@dataparade/cli 0.0.1

package/dist/src/core/pipeline/structural-scan.js

@@ -0,0 +1,304 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runStructuralScanPhase = runStructuralScanPhase;
+exports.runStructuralScan = runStructuralScan;
+const path_1 = __importDefault(require("path"));
+const scan_result_schema_1 = require("../schema/scan-result.schema");
+const file_system_1 = require("../../ingest/file-system");
+const registry_1 = require("../../analyzers/registry");
+const terraform_module_manifest_1 = require("../../analyzers/terraform/terraform-module-manifest");
+const terraform_show_json_1 = require("../../analyzers/terraform/terraform-show-json");
+const terraform_exec_1 = require("../../analyzers/terraform/terraform-exec");
+const parser_1 = require("../../analyzers/python/parser");
+const dependency_manifests_1 = require("../../analyzers/python/dependency-manifests");
+const dependency_manifests_2 = require("../../analyzers/typescript/dependency-manifests");
+const discover_service_sections_1 = require("../sectioning/discover-service-sections");
+const classifier_phase_1 = require("./classifier-phase");
+const dataflow_phase_1 = require("./dataflow-phase");
+const sorting_1 = require("./sorting");
+const scan_exclusions_1 = require("../../patterns/scan-exclusions");
+const resolve_path_under_scan_root_1 = require("./resolve-path-under-scan-root");
+function patternToRegex(pattern) {
+    // Very small subset of .gitignore-style patterns:
+    // - * matches any chars except path separator
+    // - ** matches across directories
+    // - ? matches a single non-separator
+    let escaped = pattern.replace(/[-\\^$+?.()|[\]{}*?]/g, "\\$&");
+    // Restore globs
+    escaped = escaped.replace(/\\\*\\\*/g, ".*"); // **
+    escaped = escaped.replace(/\\\*/g, "[^/]*"); // *
+    escaped = escaped.replace(/\\\?/g, "[^/]"); // ?
+    return new RegExp(`^${escaped}$`);
+}
+async function runStructuralScanPhase(rootPath, config, onWarning) {
+    const warn = (warning) => {
+        if (onWarning)
+            onWarning(warning);
+    };
+    const { scanRootDir, ingestTarget } = await (0, file_system_1.resolveScanFilesystemEntry)(rootPath);
+    const allFiles = await (0, file_system_1.ingestFileSystem)(ingestTarget, {
+        onWarning: warn,
+        excludePaths: config.excludePaths,
+    });
+    // Apply language filtering and excludePaths from configuration.
+    let files = allFiles;
+    if (config.languages && config.languages.length > 0) {
+        const allowed = new Set(config.languages);
+        files = files.filter((file) => allowed.has(file.language));
+    }
+    if (config.excludePaths && config.excludePaths.length > 0) {
+        const regexes = config.excludePaths.map((pattern) => patternToRegex(pattern));
+        files = files.filter((file) => !regexes.some((regex) => regex.test(file.path)));
+    }
+    const filesScanned = files.length;
+    const totalLines = files.reduce((sum, file) => {
+        if (!file.content)
+            return sum;
+        return sum + file.content.split(/\r?\n/g).length;
+    }, 0);
+    const languageStats = [];
+    // Python parser stats (DP-P0-CLI-702):
+    const pythonFiles = files.filter((file) => file.language === "python");
+    if (pythonFiles.length > 0) {
+        let functionsIndexed = 0;
+        let moduleLevelCallsIndexed = 0;
+        const parserWarnings = [];
+        for (const file of pythonFiles) {
+            try {
+                const moduleModel = (0, parser_1.parsePythonModule)(file);
+                functionsIndexed += moduleModel.functions.length;
+                moduleLevelCallsIndexed += moduleModel.moduleLevelCalls.length;
+                if (moduleModel.warnings.length > 0) {
+                    parserWarnings.push(...moduleModel.warnings.map((w) => `python-parser (${file.path}): ${w}`));
+                }
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : "Unknown error in Python parser.";
+                parserWarnings.push(`python-parser (${file.path}): ${message}`);
+            }
+        }
+        for (const warning of parserWarnings)
+            warn(warning);
+        languageStats.push({
+            language: "python",
