@dataparade/cli 0.0.1

package/dist/src/analyzers/terraform/parser.js

@@ -0,0 +1,202 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lineBeforeHashComment = lineBeforeHashComment;
+exports.lineBraceDelta = lineBraceDelta;
+exports.parseTerraformFile = parseTerraformFile;
+exports.extractTerraformReferences = extractTerraformReferences;
+exports.sectionIdFromFilePath = sectionIdFromFilePath;
+exports.sectionLabelFromFilePath = sectionLabelFromFilePath;
+exports.blockSourceLocation = blockSourceLocation;
+const path = __importStar(require("path"));
+function lineBeforeHashComment(raw) {
+    const idx = raw.indexOf("#");
+    if (idx === -1)
+        return raw;
+    return raw.slice(0, idx);
+}
+/**
+ * Net `{` minus `}` on a line, ignoring braces inside double-quoted strings
+ * and treating `#` as line comment start (best-effort; heredocs not modeled).
+ */
+function lineBraceDelta(line) {
+    let delta = 0;
+    let inDouble = false;
+    for (let i = 0; i < line.length; i += 1) {
+        const ch = line[i];
+        if (inDouble) {
+            if (ch === "\\" && i + 1 < line.length) {
+                i += 1;
+                continue;
+            }
+            if (ch === '"')
+                inDouble = false;
+            continue;
+        }
+        if (ch === '"') {
+            inDouble = true;
+            continue;
+        }
+        if (ch === "#")
+            break;
+        if (ch === "{")
+            delta += 1;
+        if (ch === "}")
+            delta -= 1;
+    }
+    return delta;
+}
+function matchBlockLine(trimmed, config) {
+    for (const bp of config.syntax.blockPatterns) {
+        const m = bp.regex.exec(trimmed);
+        if (!m)
+            continue;
+        const blockName = m[bp.blockNameGroup]?.trim();
+        if (!blockName)
+            continue;
+        let resourceType;
+        if (typeof bp.resourceTypeGroup === "number") {
+            resourceType = m[bp.resourceTypeGroup]?.trim();
+            if (!resourceType)
+                continue;
+        }
+        return { kind: bp.kind, resourceType, blockName };
+    }
+    return undefined;
+}
+function applyTemplate(template, m) {
+    return template.replace(/\$(\d+)/g, (_, idx) => {
+        const n = Number(idx);
+        const v = m[n];
+        return typeof v === "string" ? v : "";
+    });
+}
+function computeAddress(kind, resourceType, blockName) {
+    if (kind === "module")
+        return `module.${blockName}`;
+    if (kind === "provider")
+        return `provider.${blockName}`;
+    if (kind === "data" && resourceType)
+        return `data.${resourceType}.${blockName}`;
+    if (kind === "resource" && resourceType)
+        return `${resourceType}.${blockName}`;
+    return blockName;
+}
+function parseTerraformFile(file, config) {
+    const warnings = [];
+    const blocks = [];
+    if (file.language !== "terraform") {
+        warnings.push(`parseTerraformFile called for non-terraform file '${file.path}'.`);
+        return { blocks, warnings };
+    }
+    const lines = file.content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+        const trimmed = lineBeforeHashComment(lines[i]).trim();
+        if (!trimmed || !config.syntax.blockLineProbe.test(trimmed))
+            continue;
+        const startLine = i + 1;
+        const matched = matchBlockLine(trimmed, config);
+        if (!matched)
+            continue;
+        const { kind, resourceType, blockName } = matched;
+        let depth = lineBraceDelta(lines[i]);
+        if (depth <= 0) {
+            warnings.push(`Terraform block at ${file.path}:${startLine} has no opening brace depth; skipping.`);
+            continue;
+        }
+        const bodyStartIdx = i + 1;
+        let j = bodyStartIdx;
+        while (j < lines.length && depth > 0) {
+            depth += lineBraceDelta(lines[j]);
+            j += 1;
+        }
+        if (depth !== 0) {
+            warnings.push(`Unbalanced braces for Terraform block starting at ${file.path}:${startLine}.`);
+            break;
+        }
+        const endLine = j;
+        const bodyLines = lines.slice(i, j);
+        const bodyText = bodyLines.join("\n");
+        const address = computeAddress(kind, resourceType, blockName);
+        blocks.push({
+            kind,
+            resourceType,
+            blockName,
+            address,
+            startLine,
+            endLine,
+            bodyText,
+        });
+        i = j - 1;
+    }
+    return { blocks, warnings };
+}
+function extractTerraformReferences(bodyText, config) {
+    const refs = new Set();
+    for (const rp of config.referencePatterns) {
+        for (const m of bodyText.matchAll(rp.regex)) {
+            if (rp.skipWhenFirstTokenReserved) {
+                const first = m[1]?.toLowerCase();
+                if (first && config.reservedReferencePrefixes.has(first))
+                    continue;
+            }
+            const addr = applyTemplate(rp.template, m).trim();
+            if (addr)
+                refs.add(addr);
+        }
+    }
+    return Array.from(refs).sort((a, b) => a.localeCompare(b));
+}
+function sectionIdFromFilePath(filePath) {
+    const dir = path.posix.dirname(filePath.replace(/\\/g, "/"));
+    return dir === "." ? "root" : dir;
+}
+function sectionLabelFromFilePath(filePath) {
+    const posix = filePath.replace(/\\/g, "/");
+    const dir = path.posix.dirname(posix);
+    if (dir === ".") {
+        const base = path.posix.basename(posix);
+        return base.replace(/\.(tf|tfvars)$/i, "") || "terraform";
+    }
+    const leaf = path.posix.basename(dir);
+    return leaf || "terraform";
+}
+function blockSourceLocation(filePath, startLine, endLine) {
+    return {
+        filePath,
+        startLine,
+        endLine,
+    };
+}

