nexarch 0.12.18 → 0.12.22

package/dist/commands/ingest-infra.js

@@ -6,6 +6,45 @@ import { parseTerraformStateBuffer, projectTerraformState, inferEnvironmentFromT
 import { loadIacCatalogue, describeCatalogue } from "../lib/iac-catalogue.js";
 import { discoverRootModules, environmentFromPath } from "../lib/terraform-detect.js";
 const ENTITY_BATCH = 50;
+/**
+ * Terraform provider prefix -> the platform it provisions.
+ *
+ * Keyed off the resource type prefix rather than a provider block, because a
+ * prefix is available for every resource the projector already read and
+ * needs no second pass over the raw state. `resolveNames` are tried against
+ * the reference library first, so the platform entity stays canonical rather
+ * than a tenant inventing its own "AWS" every time; `fallbackRef`/`fallbackName`
+ * are what is used when that resolution is skipped (a dry run) or fails.
+ */
+const PROVIDER_PLATFORMS = [
+    { prefix: "azurerm_", resolveNames: ["azure", "microsoft azure"], fallbackRef: "platform:azure", fallbackName: "Microsoft Azure" },
+    { prefix: "aws_", resolveNames: ["aws", "amazon web services"], fallbackRef: "platform:aws", fallbackName: "Amazon Web Services" },
+    { prefix: "google_", resolveNames: ["gcp", "google cloud platform"], fallbackRef: "platform:gcp", fallbackName: "Google Cloud Platform" },
+    { prefix: "google-beta_", resolveNames: ["gcp", "google cloud platform"], fallbackRef: "platform:gcp", fallbackName: "Google Cloud Platform" },
+];
+/**
+ * Picks the platform an estate is provisioned on from the resource types
+ * actually seen — projected and unrecognised alike, since even a type the
+ * catalogue does not cover yet still carries its provider prefix. Ties and
+ * mixed-provider states resolve to whichever provider has the most
+ * resources: real multi-cloud-in-one-root estates are rare, and a single
+ * dominant platform is a far better default than reverting to a hardcoded
+ * one. A root module ingested with none of the providers above recognised
+ * gets no free-text guess — better to say nothing than invent a platform
+ * name from an unfamiliar prefix.
+ */
+function detectPlatform(resourceTypes) {
+    const counts = new Map();
+    for (const resourceType of resourceTypes) {
+        const platform = PROVIDER_PLATFORMS.find((p) => resourceType.startsWith(p.prefix));
+        if (platform)
+            counts.set(platform.prefix, (counts.get(platform.prefix) ?? 0) + 1);
+    }
+    if (counts.size === 0)
+        return null;
+    const [topPrefix] = [...counts.entries()].sort((a, b) => b[1] - a[1])[0];
+    return PROVIDER_PLATFORMS.find((p) => p.prefix === topPrefix) ?? null;
+}
 function readResult(raw) {
     return JSON.parse(raw.content?.[0]?.text ?? "{}");
 }
@@ -174,7 +213,13 @@ export function buildIngestPayload(params) {
             attributes: { source: "terraform_ingest", terraform_version: projection.terraformVersion },
         },
     ];
-    const relationships = [];
+    const relationships = [
+        // The environment lives on the platform. Without this edge the two nodes
+        // this payload always creates float beside each other, and no query can
+        // answer "which cloud is dev on" — every resource knows both, but the
+        // environment itself knows neither.
+        { relationshipTypeCode: "runs_on", fromEntityRef: environmentRef, toEntityRef: platformRef },
+    ];
     // Lookup tables for the topology pass below, populated alongside entities so
     // a single loop over projection.resources is enough for both.
     const entityRefByTypeAndName = new Map();
@@ -403,14 +448,21 @@ export async function ingestInfra(args) {
     }
     const { environment, how } = resolveEnvironment(projection, environmentOverride, workingDir, statePath ? null : workingDir);
     projection.environment = environment;
-    // Azure is the only provider the seed catalogue covers today; resolving it
-    // through the reference library keeps the platform entity canonical rather
-    // than inventing a second "Azure" for every tenant.
-    let platformRef = "platform:azure";
-    let platformName = "Microsoft Azure";
-    if (!dryRun) {
+    // Detected from what is actually in state, not assumed: an estate is read
+    // once and the provider it is on follows from that, the same way the
+    // catalogue itself covers whichever providers have entries rather than
+    // just Azure. Resolving the detected platform through the reference
+    // library keeps the entity canonical rather than inventing a second "AWS"
+    // for every tenant.
+    const detectedPlatform = detectPlatform([
+        ...projection.resources.map((r) => r.resourceType),
+        ...projection.unknownTypes.map((u) => u.resourceType),
+    ]);
+    let platformRef = detectedPlatform?.fallbackRef ?? "platform:unknown";
+    let platformName = detectedPlatform?.fallbackName ?? "Unrecognised cloud platform";
+    if (!dryRun && detectedPlatform) {
         try {
-            const raw = await callMcpTool("nexarch_resolve_reference", { names: ["azure"] });
+            const raw = await callMcpTool("nexarch_resolve_reference", { names: detectedPlatform.resolveNames });
             const resolved = readResult(raw);
             const hit = (resolved.results ?? []).find((r) => r.resolved && r.entityTypeCode === "platform" && r.canonicalExternalRef);
             if (hit?.canonicalExternalRef) {

