@dataparade/cli 0.0.1

package/dist/src/analyzers/shared/manifest-fs.js

@@ -0,0 +1,138 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkForManifests = walkForManifests;
+const path = __importStar(require("path"));
+const fs_1 = require("fs");
+const gitignore_1 = require("../../ingest/gitignore");
+const scan_exclusions_1 = require("../../patterns/scan-exclusions");
+function patternToRegex(pattern) {
+    let escaped = pattern.replace(/[-\\^$+?.()|[\]{}*?]/g, "\\$&");
+    escaped = escaped.replace(/\\\*\\\*/g, ".*");
+    escaped = escaped.replace(/\\\*/g, "[^/]*");
+    escaped = escaped.replace(/\\\?/g, "[^/]");
+    return new RegExp(`^${escaped}$`);
+}
+function normalizeUserPattern(pattern) {
+    return (0, gitignore_1.toPosixPath)(pattern.replace(/^\.\/+/, "").trim());
+}
+function isExcludedByUserPatterns(relativePath, excludePaths) {
+    const rel = (0, gitignore_1.toPosixPath)(relativePath);
+    for (const rawPattern of excludePaths) {
+        const pattern = normalizeUserPattern(rawPattern);
+        if (!pattern)
+            continue;
+        if (pattern.endsWith("/**")) {
+            const prefix = pattern.slice(0, -3).replace(/\/$/, "");
+            if (rel === prefix || rel.startsWith(`${prefix}/`))
+                return true;
+        }
+        if (patternToRegex(pattern).test(rel))
+            return true;
+    }
+    return false;
+}
+async function walkForManifests(dir, out, options, accumulatedGitignoreRules = []) {
+    const { rootDir, state, isManifestFile } = options;
+    const excludePaths = options.excludePaths ?? [];
+    if (state.stopped)
+        return;
+    const gitignoreRules = await (0, gitignore_1.gitignoreRulesForDir)(dir, accumulatedGitignoreRules);
+    let entries;
+    try {
+        entries = await fs_1.promises.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (state.stopped)
+            return;
+        const entryPath = path.join(dir, entry.name);
+        const relativePath = (0, gitignore_1.toPosixPath)(path.relative(rootDir, entryPath));
+        if (entry.isDirectory()) {
+            if ((0, scan_exclusions_1.shouldSkipDirectoryName)(entry.name))
+                continue;
+            if (relativePath &&
+                isExcludedByUserPatterns(relativePath, excludePaths)) {
+                continue;
+            }
+            if ((0, gitignore_1.isPathIgnored)(entryPath, true, gitignoreRules)) {
+                continue;
+            }
+            await walkForManifests(entryPath, out, options, gitignoreRules);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        if ((0, gitignore_1.isPathIgnored)(entryPath, false, gitignoreRules)) {
+            continue;
+        }
+        if (relativePath &&
+            isExcludedByUserPatterns(relativePath, excludePaths)) {
+            continue;
+        }
+        if (!isManifestFile(entry, entryPath))
+            continue;
+        const rel = path.relative(rootDir, entryPath);
+        if (rel.startsWith("..") || path.isAbsolute(rel))
+            continue;
+        const stat = await fs_1.promises.stat(entryPath).catch(() => undefined);
+        const size = stat?.size ?? 0;
+        if (size > state.maxManifestFileSizeBytes) {
+            state.onWarning?.(`manifest-scan: skipping oversized manifest (${rel}) - size ${size}B exceeds limit ${state.maxManifestFileSizeBytes}B`);
+            continue;
+        }
+        if (state.manifestFiles >= state.maxManifestFiles) {
+            state.stopped = true;
+            if (!state.warned) {
+                state.warned = true;
+                state.onWarning?.(`manifest-scan: manifest scan budget exceeded (maxManifestFiles=${state.maxManifestFiles}). Stopping scan early.`);
+            }
+            return;
+        }
+        if (state.totalReadBytes + size > state.maxTotalManifestReadBytes) {
+            state.stopped = true;
+            if (!state.warned) {
+                state.warned = true;
+                state.onWarning?.(`manifest-scan: manifest scan budget exceeded (maxTotalManifestReadBytes=${state.maxTotalManifestReadBytes}). Stopping scan early.`);
+            }
+            return;
+        }
+        state.manifestFiles += 1;
+        state.totalReadBytes += size;
+        out.push(entryPath);
+    }
+}

