infraweaver 0.1.0

package/src/mcp/terraform/cspm.ts

@@ -0,0 +1,326 @@
+import { type } from "arktype";
+import {
+  buildConcern,
+  type Concern,
+  type Severity,
+} from "#app/mcp/terraform/types";
+import { neutralizeOptional } from "#app/mcp/untrustedContent";
+
+/**
+ * Ingest EXTERNAL findings — a CSPM / cloud-security alert feed the customer already
+ * produces (Wiz, Orca, Prisma, or any tool) — and tie each alert back to the exact
+ * Terraform resource in the repo, so a runtime cloud finding can enter the normal
+ * remediation loop WITHOUT Infraweaver ever holding a cloud credential. The customer's
+ * CSPM holds the creds and emits the alerts; we only consume its output.
+ *
+ * The crux is the mapping: a CSPM alert is keyed by a live cloud resource (an ARN /
+ * resource id), not a `file:line`. This module builds a line-aware index of the
+ * repo's `resource` blocks and correlates each alert to one of them, so the alert
+ * becomes a `Concern` with a real `location`. Alerts that can't be tied to a resource
+ * in code are reported separately (never silently dropped, never fabricated).
+ *
+ * Provenance: a mapped alert becomes a `reviewer`-source concern (the existing class
+ * for findings whose originating tool Infraweaver does not re-run). It is therefore
+ * honestly `not-code-verifiable` by the `✗→✓` re-scan — the same treatment a
+ * reviewer/tfsec finding gets — unless its misconfig class also fires a local scanner
+ * rule. Pure: no filesystem, no network (the tool wrapper supplies the file bodies).
+ */
+
+// --- external-findings file schema -------------------------------------------
+
+const ExternalResource = type({
+  /** A direct Terraform address, e.g. `aws_s3_bucket.logs` (module prefixes are
+   *  tolerated — only the final `type.name` is matched). Highest-confidence key. */
+  "address?": "string",
+  "type?": "string",
+  "name?": "string",
+  /** A cloud resource id / name (e.g. the bucket name) used to correlate by value. */
+  "id?": "string",
+  /** A cloud ARN — correlated by looking for a resource whose identifier is a suffix. */
+  "arn?": "string",
+  /** Cloud TAG VALUES (lower-cased) offered as a last-resort correlation hint,
+   *  e.g. a `Name` tag that also appears in the resource block. Lowest priority
+   *  and deliberately strict: see the tag pass in `matchResource`. */
+  "tags?": "string[]",
+});
+
+const ExternalFinding = type({
+  /** The external tool's rule / policy id — provenance is preserved in `rule_id`. */
+  rule_id: "string",
+  /** The CSPM / tool name (wiz | orca | prisma | ...), prefixed onto the rule. */
+  "provider?": "string",
+  "severity?": "string",
+  "title?": "string",
+  "message?": "string",
+  "remediation?": "string",
+  "resource?": ExternalResource,
+});
+
+export const ExternalFindingsFile = type({
+  "schema?": "string",
+  findings: ExternalFinding.array(),
+});
+
+export type ExternalFinding = typeof ExternalFinding.infer;
+
+/** True for a parsed object that looks like an external-findings feed (vs a SARIF or
+ *  reviewer findings.json), so a dispatcher can route it. */
+export function isExternalFindings(parsed: unknown): boolean {
+  if (typeof parsed !== "object" || parsed === null) return false;
+  const findings = (parsed as { findings?: unknown }).findings;
+  if (!Array.isArray(findings)) return false;
+  // A reviewer findings.json also has `findings`; disambiguate on the external shape
+  // (an explicit schema tag, or a `resource`/`provider`/`rule_id` on the first item).
