,EAAE,oBAAoB,CAAC,EAAE,gBAAgB;AAC9D,aAAO,KAAK,4EAA4E;AAAA,IAC1F;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,aAAO,KAAK,8DAA8D;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/opentofu/index.d.cts

@@ -0,0 +1,131 @@
+/** Where a security-group ingress rule may allow traffic from. */
+type SecuritySource = 'self' | 'alb' | 'admin';
+/** One security-group ingress rule: a port and who may reach it. */
+interface SecurityRule {
+    /** Destination port to open on the compute nodes. */
+    port: number;
+    /** IP protocol. Default 'tcp'. */
+    protocol?: 'tcp' | 'udp';
+    /** Origins allowed to reach `port`. At least one. */
+    sources: SecuritySource[];
+    /** Human-readable description (surfaced on the rule). */
+    description?: string;
+}
+/** Front-door ALB spec. Omit entirely for forwarder-only / headless tools. */
+interface LoadBalancerSpec {
+    /** Port the tool's web UI listens on behind the ALB (e.g. Splunk Web 8000). */
+    targetPort: number;
+    /** ALB→instance protocol. Default 'HTTP' (TLS terminates at the ALB). */
+    targetProtocol?: 'HTTP' | 'HTTPS';
+    /** Health-check path on the target (e.g. '/en-US/account/login'). */
+    healthCheckPath: string;
+    /** Health-check success matcher. Default '200-399'. */
+    healthCheckMatcher?: string;
+    /** Health-check protocol. Default = targetProtocol. */
+    healthCheckProtocol?: 'HTTP' | 'HTTPS';
+    /** Compute kinds that sit behind the ALB (e.g. ['search-head','standalone']). */
+    targetKinds: string[];
+    /** Public HTTPS listener port. Default 443. */
+    listenerPort?: number;
+}
+/** An object-storage bucket the tool needs (e.g. Splunk SmartStore, frozen). */
+interface StorageSpec {
+    /** Logical suffix for the bucket name (e.g. 'smartstore'). */
+    name: string;
+}
+/** Optional Cognito/OIDC MFA enforced at the ALB, in front of the tool's UI. */
+interface AlbAuthSpec {
+    enabled: boolean;
+    userPoolArn?: string;
+    userPoolClientId?: string;
+    userPoolDomain?: string;
+}
+/**
+ * The complete declarative infra spec for one app. Everything tool-shaped is a
+ * value here; the generic module reads these via tfvars.
+ */
+interface InfraSpec {
+    /**
+     * Explicit compute kinds. When omitted, ANY plan item whose `kind` is not a
+     * generic FOUNDATION kind (see FOUNDATION_KINDS) is treated as compute — so an
+     * app's roles become compute automatically without listing them here.
+     */
+    computeKinds?: string[];
+    /** SG ingress rules: the tool's ports and who may reach each. */
+    securityRules: SecurityRule[];
+    /** ALB front-door. Omit for tools with no web UI. */
+    loadBalancer?: LoadBalancerSpec;
+    /**
+     * kind → DNS label prefix for per-node function FQDNs
+     * (e.g. { indexer: 'idx', 'search-head': 'sh', 'cluster-manager': 'mgmt' }).
+     * A kind absent from the map falls back to the kind string itself.
+     */
+    dnsPrefixes: Record<string, string>;
+    /** Object-storage buckets to create. Omit if the tool needs none. */
+    storage?: StorageSpec[];
+    /**
+     * Attach a WAFv2 web ACL (AWS-managed rule sets + IP rate limit) to the ALB.
+     * Defaults to true when `loadBalancer` is set; ignored otherwise.
+     */
+    waf?: boolean;
+    /** Optional ALB Cognito MFA. */
+    albAuth?: AlbAuthSpec;
+    /**
+     * Path, relative to the app's `infra/` dir, to the bring-up entrypoint the
+     * generic worker runs after `tofu apply` succeeds (config management +
+     * readiness gate). ALL tool-specific configuration lives behind this — e.g.
+     * './bringup/ansible/site.yml' for Splunk. Omit for tools that are ready at
+     * boot (no post-provision configuration).
+     */
+    bringup?: string;
+}
+/**
+ * Generic foundation kinds the module realizes as shared infra (not compute).
+ * Any plan `kind` NOT in this set is compute. Kept in sync with the module's
+ * `var.foundation_kinds` default.
+ */
+declare const FOUNDATION_KINDS: readonly ["network", "storage", "secrets", "tls", "load-balancer", "dns", "license-file", "hec"];
+type FoundationKind = (typeof FOUNDATION_KINDS)[number];
+
+/** ALB spec as the module expects it (snake_case). */
+interface AwsLoadBalancerVars {
+    target_port: number;
+    target_protocol: 'HTTP' | 'HTTPS';
+    health_check_path: string;
+    health_check_matcher: string;
+    health_check_protocol: string;
+    target_kinds: string[];
+    listener_port: number;
+}
+/** One rendered SG ingress rule (snake_case). */
+interface AwsSecurityRuleVars {
+    port: number;
+    protocol: 'tcp' | 'udp';
+    sources: string[];
+    description: string;
+}
+/** Cognito MFA vars (snake_case), always present so `var.alb_auth.enabled` resolves. */
+interface AwsAlbAuthVars {
+    enabled: boolean;
+    user_pool_arn: string;
+    user_pool_client_id: string;
+    user_pool_domain: string;
+}
+/** The spec-derived subset of the generic AWS module's variables. */
+interface AwsInfraVars {
+    compute_kinds: string[];
+    security_rules: AwsSecurityRuleVars[];
+    load_balancer: AwsLoadBalancerVars | null;
+    dns_prefixes: Record<string, string>;
+    waf_enabled: boolean;
+    alb_auth: AwsAlbAuthVars;
+}
+/**
+ * Render the spec-derived tfvars for the generic AWS module. Pure and
+ * deterministic — no I/O, no clock, no randomness.