package/dist/src/analyzers/shared/property-inference.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Maps YAML-driven pattern detection results to component properties.
+ *
+ * Property inference is intentionally driven by `cli/patterns/property.patterns.yaml`
+ * to avoid hard-coded inference mappings.
+ */
+import type { RawFinding } from "../../core/types/detection";
+export declare function getPropertiesFromFinding(finding: RawFinding, fileContent?: string): Record<string, unknown>;

package/dist/src/analyzers/shared/property-inference.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Maps YAML-driven pattern detection results to component properties.
+ *
+ * Property inference is intentionally driven by `cli/patterns/property.patterns.yaml`
+ * to avoid hard-coded inference mappings.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPropertiesFromFinding = getPropertiesFromFinding;
+const property_detection_config_1 = require("../../config/property-detection-config");
+function isTruthyValue(value) {
+    if (value === undefined || value === null)
+        return false;
+    if (typeof value === "string")
+        return value.trim().length > 0;
+    if (Array.isArray(value))
+        return value.length > 0;
+    return true;
+}
+function getContextValue(ctx, inputName) {
+    return ctx[inputName];
+}
+function evalCondition(when, ctx, out, regexes) {
+    if (!when)
+        return false;
+    if (when.always === true)
+        return true;
+    if (typeof when.notSet === "string") {
+        const key = String(when.notSet);
+        return out[key] === undefined;
+    }
+    if (typeof when.exists === "string") {
+        const val = getContextValue(ctx, String(when.exists));
+        return isTruthyValue(val);
+    }
+    if (when.regex && typeof when.regex === "object") {
+        const inputName = String(when.regex.input);
+        const regexName = String(when.regex.regex);
+        const re = regexes[regexName];
+        if (!re)
+            return false;
+        const val = getContextValue(ctx, inputName);
+        if (!isTruthyValue(val))
+            return false;
+        return re.test(String(val));
+    }
+    if (when.equals && typeof when.equals === "object") {
+        const inputName = String(when.equals.input);
+        const expected = when.equals.value;
+        const val = getContextValue(ctx, inputName);
+        if (!isTruthyValue(val))
+            return false;
+        return String(val) === String(expected);
+    }
+    if (Array.isArray(when.anyOf)) {
+        return when.anyOf.some((c) => evalCondition(c, ctx, out, regexes));
+    }
+    if (Array.isArray(when.allOf)) {
+        return when.allOf.every((c) => evalCondition(c, ctx, out, regexes));
+    }
+    if (when.not) {
+        return !evalCondition(when.not, ctx, out, regexes);
+    }
+    return false;
+}
+function resolveLookupTable(mapName, config) {
+    return config.lookupTables?.[mapName];
+}
+function resolveAssignment(assignment, ctx, out, config) {
+    if (assignment === undefined)
+        return undefined;
+    if (assignment === null)
+        return null;
+    const type = typeof assignment;
+    if (type !== "object") {
+        // Primitive constant.
+        return assignment;
+    }
+    const obj = assignment;
+    if (typeof obj.fromInput === "string") {
+        const v = getContextValue(ctx, obj.fromInput);
+        return v === undefined ? undefined : v;
+    }
+    if (obj.preferInputOrConstant &&
+        typeof obj.preferInputOrConstant === "object") {
+        const inputName = String(obj.preferInputOrConstant.input);
+        const fallback = obj.preferInputOrConstant.fallback;
+        const v = getContextValue(ctx, inputName);
+        return isTruthyValue(v) ? v : fallback;
+    }
+    if (obj.lookup && typeof obj.lookup === "object") {
+        const lookup = obj.lookup;
+        const mapName = String(lookup.map);
+        const keyInput = String(lookup.keyInput);
+        const transform = typeof lookup.transform === "string" ? lookup.transform : undefined;
+        const onMissing = lookup.onMissing;
+        const table = resolveLookupTable(mapName, config);
+        if (!table)
+            return undefined;
+        const keyVal = getContextValue(ctx, keyInput);
+        if (typeof keyVal !== "string")
+            return undefined;
+        const mapKey = transform === "lowercase" ? keyVal.toLowerCase() : keyVal;
+        const found = table[mapKey];
+        if (found === undefined) {
+            if (onMissing === "skip")
+                return undefined;
+            return undefined;
+        }
+        return found;
+    }
+    // Unknown object shape => treat as unset.
+    return undefined;
+}
+function applySet(setSpec, ctx, out, config) {
+    if (!setSpec || typeof setSpec !== "object")
+        return;
+    for (const [key, assignment] of Object.entries(setSpec)) {
+        const resolved = resolveAssignment(assignment, ctx, out, config);
+        if (resolved === undefined)
+            continue;
+        out[key] = resolved;
+    }
+}
+function getPropertiesFromFinding(finding, fileContent) {
+    const config = (0, property_detection_config_1.loadPropertyDetectionConfig)();
+    const { regexes, inferenceRules } = config;
+    const out = {};
+    const content = fileContent ?? "";
+    const props = (finding.properties ?? {});
+    const strategy = typeof props.strategy === "string" ? props.strategy : undefined;
+    const library = typeof props.library === "string" ? props.library : undefined;
+    const strategyStr = [strategy, library, content].filter(Boolean).join(" ");
+    const context = {
+        // Common inputs.
+        content,
+        key: typeof props.key === "string" ? props.key : undefined,
+        library,
+        strategy,
+        strategyStr,
+        // External API inputs.
+        serviceName: typeof props.serviceName === "string" ? props.serviceName : undefined,
+        documentationUrl: typeof props.documentationUrl === "string"
+            ? props.documentationUrl
+            : undefined,
+        apiVersion: typeof props.apiVersion === "string" ? props.apiVersion : undefined,
+        url: typeof props.url === "string" ? props.url : undefined,
+        // Route inputs.
+        httpMethods: props.httpMethods,
+        path: typeof props.path === "string" ? props.path : undefined,
+    };
+    const rules = inferenceRules[finding.pattern];
+    if (!Array.isArray(rules))
+        return out;
+    for (const rawRule of rules) {
+        const rule = rawRule;
+        if (!rule || typeof rule !== "object")
+            continue;
+        const ok = evalCondition(rule.when, context, out, regexes);
+        if (!ok)
+            continue;
+        applySet(rule.set, context, out, config);
+    }
+    return out;
+}

