A Terraform provider for Dokploy

Plugin-framework provider covering projects, environments, applications,
Compose stacks, managed databases, domains, mounts, ports, redirects,
basic auth, registries, SSH keys, certificates and backup destinations,
over Dokploy's tRPC-over-REST API.

The shim package exposes the provider to other Go modules, which is how
pulumi-dokploy bridges it.

.agents/skills/terraform-policy/examples/conversion/step-functions-state-machine-logging-enabled/README.md

@@ -0,0 +1,17 @@
+# Step Functions State Machine Logging Enabled
+
+## Source Sentinel Policy
+`step-functions-state-machine-logging-enabled.sentinel`
+
+## Conversion Quality
+`Good`
+
+## Why this is Good
+This policy is still a single-resource planned-value check, but it relies on a nested block (`logging_configuration`) and an allowlist of valid levels. tfpolicy can express that clearly with `core::try()` and a small local allowlist.
+
+## Key translation notes
+- Nested map access becomes direct block access through `attrs.logging_configuration[0].level`
+- The allowed log levels carry over directly into the tfpolicy version
+
+## Limitations encountered
+This relies on the provider exposing `logging_configuration` in the expected block/list shape. Otherwise, the enforcement intent maps cleanly.

.agents/skills/terraform-policy/examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.policy.hcl

@@ -0,0 +1,15 @@
+# Converted from HashiCorp PCI DSS Sentinel example: step-functions-state-machine-logging-enabled.sentinel
+# Conversion quality: Good
+
+resource_policy "aws_sfn_state_machine" "step_functions_state_machine_logging_enabled" {
+    locals {
+        logging_configuration = core::try(attrs.logging_configuration, [])
+        log_level = core::try(local.logging_configuration[0].level, "")
+        allowed_levels = ["ALL", "ERROR", "FATAL"]
+    }
+
+    enforce {
+        condition = core::contains(local.allowed_levels, local.log_level)
+        error_message = "Step Functions state machines must set logging_configuration.level to ALL, ERROR, or FATAL"
+    }
+}

.agents/skills/terraform-policy/examples/conversion/step-functions-state-machine-logging-enabled/step-functions-state-machine-logging-enabled.sentinel

@@ -0,0 +1,56 @@
+# This policy requires AWS Step Functions state machines to have logging configuration enabled with level set to "ALL", "ERROR", or "FATAL".
+
+# Copyright IBM Corp. 2025
+# SPDX-License-Identifier: BUSL-1.1
+
+# Imports
+import "tfplan/v2" as tfplan
+import "tfresources" as tf
+import "report" as report
+import "collection" as collection
+import "collection/maps" as maps
+
+# Constants
+const = {
+	"policy_name":         "sfn-logging-enabled",
+	"message":             "AWS Step Functions state machines must have logging enabled with level set to 'ALL', 'ERROR', or 'FATAL'. Refer to https://docs.aws.amazon.com/securityhub/latest/userguide/stepfunctions-controls.html#stepfunctions-1 for more details.",
+	"resource_aws_sfn":    "aws_sfn_state_machine",
+	"logging_config":      "logging_configuration",
+	"required_log_levels": ["ALL", "ERROR", "FATAL"],
+}
+
+# Variables
+resources = tf.plan(tfplan.planned_values.resources).type(const.resource_aws_sfn).resources
+
+violations = collection.reject(resources, func(res) {
+	logging_config = maps.get(res, "values." + const.logging_config, null)
+
+	if logging_config is null {
+		return false
+	}
+	log_level = maps.get(logging_config[0], "level", null)
+	if log_level is null {
+		return false
+	}
+
+	return log_level in const.required_log_levels
+})
+
+summary = {
+	"policy_name": const.policy_name,
+	"violations": map violations as _, v {
+		{
+			"address":        v.address,
+			"module_address": v.module_address,
+			"message":        const.message,
+		}
+	},
+}
+
+# Outputs
+print(report.generate_policy_report(summary))
+
+# Rules
+main = rule {
+	violations is empty
+}