cloudburn 0.18.7 → 0.18.9

package/dist/cli.js

@@ -7,10 +7,10 @@ import { fileURLToPath } from "url";
 import { CommanderError } from "commander";
 
 // src/completion/engine.ts
-var buildCompletionTree = (command) => {
+var createCompletionTree = (command) => {
   const help = command.createHelp();
   return {
-    commands: help.visibleCommands(command).map((childCommand) => buildCompletionTree(childCommand)),
+    commands: help.visibleCommands(command).map((childCommand) => createCompletionTree(childCommand)),
     name: command.name(),
     options: collectVisibleOptions([...help.visibleOptions(command), ...help.visibleGlobalOptions(command)])
   };
@@ -44,7 +44,6 @@ var parseOptionToken = (token) => {
     name: token.slice(0, separatorIndex)
   };
 };
-var createCompletionTree = (command) => buildCompletionTree(command);
 var resolveCompletionSuggestions = (root, words) => {
   const committedWords = words.length === 0 ? [] : words.slice(0, -1);
   const partialWord = words.at(-1) ?? "";
@@ -478,69 +477,12 @@ var EXIT_CODE_POLICY_VIOLATION = 1;
 var EXIT_CODE_RUNTIME_ERROR = 2;
 
 // src/formatters/error.ts
-import { isAwsDiscoveryErrorCode } from "@cloudburn/sdk";
-var sanitizeRuntimeErrorMessage = (message) => message.replace(/169\.254\.169\.254/g, "[redacted-host]").replace(/fd00:ec2::254/gi, "[redacted-host]").replace(/(https?:\/\/)([^/\s:@]+):([^/\s@]+)@/gi, "$1[redacted-auth]@").replace(
-  /([?&](?:access_token|authorization|token|x-amz-security-token|x-amz-signature|signature)=)[^&\s]+/gi,
-  "$1[redacted]"
-).replace(/(Bearer\s+)[A-Za-z0-9._~+/-]+/gi, "$1[redacted]");
-var formatError = (err) => {
-  const envelope = { error: categorize(err) };
-  return JSON.stringify(envelope, null, 2);
-};
-var categorize = (err) => {
-  if (!(err instanceof Error)) {
-    return { code: "RUNTIME_ERROR", message: "An unexpected error occurred." };
-  }
-  const code = "code" in err && typeof err.code === "string" ? err.code : void 0;
-  if (err.name === "CredentialsProviderError" || err.name === "ExpiredTokenException" || code === "CredentialsProviderError" || code === "ExpiredTokenException") {
-    return {
-      code: "CREDENTIALS_ERROR",
-      message: "AWS credentials not found or expired. Run 'aws sts get-caller-identity' to verify your session."
-    };
-  }
-  if (err.name.includes("AccessDenied") || code?.includes("AccessDenied") === true) {
-    return {
-      code: "ACCESS_DENIED",
-      message: sanitizeRuntimeErrorMessage(err.message).trim() || "Insufficient AWS permissions. Check your IAM role or policy."
-    };
-  }
-  if (err.code === "ENOENT") {
-    const path = err.path ?? "unknown";
-    return { code: "PATH_NOT_FOUND", message: `Path not found: ${path}` };
-  }
-  if (code && isAwsDiscoveryErrorCode(code)) {
-    return {
-      code,
-      message: sanitizeRuntimeErrorMessage(err.message).trim() || "AWS Resource Explorer discovery failed."
-    };
-  }
-  const sanitizedMessage = sanitizeRuntimeErrorMessage(err.message).trim();
-  return {
-    code: "RUNTIME_ERROR",
-    message: sanitizedMessage || "An unexpected error occurred."
-  };
-};
+import { categorizeError } from "@cloudburn/sdk";
+var formatError = (err) => JSON.stringify({ error: categorizeError(err) }, null, 2);
 
