nexarch 0.12.14 → 0.12.16

package/dist/commands/ingest-infra.js

@@ -3,7 +3,7 @@ import { execFileSync } from "child_process";
 import { resolve } from "path";
 import { callMcpTool } from "../lib/mcp.js";
 import { parseTerraformStateBuffer, projectTerraformState, inferEnvironmentFromTags, environmentSubtypeFor, } from "../lib/terraform-projection.js";
-import { loadTerraformCatalogue, describeCatalogue } from "../lib/terraform-catalogue.js";
+import { loadIacCatalogue, describeCatalogue } from "../lib/iac-catalogue.js";
 import { discoverRootModules, environmentFromPath } from "../lib/terraform-detect.js";
 const ENTITY_BATCH = 50;
 function readResult(raw) {
@@ -88,8 +88,28 @@ function loadState(statePath, dir) {
         return { document: parseTerraformStateBuffer(stdout), source: "terraform show -json" };
     }
     catch (error) {
-        const detail = error instanceof Error ? error.message : String(error);
-        throw new Error(`Could not read Terraform state. Run inside the infrastructure repo with terraform available, or pass --state <file>.\n  ${detail.split("\n")[0]}`);
+        // `error.message` is only ever "Command failed: terraform show -json",
+        // which names the command that failed and not one thing about why. The
+        // reason — no state, a backend that needs credentials, a lock, a directory
+        // owned by another user — is on stderr, and reporting the wrapper instead
+        // of the cause leaves the caller with nothing to act on. That matters more
+        // here than usual: the caller is normally an agent, and an agent given
+        // "Command failed" can only report failure, while an agent given
+        // "Error: Backend initialization required" can run terraform init.
+        const failure = error;
+        const stderr = (typeof failure.stderr === "string" ? failure.stderr : failure.stderr?.toString("utf8") ?? "").trim();
+        const reason = stderr || failure.message || String(error);
+        // Terraform's own errors are already formatted for a reader; keep enough
+        // lines to carry the explanation without pasting an entire trace.
+        const detail = reason
+            .split("\n")
+            .filter((line) => line.trim().length > 0)
+            .slice(0, 8)
+            .map((line) => `  ${line.trim()}`)
+            .join("\n");
+        throw new Error(`Could not read Terraform state in ${dir}.\n` +
+            `  Run inside the infrastructure repo with terraform available, or pass --state <file>.\n` +
+            `\n  terraform said:\n${detail}`);
     }
 }
 function resolveEnvironment(projection, override, dir, rootModuleDir) {
@@ -301,7 +321,7 @@ export async function ingestInfra(args) {
     // Fetched once and used for both projection and payload: two different
     // catalogues within one ingest would produce entities whose attributes and
     // whose type mapping disagreed about what a resource is.
-    const catalogueResult = await loadTerraformCatalogue();
+    const catalogueResult = await loadIacCatalogue();
     if (!asJson)
         console.log(`  ${describeCatalogue(catalogueResult)}`);
     const catalogue = catalogueResult.entries;