package/dist/commands/init-project-infra.js

@@ -65,15 +65,17 @@ function printNextSteps(steps, registered) {
  */
 function reportDryRun(params) {
     const { asJson, projectRef, detection, entities, relationships } = params;
-    const nextSteps = nextStepsFor(projectRef, detection);
+    const isLibrary = detection.repoKind === "module_library";
+    const nextSteps = isLibrary ? [] : nextStepsFor(projectRef, detection);
     if (asJson) {
         process.stdout.write(`${JSON.stringify({
             ok: true,
             dryRun: true,
             wrote: false,
             projectRef,
-            registrationStatus: "skeleton_only",
-            enrichmentCompleted: false,
+            repoKind: detection.repoKind,
+            registrationStatus: isLibrary ? "complete" : "skeleton_only",
+            enrichmentCompleted: isLibrary,
             detection,
             plan: { entities, relationships },
             nextSteps,
@@ -88,6 +90,20 @@ function reportDryRun(params) {
         for (const rel of relationships)
             console.log(`    ${rel.fromEntityRef} --${rel.relationshipTypeCode}--> ${rel.toEntityRef}`);
     }
+    // A module library has no estate, so registration really is the whole job —
+    // and saying "run the commands above" when there are none is the same defect
+    // as the missing handoff, pointed the other way.
+    if (isLibrary) {
+        console.log(`\nThis repository publishes reusable modules; it does not provision an estate,`);
+        console.log(`so there is nothing to ingest and registration is the whole job.`);
+        if (detection.publishedModules.length > 0) {
+            console.log(`\n  Modules published here:`);
+            for (const name of detection.publishedModules)
+                console.log(`    ${name}`);
+        }
+        console.log(`\nNothing was written. Re-run without --dry-run to register.`);
+        return;
+    }
     // The dry run used to stop here, which made registration look like the whole
     // job: a reader saw four entities and no hint that seven ingest runs were the
     // actual work. A preview has to preview the handoff too.
@@ -116,6 +132,8 @@ export async function runInfrastructureOnboarding(options, detection) {
             entityRef: projectRef,
             entityTypeCode: "project",
             entitySubtypeCode: "project_infrastructure",
+            // Both shapes are infrastructure projects; repo_kind above carries which,
+            // rather than inventing a subtype the ontology does not define.
             name: displayName,
             description: `Infrastructure-as-code repository provisioning the estate (${detection.signals.join(", ")}).`,
             attributes: {
@@ -124,6 +142,8 @@ export async function runInfrastructureOnboarding(options, detection) {
                 terraform_file_count: detection.terraformFileCount,
                 has_remote_backend: detection.hasRemoteBackend,
                 root_module_count: detection.rootModules.length,
+                repo_kind: detection.repoKind,
+                ...(detection.publishedModules.length > 0 ? { published_modules: detection.publishedModules.slice(0, 40) } : {}),
                 ...(detection.ciSystem ? { ci_system: detection.ciSystem } : {}),
                 ...(detection.moduleDirectories.length > 0 ? { terraform_modules: detection.moduleDirectories.slice(0, 25) } : {}),
             },
@@ -177,11 +197,23 @@ export async function runInfrastructureOnboarding(options, detection) {
     // the map up front — rather than letting the caller discover it through a
     // failure — is what lets an agent finish the job unaided.
     const roots = detection.rootModules;
-    const nextSteps = nextStepsFor(projectRef, detection);
-    if (!asJson && roots.length > 1)
+    const isLibrary = detection.repoKind === "module_library";
+    const nextSteps = isLibrary ? [] : nextStepsFor(projectRef, detection);
+    if (!asJson && !isLibrary && roots.length > 1)
         printNextSteps(nextSteps, true);
+    if (!asJson && isLibrary) {
+        console.log(`\nThis repository publishes reusable modules; it does not provision an estate.`);
+        console.log(`There is no state to read, so there is nothing to ingest — and that is the`);
+        console.log(`correct outcome rather than a gap. Its modules become architecture when a`);
+        console.log(`repository that *does* provision an estate calls them and is ingested.`);
+        if (detection.publishedModules.length > 0) {
+            console.log(`\n  Modules published here:`);
+            for (const name of detection.publishedModules)
+                console.log(`    ${name}`);
+        }
+    }
     let ingested = false;
-    if (!skipIngest && roots.length <= 1) {
+    if (!skipIngest && !isLibrary && roots.length <= 1) {
         const shouldIngest = nonInteractive ? false : await confirm("\nRead the current state and populate the graph now?");
         if (shouldIngest) {
             try {
@@ -199,7 +231,7 @@ export async function runInfrastructureOnboarding(options, detection) {
     // caller's report honest: the numbers it needs to decide "am I finished?"
     // come from the command that did the work, not from a convention it half
     // remembers.
-    const outstanding = ingested ? nextSteps.filter((step) => step.rootModule !== "." && roots.length > 1) : nextSteps;
+    const outstanding = isLibrary ? [] : ingested ? nextSteps.filter((step) => step.rootModule !== "." && roots.length > 1) : nextSteps;
     const { file, snippet } = ciSnippetFor(detection.ciSystem, detection.ciFile);
     if (asJson) {
         process.stdout.write(`${JSON.stringify({
@@ -214,11 +246,13 @@ export async function runInfrastructureOnboarding(options, detection) {
         }, null, 2)}\n`);
         return;
     }
-    console.log(`\nInfrastructure changes continuously, so ingestion belongs in the pipeline, not in someone's memory.`);
-    console.log(`Add this to ${file}:\n`);
-    console.log(snippet);
-    console.log(`\nNEXARCH_TOKEN is a service credential — create one in the workspace under`);
-    console.log(`Discovery → Agents, then store it as a masked CI variable.`);
+    if (!isLibrary) {
+        console.log(`\nInfrastructure changes continuously, so ingestion belongs in the pipeline, not in someone's memory.`);
+        console.log(`Add this to ${file}:\n`);
+        console.log(snippet);
+        console.log(`\nNEXARCH_TOKEN is a service credential — create one in the workspace under`);
+        console.log(`Discovery → Agents, then store it as a masked CI variable.`);
+    }
     if (outstanding.length > 0) {
         console.log(`\nThis run registered the repository only. Until the ${outstanding.length} ingest command${outstanding.length === 1 ? "" : "s"} above`);
         console.log(`have run, the graph knows the repo exists but nothing it provisions.`);