 // src/formatters/output.ts
+import { flattenFindings } from "@cloudburn/sdk";
 import { InvalidArgumentError } from "commander";
-
-// src/formatters/shared.ts
-var flattenScanResult = (result) => result.providers.flatMap(
-  (providerGroup) => providerGroup.rules.flatMap(
-    (ruleGroup) => ruleGroup.findings.map((finding) => ({
-      provider: providerGroup.provider,
-      ruleId: ruleGroup.ruleId,
-      service: ruleGroup.service,
-      severity: ruleGroup.severity,
-      source: ruleGroup.source,
-      message: ruleGroup.message,
-      finding
-    }))
-  )
-);
-var getScanDiagnostics = (result) => result.diagnostics ?? [];
-
-// src/formatters/output.ts
 var DEFAULT_TABLE_WIDTH = 200;
 var MIN_COLUMN_WIDTH = 4;
 var PREFERRED_MIN_COLUMN_WIDTH = 8;
@@ -579,8 +521,7 @@ var ruleListColumns = [
   { key: "name", header: "Name" },
   { key: "description", header: "Description" }
 ];
-var formatOptionDescription = "Options: table: human-readable terminal output.\njson: machine-readable output for automation and downstream systems.";
-var OUTPUT_FORMAT_OPTION_DESCRIPTION = formatOptionDescription;
+var OUTPUT_FORMAT_OPTION_DESCRIPTION = "Options: table: human-readable terminal output.\njson: machine-readable output for automation and downstream systems.";
 var parseOutputFormat = (value) => {
   if (supportedOutputFormats.includes(value)) {
     return value;
@@ -703,7 +644,7 @@ ${renderAsciiTable(diagnosticRows, diagnosticColumns)}`
       );
   }
 };
-var projectFindingRows = (result) => flattenScanResult(result).map(({ finding, message, provider, ruleId, service, severity, source }) => ({
+var projectFindingRows = (result) => flattenFindings(result).map(({ finding, message, provider, ruleId, service, severity, source }) => ({
   accountId: finding.accountId ?? "",
   actionType: finding.actionType ?? "",
   message,
@@ -719,7 +660,7 @@ var projectFindingRows = (result) => flattenScanResult(result).map(({ finding, m
   column: finding.location?.column ?? "",
   line: finding.location?.line ?? ""
 }));
-var projectDiagnosticRows = (result) => getScanDiagnostics(result).map((diagnostic) => ({
+var projectDiagnosticRows = (result) => (result.diagnostics ?? []).map((diagnostic) => ({
   message: diagnostic.message,
   provider: diagnostic.provider,
   region: diagnostic.region ?? "",
@@ -1077,7 +1018,8 @@ import { homedir } from "os";
 import { join as join2 } from "path";
 import {
   assertSupportedAwsRegion,
-  CloudBurnClient
+  CloudBurnClient,
+  resolveScanPolicy
 } from "@cloudburn/sdk";
 import { InvalidArgumentError as InvalidArgumentError3 } from "commander";
 
@@ -1096,15 +1038,6 @@ var resolveCliDebugLogger = (command) => {
   };
 };
 
-// src/policy.ts
-import { evaluateScanPolicy } from "@cloudburn/sdk";
-var hasPolicyViolation = (result, options) => {
-  if (options.failOn !== void 0) {
-    return evaluateScanPolicy(result, options.failOn).violated;
-  }
-  return options.exitCode === true ? evaluateScanPolicy(result).violated : result.policy?.violated ?? false;
-};
-
 // src/progress.ts
 var resolveCliDiscoveryProgressLogger = (command) => {
   if (isDebugEnabled(command) || process.stderr.isTTY !== true) {
@@ -1127,7 +1060,7 @@ var resolveCliDiscoveryProgressLogger = (command) => {
 };
 