+            filesParsed: pythonFiles.length,
+            functionsIndexed,
+            moduleLevelCallsIndexed,
+            warnings: parserWarnings,
+        });
+    }
+    const minimumConfidence = config.minimumConfidence;
+    const tfFiles = files.filter((f) => f.language === "terraform");
+    const terraformModuleManifest = tfFiles.length > 0
+        ? (0, terraform_module_manifest_1.buildTerraformModuleCallManifest)(scanRootDir, files)
+        : undefined;
+    let findings = (0, registry_1.runAnalyzers)(files, {
+        terraformModuleManifest,
+        terraformScanRootPath: scanRootDir,
+    });
+    const staticTfFiles = files.filter((f) => f.language === "terraform").length;
+    const jsonInputParts = [];
+    let jsonFindingsMerged = 0;
+    const planRel = config.terraformPlanPath?.trim();
+    if (planRel) {
+        const planResolved = (0, resolve_path_under_scan_root_1.resolvePathUnderScanRoot)(scanRootDir, planRel);
+        if (!planResolved.ok) {
+            warn(`terraform-plan: ${planResolved.message}`);
+        }
+        else {
+            const scanRoot = path_1.default.resolve(scanRootDir);
+            const planArg = path_1.default.relative(scanRoot, planResolved.resolved);
+            const execRes = (0, terraform_exec_1.runTerraformShowJsonSync)(scanRootDir, planArg);
+            if (execRes.ok) {
+                const label = `terraform show -json (${planRel})`;
+                const merged = (0, terraform_show_json_1.mergeTerraformShowJsonFromDoc)(findings, execRes.doc, label, warn);
+                findings.push(...merged.findings);
+                jsonFindingsMerged += merged.mergedCount;
+                jsonInputParts.push(`plan:${planRel}`);
+            }
+            else {
+                warn(`terraform-plan: ${execRes.message}`);
+            }
+        }
+    }
+    const jsonPath = config.terraformJsonPath?.trim();
+    if (jsonPath) {
+        const jsonResolved = (0, resolve_path_under_scan_root_1.resolvePathUnderScanRoot)(scanRootDir, jsonPath);
+        if (!jsonResolved.ok) {
+            warn(`terraform-json: ${jsonResolved.message}`);
+        }
+        else {
+            const merged = (0, terraform_show_json_1.mergeTerraformShowJsonFindings)(findings, jsonResolved.resolved, warn);
+            findings.push(...merged.findings);
+            jsonFindingsMerged += merged.mergedCount;
+            jsonInputParts.push(jsonResolved.resolved);
+        }
+    }
+    if (planRel && jsonPath) {
+        warn("terraform: both terraformPlanPath and terraformJsonPath are set; plan overlay is applied first, then the JSON file.");
+    }
+    const terraformScanSummary = buildTerraformScanSummary({
+        staticTfFiles,
+        jsonFindingsMerged,
+        jsonInputParts,
+        hadPlanOption: Boolean(planRel),
+        hadJsonFileOption: Boolean(jsonPath),
+    });
+    // Language-agnostic third-party service detection from Python dependency manifests.
+    if (!config.languages || config.languages.includes("python")) {
+        try {
+            findings.push(...(await (0, dependency_manifests_1.detectPythonPatternsFromDependencyManifests)(scanRootDir, {
+                onWarning: warn,
+                excludePaths: config.excludePaths,
+            })));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Unknown error parsing manifests.";
+            warn(`python-manifests: ${message}`);
+        }
+    }
+    // Language-agnostic third-party service detection from Node/TypeScript manifests.
+    const wantsTsOrJs = !config.languages ||
+        config.languages.some((l) => l === "typescript" || l === "javascript");
+    if (wantsTsOrJs) {
+        try {
+            findings.push(...(await (0, dependency_manifests_2.detectTypeScriptPatternsFromDependencyManifests)(scanRootDir, {
+                onWarning: warn,
+                excludePaths: config.excludePaths,
+            })));
+        }
+        catch (err) {
+            const message = err instanceof Error
+                ? err.message
+                : "Unknown error parsing package manifests.";
+            warn(`package-manifests: ${message}`);
+        }
+    }
+    // Apply detection feature toggles from configuration.
