nexarch 0.12.19 → 0.12.23

package/dist/lib/mcp.js

@@ -1,21 +1,8 @@
 import https from "https";
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-import { dirname, join } from "path";
 import { requireCredentials } from "./credentials.js";
+import { cliVersion } from "./version.js";
 const MCP_GATEWAY_URL = "https://mcp.nexarch.ai";
-function readCliVersion() {
-    try {
-        const here = dirname(fileURLToPath(import.meta.url));
-        const pkgPath = join(here, "..", "..", "package.json");
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-        return pkg.version ?? "0.0.0";
-    }
-    catch {
-        return "0.0.0";
-    }
-}
-const CLI_VERSION = readCliVersion();
+const CLI_VERSION = cliVersion();
 const REQUEST_TIMEOUT_MS = Number.parseInt(process.env.NEXARCH_MCP_TIMEOUT_MS ?? "90000", 10) || 90_000;
 const REQUEST_RETRIES = Math.max(0, Number.parseInt(process.env.NEXARCH_MCP_RETRIES ?? "2", 10) || 2);
 function sleep(ms) {

package/dist/lib/terraform-detect.js

@@ -2,6 +2,17 @@ import { existsSync, readdirSync, readFileSync, statSync } from "fs";
 import { join, sep } from "path";
 const SCAN_DEPTH = 8;
 const IGNORED_DIRS = new Set(["node_modules", ".git", ".terraform", "dist", "build", ".next"]);
+/**
+ * Path segments whose contents demonstrate Terraform rather than run it.
+ *
+ * An `examples/complete` directory configures a provider and looks exactly like
+ * an estate root by every local signal — which is why terraform-aws-vpc
+ * reported thirteen of them as environments while missing the modules that are
+ * the point of the repository. Worse than missing the real architecture: the
+ * examples are mutually exclusive demonstrations, so graphing them together
+ * describes an estate that has never existed anywhere.
+ */
+const NON_ESTATE_SEGMENT = /(^|[\\/])(examples?|docs?|test|tests|fixtures?|testdata|_example|sample|samples)([\\/]|$)/i;
 function collectTerraformFiles(dir, depth = 0, out = []) {
     if (depth > SCAN_DEPTH)
         return out;
@@ -115,6 +126,43 @@ function collectModuleDirectories(dir, depth = 0, out = []) {
     }
     return out;
 }
+/**
+ * Recognises a repository that publishes reusable modules rather than running an estate.
+ *
+ * The Terraform registry convention is a module at the repository root —
+ * `main.tf` with `variables.tf` and `outputs.tf` beside it — deliberately
+ * configuring no provider and no backend, because both are supplied by whoever
+ * calls it. Every signal that identifies an estate is therefore absent by
+ * design, and the signals that *are* present belong to the examples directory.
+ *
+ * This matters more than tidiness. terraform-aws-vpc has no estate to ingest:
+ * asking it for one and getting thirteen mutually exclusive demonstrations is
+ * worse than getting nothing, because nothing is honest.
+ */
+function detectPublishedModules(dir) {
+    const rootFiles = (() => {
+        try {
+            return readdirSync(dir);
+        }
+        catch {
+            return [];
+        }
+    })();
+    const hasRootModule = rootFiles.includes("variables.tf") && rootFiles.includes("outputs.tf") && rootFiles.some((f) => f.endsWith(".tf") && f !== "variables.tf" && f !== "outputs.tf");
+    const modules = [];
+    const modulesDir = join(dir, "modules");
+    try {
+        for (const child of readdirSync(modulesDir)) {
+            const full = join(modulesDir, child);
+            if (statSync(full).isDirectory() && readdirSync(full).some((f) => f.endsWith(".tf")))
+                modules.push(child);
+        }
+    }
+    catch {
+        // No modules directory; a single-module repository is still a library.
+    }
+    return { isLibrary: hasRootModule, modules: modules.sort() };
+}
 const ROOT_SCAN_DEPTH = 4;
 const ENVIRONMENT_DIR = /^(dev|development|test|qa|uat|sit|stag|staging|preprod|pre-prod|prod|production|live|dr)$/i;
 /**
@@ -159,7 +207,8 @@ export function discoverRootModules(repoDir) {
         }
         const tfFiles = entries.filter((entry) => entry.endsWith(".tf"));
         const isUnderModules = /(^|[\\/])modules([\\/]|$)/i.test(relative);
-        if (tfFiles.length > 0 && !isUnderModules) {
+        const isDemonstration = NON_ESTATE_SEGMENT.test(relative);
+        if (tfFiles.length > 0 && !isUnderModules && !isDemonstration) {
             const signals = [];
             let hasBackend = false;
             let hasLocalBackend = false;
@@ -206,7 +255,13 @@ export function discoverRootModules(repoDir) {
                 signals.push("tfvars");
             if (underStacksDir)
                 signals.push("stacks directory");
-            if (hasBackend || hasProvider || initialised || hasPluginDir || (underStacksDir && hasTfvars) || (underStacksDir && environmentHint)) {
+            // A provider block alone no longer qualifies. It is the one signal an
+            // example shares with a real estate, and treating it as sufficient is
+            // what let demonstration fixtures in. What distinguishes an estate is
+            // evidence that state exists or is configured somewhere: a backend, an
+            // initialised working directory, or a conventional stacks layout.
+            const isEstateRoot = hasBackend || initialised || hasPluginDir || (underStacksDir && (hasTfvars || Boolean(environmentHint)));
+            if (isEstateRoot) {
                 found.push({ dir, relative: relative || ".", signals, environmentHint, initialised, usesLocalBackend: hasLocalBackend });
                 // A root module's subdirectories are its own modules, not further roots.
                 return;
@@ -278,7 +333,17 @@ export function detectInfrastructureProject(dir) {
     if (rootModules.length > 0) {
         signals.push(`${rootModules.length} root module${rootModules.length === 1 ? "" : "s"}`);
     }
-    const isInfrastructure = rootModules.length > 0 || (files.length > 0 && (files.length >= 3 || hasRemoteBackend || hasProviderBlock || moduleDirectories.length > 0));
+    const library = detectPublishedModules(dir);
+    // An estate is claimed only by root modules that survived the tightened
+    // acceptance above. A repository with a root module and no estate roots is
+    // publishing modules, not running anything.
+    const repoKind = rootModules.length > 0 ? "estate" : library.isLibrary ? "module_library" : "unknown";
+    if (repoKind === "module_library") {
+        signals.push(library.modules.length > 0 ? `publishes ${library.modules.length + 1} modules` : "publishes a reusable module");
+    }
+    const isInfrastructure = rootModules.length > 0 ||
+        repoKind === "module_library" ||
+        (files.length > 0 && (files.length >= 3 || hasRemoteBackend || hasProviderBlock || moduleDirectories.length > 0));
     return {
         isInfrastructure,
         rootModules,
@@ -287,6 +352,8 @@ export function detectInfrastructureProject(dir) {
         hasRemoteBackend,
         hasProviderBlock,
         moduleDirectories,
+        repoKind,
+        publishedModules: repoKind === "module_library" ? library.modules : [],
         ...detectCiSystem(dir),
     };
 }