 // src/commands/config-options.ts
-import { builtInRuleMetadata, SEVERITIES } from "@cloudburn/sdk";
+import { SEVERITIES, validateServices } from "@cloudburn/sdk";
 import { InvalidArgumentError as InvalidArgumentError2 } from "commander";
 var parseCommaSeparatedList = (value, itemLabel) => {
   const items = value.split(",").map((item) => item.trim()).filter((item) => item.length > 0);
@@ -1146,22 +1079,25 @@ var parseSeverity = (value) => {
 var parseRuleIdList = (value) => {
   return parseCommaSeparatedList(value, "rule ID");
 };
-var parseServiceList = (value) => parseCommaSeparatedList(value, "service").map((service) => service.toLowerCase());
+var parseServiceList = (mode) => (value) => {
+  const services = parseCommaSeparatedList(value, "service");
+  try {
+    return validateServices(services, mode);
+  } catch (err) {
+    throw new InvalidArgumentError2(err.message);
+  }
+};
 var parseSourceList = (value) => parseCommaSeparatedList(value, "source").map((source) => source.toLowerCase());
-var validateServiceList = (mode, services) => {
-  if (services === void 0) {
+var toModeConfigOverride = (mode, options) => {
+  if (options.enabledRules === void 0 && options.disabledRules === void 0 && options.service === void 0) {
     return void 0;
   }
-  const validServices = new Set(
-    builtInRuleMetadata.filter((rule) => rule.supports.includes(mode)).map((rule) => rule.service)
-  );
-  const invalidService = services.find((service) => !validServices.has(service));
-  if (invalidService) {
-    throw new InvalidArgumentError2(
-      `Unknown service "${invalidService}" for ${mode}. Allowed services: ${Array.from(validServices).sort().join(", ")}.`
-    );
-  }
-  return services;
+  const modeConfig = {
+    disabledRules: options.disabledRules,
+    enabledRules: options.enabledRules,
+    services: options.service
+  };
+  return mode === "iac" ? { iac: modeConfig } : { discovery: modeConfig };
 };
 
 // src/commands/discover.ts
@@ -1178,7 +1114,6 @@ var parseCacheMode = (value) => {
   }
   throw new InvalidArgumentError3("Cache mode must be normal, refresh, or off.");
 };
-var parseDiscoveryServiceList = (value) => validateServiceList("discovery", parseServiceList(value)) ?? [];
 var describeInitializationMessage = (result) => {
   const baseMessage = result.indexType === "aggregator" ? result.aggregatorAction === "promoted" ? `Promoted the existing local Resource Explorer index in ${result.aggregatorRegion} to the aggregator.` : result.aggregatorAction === "created" ? `Configured ${result.aggregatorRegion} as the Resource Explorer aggregator.` : result.coverage === "full" ? `Resource Explorer aggregator already exists in ${result.aggregatorRegion}.` : `Resource Explorer aggregator already exists in ${result.aggregatorRegion}, but only ${result.observedStatus.indexedRegionCount} of ${result.observedStatus.totalRegionCount} regions are indexed.` : result.status === "EXISTING" ? `Local Resource Explorer setup already exists in ${result.aggregatorRegion}.` : `Local Resource Explorer setup created in ${result.aggregatorRegion}.`;
   const indexSummaryParts = [];
@@ -1258,18 +1193,6 @@ var resolveNestedRegionOption = (command, subcommandName) => {
   }
   return rawArgs[optionIndex + 1];
 };
-var toDiscoveryConfigOverride = (options) => {
-  if (options.enabledRules === void 0 && options.disabledRules === void 0 && options.service === void 0) {
-    return void 0;
-  }
-  return {
-    discovery: {
-      disabledRules: options.disabledRules,
-      enabledRules: options.enabledRules,
-      services: options.service
-    }
-  };
-};
 var runCommand = async (action) => {
   try {
     process.exitCode = await action() ?? EXIT_CODE_OK;
@@ -1299,13 +1222,13 @@ var registerDiscoverCommand = (program) => {
     ).option(
       "--service <services>",
       "Comma-separated services to include in the discovery rule set.",
-      parseDiscoveryServiceList
+      parseServiceList("discovery")
     ).option("--exit-code", "Exit with code 1 when findings exist").option("--fail-on <severity>", "Exit with code 1 for findings at or above this severity.", parseSeverity).action(async (options, command) => {
       await runCommand(async () => {
         const debugLogger = resolveCliDebugLogger(command);
         const onProgress = resolveCliDiscoveryProgressLogger(command);
         const scanner = new CloudBurnClient({ debugLogger });
-        const configOverride = toDiscoveryConfigOverride(options);
+        const configOverride = toModeConfigOverride("discovery", options);
         const loadedConfig = await scanner.loadConfig(options.config);
         const discoveryOptions = {
           cache: {
@@ -1332,10 +1255,7 @@ var registerDiscoverCommand = (program) => {
         const output = renderResponse({ kind: "scan-result", result }, format);
         process.stdout.write(`${output}
 `);
-        if (hasPolicyViolation(result, {
-          exitCode: options.exitCode,
-          failOn: options.failOn
-        })) {
+        if (resolveScanPolicy(result, options).violated) {
           return EXIT_CODE_POLICY_VIOLATION;
         }
         return EXIT_CODE_OK;
@@ -1489,42 +1409,25 @@ var registerEstimateCommand = (program) => {
 };
 