+    if (!config.enableAPIDetection) {
+        findings = findings.filter((f) => f.pattern !== "express_route" && f.pattern !== "auth_middleware");
+    }
+    if (!config.enableDatabaseDetection) {
+        findings = findings.filter((f) => f.pattern !== "database_connection");
+    }
+    findings = findings.filter((f) => f.confidence >= minimumConfidence);
+    // Discover monorepo service sections and tag findings.
+    const { sections, inferredTerraformStackSectionPathDepth, inferredMonorepoPackageSectionPathDepth, monorepoPackageSectionPathDepth: discoveredMonorepoDepth, } = await (0, discover_service_sections_1.discoverServiceSections)(scanRootDir, {
+        excludePaths: config.excludePaths,
+        terraformStackSectionPathDepth: config.terraformStackSectionPathDepth,
+        autoInferTerraformStackSectionPathDepth: config.autoInferTerraformStackSectionPathDepth,
+        monorepoPackageSectionPathDepth: config.monorepoPackageSectionPathDepth,
+        autoInferMonorepoPackageSectionPathDepth: config.autoInferMonorepoPackageSectionPathDepth,
+    });
+    if (inferredTerraformStackSectionPathDepth != null) {
+        warn(`terraform: registered stack sections at path depth ${inferredTerraformStackSectionPathDepth} (from .tf layout)`);
+    }
+    if (inferredMonorepoPackageSectionPathDepth != null) {
+        warn(`monorepo: grouping workspace packages at path depth ${inferredMonorepoPackageSectionPathDepth} (from package.json layout)`);
+    }
+    const monorepoPackageSectionPathDepth = discoveredMonorepoDepth ??
+        config.monorepoPackageSectionPathDepth ??
+        inferredMonorepoPackageSectionPathDepth;
+    (0, discover_service_sections_1.tagFindingsWithServiceSections)(findings, sections, {
+        monorepoPackageSectionPathDepth,
+    });
+    return {
+        files,
+        findings,
+        sections,
+        monorepoPackageSectionPathDepth,
+        filesScanned,
+        totalLines,
+        languageStats,
+        terraformScanSummary,
+    };
+}
+function buildTerraformScanSummary(input) {
+    const hadJsonInputs = input.jsonInputParts.length > 0 ||
+        input.hadPlanOption ||
+        input.hadJsonFileOption;
+    if (input.staticTfFiles === 0 &&
+        input.jsonFindingsMerged === 0 &&
+        !hadJsonInputs) {
+        return undefined;
+    }
+    let mode;
+    if (input.staticTfFiles > 0 && input.jsonFindingsMerged > 0) {
+        mode = "json_overlay";
+    }
+    else if (input.staticTfFiles > 0) {
+        mode = "static_tf";
+    }
+    else {
+        mode = "json_only";
+    }
+    return {
+        mode,
+        staticTfFiles: input.staticTfFiles,
+        jsonInputPath: input.jsonInputParts.length > 0
+            ? input.jsonInputParts.join("; ")
+            : undefined,
+        jsonFindingsMerged: input.jsonFindingsMerged,
+    };
+}
+async function runStructuralScan(rootPath) {
+    const config = {
+        projectName: undefined,
+        excludePaths: [...scan_exclusions_1.DEFAULT_EXCLUDED_FILE_GLOBS],
+        enableAPIDetection: true,
+        enableDatabaseDetection: true,
+        enableDataFlowDetection: true,
+        languages: undefined,
+        minimumConfidence: 0.5,
+        deepAnalysis: false,
+    };
+    const warnings = [];
+    const errors = [];
+    const start = Date.now();
+    const structural = await runStructuralScanPhase(rootPath, config, (warning) => warnings.push(warning));
+    const { files, findings, sections, monorepoPackageSectionPathDepth, filesScanned, totalLines, languageStats, terraformScanSummary, } = structural;
+    const components = (0, classifier_phase_1.runClassifierPhase)(findings, sections, {
+        projectName: "project",
+        minimumConfidence: config.minimumConfidence,
+    });
+    let dataFlows = [];
+    try {
+        dataFlows = (0, dataflow_phase_1.runDataFlowPhase)(files, components, findings, sections, {