+  const schema = (parsed as { schema?: unknown }).schema;
+  if (
+    typeof schema === "string" &&
+    schema.startsWith("infraweaver.external-findings")
+  )
+    return true;
+  const first = findings[0] as Record<string, unknown> | undefined;
+  if (!first) return false;
+  return "resource" in first || "provider" in first || "rule_id" in first;
+}
+
+// --- line-aware Terraform resource index -------------------------------------
+
+export interface TfResourceEntry {
+  /** `type.name` — the Terraform address of the block. */
+  address: string;
+  type: string;
+  name: string;
+  file: string;
+  /** 1-based line of the `resource "type" "name" {` header. */
+  line: number;
+  /** String-literal values inside the block body (bucket names, tags, ids) — the
+   *  values a CSPM alert's cloud id / ARN is correlated against. Lower-cased. */
+  identifiers: string[];
+}
+
+const RESOURCE_HEADER = /(^|\n)([ \t]*)resource\s+"([^"]+)"\s+"([^"]+)"\s*\{/g;
+
+/** Collect the string literals inside the block that opens at `openBraceIdx`, scanning
+ *  to the matching close brace (approximate — good enough to correlate an id/ARN). */
+function collectBlockIdentifiers(hcl: string, openBraceIdx: number): string[] {
+  const ids: string[] = [];
+  let depth = 0;
+  for (let i = openBraceIdx; i < hcl.length; i++) {
+    const c = hcl[i];
+    if (c === "{") depth++;
+    else if (c === "}") {
+      depth--;
+      if (depth === 0) break;
+    } else if (c === '"') {
+      let j = i + 1;
+      let value = "";
+      while (j < hcl.length && hcl[j] !== '"') {
+        if (hcl[j] === "\\") j++;
+        value += hcl[j] ?? "";
+        j++;
+      }
+      if (value) ids.push(value.toLowerCase());
+      i = j;
+    }
+  }
+  return ids;
+}
+
+/** Build a line-aware index of every `resource` block across the given `.tf` files. */
+export function indexTfResources(
+  files: ReadonlyArray<{ file: string; hcl: string }>,
+): TfResourceEntry[] {
+  const index: TfResourceEntry[] = [];
+  for (const { file, hcl } of files) {
+    RESOURCE_HEADER.lastIndex = 0;
+    let m: RegExpExecArray | null;
+    // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex-exec iteration
+    while ((m = RESOURCE_HEADER.exec(hcl)) !== null) {
+      const type = m[3];
+      const name = m[4];
+      if (type === undefined || name === undefined) continue;
+      const headerStart = m.index + (m[1] ? m[1].length : 0);
+      const line = hcl.slice(0, headerStart).split("\n").length;
+      const openBraceIdx = hcl.indexOf("{", m.index);
+      const identifiers =
+        openBraceIdx >= 0 ? collectBlockIdentifiers(hcl, openBraceIdx) : [];
+      index.push({
+        address: `${type}.${name}`,
+        type,
+        name,
+        file,
+        line,
+        identifiers,
+      });
+    }
+  }
+  return index;
+}
+
+// --- mapping -----------------------------------------------------------------
+
+/** The final `type.name` of a possibly module-qualified address. */
+function bareAddress(address: string): string {
+  const parts = address.split(".");
+  // `module.x.aws_s3_bucket.logs` → `aws_s3_bucket.logs`; `aws_s3_bucket.logs` → same.
+  return parts.length >= 2 ? parts.slice(-2).join(".") : address;
+}
+
+/** Correlate one external finding to a resource block, best key first. Returns the
+ *  matched entry, or null when the alert can't be tied to code. */
+export function matchResource(
+  finding: ExternalFinding,
+  index: TfResourceEntry[],
+): TfResourceEntry | null {
+  const r = finding.resource;
+  if (!r) return null;
+
+  // 1. Explicit Terraform address.
+  if (r.address) {
+    const want = bareAddress(r.address);
+    const hit = index.find((e) => e.address === want);
+    if (hit) return hit;
+  }
+
+  // 2. type + name.
+  if (r.type && r.name) {
+    const hit = index.find((e) => e.type === r.type && e.name === r.name);
+    if (hit) return hit;
+  }
+
+  // 3. type + a cloud id / ARN correlated against the block's identifier values.