+ */
+declare function renderInfraVars(spec: InfraSpec): AwsInfraVars;
+
+declare function validateInfraSpec(spec: InfraSpec): string[];
+
+export { type AlbAuthSpec, type AwsAlbAuthVars, type AwsInfraVars, type AwsLoadBalancerVars, type AwsSecurityRuleVars, FOUNDATION_KINDS, type FoundationKind, type InfraSpec, type LoadBalancerSpec, type SecurityRule, type SecuritySource, type StorageSpec, renderInfraVars, validateInfraSpec };

package/dist/opentofu/index.d.ts

@@ -0,0 +1,131 @@
+/** Where a security-group ingress rule may allow traffic from. */
+type SecuritySource = 'self' | 'alb' | 'admin';
+/** One security-group ingress rule: a port and who may reach it. */
+interface SecurityRule {
+    /** Destination port to open on the compute nodes. */
+    port: number;
+    /** IP protocol. Default 'tcp'. */
+    protocol?: 'tcp' | 'udp';
+    /** Origins allowed to reach `port`. At least one. */
+    sources: SecuritySource[];
+    /** Human-readable description (surfaced on the rule). */
+    description?: string;
+}
+/** Front-door ALB spec. Omit entirely for forwarder-only / headless tools. */
+interface LoadBalancerSpec {
+    /** Port the tool's web UI listens on behind the ALB (e.g. Splunk Web 8000). */
+    targetPort: number;
+    /** ALB→instance protocol. Default 'HTTP' (TLS terminates at the ALB). */
+    targetProtocol?: 'HTTP' | 'HTTPS';
+    /** Health-check path on the target (e.g. '/en-US/account/login'). */
+    healthCheckPath: string;
+    /** Health-check success matcher. Default '200-399'. */
+    healthCheckMatcher?: string;
+    /** Health-check protocol. Default = targetProtocol. */
+    healthCheckProtocol?: 'HTTP' | 'HTTPS';
+    /** Compute kinds that sit behind the ALB (e.g. ['search-head','standalone']). */
+    targetKinds: string[];
+    /** Public HTTPS listener port. Default 443. */
+    listenerPort?: number;
+}
+/** An object-storage bucket the tool needs (e.g. Splunk SmartStore, frozen). */
+interface StorageSpec {
+    /** Logical suffix for the bucket name (e.g. 'smartstore'). */
+    name: string;
+}
+/** Optional Cognito/OIDC MFA enforced at the ALB, in front of the tool's UI. */
+interface AlbAuthSpec {
+    enabled: boolean;
+    userPoolArn?: string;
+    userPoolClientId?: string;
+    userPoolDomain?: string;
+}
+/**
+ * The complete declarative infra spec for one app. Everything tool-shaped is a
+ * value here; the generic module reads these via tfvars.
+ */
+interface InfraSpec {
+    /**
+     * Explicit compute kinds. When omitted, ANY plan item whose `kind` is not a
+     * generic FOUNDATION kind (see FOUNDATION_KINDS) is treated as compute — so an
+     * app's roles become compute automatically without listing them here.
+     */
+    computeKinds?: string[];
+    /** SG ingress rules: the tool's ports and who may reach each. */
+    securityRules: SecurityRule[];
+    /** ALB front-door. Omit for tools with no web UI. */
+    loadBalancer?: LoadBalancerSpec;
+    /**
+     * kind → DNS label prefix for per-node function FQDNs
+     * (e.g. { indexer: 'idx', 'search-head': 'sh', 'cluster-manager': 'mgmt' }).
+     * A kind absent from the map falls back to the kind string itself.
+     */
+    dnsPrefixes: Record<string, string>;
+    /** Object-storage buckets to create. Omit if the tool needs none. */
+    storage?: StorageSpec[];
+    /**
+     * Attach a WAFv2 web ACL (AWS-managed rule sets + IP rate limit) to the ALB.
+     * Defaults to true when `loadBalancer` is set; ignored otherwise.
+     */
+    waf?: boolean;
+    /** Optional ALB Cognito MFA. */
+    albAuth?: AlbAuthSpec;
+    /**
+     * Path, relative to the app's `infra/` dir, to the bring-up entrypoint the
+     * generic worker runs after `tofu apply` succeeds (config management +
+     * readiness gate). ALL tool-specific configuration lives behind this — e.g.
+     * './bringup/ansible/site.yml' for Splunk. Omit for tools that are ready at
+     * boot (no post-provision configuration).
+     */
+    bringup?: string;
+}
+/**
+ * Generic foundation kinds the module realizes as shared infra (not compute).
+ * Any plan `kind` NOT in this set is compute. Kept in sync with the module's
+ * `var.foundation_kinds` default.