 // src/commands/rules-list.ts
-import { builtInRuleMetadata as builtInRuleMetadata2 } from "@cloudburn/sdk";
+import { filterBuiltInRules } from "@cloudburn/sdk";
 import { InvalidArgumentError as InvalidArgumentError4 } from "commander";
 var VALID_SOURCES = ["discovery", "iac"];
-var validateSelectedValues = (values, validValues, label) => {
-  const invalidValue = values.find((value) => !validValues.has(value));
-  if (invalidValue !== void 0) {
-    throw new InvalidArgumentError4(
-      `Unknown ${label} "${invalidValue}". Allowed ${label}s: ${Array.from(validValues).sort().join(", ")}.`
-    );
+var parseRulesListSourceList = (value) => {
+  const sources = parseSourceList(value);
+  const invalidSource = sources.find((source) => !VALID_SOURCES.includes(source));
+  if (invalidSource !== void 0) {
+    throw new InvalidArgumentError4(`Unknown source "${invalidSource}". Allowed sources: ${VALID_SOURCES.join(", ")}.`);
   }
-  return values;
-};
-var parseRulesListServiceList = (value) => validateSelectedValues(parseServiceList(value), new Set(builtInRuleMetadata2.map((rule) => rule.service)), "service");
-var parseRulesListSourceList = (value) => validateSelectedValues(parseSourceList(value), new Set(VALID_SOURCES), "source");
-var filterRules = (options) => {
-  return builtInRuleMetadata2.filter((rule) => {
-    if (options.service !== void 0 && !options.service.includes(rule.service)) {
-      return false;
-    }
-    if (options.source !== void 0 && !options.source.some((source) => rule.supports.includes(source))) {
-      return false;
-    }
-    if (options.severity !== void 0 && rule.severity !== options.severity) {
-      return false;
-    }
-    return true;
-  });
+  return sources;
 };
 var registerRulesListCommand = (program) => {
   const rulesCommand = registerParentCommand(program, "rules", "Inspect built-in CloudBurn rules");
-  rulesCommand.command("list").description("List built-in CloudBurn rules").option("--service <services>", "Comma-separated services to include.", parseRulesListServiceList).option("--severity <severity>", "Severity to include (`high`, `medium`, `low`).", parseSeverity).option("--source <sources>", "Comma-separated sources to include (`iac`, `discovery`).", parseRulesListSourceList).action(function(options) {
+  rulesCommand.command("list").description("List built-in CloudBurn rules").option("--service <services>", "Comma-separated services to include.", parseServiceList()).option("--severity <severity>", "Severity to include (`high`, `medium`, `low`).", parseSeverity).option("--source <sources>", "Comma-separated sources to include (`iac`, `discovery`).", parseRulesListSourceList).action(function(options) {
     const output = renderResponse(
       {
         kind: "rule-list",
         emptyMessage: "No built-in rules are available.",
-        rules: filterRules(options)
+        rules: filterBuiltInRules({ services: options.service, severity: options.severity, sources: options.source })
       },
       resolveOutputFormat(this, void 0, "table")
     );
@@ -1534,20 +1437,7 @@ var registerRulesListCommand = (program) => {
 };
 