package/dist/src/analyzers/terraform/detector.d.ts

@@ -0,0 +1,10 @@
+import type { FileInfo } from "../../core/types/file";
+import type { RawFinding } from "../../core/types/detection";
+import type { TerraformPatternConfig } from "./terraform-detection-config";
+import type { TerraformModuleCallManifest } from "./terraform-module-manifest";
+export interface DetectTerraformPatternsOptions {
+    manifest?: TerraformModuleCallManifest;
+    /** Scan root path (same as CLI scan target); required when manifest is set */
+    scanRootPath?: string;
+}
+export declare function detectTerraformPatterns(file: FileInfo, config: TerraformPatternConfig, opts?: DetectTerraformPatternsOptions): RawFinding[];

package/dist/src/analyzers/terraform/detector.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectTerraformPatterns = detectTerraformPatterns;
+const terraform_detection_config_1 = require("./terraform-detection-config");
+const parser_1 = require("./parser");
+const terraform_utility_resource_1 = require("./terraform-utility-resource");
+const terraform_module_manifest_1 = require("./terraform-module-manifest");
+function findSatelliteParentAddress(block, config) {
+    const rt = block.resourceType ?? "";
+    if (!rt)
+        return undefined;
+    for (const rule of config.satelliteRules) {
+        if (!rule.childResourceTypeRegex.test(rt))
+            continue;
+        const lines = block.bodyText.split(/\r?\n/);
+        for (const line of lines) {
+            const trimmed = (0, parser_1.lineBeforeHashComment)(line).trim();
+            const m = rule.parentLineRegex.exec(trimmed);
+            const g = m?.[rule.parentCaptureGroup];
+            if (typeof g === "string" && g.trim()) {
+                return g.trim();
+            }
+        }
+    }
+    return undefined;
+}
+const RESERVED_REF_FIRST = new Set([
+    "module",
+    "data",
+    "provider",
+    "var",
+    "local",
+    "each",
+    "path",
+    "terraform",
+    "count",
+]);
+/**
+ * Prefix a `type.name[...]` reference when it refers to another resource in the
+ * same module instance (not already absolute with `module.` / `data.` / …).
+ */
+function qualifyTerraformReference(ref, instancePrefix) {
+    if (!instancePrefix)
+        return ref;
+    const first = (ref.split(".")[0] ?? "").toLowerCase();
+    if (RESERVED_REF_FIRST.has(first))
+        return ref;
+    const parts = ref.split(".").filter(Boolean);
+    if (parts.length < 2)
+        return ref;
+    return `${instancePrefix}.${parts[0]}.${parts[1]}`;
+}
+function qualifyTerraformAddress(logicalAddress, instancePrefix) {
+    if (!instancePrefix)
+        return logicalAddress;
+    return `${instancePrefix}.${logicalAddress}`;
+}
+function detectTerraformPatterns(file, config, opts) {
+    if (file.language !== "terraform")
+        return [];
+    const { blocks } = (0, parser_1.parseTerraformFile)(file, config);
+    const findings = [];
+    const sectionId = (0, parser_1.sectionIdFromFilePath)(file.path);
+    const sectionLabel = (0, parser_1.sectionLabelFromFilePath)(file.path);
+    const manifest = opts?.manifest;
+    const scanRoot = opts?.scanRootPath;
+    const instancePrefixes = manifest && scanRoot
+        ? (0, terraform_module_manifest_1.moduleInstancePrefixesForFile)(manifest, scanRoot, file.path)
+        : [];
+    const passes = instancePrefixes.length > 0 ? instancePrefixes : [""];
+    const emitModuleAndProvider = instancePrefixes.length === 0;
+    for (const instancePrefix of passes) {
+        const q = (addr) => qualifyTerraformAddress(addr, instancePrefix);
+        const addressSet = new Set(blocks.map((b) => q(b.address)));
+        const omittedTerraformAddresses = new Set();
+        for (const block of blocks) {
+            if (block.kind !== "resource" && block.kind !== "data")
+                continue;
+            const rt = block.resourceType ?? "";
+            if (rt && (0, terraform_utility_resource_1.isTerraformOmittedFromServiceGraphResourceType)(rt)) {
+                omittedTerraformAddresses.add(q(block.address));
+            }
+        }
+        const satelliteChildAddresses = new Set();
+        const satelliteParentByChild = new Map();
+        for (const block of blocks) {
+            if (block.kind !== "resource" && block.kind !== "data")
+                continue;
+            const parentAddr = findSatelliteParentAddress(block, config);
+            if (parentAddr && addressSet.has(q(parentAddr))) {
+                satelliteChildAddresses.add(q(block.address));
+                satelliteParentByChild.set(q(block.address), q(parentAddr));
+            }
+        }
+        const satellitesByParent = new Map();
+        for (const block of blocks) {
+            const qa = q(block.address);