+ */
+declare const FOUNDATION_KINDS: readonly ["network", "storage", "secrets", "tls", "load-balancer", "dns", "license-file", "hec"];
+type FoundationKind = (typeof FOUNDATION_KINDS)[number];
+
+/** ALB spec as the module expects it (snake_case). */
+interface AwsLoadBalancerVars {
+    target_port: number;
+    target_protocol: 'HTTP' | 'HTTPS';
+    health_check_path: string;
+    health_check_matcher: string;
+    health_check_protocol: string;
+    target_kinds: string[];
+    listener_port: number;
+}
+/** One rendered SG ingress rule (snake_case). */
+interface AwsSecurityRuleVars {
+    port: number;
+    protocol: 'tcp' | 'udp';
+    sources: string[];
+    description: string;
+}
+/** Cognito MFA vars (snake_case), always present so `var.alb_auth.enabled` resolves. */
+interface AwsAlbAuthVars {
+    enabled: boolean;
+    user_pool_arn: string;
+    user_pool_client_id: string;
+    user_pool_domain: string;
+}
+/** The spec-derived subset of the generic AWS module's variables. */
+interface AwsInfraVars {
+    compute_kinds: string[];
+    security_rules: AwsSecurityRuleVars[];
+    load_balancer: AwsLoadBalancerVars | null;
+    dns_prefixes: Record<string, string>;
+    waf_enabled: boolean;
+    alb_auth: AwsAlbAuthVars;
+}
+/**
+ * Render the spec-derived tfvars for the generic AWS module. Pure and
+ * deterministic — no I/O, no clock, no randomness.
+ */
+declare function renderInfraVars(spec: InfraSpec): AwsInfraVars;
+
+declare function validateInfraSpec(spec: InfraSpec): string[];
+
+export { type AlbAuthSpec, type AwsAlbAuthVars, type AwsInfraVars, type AwsLoadBalancerVars, type AwsSecurityRuleVars, FOUNDATION_KINDS, type FoundationKind, type InfraSpec, type LoadBalancerSpec, type SecurityRule, type SecuritySource, type StorageSpec, renderInfraVars, validateInfraSpec };

package/dist/opentofu/index.js

@@ -0,0 +1,109 @@
+// src/opentofu/spec.ts
+var FOUNDATION_KINDS = [
+  "network",
+  "storage",
+  "secrets",
+  "tls",
+  "load-balancer",
+  "dns",
+  "license-file",
+  "hec"
+];
+
+// src/opentofu/render.ts
+function renderInfraVars(spec) {
+  const security_rules = (spec.securityRules ?? []).map((r) => ({
+    port: r.port,
+    protocol: r.protocol ?? "tcp",
+    sources: [...r.sources],
+    description: r.description ?? ""
+  }));
+  const load_balancer = spec.loadBalancer ? {
+    target_port: spec.loadBalancer.targetPort,
+    target_protocol: spec.loadBalancer.targetProtocol ?? "HTTP",
+    health_check_path: spec.loadBalancer.healthCheckPath,
+    health_check_matcher: spec.loadBalancer.healthCheckMatcher ?? "200-399",
+    health_check_protocol: spec.loadBalancer.healthCheckProtocol ?? "",
+    target_kinds: [...spec.loadBalancer.targetKinds],
+    listener_port: spec.loadBalancer.listenerPort ?? 443
+  } : null;
+  const waf_enabled = spec.waf ?? Boolean(spec.loadBalancer);
+  const alb_auth = {
+    enabled: spec.albAuth?.enabled ?? false,
+    user_pool_arn: spec.albAuth?.userPoolArn ?? "",
+    user_pool_client_id: spec.albAuth?.userPoolClientId ?? "",
+    user_pool_domain: spec.albAuth?.userPoolDomain ?? ""
+  };
+  return {
+    compute_kinds: spec.computeKinds ? [...spec.computeKinds] : [],
+    security_rules,
+    load_balancer,
+    dns_prefixes: { ...spec.dnsPrefixes },
+    waf_enabled,
+    alb_auth
+  };
+}
+
+// src/opentofu/validate.ts
+function validateInfraSpec(spec) {
+  const errors = [];
+  if (!Array.isArray(spec.securityRules) || spec.securityRules.length === 0) {
+    errors.push("securityRules must contain at least one rule.");
+  }
+  const validSources = /* @__PURE__ */ new Set(["self", "alb", "admin"]);
+  const usesAlbSource = (spec.securityRules ?? []).some(
+    (r) => (r.sources ?? []).includes("alb")
+  );
+  for (const r of spec.securityRules ?? []) {
+    if (typeof r.port !== "number" || r.port < 1 || r.port > 65535) {
+      errors.push(`securityRules: invalid port ${JSON.stringify(r.port)}.`);
+    }
+    if (!Array.isArray(r.sources) || r.sources.length === 0) {
+      errors.push(`securityRules[port ${r.port}]: sources must be non-empty.`);
+    }
+    for (const s of r.sources ?? []) {
+      if (!validSources.has(s)) {
+        errors.push(`securityRules[port ${r.port}]: unknown source "${s}" (expected self|alb|admin).`);
+      }
+    }
+  }
+  if (usesAlbSource && !spec.loadBalancer) {
+    errors.push('a securityRules entry uses source "alb" but no loadBalancer is declared.');
+  }
+  if (spec.loadBalancer) {
+    const lb = spec.loadBalancer;
+    if (typeof lb.targetPort !== "number") {
+      errors.push("loadBalancer.targetPort is required.");
+    }
+    if (!lb.healthCheckPath || !lb.healthCheckPath.startsWith("/")) {
+      errors.push('loadBalancer.healthCheckPath must be an absolute path (start with "/").');
+    }
+    if (!Array.isArray(lb.targetKinds) || lb.targetKinds.length === 0) {
+      errors.push("loadBalancer.targetKinds must name at least one compute kind.");