package/dist/src/analyzers/terraform/terraform-detection-config.d.ts

@@ -0,0 +1,48 @@
+export interface TerraformResourceHints {
+    componentSubType: string;
+    cloud_provider: string;
+}
+export interface TerraformBlockPatternCompiled {
+    kind: "resource" | "data" | "module" | "provider";
+    regex: RegExp;
+    resourceTypeGroup?: number;
+    blockNameGroup: number;
+}
+export interface TerraformSyntaxCompiled {
+    blockLineProbe: RegExp;
+    blockPatterns: TerraformBlockPatternCompiled[];
+}
+export interface TerraformReferencePatternCompiled {
+    id: string;
+    regex: RegExp;
+    template: string;
+    skipWhenFirstTokenReserved: boolean;
+}
+export interface TerraformSatelliteRuleCompiled {
+    id: string;
+    childResourceTypeRegex: RegExp;
+    parentLineRegex: RegExp;
+    parentCaptureGroup: number;
+}
+export interface TerraformResourceTypeHintCompiled {
+    id: string;
+    regex: RegExp;
+    componentSubType: string;
+    cloud_provider: string;
+}
+export interface TerraformProviderServiceNameCompiled {
+    regex: RegExp;
+    serviceName: string;
+}
+export interface TerraformPatternConfig {
+    syntax: TerraformSyntaxCompiled;
+    reservedReferencePrefixes: Set<string>;
+    referencePatterns: TerraformReferencePatternCompiled[];
+    satelliteRules: TerraformSatelliteRuleCompiled[];
+    resourceTypeHints: TerraformResourceTypeHintCompiled[];
+    providerServiceNames: TerraformProviderServiceNameCompiled[];
+}
+export declare function clearTerraformPatternConfigCache(): void;
+export declare function loadTerraformPatternConfig(): TerraformPatternConfig;
+export declare function lookupTerraformResourceHints(resourceType: string, config: TerraformPatternConfig): TerraformResourceHints;
+export declare function lookupTerraformProviderServiceName(providerName: string, config: TerraformPatternConfig): string;