package/dist/commands/init-project.js

@@ -1003,7 +1003,63 @@ export function scanProject(dir) {
     };
 }
 // ─── Relationship type selection ──────────────────────────────────────────────
-function pickRelationshipType(toEntityTypeCode, toEntitySubtypeCode, _fromEntityTypeCode = "application") {
+/**
+ * The relationship pairs this workspace's ontology actually permits.
+ *
+ * Populated once per run from the ingest contract. Empty means the contract
+ * could not be read, in which case selection falls back to its preferences
+ * unchecked — a scan that records slightly wrong relationships is worth more
+ * than a scan that refuses to run because a read failed.
+ */
+let allowedLinks = new Set();
+function linkKey(from, rel, to) {
+    return `${from}|${rel}|${to}`;
+}
+export async function loadAllowedLinks(companyId) {
+    try {
+        const raw = await callMcpTool("nexarch_get_ingest_contract", { companyId }, { companyId });
+        const parsed = parseToolText(raw);
+        const links = parsed.ontology?.allowedLinks ?? [];
+        allowedLinks = new Set(links.map((l) => linkKey(l.fromEntityTypeCode, l.relationshipTypeCode, l.toEntityTypeCode)));
+        return allowedLinks.size;
+    }
+    catch {
+        allowedLinks = new Set();
+        return 0;
+    }
+}
+/**
+ * Narrows a preferred relationship type to one the ontology accepts.
+ *
+ * The preference below encodes what a relationship *means*; this decides
+ * whether the graph will take it from this particular source. Those came apart
+ * in practice: a technology_component depending on a managed service was
+ * offered `integrates_with`, which only accepts application-shaped sources, and
+ * every such write was refused server-side. Refusals are silent unless someone
+ * reads telemetry, so the scan looked clean and the edges simply were not there.
+ *
+ * Checking here rather than hoping also means an ontology change cannot quietly
+ * invalidate a shipped CLI: the contract is read at run time, so the constraint
+ * the gateway will apply is the constraint used to choose.
+ */
+function conformRelationshipType(preferred, fromEntityTypeCode, toEntityTypeCode) {
+    if (allowedLinks.size === 0)
+        return preferred;
+    if (allowedLinks.has(linkKey(fromEntityTypeCode, preferred, toEntityTypeCode)))
+        return preferred;
+    // depends_on is the broadest runtime statement and the gateway's own
+    // suggestion when it rejects one of these; part_of covers containment when
+    // even that is not permitted.
+    for (const fallback of ["depends_on", "runs_on", "part_of"]) {
+        if (fallback !== preferred && allowedLinks.has(linkKey(fromEntityTypeCode, fallback, toEntityTypeCode)))
+            return fallback;
+    }
+    // Nothing legal connects these two. Returning the preference lets the write
+    // be refused with the gateway's own explanation, which is more useful than a
+    // silently dropped relationship.
+    return preferred;
+}
+function pickRelationshipType(toEntityTypeCode, toEntitySubtypeCode, fromEntityTypeCode = "application") {
     switch (toEntityTypeCode) {
         case "model":
             return "uses_model";
@@ -1134,6 +1190,11 @@ export async function initProject(args) {
             return;
         }
     }
+    // Read before anything is chosen: relationship selection below narrows its
+    // preferences to what this workspace's ontology actually accepts, and an
+    // empty set means every preference goes through unchecked.
+    const linkCount = await loadAllowedLinks(creds.companyId);
+    logProgress("contract.loaded", `allowedLinks=${linkCount}`);
     if (!asJson)
         console.log(`Scanning ${dir}…`);
     logProgress("scan.start", dir);
@@ -1511,7 +1572,7 @@ export async function initProject(args) {
         if (!rootDepNames.has(r.input) && !rootDepNames.has(r.normalised))
             continue;
         const depSpec = rootDepVersions.get(r.input) ?? rootDepVersions.get(r.normalised);
-        addRel(pickRelationshipType(r.entityTypeCode, r.entitySubtypeCode), projectExternalKey, r.canonicalExternalRef, 0.9, {
+        addRel(conformRelationshipType(pickRelationshipType(r.entityTypeCode, r.entitySubtypeCode), entityTypeOverride, r.entityTypeCode), projectExternalKey, r.canonicalExternalRef, 0.9, {
             source: depSpec?.source ?? "manifest_scan",
             detected_at: nowIso,
             ...buildVersionAttributes(depSpec?.versionRaw ?? null, depSpec?.source ?? "manifest_scan"),
@@ -1541,7 +1602,7 @@ export async function initProject(args) {
         for (const dep of sp.depSpecs) {
             const r = resolvedByInput.get(dep.name);
             if (r?.canonicalExternalRef && r.entityTypeCode) {
-                addRel(pickRelationshipType(r.entityTypeCode, r.entitySubtypeCode, sp.entityType), sp.externalKey, r.canonicalExternalRef, 0.9, {
+                addRel(conformRelationshipType(pickRelationshipType(r.entityTypeCode, r.entitySubtypeCode, sp.entityType), sp.entityType, r.entityTypeCode), sp.externalKey, r.canonicalExternalRef, 0.9, {
                     source: dep.source,
                     detected_at: nowIso,
                     ...buildVersionAttributes(dep.versionRaw, dep.source),
@@ -1829,7 +1890,7 @@ export async function initProject(args) {
                     .map((d) => resolvedByInput.get(d.name))
                     .filter((r) => !!r?.canonicalExternalRef)
                     .map((r) => {
-                    const relationshipTypeCode = pickRelationshipType(r.entityTypeCode, r.entitySubtypeCode, sp.entityType);
+                    const relationshipTypeCode = conformRelationshipType(pickRelationshipType(r.entityTypeCode, r.entitySubtypeCode, sp.entityType), sp.entityType, r.entityTypeCode);
                     const relationshipKey = `${relationshipTypeCode}::${sp.externalKey}::${r.canonicalExternalRef}`;
                     return {
                         canonicalExternalRef: r.canonicalExternalRef,

package/dist/index.js

@@ -28,6 +28,7 @@ import { proposalsStart } from "./commands/proposals-start.js";
 import { registerRuntime } from "./commands/register-runtime.js";
 import { ingestInfra } from "./commands/ingest-infra.js";
 import { verifyTrust } from "./commands/verify-trust.js";
+import { cliBuild, formatBuild } from "./lib/version.js";
 const [, , command, ...args] = process.argv;
 const commands = {
     login,
@@ -75,6 +76,17 @@ async function main() {
             return;
         }
     }
+    // Answered before dispatch, and before any credential is required: "which
+    // copy am I running" has to work when nothing else does.
+    if (command === "--version" || command === "-v" || command === "version") {
+        const build = cliBuild();
+        if (args.includes("--json"))
+            process.stdout.write(`${JSON.stringify(build, null, 2)}
+`);
+        else
+            console.log(formatBuild(build));
+        return;
+    }
     const handler = commands[command ?? ""];
     if (!handler) {
         console.log(`
@@ -83,6 +95,7 @@ nexarch — Your architecture workspace for AI delivery.
 Usage:
   nexarch login         Authenticate in browser and store company-scoped credentials
                         Option: --company <id>
+  nexarch --version     Print the version and the path this copy runs from
   nexarch logout        Remove stored credentials
   nexarch status        Check connection and show architecture summary
   nexarch verify-trust  Verify this repo's Nexarch trust attestation. Reads the token