+  // ARN matching is SEGMENT-exact (split on `:` and `/`), never substring — an
+  // unanchored `includes` would let an incidental literal like `"private"` in one
+  // block claim `arn:aws:s3:::private-bucket` and pin the alert to the wrong
+  // resource. Wrong-file mapping is worse than honest `unmapped`.
+  const idNeedle = r.id?.toLowerCase();
+  const arn = r.arn?.toLowerCase();
+  const arnSegments = arn ? new Set(arn.split(/[:/]/).filter(Boolean)) : null;
+  if (idNeedle || arnSegments) {
+    const candidates = r.type ? index.filter((e) => e.type === r.type) : index;
+    const hit = candidates.find((e) =>
+      e.identifiers.some(
+        (v) => (idNeedle && v === idNeedle) || arnSegments?.has(v) === true,
+      ),
+    );
+    if (hit) return hit;
+  }
+
+  // 4. Tag hints — lowest priority, for feeds (Prowler) whose alerts carry cloud
+  // tags but no ARN our source happens to contain. Callers must supply only
+  // IDENTITY-bearing tag values (a `Name` tag), never descriptive ones: if
+  // "production" happens to appear in exactly one block, a descriptive-tag pass
+  // would pin every finding tagged `env=production` to that one resource. A value
+  // must match a block's string literal EXACTLY, and the hits across ALL tags
+  // must resolve to exactly one resource — deciding per-tag would make the answer
+  // depend on label order when two tags each uniquely hit different resources.
+  // Any ambiguity yields `unmapped`, never a coin-flip between candidates.
+  const tags =
+    r.tags?.map((t) => t.toLowerCase()).filter((t) => t.length >= 4) ?? [];
+  if (tags.length > 0) {
+    const hits = new Set<TfResourceEntry>();
+    for (const tag of tags) {
+      for (const e of index) if (e.identifiers.includes(tag)) hits.add(e);
+    }
+    if (hits.size === 1) return [...hits][0] as TfResourceEntry;
+  }
+
+  return null;
+}
+
+/** Why an alert couldn't be mapped to a resource in code (for honest reporting). */
+export interface UnmappedFinding {
+  rule_id: string;
+  provider: string | null;
+  resource: ExternalFinding["resource"] | null;
+  reason: string;
+}
+
+export interface MappedExternalFindings {
+  concerns: Concern[];
+  unmapped: UnmappedFinding[];
+}
+
+const SEVERITY_WORDS: Record<string, Severity> = {
+  critical: "critical",
+  high: "high",
+  medium: "medium",
+  moderate: "medium",
+  low: "low",
+  info: "info",
+  informational: "info",
+  none: "info",
+};
+
+/** Normalise an external severity string (word or numeric CVSS) to our scale. */
+export function normalizeExternalSeverity(raw: string | undefined): Severity {
+  if (!raw) return "medium";
+  const word = SEVERITY_WORDS[raw.trim().toLowerCase()];
+  if (word) return word;
+  const num = Number(raw);
+  if (Number.isFinite(num)) {
+    if (num >= 9) return "critical";
+    if (num >= 7) return "high";
+    if (num >= 4) return "medium";
+    if (num > 0) return "low";
+  }
+  return "medium";
+}
+
+/** A safe bare-rule token: `<provider>-<external rule id>`, provider omitted when absent. */
+function ruleToken(finding: ExternalFinding): string {
+  const provider = finding.provider?.trim().toLowerCase();
+  const base = finding.rule_id.trim();
+  const combined = provider ? `${provider}-${base}` : base;
+  // Keep it a clean rule token (no `:` so `reviewer:<rule>` stays unambiguous).
+  return combined.replace(/[:\s]+/g, "-");
+}
+
+/**
+ * Turn a batch of external findings into `reviewer`-source concerns by mapping each
+ * to its Terraform resource. Unmappable alerts are returned separately so the caller
+ * can report them honestly rather than drop them.