package/dist/lib/iac-catalogue-seed.js

@@ -0,0 +1,227 @@
+/**
+ * Fallback catalogue for Terraform resource types.
+ *
+ * GENERATED FILE — DO NOT EDIT BY HAND.
+ * Regenerate with: node web/scripts/export-iac-catalogue.mjs
+ *
+ * The catalogue proper is platform reference data, curated in
+ * `iac_catalogue_entry` and served to every tenant, so supporting a new
+ * service is a data change rather than a CLI release. This file is what the CLI
+ * falls back to when it cannot reach the platform — offline, or a CI runner with
+ * no route to the gateway. It is generated from that table so it can never get
+ * ahead of it: editing it by hand recreates the two-sources-of-truth problem
+ * moving the catalogue out of the CLI was meant to end.
+ *
+ * 25 entries, exported 2026-08-21.
+ */
+export const IAC_CATALOGUE_SEED = [
+    {
+        resourceType: "azurerm_container_app_environment",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_environment",
+        attributes: ["name", "location", "resource_group_name", "default_domain", "infrastructure_subnet_id", "internal_load_balancer_enabled", "static_ip_address", "zone_redundancy_enabled"],
+        references: { "infrastructure_subnet_id": "azurerm_subnet" },
+        cloudResourceType: "Microsoft.App/managedEnvironments",
+    },
+    {
+        resourceType: "azurerm_service_plan",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_environment",
+        attributes: ["name", "location", "resource_group_name", "sku_name", "os_type", "worker_count"],
+        cloudResourceType: "Microsoft.Web/serverfarms",
+    },
+    {
+        resourceType: "azurerm_cognitive_account",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "compute_host",
+        attributes: ["name", "location", "resource_group_name", "kind", "sku_name", "endpoint", "custom_subdomain_name", "public_network_access_enabled", "local_auth_enabled"],
+        cloudResourceType: "Microsoft.CognitiveServices/accounts",
+    },
+    {
+        resourceType: "azurerm_container_app",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["name", "location", "resource_group_name", "container_app_environment_id", "revision_mode", "workload_profile_name"],
+        references: { "container_app_environment_id": "azurerm_container_app_environment" },
+        cloudResourceType: "Microsoft.App/containerApps",
+    },
+    {
+        resourceType: "azurerm_container_app_job",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["name", "location", "resource_group_name", "container_app_environment_id", "replica_timeout_in_seconds", "workload_profile_name"],
+        references: { "container_app_environment_id": "azurerm_container_app_environment" },
+        cloudResourceType: "Microsoft.App/jobs",
+    },
+    {
+        resourceType: "azurerm_linux_web_app",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["name", "location", "resource_group_name", "service_plan_id", "https_only", "default_hostname"],
+        references: { "service_plan_id": "azurerm_service_plan" },
+        cloudResourceType: "Microsoft.Web/sites",
+    },
+    {
+        resourceType: "azurerm_cosmosdb_account",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_document",
+        role: "data_store",
+        attributes: ["name", "location", "resource_group_name", "kind", "offer_type", "public_network_access_enabled", "endpoint"],
+        cloudResourceType: "Microsoft.DocumentDB/databaseAccounts",
+    },
+    {
+        resourceType: "azurerm_postgresql_flexible_server",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_relational",
+        role: "data_store",
+        attributes: ["name", "location", "resource_group_name", "fqdn", "version", "sku_name", "storage_mb", "storage_tier", "public_network_access_enabled", "delegated_subnet_id", "private_dns_zone_id", "backup_retention_days", "geo_redundant_backup_enabled", "zone"],
+        cloudResourceType: "Microsoft.DBforPostgreSQL/flexibleServers",
+    },
+    {
+        resourceType: "azurerm_postgresql_flexible_server_database",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_relational",
+        role: "data_store",
+        attributes: ["name", "server_id", "charset", "collation"],
+        cloudResourceType: "Microsoft.DBforPostgreSQL/flexibleServers/databases",
+    },
+    {
+        resourceType: "azurerm_storage_account",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_object",
+        role: "data_store",
+        attributes: ["name", "location", "resource_group_name", "account_kind", "account_tier", "account_replication_type", "access_tier", "https_traffic_only_enabled", "min_tls_version", "public_network_access_enabled", "allow_nested_items_to_be_public", "shared_access_key_enabled", "primary_blob_endpoint", "primary_location", "secondary_location"],