package/dist/lib/iac-catalogue-seed.js

@@ -12,9 +12,18 @@
  * ahead of it: editing it by hand recreates the two-sources-of-truth problem
  * moving the catalogue out of the CLI was meant to end.
  *
- * 30 entries, exported 2026-08-21.
+ * 86 entries, exported 2026-08-22.
  */
 export const IAC_CATALOGUE_SEED = [
+    {
+        resourceType: "aws_ecs_cluster",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_environment",
+        attributes: ["name"],
+        canonicalEntityRef: "global:platform_component:aws_ecs",
+        cloudResourceType: "AWS::ECS::Cluster",
+    },
     {
         resourceType: "azurerm_container_app_environment",
         entityTypeCode: "platform_component",
@@ -34,6 +43,71 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_app_service",
         cloudResourceType: "Microsoft.Web/serverfarms",
     },
+    {
+        resourceType: "aws_ecs_service",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["name", "cluster", "task_definition", "desired_count", "launch_type"],
+        references: { "cluster": "aws_ecs_cluster" },
+        nameReferences: { "task_definition": "aws_ecs_task_definition" },
+        canonicalEntityRef: "global:platform_component:aws_ecs",
+        cloudResourceType: "AWS::ECS::Service",
+    },
+    {
+        resourceType: "aws_ecs_task_definition",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        attributes: ["family", "network_mode", "requires_compatibilities", "cpu", "memory"],
+        canonicalEntityRef: "global:platform_component:aws_ecs",
+        cloudResourceType: "AWS::ECS::TaskDefinition",
+        nameAttribute: "family",
+    },
+    {
+        resourceType: "aws_instance",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["ami", "instance_type", "availability_zone", "subnet_id", "vpc_security_group_ids", "private_ip", "associate_public_ip_address", "iam_instance_profile"],
+        references: { "subnet_id": "aws_subnet" },
+        canonicalEntityRef: "global:platform_component:aws_ec2",
+        cloudResourceType: "AWS::EC2::Instance",
+    },
+    {
+        resourceType: "aws_lambda_function",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_runtime",
+        role: "compute_host",
+        bindable: true,
+        attributes: ["function_name", "runtime", "handler", "memory_size", "timeout", "role", "architectures", "package_type"],
+        references: { "role": "aws_iam_role" },
+        canonicalEntityRef: "global:platform_component:aws_lambda",
+        cloudResourceType: "AWS::Lambda::Function",
+        nameAttribute: "function_name",
+    },
+    {
+        resourceType: "azurerm_ai_foundry",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "compute_host",
+        attributes: ["name", "location", "resource_group_name", "storage_account_id", "key_vault_id", "public_network_access"],
+        references: { "key_vault_id": "azurerm_key_vault", "storage_account_id": "azurerm_storage_account" },
+        canonicalEntityRef: "global:platform_component:azure_ai_foundry",
+        cloudResourceType: "Microsoft.MachineLearningServices/workspaces",
+    },
+    {
+        resourceType: "azurerm_ai_foundry_project",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "compute_host",
+        attributes: ["name", "location", "ai_services_hub_id", "description"],
+        references: { "ai_services_hub_id": "azurerm_ai_foundry" },
+        canonicalEntityRef: "global:platform_component:azure_ai_foundry",
+        cloudResourceType: "Microsoft.MachineLearningServices/workspaces/projects",
+    },
     {
         resourceType: "azurerm_cognitive_account",
         entityTypeCode: "platform_component",
@@ -86,6 +160,45 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_static_web_apps",
         cloudResourceType: "Microsoft.Web/staticSites",
     },
+    {
+        resourceType: "aws_db_instance",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_relational",
+        role: "data_store",
+        attributes: ["identifier", "engine", "engine_version", "instance_class", "allocated_storage", "publicly_accessible", "multi_az", "db_subnet_group_name"],
+        canonicalEntityRef: "global:platform_component:aws_rds",
+        cloudResourceType: "AWS::RDS::DBInstance",
+        nameAttribute: "identifier",
+    },
+    {
+        resourceType: "aws_dynamodb_table",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_document",
+        role: "data_store",
+        attributes: ["name", "billing_mode", "hash_key", "range_key", "stream_enabled"],
+        canonicalEntityRef: "global:platform_component:aws_dynamodb",
+        cloudResourceType: "AWS::DynamoDB::Table",
+    },
+    {
+        resourceType: "aws_elasticache_cluster",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_cache",
+        role: "data_store",
+        attributes: ["cluster_id", "engine", "engine_version", "node_type", "num_cache_nodes"],
+        canonicalEntityRef: "global:platform_component:aws_elasticache",
+        cloudResourceType: "AWS::ElastiCache::CacheCluster",
+        nameAttribute: "cluster_id",
+    },
+    {
+        resourceType: "aws_s3_bucket",
+        entityTypeCode: "data_store",
+        entitySubtypeCode: "store_object",
+        role: "data_store",
+        attributes: ["bucket", "bucket_prefix", "force_destroy"],
+        canonicalEntityRef: "global:platform_component:aws_s3",
+        cloudResourceType: "AWS::S3::Bucket",
+        nameAttribute: "bucket",
+    },
     {
         resourceType: "azurerm_cosmosdb_account",
         entityTypeCode: "data_store",
@@ -131,6 +244,65 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_storage",
         cloudResourceType: "Microsoft.Storage/storageAccounts/blobServices/containers",
     },
+    {
+        resourceType: "aws_cloudfront_distribution",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["enabled", "comment", "default_root_object", "domain_name"],
+        canonicalEntityRef: "global:platform_component:aws_cloudfront",
+        cloudResourceType: "AWS::CloudFront::Distribution",
+        nameAttribute: "domain_name",
+    },
+    {