+    }
+    const targetPortOpen = (spec.securityRules ?? []).some(
+      (r) => r.port === lb.targetPort && (r.sources ?? []).includes("alb")
+    );
+    if (!targetPortOpen) {
+      errors.push(
+        `loadBalancer.targetPort ${lb.targetPort} is not opened to source "alb" in securityRules \u2014 the ALB can't reach the web tier.`
+      );
+    }
+  }
+  if (spec.albAuth?.enabled) {
+    const a = spec.albAuth;
+    if (!a.userPoolArn || !a.userPoolClientId || !a.userPoolDomain) {
+      errors.push("albAuth.enabled requires userPoolArn, userPoolClientId and userPoolDomain.");
+    }
+    if (!spec.loadBalancer) {
+      errors.push("albAuth is set but there is no loadBalancer to attach it to.");
+    }
+  }
+  return errors;
+}
+export {
+  FOUNDATION_KINDS,
+  renderInfraVars,
+  validateInfraSpec
+};
+//# sourceMappingURL=index.js.map

package/dist/opentofu/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/opentofu/spec.ts","../../src/opentofu/render.ts","../../src/opentofu/validate.ts"],"sourcesContent":["// =============================================================================\n// InfraSpec — the declarative, tool-agnostic infrastructure contract.\n//\n// An app ships one of these in `apps/<app>/infra/spec.ts`. The SDK renders it\n// into the generic OpenTofu module's tfvars (see ./render). NOTHING in the\n// module is tool-specific: an app supplies all of its shape (roles, ports,\n// front-door, DNS, bring-up) as DATA here, so the same modules provision Splunk,\n// Security Onion, or any other BYOI tool without a line of per-tool HCL.\n//\n// Pairs with sdk/opentofu/modules/<cloud> (the generic HCL) and the platform\n// render+apply worker, which invokes the app's `bringup` entrypoint after apply.\n// =============================================================================\n\n/** Where a security-group ingress rule may allow traffic from. */\nexport type SecuritySource =\n  | 'self' // peer nodes in this stack (the node SG referencing itself)\n  | 'alb' // the public ALB security group (only valid when loadBalancer is set)\n  | 'admin'; // the Veltrix control-plane / admin CIDR (var.admin_cidr)\n\n/** One security-group ingress rule: a port and who may reach it. */\nexport interface SecurityRule {\n  /** Destination port to open on the compute nodes. */\n  port: number;\n  /** IP protocol. Default 'tcp'. */\n  protocol?: 'tcp' | 'udp';\n  /** Origins allowed to reach `port`. At least one. */\n  sources: SecuritySource[];\n  /** Human-readable description (surfaced on the rule). */\n  description?: string;\n}\n\n/** Front-door ALB spec. Omit entirely for forwarder-only / headless tools. */\nexport interface LoadBalancerSpec {\n  /** Port the tool's web UI listens on behind the ALB (e.g. Splunk Web 8000). */\n  targetPort: number;\n  /** ALB→instance protocol. Default 'HTTP' (TLS terminates at the ALB). */\n  targetProtocol?: 'HTTP' | 'HTTPS';\n  /** Health-check path on the target (e.g. '/en-US/account/login'). */\n  healthCheckPath: string;\n  /** Health-check success matcher. Default '200-399'. */\n  healthCheckMatcher?: string;\n  /** Health-check protocol. Default = targetProtocol. */\n  healthCheckProtocol?: 'HTTP' | 'HTTPS';\n  /** Compute kinds that sit behind the ALB (e.g. ['search-head','standalone']). */\n  targetKinds: string[];\n  /** Public HTTPS listener port. Default 443. */\n  listenerPort?: number;\n}\n\n/** An object-storage bucket the tool needs (e.g. Splunk SmartStore, frozen). */\nexport interface StorageSpec {\n  /** Logical suffix for the bucket name (e.g. 'smartstore'). */\n  name: string;\n}\n\n/** Optional Cognito/OIDC MFA enforced at the ALB, in front of the tool's UI. */\nexport interface AlbAuthSpec {\n  enabled: boolean;\n  userPoolArn?: string;\n  userPoolClientId?: string;\n  userPoolDomain?: string;\n}\n\n/**\n * The complete declarative infra spec for one app. Everything tool-shaped is a\n * value here; the generic module reads these via tfvars.\n */\nexport interface InfraSpec {\n  /**\n   * Explicit compute kinds. When omitted, ANY plan item whose `kind` is not a\n   * generic FOUNDATION kind (see FOUNDATION_KINDS) is treated as compute — so an\n   * app's roles become compute automatically without listing them here.\n   */\n  computeKinds?: string[];\n\n  /** SG ingress rules: the tool's ports and who may reach each. */\n  securityRules: SecurityRule[];\n\n  /** ALB front-door. Omit for tools with no web UI. */\n  loadBalancer?: LoadBalancerSpec;\n\n  /**\n   * kind → DNS label prefix for per-node function FQDNs\n   * (e.g. { indexer: 'idx', 'search-head': 'sh', 'cluster-manager': 'mgmt' }).\n   * A kind absent from the map falls back to the kind string itself.\n   */\n  dnsPrefixes: Record<string, string>;\n\n  /** Object-storage buckets to create. Omit if the tool needs none. */\n  storage?: StorageSpec[];\n\n  /**\n   * Attach a WAFv2 web ACL (AWS-managed rule sets + IP rate limit) to the ALB.