+ */
+export function mapExternalFindings(
+  findings: ReadonlyArray<ExternalFinding>,
+  index: TfResourceEntry[],
+): MappedExternalFindings {
+  const concerns: Concern[] = [];
+  const unmapped: UnmappedFinding[] = [];
+  for (const finding of findings) {
+    const match = matchResource(finding, index);
+    if (!match) {
+      unmapped.push({
+        rule_id: finding.rule_id,
+        provider: finding.provider ?? null,
+        resource: finding.resource ?? null,
+        reason: finding.resource
+          ? "no Terraform resource in the repo matched this alert's cloud resource"
+          : "the alert carries no resource identifier to map",
+      });
+      continue;
+    }
+    // LLM01: `title` / `message` / `remediation` are free text from a
+    // third-party feed — the least-obvious attacker-influenced channel into the
+    // agent's context, and from there into PR bodies, review comments and
+    // SARIF, all of which render Markdown and some HTML. Neutralise the markup
+    // where the text ENTERS our data model, so every downstream surface is
+    // covered once instead of each having to remember. See mcp/untrustedContent.ts.
+    const evidence =
+      neutralizeOptional(finding.title) ??
+      neutralizeOptional(finding.message) ??
+      finding.rule_id;
+    concerns.push(
+      buildConcern({
+        source: "reviewer",
+        rule: ruleToken(finding),
+        file: match.file,
+        line: match.line,
+        severity: normalizeExternalSeverity(finding.severity),
+        category: "security",
+        evidence,
+        remediation_hint: neutralizeOptional(finding.remediation),
+      }),
+    );
+  }
+  return { concerns, unmapped };
+}

package/src/mcp/terraform/currency.ts

@@ -0,0 +1,354 @@
+/**
+ * Version currency (provider currency / module upgrades).
+ *
+ * Answers one question the scanners can't: "is a NEWER version available?"
+ * tflint checks that versions are *pinned*; nothing we run checks that they're
+ * *current*. This module compares the workspace's pinned provider requirements
+ * and registry-module pins against the Terraform Registry's published versions.
+ *
+ * Deliberately NOT a scanner source: results are advisory intelligence the
+ * Remediate mode turns into `chore(deps)` upgrade PRs, not `Concern`s — the
+ * finding baseline stays scanner-owned (see docs/workplan/04-implementation-plan.md).
+ *
+ * Degrades green everywhere: a per-source lookup failure is reported on that
+ * row (`lookup: "error" | "not_found" | "unsupported_source"`), and only a
+ * fully-unreachable registry (every lookup failed) becomes a tool-level skip.
+ */
+
+import semver from "semver";
+import { collectModuleGraph, splitModuleSource } from "#app/mcp/modules";
+import { collectProviderRequirements } from "#app/mcp/terraform/scanners";
+
+export const DEFAULT_REGISTRY_BASE_URL = "https://registry.terraform.io";
+const FETCH_TIMEOUT_MS = 5_000;
+
+// --- constraint parsing (pure) ----------------------------------------------
+
+/** one comparator of a Terraform constraint: `~> 5.0`, `>= 1.2`, `5.1.0`. */
+const COMPARATOR_RE = /^(~>|>=|<=|!=|=|>|<)?\s*v?(\d+(?:\.\d+){0,2})$/;
+
+/** pad a 1-3 part version to full semver: `5` → `5.0.0`, `5.1` → `5.1.0`. */
+function padVersion(version: string): string {
+  const parts = version.split(".");
+  while (parts.length < 3) parts.push("0");
+  return parts.join(".");
+}
+
+/**
+ * Convert ONE Terraform version constraint string (comma-separated comparators,
+ * AND semantics) into an npm semver range, or null when any comparator is
+ * unparseable. `~>` is Terraform's pessimistic operator: the RIGHTMOST given
+ * component may float (`~> 5.0` → `>=5.0.0 <6.0.0`, `~> 5.1.2` → `>=5.1.2 <5.2.0`,
+ * `~> 5` → `>=5.0.0 <6.0.0`). `!=` comparators have no single-range npm
+ * equivalent and are skipped — acceptable here because the result only ranks
+ * candidate versions, it never selects what gets installed.