+        resourceType: "aws_lb",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "internal", "load_balancer_type", "security_groups", "subnets", "dns_name"],
+        canonicalEntityRef: "global:platform_component:aws_elastic_load_balancing",
+        cloudResourceType: "AWS::ElasticLoadBalancingV2::LoadBalancer",
+    },
+    {
+        resourceType: "aws_lb_listener",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["port", "protocol", "load_balancer_arn"],
+        references: { "load_balancer_arn": "aws_lb" },
+        canonicalEntityRef: "global:platform_component:aws_elastic_load_balancing",
+        cloudResourceType: "AWS::ElasticLoadBalancingV2::Listener",
+    },
+    {
+        resourceType: "aws_lb_target_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "port", "protocol", "target_type", "vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_elastic_load_balancing",
+        cloudResourceType: "AWS::ElasticLoadBalancingV2::TargetGroup",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_custom_domain",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "host_name", "cdn_frontdoor_profile_id", "dns_zone_id"],
+        references: { "dns_zone_id": "azurerm_dns_zone", "cdn_frontdoor_profile_id": "azurerm_cdn_frontdoor_profile" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/customDomains",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_custom_domain_association",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["cdn_frontdoor_custom_domain_id"],
+        references: { "cdn_frontdoor_custom_domain_id": "azurerm_cdn_frontdoor_custom_domain" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/customDomains/associations",
+    },
     {
         resourceType: "azurerm_cdn_frontdoor_endpoint",
         entityTypeCode: "platform_component",
@@ -149,6 +321,26 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_web_application_firewall",
         cloudResourceType: "Microsoft.Network/frontDoorWebApplicationFirewallPolicies",
     },
+    {
+        resourceType: "azurerm_cdn_frontdoor_origin",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "host_name", "enabled", "certificate_name_check_enabled", "cdn_frontdoor_origin_group_id"],
+        references: { "cdn_frontdoor_origin_group_id": "azurerm_cdn_frontdoor_origin_group" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/originGroups/origins",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_origin_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "session_affinity_enabled", "cdn_frontdoor_profile_id"],
+        references: { "cdn_frontdoor_profile_id": "azurerm_cdn_frontdoor_profile" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/originGroups",
+    },
     {
         resourceType: "azurerm_cdn_frontdoor_profile",
         entityTypeCode: "platform_component",
@@ -158,6 +350,25 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_front_door",
         cloudResourceType: "Microsoft.Cdn/profiles",
     },
+    {
+        resourceType: "azurerm_cdn_frontdoor_route",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "edge",
+        attributes: ["name", "enabled", "patterns_to_match", "supported_protocols", "forwarding_protocol", "https_redirect_enabled", "cdn_frontdoor_endpoint_id", "cdn_frontdoor_origin_group_id"],
+        references: { "cdn_frontdoor_endpoint_id": "azurerm_cdn_frontdoor_endpoint", "cdn_frontdoor_origin_group_id": "azurerm_cdn_frontdoor_origin_group" },
+        canonicalEntityRef: "global:platform_component:azure_front_door",
+        cloudResourceType: "Microsoft.Cdn/profiles/afdEndpoints/routes",
+    },
+    {
+        resourceType: "azurerm_cdn_frontdoor_security_policy",
+        entityTypeCode: "policy_control",
+        role: "edge",
+        attributes: ["name", "cdn_frontdoor_profile_id"],
+        references: { "cdn_frontdoor_profile_id": "azurerm_cdn_frontdoor_profile" },
+        canonicalEntityRef: "global:platform_component:azure_web_application_firewall",
+        cloudResourceType: "Microsoft.Cdn/profiles/securityPolicies",
+    },
     {
         resourceType: "azurerm_static_web_app_custom_domain",
         entityTypeCode: "platform_component",
@@ -187,6 +398,100 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_traffic_manager",
         cloudResourceType: "Microsoft.Network/trafficManagerProfiles",
     },
+    {
+        resourceType: "aws_iam_policy",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "path", "description"],
+        canonicalEntityRef: "global:platform_component:aws_iam",
+        cloudResourceType: "AWS::IAM::ManagedPolicy",
+    },
+    {
+        resourceType: "aws_iam_role_policy_attachment",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["role", "policy_arn"],
+        canonicalEntityRef: "global:platform_component:aws_iam",
+        cloudResourceType: "AWS::IAM::RolePolicyAttachment",
+    },
+    {
+        resourceType: "azurerm_policy_definition_built_in",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "display_name", "policy_type", "mode"],
+        canonicalEntityRef: "global:platform_component:azure_policy",
+        cloudResourceType: "Microsoft.Authorization/policyDefinitions",
+    },
+    {
+        resourceType: "azurerm_policy_set_definition",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "display_name", "policy_type", "management_group_id"],
+        canonicalEntityRef: "global:platform_component:azure_policy",
+        cloudResourceType: "Microsoft.Authorization/policySetDefinitions",
+    },
+    {
+        resourceType: "azurerm_security_center_contact",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "alert_notifications", "alerts_to_admins"],
+        canonicalEntityRef: "global:platform_component:azure_defender_for_cloud",
+        cloudResourceType: "Microsoft.Security/securityContacts",
+    },
+    {
+        resourceType: "azurerm_security_center_subscription_pricing",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["tier", "resource_type"],
+        canonicalEntityRef: "global:platform_component:azure_defender_for_cloud",
+        cloudResourceType: "Microsoft.Security/pricings",