+            enableDataFlowDetection: config.enableDataFlowDetection,
+            minimumConfidence: config.minimumConfidence,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error
+            ? err.message
+            : "Unknown error during data-flow detection.";
+        errors.push(`data-flow: ${message}`);
+    }
+    (0, sorting_1.sortComponentsDeterministically)(components);
+    (0, sorting_1.sortDataFlowsDeterministically)(dataFlows);
+    const scanResult = {
+        components,
+        dataFlows,
+        filesScanned,
+        filesSkipped: 0,
+        totalLines,
+        scanDurationMs: Date.now() - start,
+        warnings,
+        errors,
+        languageStats: languageStats.length > 0 ? languageStats : undefined,
+        terraformScanSummary,
+    };
+    const validation = (0, scan_result_schema_1.validateScanResult)(scanResult);
+    if (!validation.ok) {
+        errors.push(...validation.errors);
+        scanResult.errors = errors;
+    }
+    return {
+        scanResult,
+        files,
+        findings,
+    };
+}

package/dist/src/core/pipeline/terraform-flow-utils.d.ts

@@ -0,0 +1,6 @@
+import type { DetectedComponent } from "../types/component";
+import type { DetectedDataFlow } from "../types/data-flow";
+export declare function findPrimaryTerraformProvider(components: DetectedComponent[]): DetectedComponent | undefined;
+export declare function hasDirectedFlow(flows: DetectedDataFlow[], sourceId: string, targetId: string): boolean;
+export declare function nextSyntheticFlowId(flows: DetectedDataFlow[]): string;
+export declare function listTerraformModuleShells(components: DetectedComponent[]): DetectedComponent[];

package/dist/src/core/pipeline/terraform-flow-utils.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findPrimaryTerraformProvider = findPrimaryTerraformProvider;
+exports.hasDirectedFlow = hasDirectedFlow;
+exports.nextSyntheticFlowId = nextSyntheticFlowId;
+exports.listTerraformModuleShells = listTerraformModuleShells;
+const main_application_selection_1 = require("../../classifier/main-application-selection");
+const component_predicates_1 = require("../terraform/component-predicates");
+function findPrimaryTerraformProvider(components) {
+    const aws = components.find((c) => c.type === "third_party" && (0, component_predicates_1.trimTerraformAddress)(c) === "provider.aws");
+    if (aws)
+        return aws;
+    return components.find((c) => (0, component_predicates_1.isTerraformProviderComponent)(c));
+}
+function hasDirectedFlow(flows, sourceId, targetId) {
+    return flows.some((f) => f.sourceComponentId === sourceId && f.targetComponentId === targetId);
+}
+function nextSyntheticFlowId(flows) {
+    let max = 0;
+    for (const f of flows) {
+        const m = /^flow_(\d+)$/.exec(f.id);
+        if (m)
+            max = Math.max(max, Number.parseInt(m[1], 10));
+        const m2 = /^flow_minimal_(\d+)$/.exec(f.id);
+        if (m2)
+            max = Math.max(max, Number.parseInt(m2[1], 10));
+    }
+    return `flow_minimal_${max + 1}`;
+}
+function listTerraformModuleShells(components) {
+    return components.filter(main_application_selection_1.isTerraformModuleCallShellAsset);
+}

package/dist/src/core/pipeline/terraform-minimal-services.d.ts

@@ -0,0 +1,31 @@
+import type { DetectedComponent } from "../types/component";
+import type { DetectedDataFlow } from "../types/data-flow";
+import type { ScanResult } from "../types/result";
+import { applyMixedAppTerraformScanResult, isMixedAppTerraformScan, shouldKeepComponentInMixedAppTerraformScan } from "./mixed-app-terraform-scan";
+export { applyMixedAppTerraformScanResult, isMixedAppTerraformScan, shouldKeepComponentInMixedAppTerraformScan, };
+/**
+ * Minimal service view is only for IaC-primary scans; mixed app+Terraform repos
+ * use {@link applyMixedAppTerraformScanResult} instead of the full resource graph.