+        cloudResourceType: "Microsoft.Storage/storageAccounts",
+    },
+    {
+        resourceType: "azurerm_storage_container",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_object",
+        role: "data_store",
+        attributes: ["name", "container_access_type", "storage_account_id", "has_immutability_policy"],
+        cloudResourceType: "Microsoft.Storage/storageAccounts/blobServices/containers",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_endpoint",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "host_name", "enabled", "cdn_frontdoor_profile_id"],
+        references: { "cdn_frontdoor_profile_id": "azurerm_cdn_frontdoor_profile" },
+        cloudResourceType: "Microsoft.Cdn/profiles/afdEndpoints",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_firewall_policy",
+        entityTypeCode: "policy_control",
+        role: "edge",
+        attributes: ["name", "location", "resource_group_name", "sku_name", "mode", "enabled"],
+        cloudResourceType: "Microsoft.Network/frontDoorWebApplicationFirewallPolicies",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_profile",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "location", "resource_group_name", "sku_name", "response_timeout_seconds"],
+        cloudResourceType: "Microsoft.Cdn/profiles",
+    },
+    {
+        resourceType: "azurerm_role_assignment",
+        entityTypeCode: "policy_control",
+        role: "identity",
+        attributes: ["name", "principal_id", "principal_type", "role_definition_name", "scope"],
+        cloudResourceType: "Microsoft.Authorization/roleAssignments",
+    },
+    {
+        resourceType: "azurerm_user_assigned_identity",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_control_plane",
+        role: "identity",
+        attributes: ["name", "location", "resource_group_name", "client_id", "principal_id", "tenant_id"],
+        cloudResourceType: "Microsoft.ManagedIdentity/userAssignedIdentities",
+    },
+    {
+        resourceType: "azurerm_servicebus_namespace",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "messaging",
+        attributes: ["name", "location", "resource_group_name", "sku", "public_network_access_enabled"],
+        cloudResourceType: "Microsoft.ServiceBus/namespaces",
+    },
+    {
+        resourceType: "azurerm_servicebus_queue",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "messaging",
+        attributes: ["name", "namespace_id", "max_delivery_count", "requires_session"],
+        references: { "namespace_id": "azurerm_servicebus_namespace" },
+        cloudResourceType: "Microsoft.ServiceBus/namespaces/queues",
+    },
+    {
+        resourceType: "azurerm_private_dns_zone",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "number_of_record_sets"],
+        cloudResourceType: "Microsoft.Network/privateDnsZones",
+    },
+    {
+        resourceType: "azurerm_private_endpoint",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "location", "resource_group_name", "subnet_id"],
+        references: { "subnet_id": "azurerm_subnet" },
+        cloudResourceType: "Microsoft.Network/privateEndpoints",
+    },
+    {
+        resourceType: "azurerm_subnet",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "virtual_network_name", "address_prefixes", "default_outbound_access_enabled", "private_endpoint_network_policies"],
+        nameReferences: { "virtual_network_name": "azurerm_virtual_network" },
+        cloudResourceType: "Microsoft.Network/virtualNetworks/subnets",
+    },
+    {
+        resourceType: "azurerm_virtual_network",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "location", "resource_group_name", "address_space", "guid"],
+        cloudResourceType: "Microsoft.Network/virtualNetworks",
+    },
+    {
+        resourceType: "azurerm_log_analytics_workspace",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "observability",
+        attributes: ["name", "location", "resource_group_name", "sku", "retention_in_days", "workspace_id"],
+        cloudResourceType: "Microsoft.OperationalInsights/workspaces",
+    },
+    {
+        resourceType: "azurerm_container_registry",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "registry",
+        attributes: ["name", "location", "resource_group_name", "login_server", "sku", "admin_enabled", "public_network_access_enabled"],
+        cloudResourceType: "Microsoft.ContainerRegistry/registries",
+    },
+    {
+        resourceType: "azurerm_key_vault",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "secret_store",
+        attributes: ["name", "location", "resource_group_name", "vault_uri", "sku_name", "enable_rbac_authorization", "rbac_authorization_enabled", "public_network_access_enabled", "purge_protection_enabled", "soft_delete_retention_days"],
+        cloudResourceType: "Microsoft.KeyVault/vaults",
+    },
+];