+    },
+    {
+        resourceType: "azurerm_security_center_workspace",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["scope", "workspace_id"],
+        references: { "workspace_id": "azurerm_log_analytics_workspace" },
+        canonicalEntityRef: "global:platform_component:azure_defender_for_cloud",
+        cloudResourceType: "Microsoft.Security/workspaceSettings",
+    },
+    {
+        resourceType: "azurerm_storage_container_immutability_policy",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["storage_container_resource_manager_id", "immutability_period_in_days", "protected_append_writes_all_enabled"],
+        references: { "storage_container_resource_manager_id": "azurerm_storage_container" },
+        canonicalEntityRef: "global:platform_component:azure_storage",
+        cloudResourceType: "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
+    },
+    {
+        resourceType: "azurerm_subscription_policy_assignment",
+        entityTypeCode: "policy_control",
+        role: "governance",
+        attributes: ["name", "display_name", "policy_definition_id", "subscription_id", "enforce"],
+        references: { "policy_definition_id": "azurerm_policy_set_definition" },
+        canonicalEntityRef: "global:platform_component:azure_policy",
+        cloudResourceType: "Microsoft.Authorization/policyAssignments",
+    },
+    {
+        resourceType: "aws_iam_role",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_control_plane",
+        role: "identity",
+        attributes: ["name", "path", "description", "max_session_duration"],
+        canonicalEntityRef: "global:platform_component:aws_iam",
+        cloudResourceType: "AWS::IAM::Role",
+    },
+    {
+        resourceType: "azurerm_federated_identity_credential",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_control_plane",
+        role: "identity",
+        attributes: ["name", "resource_group_name", "audience", "issuer", "subject", "parent_id"],
+        references: { "parent_id": "azurerm_user_assigned_identity" },
+        canonicalEntityRef: "global:platform_component:azure_managed_identity",
+        cloudResourceType: "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
+    },
     {
         resourceType: "azurerm_role_assignment",
         entityTypeCode: "policy_control",
@@ -204,6 +509,34 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_managed_identity",
         cloudResourceType: "Microsoft.ManagedIdentity/userAssignedIdentities",
     },
+    {
+        resourceType: "aws_sns_topic",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "messaging",
+        attributes: ["name", "display_name", "fifo_topic"],
+        canonicalEntityRef: "global:platform_component:aws_sns",
+        cloudResourceType: "AWS::SNS::Topic",
+    },
+    {
+        resourceType: "aws_sns_topic_subscription",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "messaging",
+        attributes: ["protocol", "topic_arn"],
+        references: { "topic_arn": "aws_sns_topic" },
+        canonicalEntityRef: "global:platform_component:aws_sns",
+        cloudResourceType: "AWS::SNS::Subscription",
+    },
+    {
+        resourceType: "aws_sqs_queue",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "messaging",
+        attributes: ["name", "fifo_queue", "visibility_timeout_seconds", "message_retention_seconds", "delay_seconds"],
+        canonicalEntityRef: "global:platform_component:aws_sqs",
+        cloudResourceType: "AWS::SQS::Queue",
+    },
     {
         resourceType: "azurerm_servicebus_namespace",
         entityTypeCode: "platform_component",
@@ -223,6 +556,133 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_service_bus",
         cloudResourceType: "Microsoft.ServiceBus/namespaces/queues",
     },
+    {
+        resourceType: "aws_db_subnet_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_rds",
+        cloudResourceType: "AWS::RDS::DBSubnetGroup",
+    },
+    {
+        resourceType: "aws_internet_gateway",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::InternetGateway",
+    },
+    {
+        resourceType: "aws_nat_gateway",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["subnet_id", "allocation_id", "connectivity_type"],
+        references: { "subnet_id": "aws_subnet" },
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::NatGateway",
+    },
+    {
+        resourceType: "aws_route53_record",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "type", "ttl", "zone_id"],
+        canonicalEntityRef: "global:platform_component:aws_route53",
+        cloudResourceType: "AWS::Route53::RecordSet",
+    },
+    {
+        resourceType: "aws_route53_zone",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "comment"],
+        canonicalEntityRef: "global:platform_component:aws_route53",
+        cloudResourceType: "AWS::Route53::HostedZone",
+    },
+    {
+        resourceType: "aws_route_table",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::RouteTable",
+    },
+    {
+        resourceType: "aws_security_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "description", "vpc_id"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_security_group",
+        cloudResourceType: "AWS::EC2::SecurityGroup",
+    },
+    {
+        resourceType: "aws_subnet",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["cidr_block", "availability_zone", "vpc_id", "map_public_ip_on_launch"],
+        references: { "vpc_id": "aws_vpc" },
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::Subnet",
+        nameAttribute: "id",
+    },
+    {
+        resourceType: "aws_vpc",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["cidr_block", "enable_dns_support", "enable_dns_hostnames", "instance_tenancy"],
+        canonicalEntityRef: "global:platform_component:aws_vpc",
+        cloudResourceType: "AWS::EC2::VPC",
+        nameAttribute: "id",
+    },
+    {
+        resourceType: "azurerm_dns_cname_record",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "zone_name", "ttl", "record"],