+ */
+export declare function isTerraformPrimaryScan(components: DetectedComponent[]): boolean;
+/** `module.ecs_frontend` → `ECS Frontend` */
+export declare function ecsModuleServiceLabel(terraformAddress: string): string;
+export declare function isManagedServiceAsset(c: DetectedComponent): boolean;
+/**
+ * Layout / bucket for minimal Terraform diagram (left-to-right story).
+ */
+export declare function terraformMinimalLayoutBucket(c: DetectedComponent | undefined): "actor" | "main" | "ecs" | "provider" | "managed" | null;
+/** Diagram layout: same eligibility as {@link applyTerraformMinimalServiceScanResult}. */
+export declare function shouldUseTerraformMinimalServiceDiagramLayout(components: DetectedComponent[]): boolean;
+/**
+ * Ensures User → main app → (ECS shells when present) → Terraform provider hub,
+ * and provider → each managed subservice, when edges were dropped or never created.
+ */
+export declare function ensureTerraformMinimalHubAndManagedFlows(components: DetectedComponent[], flows: DetectedDataFlow[]): DetectedDataFlow[];
+/**
+ * For {@link isTerraformPrimaryScan} with at least two ECS/managed service nodes,
+ * shrink components and flows to **User**, **main application**, **Terraform
+ * `provider.*` hub**, **managed service nodes**, and **`module.ecs_*`** workload
+ * shells. Otherwise returns `scanResult` unchanged.
+ */
+export declare function applyTerraformMinimalServiceScanResult(scanResult: ScanResult): ScanResult;

package/dist/src/core/pipeline/terraform-minimal-services.js

@@ -0,0 +1,225 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shouldKeepComponentInMixedAppTerraformScan = exports.isMixedAppTerraformScan = exports.applyMixedAppTerraformScanResult = void 0;
+exports.isTerraformPrimaryScan = isTerraformPrimaryScan;
+exports.ecsModuleServiceLabel = ecsModuleServiceLabel;
+exports.isManagedServiceAsset = isManagedServiceAsset;
+exports.terraformMinimalLayoutBucket = terraformMinimalLayoutBucket;
+exports.shouldUseTerraformMinimalServiceDiagramLayout = shouldUseTerraformMinimalServiceDiagramLayout;
+exports.ensureTerraformMinimalHubAndManagedFlows = ensureTerraformMinimalHubAndManagedFlows;
+exports.applyTerraformMinimalServiceScanResult = applyTerraformMinimalServiceScanResult;
+const application_injection_1 = require("../../classifier/application-injection");
+const component_predicates_1 = require("../terraform/component-predicates");
+const mixed_app_terraform_scan_1 = require("./mixed-app-terraform-scan");
+Object.defineProperty(exports, "applyMixedAppTerraformScanResult", { enumerable: true, get: function () { return mixed_app_terraform_scan_1.applyMixedAppTerraformScanResult; } });
+Object.defineProperty(exports, "isMixedAppTerraformScan", { enumerable: true, get: function () { return mixed_app_terraform_scan_1.isMixedAppTerraformScan; } });
+Object.defineProperty(exports, "shouldKeepComponentInMixedAppTerraformScan", { enumerable: true, get: function () { return mixed_app_terraform_scan_1.shouldKeepComponentInMixedAppTerraformScan; } });
+const terraform_flow_utils_1 = require("./terraform-flow-utils");
+const ECS_MODULE_ADDRESS = /^module\.ecs_[^.]+$/;
+/**
+ * Minimal service view is only for IaC-primary scans; mixed app+Terraform repos
+ * use {@link applyMixedAppTerraformScanResult} instead of the full resource graph.