package/dist/lib/iac-catalogue.js

@@ -0,0 +1,41 @@
+import { callMcpTool } from "./mcp.js";
+import { IAC_CATALOGUE_SEED } from "./iac-catalogue-seed.js";
+/**
+ * Rejects a payload that would widen what may be read.
+ *
+ * A served catalogue is a network response, and this one decides what leaves
+ * the machine. An entry with no attributes is meaningless — it would project a
+ * resource stripped of all evidence — and an entry missing its type mapping
+ * cannot be applied at all, so neither is accepted quietly. Terraform's own
+ * `sensitive_values` gate still runs behind whatever survives here.
+ */
+function usableEntries(payload) {
+    return (payload.entries ?? []).filter((entry) => typeof entry?.resourceType === "string" &&
+        typeof entry?.entityTypeCode === "string" &&
+        Array.isArray(entry?.attributes) &&
+        entry.attributes.length > 0 &&
+        entry.attributes.every((attribute) => typeof attribute === "string"));
+}
+export async function loadIacCatalogue() {
+    try {
+        const raw = await callMcpTool("nexarch_get_iac_catalogue", {});
+        const payload = JSON.parse(raw.content?.[0]?.text ?? "{}");
+        const entries = usableEntries(payload);
+        // An empty or unparseable response is not a reason to ingest nothing: the
+        // bundled copy is known-good and was generated from this same table.
+        if (entries.length === 0) {
+            return { entries: IAC_CATALOGUE_SEED, source: "bundled", reason: "the platform returned no usable entries" };
+        }
+        return { entries, source: "platform", reason: null };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { entries: IAC_CATALOGUE_SEED, source: "bundled", reason: message };
+    }
+}
+/** One line describing which catalogue was used, so a stale ingest is never silent. */
+export function describeCatalogue(result) {
+    if (result.source === "platform")
+        return `Catalogue: ${result.entries.length} resource types from the platform.`;
+    return `Catalogue: ${result.entries.length} resource types from the bundled copy — ${result.reason}.\n  Types added to the platform since this CLI was published will not be recognised.`;
+}

package/dist/lib/terraform-detect.js

@@ -183,7 +183,14 @@ export function discoverRootModules(repoDir) {
                 if (/^\s*provider\s+"[a-z0-9_]+"\s*\{/m.test(content))
                     hasProvider = true;
             }
-            const initialised = existsSync(join(dir, ".terraform"));
+            // A `.terraform` directory only proves provider plugins were downloaded.
+            // The backend — the thing `terraform show` needs — is initialised when
+            // `.terraform/terraform.tfstate` records its configuration. Treating the
+            // directory as proof reports a root as ready, the caller runs ingest, and
+            // Terraform answers "Backend initialization required" from somewhere the
+            // caller was told not to expect it.
+            const hasPluginDir = existsSync(join(dir, ".terraform"));
+            const initialised = existsSync(join(dir, ".terraform", "terraform.tfstate"));
             const hasTfvars = entries.some((entry) => entry.endsWith(".tfvars") || entry.endsWith(".tfvars.json"));
             const environmentHint = environmentFromPath(relative);
             const underStacksDir = /(^|[\\/])(environments|envs|stacks|live)([\\/]|$)/i.test(relative);
@@ -193,11 +200,13 @@ export function discoverRootModules(repoDir) {
                 signals.push("provider configuration");
             if (initialised)
                 signals.push("initialised");
+            else if (hasPluginDir)
+                signals.push("providers downloaded, backend not initialised");
             if (hasTfvars)
                 signals.push("tfvars");
             if (underStacksDir)
                 signals.push("stacks directory");
-            if (hasBackend || hasProvider || initialised || (underStacksDir && hasTfvars) || (underStacksDir && environmentHint)) {
+            if (hasBackend || hasProvider || initialised || hasPluginDir || (underStacksDir && hasTfvars) || (underStacksDir && environmentHint)) {
                 found.push({ dir, relative: relative || ".", signals, environmentHint, initialised, usesLocalBackend: hasLocalBackend });
                 // A root module's subdirectories are its own modules, not further roots.
                 return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexarch",
-  "version": "0.12.14",
+  "version": "0.12.16",
   "description": "Your architecture workspace for AI delivery.",
   "keywords": [
     "nexarch",