+ */
+export function terraformConstraintToRange(constraint: string): string | null {
+  const parts = constraint
+    .split(",")
+    .map((p) => p.trim())
+    .filter(Boolean);
+  if (parts.length === 0) return null;
+
+  const ranges: string[] = [];
+  for (const part of parts) {
+    const m = part.match(COMPARATOR_RE);
+    if (!m) return null;
+    const op = m[1] ?? "=";
+    const raw = m[2];
+    if (raw === undefined) return null;
+    if (op === "!=") continue; // see docstring — skipped, never fatal
+    const full = padVersion(raw);
+    if (op === "~>") {
+      const given = raw.split(".").length;
+      // bump the component LEFT of the floating one: `~> 5.1.2` floats patch
+      // (< 5.2.0); `~> 5.0` and `~> 5` float minor/major-rightmost (< 6.0.0).
+      const upper =
+        given >= 3
+          ? `${semver.major(full)}.${semver.minor(full) + 1}.0`
+          : `${semver.major(full) + 1}.0.0`;
+      ranges.push(`>=${full} <${upper}`);
+    } else if (op === "=") {
+      ranges.push(full);
+    } else {
+      ranges.push(`${op}${full}`);
+    }
+  }
+  return ranges.length > 0 ? ranges.join(" ") : null;
+}
+
+// --- currency classification (pure) -----------------------------------------
+
+export interface CurrencyVerdict {
+  /** newest stable version the registry publishes (null: nothing published). */
+  latest: string | null;
+  /** newest published version the written constraint admits (null: no
+   * constraint, unparseable constraint, or nothing satisfies). */
+  newestSatisfying: string | null;
+  /** true when the registry has a stable version the constraint does NOT admit
+   * — i.e. an upgrade PR is available. Always false without a constraint. */
+  outdated: boolean;
+  /** how many MAJORs the constraint's best version trails the latest by —
+   * >0 signals an interface-risk upgrade that must be `needs-human`. */
+  majorsBehind: number;
+}
+
+/** drop non-semver tokens and prereleases; registries publish plain versions
+ * but git refs (`v1.2.0-rc1`, branch names) also land here via module pins.
+ * Valid-but-prerelease versions must be dropped BEFORE any coercion — coercing
+ * `7.0.0-beta1` would strip the suffix and misreport a beta as stable. */
+function stableVersions(available: string[]): string[] {
+  const out: string[] = [];
+  for (const raw of available) {
+    const exact = semver.valid(raw);
+    if (exact !== null) {
+      if (semver.prerelease(exact) === null) out.push(exact);
+      continue;
+    }
+    const coerced = semver.coerce(raw);
+    if (coerced !== null) out.push(coerced.version);
+  }
+  return out;
+}
+
+export function classifyCurrency(params: {
+  constraint: string | null;
+  available: string[];
+}): CurrencyVerdict {
+  const versions = stableVersions(params.available);
+  const latest = versions.length > 0 ? (versions.sort(semver.rcompare)[0] ?? null) : null;
+  if (latest === null) {
+    return { latest: null, newestSatisfying: null, outdated: false, majorsBehind: 0 };
+  }
+  if (params.constraint === null) {
+    return { latest, newestSatisfying: null, outdated: false, majorsBehind: 0 };
+  }
+  const range = terraformConstraintToRange(params.constraint);
+  if (range === null) {
+    return { latest, newestSatisfying: null, outdated: false, majorsBehind: 0 };
+  }
+  const newestSatisfying = semver.maxSatisfying(versions, range);
+  const outdated = newestSatisfying === null || semver.lt(newestSatisfying, latest);
+  const majorsBehind = newestSatisfying
+    ? Math.max(0, semver.major(latest) - semver.major(newestSatisfying))
+    : Math.max(0, semver.major(latest));
+  return { latest, newestSatisfying, outdated, majorsBehind };
+}
+
+// --- registry lookups (I/O) --------------------------------------------------
+
+export type LookupStatus = "ok" | "not_found" | "error" | "unsupported_source";
+
+/** strip a leading default-registry host; reject other hosts (private/TFE
+ * registries use different auth + paths — out of scope for the public check). */
+export function normalizeRegistryPath(base: string, expectedSegments: number): string | null {
+  const segments = base.split("/").filter(Boolean);
+  if (segments.length === expectedSegments + 1 && segments[0]?.includes(".")) {
+    if (segments[0] !== "registry.terraform.io") return null;
+    segments.shift();
+  }
+  return segments.length === expectedSegments ? segments.join("/") : null;
+}
+
+/**
+ * One registry GET that returns parsed JSON or a per-lookup status. Shared by
+ * the version-currency lookups here and the registry module-detail/search
+ * lookups in `./registry.ts` so every registry call degrades green identically:
+ * 404 → `not_found`, network/non-2xx/parse failure → `error`. `headers` carries
+ * the `Authorization: Bearer …` token for a private-registry call (public default
+ * registry calls pass none).