package/dist/src/analyzers/terraform/terraform-detection-config.js

@@ -0,0 +1,218 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearTerraformPatternConfigCache = clearTerraformPatternConfigCache;
+exports.loadTerraformPatternConfig = loadTerraformPatternConfig;
+exports.lookupTerraformResourceHints = lookupTerraformResourceHints;
+exports.lookupTerraformProviderServiceName = lookupTerraformProviderServiceName;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const yaml_1 = __importDefault(require("yaml"));
+function compileRegex(pattern, flags) {
+    try {
+        return new RegExp(pattern, flags ?? "");
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid regex '${pattern}': ${msg}`);
+    }
+}
+function getPatternsFilePath() {
+    const parts = __dirname.split(path_1.default.sep);
+    const distIndex = parts.lastIndexOf("dist");
+    const cliRoot = distIndex !== -1
+        ? parts.slice(0, distIndex).join(path_1.default.sep)
+        : path_1.default.resolve(__dirname, "../../..");
+    return path_1.default.join(cliRoot, "patterns", "terraform.patterns.yaml");
+}
+function getPatternsDirForGeneratedHints() {
+    const parts = __dirname.split(path_1.default.sep);
+    const distIndex = parts.lastIndexOf("dist");
+    const cliRoot = distIndex !== -1
+        ? parts.slice(0, distIndex).join(path_1.default.sep)
+        : path_1.default.resolve(__dirname, "../../..");
+    return path_1.default.join(cliRoot, "patterns");
+}
+function mergeGeneratedHintsAtYamlAnchor(hints, anchorId, fileName) {
+    const idx = hints.findIndex((h) => h.id === anchorId);
+    if (idx < 0)
+        return hints;
+    const genPath = path_1.default.join(getPatternsDirForGeneratedHints(), fileName);
+    let gen = [];
+    try {
+        const text = fs_1.default.readFileSync(genPath, "utf8");
+        const parsed = JSON.parse(text);
+        gen = parsed.hints ?? [];
+    }
+    catch {
+        return hints;
+    }
+    if (gen.length === 0)
+        return hints;
+    return [...hints.slice(0, idx), ...gen, ...hints.slice(idx)];
+}
+/**
+ * Inserts CDKTF-derived `aws_<service>_` / `azurerm_<service>_` hints immediately
+ * before each provider's default `^aws_` / `^azurerm_` catch-all rules.
+ */
+function mergeProviderGeneratedResourceHints(hints) {
+    let merged = mergeGeneratedHintsAtYamlAnchor(hints, "aws_default_family", "aws-terraform-service-hints.generated.json");
+    merged = mergeGeneratedHintsAtYamlAnchor(merged, "azurerm_default_family", "azure-terraform-service-hints.generated.json");
+    merged = mergeGeneratedHintsAtYamlAnchor(merged, "kubernetes_default_family", "kubernetes-terraform-service-hints.generated.json");
+    return merged;
+}
+let cachedConfig;
+function clearTerraformPatternConfigCache() {
+    cachedConfig = undefined;
+}
+function normalizeConfig(raw) {
+    if (!raw.syntax?.block_line_probe_regex) {
+        throw new Error("terraform.patterns.yaml: missing syntax.block_line_probe_regex");
+    }
+    const blockLineProbe = compileRegex(raw.syntax.block_line_probe_regex);
+    const rawPatterns = raw.syntax.block_patterns;
+    if (!Array.isArray(rawPatterns) || rawPatterns.length === 0) {
+        throw new Error("terraform.patterns.yaml: syntax.block_patterns must be a non-empty array");
+    }
+    const blockPatterns = [];
+    for (const bp of rawPatterns) {
+        if (!bp.kind || !bp.regex || typeof bp.block_name_group !== "number") {
+            throw new Error("terraform.patterns.yaml: each block_patterns entry needs kind, regex, block_name_group");
+        }
+        if (!["resource", "data", "module", "provider"].includes(bp.kind)) {
+            throw new Error(`terraform.patterns.yaml: invalid block kind '${bp.kind}'`);
+        }
+        const kind = bp.kind;
+        if ((kind === "resource" || kind === "data") &&
+            typeof bp.resource_type_group !== "number") {
+            throw new Error(`terraform.patterns.yaml: block pattern '${kind}' requires resource_type_group`);
+        }
+        blockPatterns.push({
+            kind,
+            regex: compileRegex(bp.regex),
+            resourceTypeGroup: bp.resource_type_group,
+            blockNameGroup: bp.block_name_group,
+        });
+    }
+    const reserved = new Set((raw.reserved_reference_first_tokens ?? []).map((s) => String(s).toLowerCase()));
+    const refPatternsRaw = raw.reference_patterns;
+    if (!Array.isArray(refPatternsRaw) || refPatternsRaw.length === 0) {
+        throw new Error("terraform.patterns.yaml: reference_patterns required");