 // src/commands/scan.ts
-import { CloudBurnClient as CloudBurnClient2 } from "@cloudburn/sdk";
-var parseIaCServiceList = (value) => validateServiceList("iac", parseServiceList(value)) ?? [];
-var toScanConfigOverride = (options) => {
-  if (options.enabledRules === void 0 && options.disabledRules === void 0 && options.service === void 0) {
-    return void 0;
-  }
-  return {
-    iac: {
-      disabledRules: options.disabledRules,
-      enabledRules: options.enabledRules,
-      services: options.service
-    }
-  };
-};
+import { CloudBurnClient as CloudBurnClient2, resolveScanPolicy as resolveScanPolicy2 } from "@cloudburn/sdk";
 var registerScanCommand = (program) => {
   setCommandExamples(
     program.command("scan").description("Run an autodetected static IaC scan").argument("[path]", "Terraform file, CloudFormation template, or directory to scan").option("--config <path>", "Explicit CloudBurn config file to load (required for config files in CI)").option(
@@ -1558,22 +1448,23 @@ var registerScanCommand = (program) => {
       "--disabled-rules <ruleIds>",
       "Comma-separated rule IDs to disable from the default AWS Core preset.",
       parseRuleIdList
-    ).option("--service <services>", "Comma-separated services to include in the scan rule set.", parseIaCServiceList).option("--exit-code", "Exit with code 1 when findings exist").option("--fail-on <severity>", "Exit with code 1 for findings at or above this severity.", parseSeverity).action(async (path, options, command) => {
+    ).option(
+      "--service <services>",
+      "Comma-separated services to include in the scan rule set.",
+      parseServiceList("iac")
+    ).option("--exit-code", "Exit with code 1 when findings exist").option("--fail-on <severity>", "Exit with code 1 for findings at or above this severity.", parseSeverity).action(async (path, options, command) => {
       try {
         const debugLogger = resolveCliDebugLogger(command);
         const scanner = new CloudBurnClient2({ debugLogger });
-        const configOverride = toScanConfigOverride(options);
         const loadedConfig = await scanner.loadConfig(options.config);
-        const scanPath = path ?? process.cwd();
-        const result = configOverride === void 0 && options.config === void 0 ? await scanner.scanStatic(scanPath) : options.config === void 0 ? await scanner.scanStatic(scanPath, configOverride) : await scanner.scanStatic(scanPath, configOverride, { configPath: options.config });
+        const result = await scanner.scanStatic(path ?? process.cwd(), toModeConfigOverride("iac", options), {
+          configPath: options.config
+        });
         const format = resolveOutputFormat(command, void 0, loadedConfig.iac.format ?? "table");
         const output = renderResponse({ kind: "scan-result", result }, format);
         process.stdout.write(`${output}
 `);
-        if (hasPolicyViolation(result, {
-          exitCode: options.exitCode,
-          failOn: options.failOn
-        })) {
+        if (resolveScanPolicy2(result, options).violated) {
           process.exitCode = EXIT_CODE_POLICY_VIOLATION;
           return;
         }
@@ -1604,7 +1495,7 @@ var isCliEntrypoint = (moduleUrl, argvEntry = process.argv[1]) => {
 };
 var createProgram = () => {
   const program = createCliCommand();
-  program.name("cloudburn").usage("[command]").description("Know what you spend. Fix what you waste.").version("0.18.7").option("--debug", "Write execution trace messages to stderr").option("--format <format>", OUTPUT_FORMAT_OPTION_DESCRIPTION, parseOutputFormat);
+  program.name("cloudburn").usage("[command]").description("Know what you spend. Fix what you waste.").version("0.18.9").option("--debug", "Write execution trace messages to stderr").option("--format <format>", OUTPUT_FORMAT_OPTION_DESCRIPTION, parseOutputFormat);
   configureCliHelp(program);
   program.exitOverride();
   registerCompletionCommand(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudburn",
-  "version": "0.18.7",
+  "version": "0.18.9",
   "description": "Cloudburn CLI for cloud cost optimization",
   "homepage": "https://cloudburn.io/docs",
   "bugs": {
@@ -20,7 +20,7 @@
   ],
   "dependencies": {
     "commander": "^15.0.0",
-    "@cloudburn/sdk": "0.37.2"
+    "@cloudburn/sdk": "0.38.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.12",