+ */
+function isTerraformPrimaryScan(components) {
+    const hasTf = components.some(component_predicates_1.hasTerraformAddress);
+    if (!hasTf)
+        return false;
+    if ((0, mixed_app_terraform_scan_1.isMixedAppTerraformScan)(components))
+        return false;
+    return !components.some((c) => c.type === "asset" &&
+        !c.properties?.managed_by_provider &&
+        !(0, component_predicates_1.hasTerraformAddress)(c) &&
+        (c.subType === "api" || c.subType === "service"));
+}
+function titleCaseWords(s) {
+    return s
+        .split(/[\s_]+/)
+        .filter(Boolean)
+        .map((w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase())
+        .join(" ");
+}
+/** `module.ecs_frontend` → `ECS Frontend` */
+function ecsModuleServiceLabel(terraformAddress) {
+    const m = /^module\.ecs_(.+)$/.exec(terraformAddress.trim());
+    if (!m)
+        return terraformAddress;
+    return `ECS ${titleCaseWords(m[1].replace(/_/g, " "))}`;
+}
+function isEcsModuleShell(c) {
+    if (c.type !== "asset")
+        return false;
+    const addr = (0, component_predicates_1.trimTerraformAddress)(c);
+    return addr.length > 0 && ECS_MODULE_ADDRESS.test(addr);
+}
+function isManagedServiceAsset(c) {
+    return (c.type === "asset" &&
+        typeof c.properties?.managed_by_provider === "string" &&
+        c.properties.managed_by_provider.trim().length > 0);
+}
+function isMainApplicationLike(c) {
+    if (c.type !== "asset")
+        return false;
+    const inj = c.properties?.sourceContext === application_injection_1.INJECTED_PROJECT_PLACEHOLDER_SOURCE_CONTEXT;
+    const main = c.properties?.isMainApplication === true ||
+        c.properties?.isMainApplication === "true";
+    return Boolean(main || inj);
+}
+/**
+ * Layout / bucket for minimal Terraform diagram (left-to-right story).
+ */
+function terraformMinimalLayoutBucket(c) {
+    if (!c)
+        return null;
+    if (c.type === "actor")
+        return "actor";
+    if ((0, component_predicates_1.isTerraformProviderComponent)(c))
+        return "provider";
+    if (c.type === "asset") {
+        if (isManagedServiceAsset(c))
+            return "managed";
+        if (isEcsModuleShell(c))
+            return "ecs";
+        if (isMainApplicationLike(c))
+            return "main";
+    }
+    return null;
+}
+function cloneRelabeledEcsModule(c) {
+    const addr = (0, component_predicates_1.trimTerraformAddress)(c);
+    const label = ecsModuleServiceLabel(addr);
+    if (label === c.name)
+        return c;
+    return { ...c, name: label };
+}
+function countServiceNodes(components) {
+    let n = 0;
+    for (const c of components) {
+        if (isManagedServiceAsset(c) || isEcsModuleShell(c))
+            n += 1;
+    }
+    return n;
+}
+/** Diagram layout: same eligibility as {@link applyTerraformMinimalServiceScanResult}. */
+function shouldUseTerraformMinimalServiceDiagramLayout(components) {
+    return isTerraformPrimaryScan(components) && countServiceNodes(components) >= 2;
+}
+function findPrimaryMainApp(components) {
+    const mains = components.filter(isMainApplicationLike);
+    mains.sort((a, b) => a.id.localeCompare(b.id));
+    return mains[0];
+}
+function findPrimaryActor(components) {
+    const actors = components.filter((c) => c.type === "actor");
+    actors.sort((a, b) => a.id.localeCompare(b.id));
+    return actors[0];
+}
+function flowTypeProviderToManaged(m) {
+    const k = String(m.properties?.managed_service_key ?? "").toLowerCase();
+    if (k.includes("postgres") ||
+        k.includes("pg") ||
+        k === "rds" ||
+        k.includes("mysql") ||
+        k.includes("sql")) {
+        return "database_query";
+    }
+    if (k === "s3" || k.includes("storage") || k.includes("bucket")) {
+        return "file_transfer";
+    }
+    return "api_call";
+}
+/**
+ * Ensures User → main app → (ECS shells when present) → Terraform provider hub,
+ * and provider → each managed subservice, when edges were dropped or never created.