+            if (!satelliteChildAddresses.has(qa))
+                continue;
+            const parentAddr = satelliteParentByChild.get(qa);
+            if (!parentAddr)
+                continue;
+            const list = satellitesByParent.get(parentAddr) ?? [];
+            list.push(block);
+            satellitesByParent.set(parentAddr, list);
+        }
+        for (const block of blocks) {
+            const location = (0, parser_1.blockSourceLocation)(file.path, block.startLine, block.endLine);
+            if (block.kind === "resource" || block.kind === "data") {
+                const qa = q(block.address);
+                if (satelliteChildAddresses.has(qa)) {
+                    continue;
+                }
+                const rt = block.resourceType ?? "unknown";
+                if ((0, terraform_utility_resource_1.isTerraformOmittedFromServiceGraphResourceType)(rt)) {
+                    continue;
+                }
+                const hints = (0, terraform_detection_config_1.lookupTerraformResourceHints)(rt, config);
+                const rawRefs = (0, parser_1.extractTerraformReferences)(block.bodyText, config).filter((r) => r !== block.address && !omittedTerraformAddresses.has(q(r)));
+                const refs = new Set(rawRefs.map((r) => qualifyTerraformReference(r, instancePrefix)));
+                const mergedSats = satellitesByParent.get(qa) ?? [];
+                const terraform_satellites = mergedSats.map((s) => ({
+                    terraform_address: q(s.address),
+                    resource_type: s.resourceType ?? "unknown",
+                    start_line: s.startLine,
+                    end_line: s.endLine,
+                }));
+                for (const sat of mergedSats) {
+                    for (const r of (0, parser_1.extractTerraformReferences)(sat.bodyText, config)) {
+                        if (r !== block.address && !omittedTerraformAddresses.has(q(r))) {
+                            refs.add(qualifyTerraformReference(r, instancePrefix));
+                        }
+                    }
+                }
+                findings.push({
+                    pattern: "terraform_resource",
+                    name: qa,
+                    confidence: 0.9,
+                    location,
+                    properties: {
+                        terraform_address: qa,
+                        terraform_block_kind: block.kind,
+                        resource_type: rt,
+                        block_name: block.blockName,
+                        componentSubType: hints.componentSubType,
+                        cloud_provider: hints.cloud_provider,
+                        section_id: sectionId,
+                        section_label: sectionLabel,
+                        terraform_references: Array.from(refs).sort((a, b) => a.localeCompare(b)),
+                        ...(instancePrefix
+                            ? { terraform_module_instance: instancePrefix }
+                            : {}),
+                        ...(terraform_satellites.length > 0
+                            ? { terraform_satellites }
+                            : {}),
+                    },
+                });
+                continue;
+            }
+            if (!emitModuleAndProvider) {
+                continue;
+            }
+            if (block.kind === "module") {
+                findings.push({
+                    pattern: "terraform_module",
+                    name: `module:${block.blockName}`,
+                    confidence: 0.88,
+                    location,
+                    properties: {
+                        terraform_address: block.address,
+                        module_name: block.blockName,
+                        componentSubType: "application",
+                        section_id: sectionId,
+                        section_label: sectionLabel,
+                    },
+                });
+                continue;
+            }
+            if (block.kind === "provider") {
+                const pn = block.blockName;
+                findings.push({
+                    pattern: "terraform_provider",
+                    name: `provider:${pn}`,
+                    confidence: 0.92,
+                    location,
+                    properties: {
+                        terraform_address: block.address,
+                        provider_name: pn,
+                        serviceName: (0, terraform_detection_config_1.lookupTerraformProviderServiceName)(pn, config),
+                        section_id: sectionId,
+                        section_label: sectionLabel,
+                    },
+                });
+            }
+        }
+    }
+    return findings;
+}