\n   * Defaults to true when `loadBalancer` is set; ignored otherwise.\n   */\n  waf?: boolean;\n\n  /** Optional ALB Cognito MFA. */\n  albAuth?: AlbAuthSpec;\n\n  /**\n   * Path, relative to the app's `infra/` dir, to the bring-up entrypoint the\n   * generic worker runs after `tofu apply` succeeds (config management +\n   * readiness gate). ALL tool-specific configuration lives behind this — e.g.\n   * './bringup/ansible/site.yml' for Splunk. Omit for tools that are ready at\n   * boot (no post-provision configuration).\n   */\n  bringup?: string;\n}\n\n/**\n * Generic foundation kinds the module realizes as shared infra (not compute).\n * Any plan `kind` NOT in this set is compute. Kept in sync with the module's\n * `var.foundation_kinds` default.\n */\nexport const FOUNDATION_KINDS = [\n  'network',\n  'storage',\n  'secrets',\n  'tls',\n  'load-balancer',\n  'dns',\n  'license-file',\n  'hec',\n] as const;\n\nexport type FoundationKind = (typeof FOUNDATION_KINDS)[number];\n","// =============================================================================\n// render — turn an app's declarative InfraSpec into the generic OpenTofu\n// module's variable values (tfvars).\n//\n// The platform render+apply worker builds the BASE vars (app_id, customer_id,\n// plan, subnet_cidr, tags, region, ...) from the DeployRequest, and merges these\n// SPEC-derived vars on top. Field names are snake_case to match the HCL module\n// variables 1:1. Defaults mirror the module's `optional(...)` defaults, applied\n// here so the emitted tfvars are explicit and self-describing.\n// =============================================================================\n\nimport type { InfraSpec } from './spec';\n\n/** ALB spec as the module expects it (snake_case). */\nexport interface AwsLoadBalancerVars {\n  target_port: number;\n  target_protocol: 'HTTP' | 'HTTPS';\n  health_check_path: string;\n  health_check_matcher: string;\n  health_check_protocol: string; // \"\" => module falls back to target_protocol\n  target_kinds: string[];\n  listener_port: number;\n}\n\n/** One rendered SG ingress rule (snake_case). */\nexport interface AwsSecurityRuleVars {\n  port: number;\n  protocol: 'tcp' | 'udp';\n  sources: string[];\n  description: string;\n}\n\n/** Cognito MFA vars (snake_case), always present so `var.alb_auth.enabled` resolves. */\nexport interface AwsAlbAuthVars {\n  enabled: boolean;\n  user_pool_arn: string;\n  user_pool_client_id: string;\n  user_pool_domain: string;\n}\n\n/** The spec-derived subset of the generic AWS module's variables. */\nexport interface AwsInfraVars {\n  compute_kinds: string[];\n  security_rules: AwsSecurityRuleVars[];\n  load_balancer: AwsLoadBalancerVars | null;\n  dns_prefixes: Record<string, string>;\n  waf_enabled: boolean;\n  alb_auth: AwsAlbAuthVars;\n}\n\n/**\n * Render the spec-derived tfvars for the generic AWS module. Pure and\n * deterministic — no I/O, no clock, no randomness.\n */\nexport function renderInfraVars(spec: InfraSpec): AwsInfraVars {\n  const security_rules: AwsSecurityRuleVars[] = (spec.securityRules ?? []).map((r) => ({\n    port: r.port,\n    protocol: r.protocol ?? 'tcp',\n    sources: [...r.sources],\n    description: r.description ?? '',\n  }));\n\n  const load_balancer: AwsLoadBalancerVars | null = spec.loadBalancer\n    ? {\n        target_port: spec.loadBalancer.targetPort,\n        target_protocol: spec.loadBalancer.targetProtocol ?? 'HTTP',\n        health_check_path: spec.loadBalancer.healthCheckPath,\n        health_check_matcher: spec.loadBalancer.healthCheckMatcher ?? '200-399',\n        health_check_protocol: spec.loadBalancer.healthCheckProtocol ?? '',\n        target_kinds: [...spec.loadBalancer.targetKinds],\n        listener_port: spec.loadBalancer.listenerPort ?? 443,\n      }\n    : null;\n\n  // WAF defaults ON when there is a load balancer, OFF otherwise (the module\n  // ignores it without an ALB, but keep the emitted value honest).\n  const waf_enabled = spec.waf ?? Boolean(spec.loadBalancer);\n\n  const alb_auth: AwsAlbAuthVars = {\n    enabled: spec.albAuth?.enabled ?? false,\n    user_pool_arn: spec.albAuth?.userPoolArn ?? '',\n    user_pool_client_id: spec.albAuth?.userPoolClientId ?? '',\n    user_pool_domain: spec.albAuth?.userPoolDomain ?? '',\n  };\n\n  return {\n    compute_kinds: spec.computeKinds ? [...spec.computeKinds] : [],\n    security_rules,\n    load_balancer,\n    dns_prefixes: { ...spec.dnsPrefixes },\n    waf_enabled,\n    alb_auth,\n  };\n}\n","// =============================================================================\n// validateInfraSpec — cheap, dependency-free checks that catch the InfraSpec\n// mistakes the OpenTofu module can't (or would only surface at apply time).\n// Returns a list of human-readable errors; empty === valid.