+ */
+function ensureTerraformMinimalHubAndManagedFlows(components, flows) {
+    const next = [...flows];
+    const actor = findPrimaryActor(components);
+    const main = findPrimaryMainApp(components);
+    const provider = (0, terraform_flow_utils_1.findPrimaryTerraformProvider)(components);
+    const managed = components.filter(isManagedServiceAsset);
+    const push = (sourceId, targetId, type) => {
+        if ((0, terraform_flow_utils_1.hasDirectedFlow)(next, sourceId, targetId))
+            return;
+        next.push({
+            id: (0, terraform_flow_utils_1.nextSyntheticFlowId)(next),
+            sourceComponentId: sourceId,
+            targetComponentId: targetId,
+            type,
+            confidence: 0.72,
+            description: "terraform_minimal_service_hub",
+        });
+    };
+    if (actor && main) {
+        push(actor.id, main.id, "api_call");
+    }
+    const ecsShells = components.filter(isEcsModuleShell);
+    ecsShells.sort((a, b) => a.id.localeCompare(b.id));
+    if (main && ecsShells.length > 0) {
+        for (const ecs of ecsShells) {
+            push(main.id, ecs.id, "api_call");
+        }
+        if (provider) {
+            for (const ecs of ecsShells) {
+                push(ecs.id, provider.id, "api_call");
+            }
+        }
+    }
+    else if (main && provider) {
+        push(main.id, provider.id, "api_call");
+    }
+    if (provider) {
+        for (const m of managed) {
+            const mp = m.properties?.managed_by_provider;
+            if (typeof mp !== "string" || mp.trim() !== provider.id)
+                continue;
+            push(provider.id, m.id, flowTypeProviderToManaged(m));
+        }
+    }
+    return next;
+}
+function dropRedundantDirectMainToPrimaryProviderWhenEcsHub(components, flows) {
+    const ecsShells = components.filter(isEcsModuleShell);
+    if (ecsShells.length === 0)
+        return flows;
+    const main = findPrimaryMainApp(components);
+    const provider = (0, terraform_flow_utils_1.findPrimaryTerraformProvider)(components);
+    if (!main || !provider)
+        return flows;
+    return flows.filter((f) => !(f.sourceComponentId === main.id &&
+        f.targetComponentId === provider.id));
+}
+/**
+ * For {@link isTerraformPrimaryScan} with at least two ECS/managed service nodes,
+ * shrink components and flows to **User**, **main application**, **Terraform
+ * `provider.*` hub**, **managed service nodes**, and **`module.ecs_*`** workload
+ * shells. Otherwise returns `scanResult` unchanged.
+ */
+function applyTerraformMinimalServiceScanResult(scanResult) {
+    const mixedReduced = (0, mixed_app_terraform_scan_1.applyMixedAppTerraformScanResult)(scanResult);
+    if (!isTerraformPrimaryScan(mixedReduced.components))
+        return mixedReduced;
+    if (countServiceNodes(mixedReduced.components) < 2)
+        return mixedReduced;
+    const keptIds = new Set();
+    for (const c of mixedReduced.components) {
+        if (c.type === "actor")
+            keptIds.add(c.id);
+        if ((0, component_predicates_1.isTerraformProviderComponent)(c))
+            keptIds.add(c.id);
+        if (isMainApplicationLike(c))
+            keptIds.add(c.id);
+        if (isManagedServiceAsset(c) || isEcsModuleShell(c))
+            keptIds.add(c.id);
+    }
+    const components = mixedReduced.components
+        .filter((c) => keptIds.has(c.id))
+        .map((c) => (isEcsModuleShell(c) ? cloneRelabeledEcsModule(c) : c));
+    let flows = mixedReduced.dataFlows.filter((f) => keptIds.has(f.sourceComponentId) && keptIds.has(f.targetComponentId));
+    flows = ensureTerraformMinimalHubAndManagedFlows(components, flows);
+    flows = dropRedundantDirectMainToPrimaryProviderWhenEcsHub(components, flows);
+    return {
+        ...mixedReduced,
+        components,
+        dataFlows: flows,
+    };
+}