+ */
+export async function fetchRegistryJson(
+  url: string,
+  headers?: Record<string, string>,
+): Promise<{ status: LookupStatus; body: unknown }> {
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      ...(headers ? { headers } : {}),
+    });
+  } catch {
+    return { status: "error", body: null };
+  }
+  if (response.status === 404) return { status: "not_found", body: null };
+  if (!response.ok) return { status: "error", body: null };
+  try {
+    return { status: "ok", body: await response.json() };
+  } catch {
+    return { status: "error", body: null };
+  }
+}
+
+async function fetchVersionList(
+  url: string,
+  extract: (body: unknown) => string[] | null,
+): Promise<{ status: LookupStatus; versions: string[] }> {
+  const { status, body } = await fetchRegistryJson(url);
+  if (status !== "ok") return { status, versions: [] };
+  const versions = extract(body);
+  if (versions === null) return { status: "error", versions: [] };
+  return { status: "ok", versions };
+}
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** pull `[{version}, …]` out of a `{ …, versions: [...] }` payload. */
+function extractVersionsArray(container: unknown): string[] | null {
+  if (!isRecord(container) || !Array.isArray(container.versions)) return null;
+  const out: string[] = [];
+  for (const entry of container.versions) {
+    if (isRecord(entry) && typeof entry.version === "string") out.push(entry.version);
+  }
+  return out;
+}
+
+/** GET /v1/providers/{namespace}/{type}/versions — provider release list. */
+export async function fetchProviderVersions(
+  source: string,
+  opts: { baseUrl?: string } = {},
+): Promise<{ status: LookupStatus; versions: string[] }> {
+  const path = normalizeRegistryPath(source, 2);
+  if (path === null) return { status: "unsupported_source", versions: [] };
+  const base = opts.baseUrl ?? DEFAULT_REGISTRY_BASE_URL;
+  return fetchVersionList(`${base}/v1/providers/${path}/versions`, extractVersionsArray);
+}
+
+/** GET /v1/modules/{namespace}/{name}/{provider}/versions — registry-module
+ * release list (the response nests per-module records; the first is the
+ * requested module, the rest are dependency records we don't want). */
+export async function fetchModuleVersions(
+  sourceBase: string,
+  opts: { baseUrl?: string } = {},
+): Promise<{ status: LookupStatus; versions: string[] }> {
+  const path = normalizeRegistryPath(sourceBase, 3);
+  if (path === null) return { status: "unsupported_source", versions: [] };
+  const base = opts.baseUrl ?? DEFAULT_REGISTRY_BASE_URL;
+  return fetchVersionList(`${base}/v1/modules/${path}/versions`, (body) => {
+    if (!isRecord(body) || !Array.isArray(body.modules)) return null;
+    return extractVersionsArray(body.modules[0]);
+  });
+}
+
+// --- workspace report (orchestration) ----------------------------------------
+
+export interface ProviderCurrencyRow {
+  name: string;
+  source: string;
+  constraint: string | null;
+  latest: string | null;
+  newest_satisfying: string | null;
+  outdated: boolean;
+  majors_behind: number;
+  lookup: LookupStatus;
+}
+
+export interface ModuleCurrencyRow {
+  name: string;
+  source: string;
+  version: string | null;
+  latest: string | null;
+  newest_satisfying: string | null;
+  outdated: boolean;
+  /** registry module with no `version` attribute — pin it (to `latest`). */
+  unpinned: boolean;
+  lookup: LookupStatus;
+  declared_in: string;
+}
+
+export interface CurrencyReport {
+  providers: ProviderCurrencyRow[];
+  modules: ModuleCurrencyRow[];
+  outdated_count: number;
+  unpinned_count: number;
+  lookups_attempted: number;
+  lookups_failed: number;
+}
+
+/** bare `aws` in a legacy required_providers block means `hashicorp/aws`. */
+function providerSource(name: string, source: string | null): string {
+  return source ?? `hashicorp/${name}`;
+}
+
+export async function checkVersionCurrency(
+  cwd: string,
+  opts: { baseUrl?: string } = {},
+): Promise<CurrencyReport> {
+  const providerReqs = collectProviderRequirements(cwd);
+  const registryModules = collectModuleGraph(cwd).modules.filter((m) => m.kind === "registry");
+
+  // one lookup per distinct source — a workspace redeclaring `hashicorp/aws`
+  // in every root must not turn into N identical registry calls.