\n// =============================================================================\n\nimport type { InfraSpec } from './spec';\n\nexport function validateInfraSpec(spec: InfraSpec): string[] {\n  const errors: string[] = [];\n\n  if (!Array.isArray(spec.securityRules) || spec.securityRules.length === 0) {\n    errors.push('securityRules must contain at least one rule.');\n  }\n\n  const validSources = new Set(['self', 'alb', 'admin']);\n  const usesAlbSource = (spec.securityRules ?? []).some((r) =>\n    (r.sources ?? []).includes('alb'),\n  );\n\n  for (const r of spec.securityRules ?? []) {\n    if (typeof r.port !== 'number' || r.port < 1 || r.port > 65535) {\n      errors.push(`securityRules: invalid port ${JSON.stringify(r.port)}.`);\n    }\n    if (!Array.isArray(r.sources) || r.sources.length === 0) {\n      errors.push(`securityRules[port ${r.port}]: sources must be non-empty.`);\n    }\n    for (const s of r.sources ?? []) {\n      if (!validSources.has(s)) {\n        errors.push(`securityRules[port ${r.port}]: unknown source \"${s}\" (expected self|alb|admin).`);\n      }\n    }\n  }\n\n  // \"alb\" sources are meaningless without a load balancer.\n  if (usesAlbSource && !spec.loadBalancer) {\n    errors.push('a securityRules entry uses source \"alb\" but no loadBalancer is declared.');\n  }\n\n  if (spec.loadBalancer) {\n    const lb = spec.loadBalancer;\n    if (typeof lb.targetPort !== 'number') {\n      errors.push('loadBalancer.targetPort is required.');\n    }\n    if (!lb.healthCheckPath || !lb.healthCheckPath.startsWith('/')) {\n      errors.push('loadBalancer.healthCheckPath must be an absolute path (start with \"/\").');\n    }\n    if (!Array.isArray(lb.targetKinds) || lb.targetKinds.length === 0) {\n      errors.push('loadBalancer.targetKinds must name at least one compute kind.');\n    }\n    // The web tier must be reachable from the ALB.\n    const targetPortOpen = (spec.securityRules ?? []).some(\n      (r) => r.port === lb.targetPort && (r.sources ?? []).includes('alb'),\n    );\n    if (!targetPortOpen) {\n      errors.push(\n        `loadBalancer.targetPort ${lb.targetPort} is not opened to source \"alb\" in securityRules — the ALB can't reach the web tier.`,\n      );\n    }\n  }\n\n  if (spec.albAuth?.enabled) {\n    const a = spec.albAuth;\n    if (!a.userPoolArn || !a.userPoolClientId || !a.userPoolDomain) {\n      errors.push('albAuth.enabled requires userPoolArn, userPoolClientId and userPoolDomain.');\n    }\n    if (!spec.loadBalancer) {\n      errors.push('albAuth is set but there is no loadBalancer to attach it to.');\n    }\n  }\n\n  return errors;\n}\n"],"mappings":";AAmHO,IAAM,mBAAmB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACtEO,SAAS,gBAAgB,MAA+B;AAC7D,QAAM,kBAAyC,KAAK,iBAAiB,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,IACnF,MAAM,EAAE;AAAA,IACR,UAAU,EAAE,YAAY;AAAA,IACxB,SAAS,CAAC,GAAG,EAAE,OAAO;AAAA,IACtB,aAAa,EAAE,eAAe;AAAA,EAChC,EAAE;AAEF,QAAM,gBAA4C,KAAK,eACnD;AAAA,IACE,aAAa,KAAK,aAAa;AAAA,IAC/B,iBAAiB,KAAK,aAAa,kBAAkB;AAAA,IACrD,mBAAmB,KAAK,aAAa;AAAA,IACrC,sBAAsB,KAAK,aAAa,sBAAsB;AAAA,IAC9D,uBAAuB,KAAK,aAAa,uBAAuB;AAAA,IAChE,cAAc,CAAC,GAAG,KAAK,aAAa,WAAW;AAAA,IAC/C,eAAe,KAAK,aAAa,gBAAgB;AAAA,EACnD,IACA;AAIJ,QAAM,cAAc,KAAK,OAAO,QAAQ,KAAK,YAAY;AAEzD,QAAM,WAA2B;AAAA,IAC/B,SAAS,KAAK,SAAS,WAAW;AAAA,IAClC,eAAe,KAAK,SAAS,eAAe;AAAA,IAC5C,qBAAqB,KAAK,SAAS,oBAAoB;AAAA,IACvD,kBAAkB,KAAK,SAAS,kBAAkB;AAAA,EACpD;AAEA,SAAO;AAAA,IACL,eAAe,KAAK,eAAe,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC;AAAA,IAC7D;AAAA,IACA;AAAA,IACA,cAAc,EAAE,GAAG,KAAK,YAAY;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACF;;;ACrFO,SAAS,kBAAkB,MAA2B;AAC3D,QAAM,SAAmB,CAAC;AAE1B,MAAI,CAAC,MAAM,QAAQ,KAAK,aAAa,KAAK,KAAK,cAAc,WAAW,GAAG;AACzE,WAAO,KAAK,+CAA+C;AAAA,EAC7D;AAEA,QAAM,eAAe,oBAAI,IAAI,CAAC,QAAQ,OAAO,OAAO,CAAC;AACrD,QAAM,iBAAiB,KAAK,iBAAiB,CAAC,GAAG;AAAA,IAAK,CAAC,OACpD,EAAE,WAAW,CAAC,GAAG,SAAS,KAAK;AAAA,EAClC;AAEA,aAAW,KAAK,KAAK,iBAAiB,CAAC,GAAG;AACxC,QAAI,OAAO,EAAE,SAAS,YAAY,EAAE,OAAO,KAAK,EAAE,OAAO,OAAO;AAC9D,aAAO,KAAK,+BAA+B,KAAK,UAAU,EAAE,IAAI,CAAC,GAAG;AAAA,IACtE;AACA,QAAI,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK,EAAE,QAAQ,WAAW,GAAG;AACvD,aAAO,KAAK,sBAAsB,EAAE,IAAI,+BAA+B;AAAA,IACzE;AACA,eAAW,KAAK,EAAE,WAAW,CAAC,GAAG;AAC/B,UAAI,CAAC,aAAa,IAAI,CAAC,GAAG;AACxB,eAAO,KAAK,sBAAsB,EAAE,IAAI,sBAAsB,CAAC,8BAA8B;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AAGA,MAAI,iBAAiB,CAAC,KAAK,cAAc;AACvC,WAAO,KAAK,0EAA0E;AAAA,EACxF;AAEA,MAAI,KAAK,cAAc;AACrB,UAAM,KAAK,KAAK;AAChB,QAAI,OAAO,GAAG,eAAe,UAAU;AACrC,aAAO,KAAK,sCAAsC;AAAA,IACpD;AACA,QAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,gBAAgB,WAAW,GAAG,GAAG;AAC9D,aAAO,KAAK,yEAAyE;AAAA,IACvF;AACA,QAAI,CAAC,MAAM,QAAQ,GAAG,WAAW,KAAK,GAAG,YAAY,WAAW,GAAG;AACjE,aAAO,KAAK,+DAA+D;AAAA,IAC7E;AAEA,UAAM,kBAAkB,KAAK,iBAAiB,CAAC,GAAG;AAAA,MAChD,CAAC,MAAM,EAAE,SAAS,GAAG,eAAe,EAAE,WAAW,CAAC,GAAG,SAAS,KAAK;AAAA,IACrE;AACA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL,2BAA2B,GAAG,UAAU;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAEA,MAAI,KAAK,SAAS,SAAS;AACzB,UAAM,IAAI,KAAK;AACf,QAAI,CAAC,EAAE,eAAe,CAAC,EAAE,oBAAoB,CAAC,EAAE,gBAAgB;AAC9D,aAAO,KAAK,4EAA4E;AAAA,IAC1F;AACA,QAAI,CAAC,KAAK,cAAc;AACtB,aAAO,KAAK,8DAA8D;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/pipeline/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/pipeline/index.ts