+    }
+    const referencePatterns = [];
+    for (const rp of refPatternsRaw) {
+        if (!rp.id || !rp.regex || !rp.template) {
+            throw new Error("terraform.patterns.yaml: each reference_patterns entry needs id, regex, template");
+        }
+        referencePatterns.push({
+            id: rp.id,
+            regex: compileRegex(rp.regex, rp.flags ?? "gi"),
+            template: rp.template,
+            skipWhenFirstTokenReserved: Boolean(rp.skip_when_first_token_reserved),
+        });
+    }
+    const satelliteRules = [];
+    for (const sr of raw.satellite_resource_rules ?? []) {
+        if (!sr.id ||
+            !sr.child_resource_type_regex ||
+            !sr.parent_address_from_body_line?.regex) {
+            throw new Error("terraform.patterns.yaml: invalid satellite_resource_rules entry");
+        }
+        const cg = sr.parent_address_from_body_line.capture_group;
+        if (typeof cg !== "number" || cg < 1) {
+            throw new Error(`terraform.patterns.yaml: satellite '${sr.id}' needs parent_address_from_body_line.capture_group >= 1`);
+        }
+        satelliteRules.push({
+            id: sr.id,
+            childResourceTypeRegex: compileRegex(sr.child_resource_type_regex),
+            parentLineRegex: compileRegex(sr.parent_address_from_body_line.regex),
+            parentCaptureGroup: cg,
+        });
+    }
+    const hintsRaw = mergeProviderGeneratedResourceHints(raw.resource_type_hints ?? []);
+    if (!Array.isArray(hintsRaw) || hintsRaw.length === 0) {
+        throw new Error("terraform.patterns.yaml: resource_type_hints required");
+    }
+    const resourceTypeHints = [];
+    for (const h of hintsRaw) {
+        if (!h.id || !h.resource_type_regex || !h.componentSubType || !h.cloud_provider) {
+            throw new Error("terraform.patterns.yaml: each resource_type_hints entry needs id, resource_type_regex, componentSubType, cloud_provider");
+        }
+        resourceTypeHints.push({
+            id: h.id,
+            regex: compileRegex(h.resource_type_regex),
+            componentSubType: h.componentSubType,
+            cloud_provider: h.cloud_provider,
+        });
+    }
+    const providerServiceNames = [];
+    for (const p of raw.provider_service_names ?? []) {
+        if (!p.provider_key_regex || !p.serviceName) {
+            throw new Error("terraform.patterns.yaml: provider_service_names entries need provider_key_regex and serviceName");
+        }
+        providerServiceNames.push({
+            regex: compileRegex(p.provider_key_regex, "i"),
+            serviceName: p.serviceName,
+        });
+    }
+    return {
+        syntax: { blockLineProbe, blockPatterns },
+        reservedReferencePrefixes: reserved,
+        referencePatterns,
+        satelliteRules,
+        resourceTypeHints,
+        providerServiceNames,
+    };
+}
+function loadTerraformPatternConfig() {
+    if (process.env.NODE_ENV !== "test" && cachedConfig) {
+        return cachedConfig;
+    }
+    const patternsPath = getPatternsFilePath();
+    let rawText;
+    try {
+        rawText = fs_1.default.readFileSync(patternsPath, "utf8");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Terraform pattern config is required but could not be read from '${patternsPath}': ${message}`);
+    }
+    const parsed = yaml_1.default.parse(rawText);
+    if (!parsed || typeof parsed !== "object") {
+        throw new Error(`Terraform pattern config at '${patternsPath}' did not parse to an object.`);
+    }
+    try {
+        const normalized = normalizeConfig(parsed);
+        if (process.env.NODE_ENV !== "test") {
+            cachedConfig = normalized;
+        }
+        return normalized;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid Terraform pattern config at '${patternsPath}': ${message}`);
+    }
+}
+function lookupTerraformResourceHints(resourceType, config) {
+    const rt = resourceType.trim();
+    for (const h of config.resourceTypeHints) {
+        if (h.regex.test(rt)) {
+            return {
+                componentSubType: h.componentSubType,
+                cloud_provider: h.cloud_provider,
+            };
+        }
+    }
+    return { componentSubType: "application", cloud_provider: "unknown" };
+}
+function lookupTerraformProviderServiceName(providerName, config) {
+    const key = providerName.trim();
+    for (const row of config.providerServiceNames) {
+        if (row.regex.test(key)) {
+            return row.serviceName;
+        }
+    }
+    return `Terraform provider (${key})`;
+}