+  const providerLookups = new Map<string, Promise<{ status: LookupStatus; versions: string[] }>>();
+  for (const req of providerReqs) {
+    const source = providerSource(req.name, req.source);
+    if (!providerLookups.has(source)) {
+      providerLookups.set(source, fetchProviderVersions(source, opts));
+    }
+  }
+  const moduleLookups = new Map<string, Promise<{ status: LookupStatus; versions: string[] }>>();
+  for (const mod of registryModules) {
+    const base = splitModuleSource(mod.source).base;
+    if (!moduleLookups.has(base)) {
+      moduleLookups.set(base, fetchModuleVersions(base, opts));
+    }
+  }
+  // resolve every lookup up front so the row loops below read settled results
+  // (and so a missing map entry can degrade to an error row, not a crash).
+  const noLookup = { status: "error" as LookupStatus, versions: [] as string[] };
+  const providerResults = new Map(
+    await Promise.all([...providerLookups].map(async ([source, p]) => [source, await p] as const)),
+  );
+  const moduleResults = new Map(
+    await Promise.all([...moduleLookups].map(async ([base, p]) => [base, await p] as const)),
+  );
+
+  const providers: ProviderCurrencyRow[] = [];
+  for (const req of providerReqs) {
+    const source = providerSource(req.name, req.source);
+    const result = providerResults.get(source) ?? noLookup;
+    const verdict = classifyCurrency({ constraint: req.version, available: result.versions });
+    providers.push({
+      name: req.name,
+      source,
+      constraint: req.version,
+      latest: verdict.latest,
+      newest_satisfying: verdict.newestSatisfying,
+      outdated: result.status === "ok" && verdict.outdated,
+      majors_behind: result.status === "ok" ? verdict.majorsBehind : 0,
+      lookup: result.status,
+    });
+  }
+
+  const modules: ModuleCurrencyRow[] = [];
+  for (const mod of registryModules) {
+    const base = splitModuleSource(mod.source).base;
+    const result = moduleResults.get(base) ?? noLookup;
+    const verdict = classifyCurrency({ constraint: mod.version, available: result.versions });
+    modules.push({
+      name: mod.name,
+      source: mod.source,
+      version: mod.version,
+      latest: verdict.latest,
+      newest_satisfying: verdict.newestSatisfying,
+      outdated: result.status === "ok" && verdict.outdated,
+      unpinned: mod.version === null,
+      lookup: result.status,
+      declared_in: mod.declaredIn,
+    });
+  }
+
+  const failed = [...providers, ...modules].filter(
+    (row) => row.lookup === "error" || row.lookup === "not_found",
+  ).length;
+  return {
+    providers,
+    modules,
+    outdated_count: [...providers, ...modules].filter((r) => r.outdated).length,
+    unpinned_count: modules.filter((m) => m.unpinned).length,
+    lookups_attempted: providers.length + modules.length,
+    lookups_failed: failed,
+  };
+}