 var pipeline_exports = {};
 __export(pipeline_exports, {
+  defineConnectionTester: () => defineConnectionTester,
   defineDeployer: () => defineDeployer,
   defineDriftDetector: () => defineDriftDetector,
   defineHealthChecker: () => defineHealthChecker,
@@ -52,8 +53,14 @@ function defineHealthChecker(handler) {
 function defineDriftDetector(handler) {
   return handler;
 }
+
+// src/pipeline/define-connection-tester.ts
+function defineConnectionTester(handler) {
+  return handler;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  defineConnectionTester,
   defineDeployer,
   defineDriftDetector,
   defineHealthChecker,

package/dist/pipeline/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/pipeline/index.ts","../../src/pipeline/define-validator.ts","../../src/pipeline/define-deployer.ts","../../src/pipeline/define-rollback-handler.ts","../../src/pipeline/define-health-checker.ts","../../src/pipeline/define-drift-detector.ts"],"sourcesContent":["export { defineValidator } from './define-validator'\nexport { defineDeployer } from './define-deployer'\nexport { defineRollbackHandler } from './define-rollback-handler'\nexport { defineHealthChecker } from './define-health-checker'\nexport { defineDriftDetector } from './define-drift-detector'\n","import type { PipelineContext, ValidationResult } from '../types/pipeline'\n\n/**\n * Define a validation handler for a configuration type.\n *\n * @example\n * ```ts\n * import { defineValidator } from '@veltrixsecops/app-sdk/pipeline'\n *\n * export default defineValidator(async (ctx) => {\n *   const errors = []\n *   const name = ctx.canvas.sections[0]?.fields['name']\n *   if (!name) {\n *     errors.push({ field: 'name', message: 'Name is required', code: 'REQUIRED' })\n *   }\n *   return { valid: errors.length === 0, errors, warnings: [] }\n * })\n * ```\n */\nexport function defineValidator(\n  handler: (ctx: PipelineContext) => Promise<ValidationResult>,\n): (ctx: PipelineContext) => Promise<ValidationResult> {\n  return handler\n}\n","import type { DeployContext, DeployResult } from '../types/pipeline'\n\n/**\n * Define a deploy handler for a configuration type.\n *\n * @example\n * ```ts\n * import { defineDeployer } from '@veltrixsecops/app-sdk/pipeline'\n *\n * export default defineDeployer(async (ctx) => {\n *   const { component, credential, connectivity, canvas } = ctx\n *   // Push configuration to the tool\n *   return { success: true, message: 'Deployed', rollbackData: previousState }\n * })\n * ```\n */\nexport function defineDeployer(\n  handler: (ctx: DeployContext) => Promise<DeployResult>,\n): (ctx: DeployContext) => Promise<DeployResult> {\n  return handler\n}\n","import type { RollbackContext, RollbackResult } from '../types/pipeline'\n\n/**\n * Define a rollback handler for a configuration type.\n */\nexport function defineRollbackHandler(\n  handler: (ctx: RollbackContext) => Promise<RollbackResult>,\n): (ctx: RollbackContext) => Promise<RollbackResult> {\n  return handler\n}\n","import type { HealthCheckContext, HealthCheckResult } from '../types/pipeline'\n\n/**\n * Define a health check handler for a configuration type.\n */\nexport function defineHealthChecker(\n  handler: (ctx: HealthCheckContext) => Promise<HealthCheckResult>,\n): (ctx: HealthCheckContext) => Promise<HealthCheckResult> {\n  return handler\n}\n","import type { DriftContext, DriftResult } from '../types/pipeline'\n\n/**\n * Define a drift detection handler for a configuration type.\n */\nexport function defineDriftDetector(\n  handler: (ctx: DriftContext) => Promise<DriftResult>,\n): (ctx: DriftContext) => Promise<DriftResult> {\n  return handler\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBO,SAAS,gBACd,SACqD;AACrD,SAAO;AACT;;;ACPO,SAAS,eACd,SAC+C;AAC/C,SAAO;AACT;;;ACfO,SAAS,sBACd,SACmD;AACnD,SAAO;AACT;;;ACJO,SAAS,oBACd,SACyD;AACzD,SAAO;AACT;;;ACJO,SAAS,oBACd,SAC6C;AAC7C,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/pipeline/index.ts","../../src/pipeline/define-validator.ts","../../src/pipeline/define-deployer.ts","../../src/pipeline/define-rollback-handler.ts","../../src/pipeline/define-health-checker.ts","../../src/pipeline/define-drift-detector.ts","../../src/pipeline/define-connection-tester.ts"],"sourcesContent":["export { defineValidator } from './define-validator'\nexport { defineDeployer } from './define-deployer'\nexport { defineRollbackHandler } from './define-rollback-handler'\nexport { defineHealthChecker } from './define-health-checker'\nexport { defineDriftDetector } from './define-drift-detector'\nexport { defineConnectionTester } from './define-connection-tester'\n","import type { PipelineContext, ValidationResult } from '../types/pipeline'\n\n/**\n * Define a validation handler for a configuration type.