+        nameReferences: { "zone_name": "azurerm_dns_zone" },
+        canonicalEntityRef: "global:platform_component:azure_dns",
+        cloudResourceType: "Microsoft.Network/dnsZones/CNAME",
+    },
+    {
+        resourceType: "azurerm_dns_txt_record",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "zone_name", "ttl"],
+        nameReferences: { "zone_name": "azurerm_dns_zone" },
+        canonicalEntityRef: "global:platform_component:azure_dns",
+        cloudResourceType: "Microsoft.Network/dnsZones/TXT",
+    },
+    {
+        resourceType: "azurerm_dns_zone",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "number_of_record_sets", "name_servers"],
+        canonicalEntityRef: "global:platform_component:azure_dns",
+        cloudResourceType: "Microsoft.Network/dnsZones",
+    },
+    {
+        resourceType: "azurerm_network_security_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "location", "resource_group_name"],
+        canonicalEntityRef: "global:platform_component:azure_network_security_group",
+        cloudResourceType: "Microsoft.Network/networkSecurityGroups",
+    },
     {
         resourceType: "azurerm_private_dns_zone",
         entityTypeCode: "platform_component",
@@ -232,6 +692,17 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_private_dns",
         cloudResourceType: "Microsoft.Network/privateDnsZones",
     },
+    {
+        resourceType: "azurerm_private_dns_zone_virtual_network_link",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["name", "resource_group_name", "private_dns_zone_name", "virtual_network_id", "registration_enabled"],
+        references: { "virtual_network_id": "azurerm_virtual_network" },
+        nameReferences: { "private_dns_zone_name": "azurerm_private_dns_zone" },
+        canonicalEntityRef: "global:platform_component:azure_private_dns",
+        cloudResourceType: "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+    },
     {
         resourceType: "azurerm_private_endpoint",
         entityTypeCode: "platform_component",
@@ -252,6 +723,16 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_virtual_network",
         cloudResourceType: "Microsoft.Network/virtualNetworks/subnets",
     },
+    {
+        resourceType: "azurerm_subnet_network_security_group_association",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "network_boundary",
+        attributes: ["subnet_id", "network_security_group_id"],
+        references: { "subnet_id": "azurerm_subnet", "network_security_group_id": "azurerm_network_security_group" },
+        canonicalEntityRef: "global:platform_component:azure_network_security_group",
+        cloudResourceType: "Microsoft.Network/virtualNetworks/subnets/networkSecurityGroupAssociations",
+    },
     {
         resourceType: "azurerm_virtual_network",
         entityTypeCode: "platform_component",
@@ -261,6 +742,25 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_virtual_network",
         cloudResourceType: "Microsoft.Network/virtualNetworks",
     },
+    {
+        resourceType: "aws_cloudwatch_log_group",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "observability",
+        attributes: ["name", "retention_in_days"],
+        canonicalEntityRef: "global:platform_component:aws_cloudwatch",
+        cloudResourceType: "AWS::Logs::LogGroup",
+    },
+    {
+        resourceType: "aws_cloudwatch_metric_alarm",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "observability",
+        attributes: ["alarm_name", "comparison_operator", "evaluation_periods", "metric_name", "namespace", "period", "statistic", "threshold"],
+        canonicalEntityRef: "global:platform_component:aws_cloudwatch",
+        cloudResourceType: "AWS::CloudWatch::Alarm",
+        nameAttribute: "alarm_name",
+    },
     {
         resourceType: "azurerm_log_analytics_workspace",
         entityTypeCode: "platform_component",
@@ -270,6 +770,25 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_monitor",
         cloudResourceType: "Microsoft.OperationalInsights/workspaces",
     },
+    {
+        resourceType: "azurerm_monitor_diagnostic_setting",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "observability",
+        attributes: ["name", "target_resource_id", "log_analytics_workspace_id", "storage_account_id"],
+        references: { "storage_account_id": "azurerm_storage_account", "log_analytics_workspace_id": "azurerm_log_analytics_workspace" },
+        canonicalEntityRef: "global:platform_component:azure_monitor",
+        cloudResourceType: "Microsoft.Insights/diagnosticSettings",
+    },
+    {
+        resourceType: "aws_ecr_repository",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "registry",
+        attributes: ["name", "image_tag_mutability", "force_delete"],
+        canonicalEntityRef: "global:platform_component:aws_ecr",
+        cloudResourceType: "AWS::ECR::Repository",
+    },
     {
         resourceType: "azurerm_container_registry",
         entityTypeCode: "platform_component",
@@ -288,6 +807,26 @@ export const IAC_CATALOGUE_SEED = [
         canonicalEntityRef: "global:platform_component:azure_resource_group",
         cloudResourceType: "Microsoft.Resources/resourceGroups",
     },
+    {
+        resourceType: "aws_kms_key",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "secret_store",
+        attributes: ["description", "key_usage", "deletion_window_in_days", "enable_key_rotation"],
+        canonicalEntityRef: "global:platform_component:aws_kms",
+        cloudResourceType: "AWS::KMS::Key",
+        nameAttribute: "id",
+    },
+    {
+        resourceType: "aws_secretsmanager_secret",
+        entityTypeCode: "platform_component",
+        entitySubtypeCode: "platform_service",
+        role: "secret_store",
+        attributes: ["name", "description", "kms_key_id"],
+        references: { "kms_key_id": "aws_kms_key" },
+        canonicalEntityRef: "global:platform_component:aws_secrets_manager",
+        cloudResourceType: "AWS::SecretsManager::Secret",
+    },
     {
         resourceType: "azurerm_key_vault",
         entityTypeCode: "platform_component",