package/dist/src/analyzers/terraform/terraform-exec.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Run `terraform show -json <planFile>` with cwd set to the scan root.
+ * Requires the `terraform` binary on `PATH`.
+ */
+export declare function runTerraformShowJsonSync(scanRoot: string, planRelativePath: string): {
+    ok: true;
+    doc: Record<string, unknown>;
+} | {
+    ok: false;
+    message: string;
+};

package/dist/src/analyzers/terraform/terraform-exec.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runTerraformShowJsonSync = runTerraformShowJsonSync;
+const child_process_1 = require("child_process");
+/**
+ * Run `terraform show -json <planFile>` with cwd set to the scan root.
+ * Requires the `terraform` binary on `PATH`.
+ */
+function runTerraformShowJsonSync(scanRoot, planRelativePath) {
+    const result = (0, child_process_1.spawnSync)("terraform", ["show", "-json", planRelativePath], {
+        cwd: scanRoot,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    if (result.error) {
+        return { ok: false, message: result.error.message };
+    }
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === "string"
+            ? result.stderr
+            : String(result.stderr ?? "");
+        return {
+            ok: false,
+            message: stderr.trim() || `terraform exited with code ${result.status}`,
+        };
+    }
+    try {
+        const doc = JSON.parse(result.stdout);
+        return { ok: true, doc };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { ok: false, message: `invalid JSON from terraform show: ${msg}` };
+    }
+}

package/dist/src/analyzers/terraform/terraform-module-manifest.d.ts

@@ -0,0 +1,19 @@
+import type { FileInfo } from "../../core/types/file";
+export interface TerraformModuleCallManifest {
+    /**
+     * Module source directory relative to scan root (posix, no trailing slash)
+     * → Terraform module instance addresses declared in HCL (e.g. `module.vpc`).
+     */
+    instancesByModuleSourceDir: Map<string, string[]>;
+}
+/**
+ * Walk all Terraform files, parse `module` blocks, and index which HCL module
+ * instance addresses (`module.foo`) target which on-disk module directory
+ * (relative to the scan root). Used to qualify resource addresses inside
+ * shared module sources so references and provider flows line up with root
+ * `module.*` calls.
+ */
+export declare function buildTerraformModuleCallManifest(scanRootPath: string, files: FileInfo[]): TerraformModuleCallManifest;
+/** Directory of `filePath` relative to scan root (posix). */
+export declare function terraformModuleDirKeyRelativeToRoot(scanRootPath: string, filePath: string): string;
+export declare function moduleInstancePrefixesForFile(manifest: TerraformModuleCallManifest | undefined, scanRootPath: string, filePath: string): string[];