package/dist/lib/terraform-projection.js

@@ -208,7 +208,7 @@ export function projectTerraformState(params) {
             entitySubtypeCode: entry.entitySubtypeCode ?? null,
             role: entry.role,
             mode: typeof resource.mode === "string" ? resource.mode : "managed",
-            name: typeof values.name === "string" ? values.name : null,
+            name: typeof values[entry.nameAttribute ?? "name"] === "string" ? values[entry.nameAttribute ?? "name"] : null,
             attributes,
             tags: projectTags(values, sensitiveValues),
             identityIds: projectIdentityIds(values),

package/dist/lib/trust.js

@@ -1,11 +1,18 @@
 import https from "https";
 import { requireCredentials } from "./credentials.js";
 const MCP_GATEWAY_URL = "https://mcp.nexarch.ai";
-export async function requestTrustAttestation(agentId) {
+/**
+ * `contentHash` (sha256 hex of the exact managed-section text being written)
+ * binds the signature to the instructions themselves, not just to the claim
+ * that Nexarch minted *a* token for this agent — see ADR-0112. Omit it only
+ * when there is no section body yet to hash.
+ */
+export async function requestTrustAttestation(agentId, contentHash) {
     const creds = requireCredentials();
     const body = JSON.stringify({
         agentId,
-        scope: "instruction_injection",
+        scope: "agent_config_write",
+        ...(contentHash ? { contentHash } : {}),
     });
     return new Promise((resolve) => {
         const url = new URL("/trust/attest", MCP_GATEWAY_URL);

package/dist/lib/version.js

@@ -0,0 +1,41 @@
+import { readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+export function cliBuild() {
+    let version = "0.0.0";
+    let installPath = "unknown";
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const root = resolve(here, "..", "..");
+        installPath = root;
+        const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        version = pkg.version ?? "0.0.0";
+    }
+    catch {
+        // A CLI that cannot read its own manifest should still run; it just cannot
+        // say which build it is.
+    }
+    return {
+        version,
+        installPath,
+        viaNpx: /[\\/]_npx[\\/]/.test(installPath),
+        nodeVersion: process.version,
+    };
+}
+/** Just the version, for the MCP client's user agent. */
+export function cliVersion() {
+    return cliBuild().version;
+}
+/** The block printed by `nexarch --version`. */
+export function formatBuild(build) {
+    return [
+        `nexarch ${build.version}`,
+        `  running from  ${build.installPath}${build.viaNpx ? "  (npx cache)" : ""}`,
+        `  node          ${build.nodeVersion}`,
+        build.viaNpx
+            ? ""
+            : `\n  This is an installed copy, not a fresh download. If it is older than you\n  expect, a global install is shadowing \`npx nexarch@latest\`:\n    npm rm -g nexarch`,
+    ]
+        .filter(Boolean)
+        .join("\n");
+}

package/package.json

@@ -1,35 +1,35 @@
-{
-  "name": "nexarch",
-  "version": "0.12.19",
-  "description": "Your architecture workspace for AI delivery.",
-  "keywords": [
-    "nexarch",
-    "mcp",
-    "architecture",
-    "ai"
-  ],
-  "license": "MIT",
-  "author": "Nexarch <hello@nexarch.ai>",
-  "homepage": "https://nexarch.ai",
-  "engines": {
-    "node": ">=18"
-  },
-  "type": "module",
-  "bin": {
-    "nexarch": "dist/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "tsc",
-    "dev": "tsx src/index.ts",
-    "typecheck": "tsc --noEmit"
-  },
-  "devDependencies": {
-    "@types/node": "^22",
-    "tsx": "^4",
-    "typescript": "^5"
-  }
-}
+{
+  "name": "nexarch",
+  "version": "0.12.23",
+  "description": "Your architecture workspace for AI delivery.",
+  "keywords": [
+    "nexarch",
+    "mcp",
+    "architecture",
+    "ai"
+  ],
+  "license": "MIT",
+  "author": "Nexarch <hello@nexarch.ai>",
+  "homepage": "https://nexarch.ai",
+  "engines": {
+    "node": ">=18"
+  },
+  "type": "module",
+  "bin": {
+    "nexarch": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "tsc",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "tsx": "^4",
+    "typescript": "^5"
+  }
+}