\n *\n * @example\n * ```ts\n * import { defineValidator } from '@veltrixsecops/app-sdk/pipeline'\n *\n * export default defineValidator(async (ctx) => {\n *   const errors = []\n *   const name = ctx.canvas.sections[0]?.fields['name']\n *   if (!name) {\n *     errors.push({ field: 'name', message: 'Name is required', code: 'REQUIRED' })\n *   }\n *   return { valid: errors.length === 0, errors, warnings: [] }\n * })\n * ```\n */\nexport function defineValidator(\n  handler: (ctx: PipelineContext) => Promise<ValidationResult>,\n): (ctx: PipelineContext) => Promise<ValidationResult> {\n  return handler\n}\n","import type { DeployContext, DeployResult } from '../types/pipeline'\n\n/**\n * Define a deploy handler for a configuration type.\n *\n * @example\n * ```ts\n * import { defineDeployer } from '@veltrixsecops/app-sdk/pipeline'\n *\n * export default defineDeployer(async (ctx) => {\n *   const { component, credential, connectivity, canvas } = ctx\n *   // Push configuration to the tool\n *   return { success: true, message: 'Deployed', rollbackData: previousState }\n * })\n * ```\n */\nexport function defineDeployer(\n  handler: (ctx: DeployContext) => Promise<DeployResult>,\n): (ctx: DeployContext) => Promise<DeployResult> {\n  return handler\n}\n","import type { RollbackContext, RollbackResult } from '../types/pipeline'\n\n/**\n * Define a rollback handler for a configuration type.\n */\nexport function defineRollbackHandler(\n  handler: (ctx: RollbackContext) => Promise<RollbackResult>,\n): (ctx: RollbackContext) => Promise<RollbackResult> {\n  return handler\n}\n","import type { HealthCheckContext, HealthCheckResult } from '../types/pipeline'\n\n/**\n * Define a health check handler for a configuration type.\n */\nexport function defineHealthChecker(\n  handler: (ctx: HealthCheckContext) => Promise<HealthCheckResult>,\n): (ctx: HealthCheckContext) => Promise<HealthCheckResult> {\n  return handler\n}\n","import type { DriftContext, DriftResult } from '../types/pipeline'\n\n/**\n * Define a drift detection handler for a configuration type.\n */\nexport function defineDriftDetector(\n  handler: (ctx: DriftContext) => Promise<DriftResult>,\n): (ctx: DriftContext) => Promise<DriftResult> {\n  return handler\n}\n","import type { TestConnectionContext, TestConnectionResult } from '../types/pipeline'\n\n/**\n * Define a connection-test handler for an app. The platform runs it in-process\n * with the decrypted credential to verify a Connection's endpoint + credentials\n * before they're relied on for deployments.\n */\nexport function defineConnectionTester(\n  handler: (ctx: TestConnectionContext) => Promise<TestConnectionResult>,\n): (ctx: TestConnectionContext) => Promise<TestConnectionResult> {\n  return handler\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACmBO,SAAS,gBACd,SACqD;AACrD,SAAO;AACT;;;ACPO,SAAS,eACd,SAC+C;AAC/C,SAAO;AACT;;;ACfO,SAAS,sBACd,SACmD;AACnD,SAAO;AACT;;;ACJO,SAAS,oBACd,SACyD;AACzD,SAAO;AACT;;;ACJO,SAAS,oBACd,SAC6C;AAC7C,SAAO;AACT;;;ACFO,SAAS,uBACd,SAC+D;AAC/D,SAAO;AACT;","names":[]}

package/dist/pipeline/index.d.cts

@@ -1,4 +1,4 @@
-import { P as PipelineContext, v as ValidationResult, D as DeployContext, h as DeployResult, R as RollbackContext, t as RollbackResult, o as HealthCheckContext, q as HealthCheckResult, k as DriftContext, n as DriftResult } from '../pipeline-A-gSsPRR.cjs';
+import { P as PipelineContext, I as ValidationResult, D as DeployContext, i as DeployResult, x as RollbackContext, z as RollbackResult, p as HealthCheckContext, r as HealthCheckResult, l as DriftContext, o as DriftResult, T as TestConnectionContext, B as TestConnectionResult } from '../pipeline-beeT8dje.cjs';
 
 /**
  * Define a validation handler for a configuration type.
@@ -50,4 +50,11 @@ declare function defineHealthChecker(handler: (ctx: HealthCheckContext) => Promi
  */
 declare function defineDriftDetector(handler: (ctx: DriftContext) => Promise<DriftResult>): (ctx: DriftContext) => Promise<DriftResult>;
 
-export { defineDeployer, defineDriftDetector, defineHealthChecker, defineRollbackHandler, defineValidator };
+/**
+ * Define a connection-test handler for an app. The platform runs it in-process
+ * with the decrypted credential to verify a Connection's endpoint + credentials
+ * before they're relied on for deployments.
+ */
+declare function defineConnectionTester(handler: (ctx: TestConnectionContext) => Promise<TestConnectionResult>): (ctx: TestConnectionContext) => Promise<TestConnectionResult>;
+
+export { defineConnectionTester, defineDeployer, defineDriftDetector, defineHealthChecker, defineRollbackHandler, defineValidator };