package/dist/src/analyzers/terraform/terraform-module-manifest.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildTerraformModuleCallManifest = buildTerraformModuleCallManifest;
+exports.terraformModuleDirKeyRelativeToRoot = terraformModuleDirKeyRelativeToRoot;
+exports.moduleInstancePrefixesForFile = moduleInstancePrefixesForFile;
+const path_1 = __importDefault(require("path"));
+const terraform_detection_config_1 = require("./terraform-detection-config");
+const parser_1 = require("./parser");
+const MODULE_SOURCE_LINE = /^\s*source\s*=\s*"([^"]+)"\s*$/m;
+function posix(p) {
+    return p.replace(/\\/g, "/");
+}
+function isFilesystemModuleSource(source) {
+    const s = source.trim();
+    if (!s)
+        return false;
+    return s.startsWith(".") || s.startsWith("/") || s.startsWith("..");
+}
+/**
+ * Walk all Terraform files, parse `module` blocks, and index which HCL module
+ * instance addresses (`module.foo`) target which on-disk module directory
+ * (relative to the scan root). Used to qualify resource addresses inside
+ * shared module sources so references and provider flows line up with root
+ * `module.*` calls.
+ */
+function buildTerraformModuleCallManifest(scanRootPath, files) {
+    const rootAbs = path_1.default.resolve(scanRootPath);
+    const instancesByModuleSourceDir = new Map();
+    const config = (0, terraform_detection_config_1.loadTerraformPatternConfig)();
+    for (const file of files) {
+        if (file.language !== "terraform")
+            continue;
+        const { blocks } = (0, parser_1.parseTerraformFile)(file, config);
+        const fromDirAbs = path_1.default.resolve(rootAbs, path_1.default.dirname(file.path));
+        for (const block of blocks) {
+            if (block.kind !== "module")
+                continue;
+            const srcMatch = MODULE_SOURCE_LINE.exec(block.bodyText);
+            if (!srcMatch)
+                continue;
+            const sourceRaw = srcMatch[1]?.trim();
+            if (!sourceRaw || !isFilesystemModuleSource(sourceRaw))
+                continue;
+            const moduleSourceAbs = path_1.default.resolve(fromDirAbs, sourceRaw);
+            const relDir = posix(path_1.default.relative(rootAbs, moduleSourceAbs));
+            if (!relDir || relDir.startsWith(".."))
+                continue;
+            const fq = block.address;
+            if (!fq.startsWith("module."))
+                continue;
+            const list = instancesByModuleSourceDir.get(relDir) ?? [];
+            list.push(fq);
+            instancesByModuleSourceDir.set(relDir, list);
+        }
+    }
+    for (const [k, v] of instancesByModuleSourceDir) {
+        instancesByModuleSourceDir.set(k, Array.from(new Set(v)).sort((a, b) => a.localeCompare(b)));
+    }
+    return { instancesByModuleSourceDir };
+}
+/** Directory of `filePath` relative to scan root (posix). */
+function terraformModuleDirKeyRelativeToRoot(scanRootPath, filePath) {
+    const rootAbs = path_1.default.resolve(scanRootPath);
+    const dirAbs = path_1.default.resolve(rootAbs, path_1.default.dirname(filePath));
+    return posix(path_1.default.relative(rootAbs, dirAbs));
+}
+function moduleInstancePrefixesForFile(manifest, scanRootPath, filePath) {
+    if (!manifest)
+        return [];
+    const dirKey = terraformModuleDirKeyRelativeToRoot(scanRootPath, filePath);
+    return manifest.instancesByModuleSourceDir.get(dirKey) ?? [];
+}

package/dist/src/analyzers/terraform/terraform-show-json.d.ts

@@ -0,0 +1,15 @@
+import type { RawFinding } from "../../core/types/detection";
+export interface TerraformJsonMergeResult {
+    findings: RawFinding[];
+    mergedCount: number;
+}
+/**
+ * Parse a `terraform show -json` object (plan or state) and emit `RawFinding`s
+ * for addresses not already present in `existingFindings`.
+ */
+export declare function mergeTerraformShowJsonFromDoc(existingFindings: RawFinding[], doc: Record<string, unknown>, syntheticFileLabel: string, onWarning?: (message: string) => void): TerraformJsonMergeResult;
+/**
+ * Parse a `terraform show -json` file (plan or state) and emit `RawFinding`s
+ * for addresses not already present in `existingFindings` (static `.tf` wins).
+ */
+export declare function mergeTerraformShowJsonFindings(existingFindings: RawFinding[], jsonAbsolutePath: string, onWarning?: (message: string) => void): TerraformJsonMergeResult;