package/dist/lib/mcp.js

@@ -1,21 +1,8 @@
 import https from "https";
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-import { dirname, join } from "path";
 import { requireCredentials } from "./credentials.js";
+import { cliVersion } from "./version.js";
 const MCP_GATEWAY_URL = "https://mcp.nexarch.ai";
-function readCliVersion() {
-    try {
-        const here = dirname(fileURLToPath(import.meta.url));
-        const pkgPath = join(here, "..", "..", "package.json");
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-        return pkg.version ?? "0.0.0";
-    }
-    catch {
-        return "0.0.0";
-    }
-}
-const CLI_VERSION = readCliVersion();
+const CLI_VERSION = cliVersion();
 const REQUEST_TIMEOUT_MS = Number.parseInt(process.env.NEXARCH_MCP_TIMEOUT_MS ?? "90000", 10) || 90_000;
 const REQUEST_RETRIES = Math.max(0, Number.parseInt(process.env.NEXARCH_MCP_RETRIES ?? "2", 10) || 2);
 function sleep(ms) {

package/dist/lib/terraform-detect.js

@@ -2,6 +2,17 @@ import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { join, sep } from "path";
 const SCAN_DEPTH = 8;
 const IGNORED_DIRS = new Set(["node_modules", ".git", ".terraform", "dist", "build", ".next"]);
+/**
+ * Path segments whose contents demonstrate Terraform rather than run it.
+ *
+ * An `examples/complete` directory configures a provider and looks exactly like
+ * an estate root by every local signal — which is why terraform-aws-vpc
+ * reported thirteen of them as environments while missing the modules that are
+ * the point of the repository. Worse than missing the real architecture: the
+ * examples are mutually exclusive demonstrations, so graphing them together
+ * describes an estate that has never existed anywhere.
+ */
+const NON_ESTATE_SEGMENT = /(^|[\\/])(examples?|docs?|test|tests|fixtures?|testdata|_example|sample|samples)([\\/]|$)/i;
 function collectTerraformFiles(dir, depth = 0, out = []) {
     if (depth > SCAN_DEPTH)
         return out;
@@ -115,6 +126,43 @@ function collectModuleDirectories(dir, depth = 0, out = []) {
     }
     return out;
 }
+/**
+ * Recognises a repository that publishes reusable modules rather than running an estate.
+ *
+ * The Terraform registry convention is a module at the repository root —
+ * `main.tf` with `variables.tf` and `outputs.tf` beside it — deliberately
+ * configuring no provider and no backend, because both are supplied by whoever
+ * calls it. Every signal that identifies an estate is therefore absent by
+ * design, and the signals that *are* present belong to the examples directory.
+ *
+ * This matters more than tidiness. terraform-aws-vpc has no estate to ingest:
+ * asking it for one and getting thirteen mutually exclusive demonstrations is
+ * worse than getting nothing, because nothing is honest.
+ */
+function detectPublishedModules(dir) {
+    const rootFiles = (() => {
+        try {
+            return readdirSync(dir);
+        }
+        catch {
+            return [];
+        }
+    })();
+    const hasRootModule = rootFiles.includes("variables.tf") && rootFiles.includes("outputs.tf") && rootFiles.some((f) => f.endsWith(".tf") && f !== "variables.tf" && f !== "outputs.tf");
+    const modules = [];
+    const modulesDir = join(dir, "modules");
+    try {
+        for (const child of readdirSync(modulesDir)) {
+            const full = join(modulesDir, child);
+            if (statSync(full).isDirectory() && readdirSync(full).some((f) => f.endsWith(".tf")))
+                modules.push(child);
+        }
+    }
+    catch {
+        // No modules directory; a single-module repository is still a library.
+    }
+    return { isLibrary: hasRootModule, modules: modules.sort() };
+}
 const ROOT_SCAN_DEPTH = 4;
 const ENVIRONMENT_DIR = /^(dev|development|test|qa|uat|sit|stag|staging|preprod|pre-prod|prod|production|live|dr)$/i;
 /**
@@ -159,7 +207,8 @@ export function discoverRootModules(repoDir) {
         }
         const tfFiles = entries.filter((entry) => entry.endsWith(".tf"));
         const isUnderModules = /(^|[\\/])modules([\\/]|$)/i.test(relative);
-        if (tfFiles.length > 0 && !isUnderModules) {
+        const isDemonstration = NON_ESTATE_SEGMENT.test(relative);
+        if (tfFiles.length > 0 && !isUnderModules && !isDemonstration) {
             const signals = [];
             let hasBackend = false;
             let hasLocalBackend = false;
@@ -206,7 +255,13 @@ export function discoverRootModules(repoDir) {
                 signals.push("tfvars");
             if (underStacksDir)
                 signals.push("stacks directory");
-            if (hasBackend || hasProvider || initialised || hasPluginDir || (underStacksDir && hasTfvars) || (underStacksDir && environmentHint)) {
+            // A provider block alone no longer qualifies. It is the one signal an
+            // example shares with a real estate, and treating it as sufficient is
+            // what let demonstration fixtures in. What distinguishes an estate is
+            // evidence that state exists or is configured somewhere: a backend, an
+            // initialised working directory, or a conventional stacks layout.
+            const isEstateRoot = hasBackend || initialised || hasPluginDir || (underStacksDir && (hasTfvars || Boolean(environmentHint)));
+            if (isEstateRoot) {
                 found.push({ dir, relative: relative || ".", signals, environmentHint, initialised, usesLocalBackend: hasLocalBackend });
                 // A root module's subdirectories are its own modules, not further roots.
                 return;
@@ -278,7 +333,17 @@ export function detectInfrastructureProject(dir) {
     if (rootModules.length > 0) {
         signals.push(`${rootModules.length} root module${rootModules.length === 1 ? "" : "s"}`);
     }
-    const isInfrastructure = rootModules.length > 0 || (files.length > 0 && (files.length >= 3 || hasRemoteBackend || hasProviderBlock || moduleDirectories.length > 0));
+    const library = detectPublishedModules(dir);
+    // An estate is claimed only by root modules that survived the tightened
+    // acceptance above. A repository with a root module and no estate roots is
+    // publishing modules, not running anything.
+    const repoKind = rootModules.length > 0 ? "estate" : library.isLibrary ? "module_library" : "unknown";
+    if (repoKind === "module_library") {
+        signals.push(library.modules.length > 0 ? `publishes ${library.modules.length + 1} modules` : "publishes a reusable module");
+    }
+    const isInfrastructure = rootModules.length > 0 ||
+        repoKind === "module_library" ||
+        (files.length > 0 && (files.length >= 3 || hasRemoteBackend || hasProviderBlock || moduleDirectories.length > 0));
     return {
         isInfrastructure,
         rootModules,
@@ -287,6 +352,8 @@ export function detectInfrastructureProject(dir) {
         hasRemoteBackend,
         hasProviderBlock,
         moduleDirectories,
+        repoKind,
+        publishedModules: repoKind === "module_library" ? library.modules : [],
         ...detectCiSystem(dir),
     };
 }

package/dist/lib/terraform-projection.js

@@ -208,7 +208,7 @@ export function projectTerraformState(params) {
             entitySubtypeCode: entry.entitySubtypeCode ?? null,
             role: entry.role,
             mode: typeof resource.mode === "string" ? resource.mode : "managed",
-            name: typeof values.name === "string" ? values.name : null,
+            name: typeof values[entry.nameAttribute ?? "name"] === "string" ? values[entry.nameAttribute ?? "name"] : null,
             attributes,
             tags: projectTags(values, sensitiveValues),
             identityIds: projectIdentityIds(values),

package/dist/lib/version.js

@@ -0,0 +1,41 @@
+import { readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+export function cliBuild() {
+    let version = "0.0.0";
+    let installPath = "unknown";
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const root = resolve(here, "..", "..");
+        installPath = root;
+        const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        version = pkg.version ?? "0.0.0";
+    }
+    catch {
+        // A CLI that cannot read its own manifest should still run; it just cannot
+        // say which build it is.
+    }
+    return {
+        version,
+        installPath,
+        viaNpx: /[\\/]_npx[\\/]/.test(installPath),
+        nodeVersion: process.version,
+    };
+}
+/** Just the version, for the MCP client's user agent. */
+export function cliVersion() {
+    return cliBuild().version;
+}
+/** The block printed by `nexarch --version`. */
+export function formatBuild(build) {
+    return [
+        `nexarch ${build.version}`,
+        `  running from  ${build.installPath}${build.viaNpx ? "  (npx cache)" : ""}`,
+        `  node          ${build.nodeVersion}`,
+        build.viaNpx
+            ? ""
+            : `\n  This is an installed copy, not a fresh download. If it is older than you\n  expect, a global install is shadowing \`npx nexarch@latest\`:\n    npm rm -g nexarch`,
+    ]
+        .filter(Boolean)
+        .join("\n");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexarch",
-  "version": "0.12.18",
+  "version": "0.12.22",
   "description": "Your architecture workspace for AI delivery.",
   "keywords": [
     "nexarch",