package/dist/src/analyzers/terraform/index.d.ts

@@ -0,0 +1,2 @@
+import type { Analyzer } from "../types";
+export declare function createTerraformAnalyzer(): Analyzer;

package/dist/src/analyzers/terraform/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTerraformAnalyzer = createTerraformAnalyzer;
+const detector_1 = require("./detector");
+const terraform_detection_config_1 = require("./terraform-detection-config");
+function createTerraformAnalyzer() {
+    const config = (0, terraform_detection_config_1.loadTerraformPatternConfig)();
+    return {
+        detect(file) {
+            return (0, detector_1.detectTerraformPatterns)(file, config);
+        },
+    };
+}

package/dist/src/analyzers/terraform/parser.d.ts

@@ -0,0 +1,29 @@
+import type { FileInfo, SourceLocation } from "../../core/types/file";
+import type { TerraformPatternConfig } from "./terraform-detection-config";
+export type TerraformBlockKind = "resource" | "data" | "module" | "provider";
+export interface ParsedTerraformBlock {
+    kind: TerraformBlockKind;
+    /** First quoted label for resource/data (e.g. aws_lambda_function); provider name for provider; omitted for module. */
+    resourceType?: string;
+    /** Second quoted label for resource/data; module name for module. */
+    blockName: string;
+    address: string;
+    startLine: number;
+    endLine: number;
+    bodyText: string;
+}
+export interface ParseTerraformFileResult {
+    blocks: ParsedTerraformBlock[];
+    warnings: string[];
+}
+export declare function lineBeforeHashComment(raw: string): string;
+/**
+ * Net `{` minus `}` on a line, ignoring braces inside double-quoted strings
+ * and treating `#` as line comment start (best-effort; heredocs not modeled).
+ */
+export declare function lineBraceDelta(line: string): number;
+export declare function parseTerraformFile(file: FileInfo, config: TerraformPatternConfig): ParseTerraformFileResult;
+export declare function extractTerraformReferences(bodyText: string, config: TerraformPatternConfig): string[];
+export declare function sectionIdFromFilePath(filePath: string): string;
+export declare function sectionLabelFromFilePath(filePath: string): string;
+export declare function blockSourceLocation(filePath: string, startLine: number, endLine: number): SourceLocation;