nexarch 0.12.5 → 0.12.7

package/dist/commands/ingest-infra.js

@@ -0,0 +1,319 @@
+import { readFileSync, existsSync, readdirSync } from "fs";
+import { execFileSync } from "child_process";
+import { resolve } from "path";
+import { callMcpTool } from "../lib/mcp.js";
+import { parseTerraformStateBuffer, projectTerraformState, inferEnvironmentFromTags, environmentSubtypeFor, } from "../lib/terraform-projection.js";
+import { TERRAFORM_CATALOGUE_SEED } from "../lib/terraform-catalogue-seed.js";
+import { discoverRootModules, environmentFromPath } from "../lib/terraform-detect.js";
+const ENTITY_BATCH = 50;
+function readResult(raw) {
+    return JSON.parse(raw.content?.[0]?.text ?? "{}");
+}
+function slug(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 80);
+}
+function parseArgs(args) {
+    const get = (flag) => {
+        const index = args.indexOf(flag);
+        return index >= 0 && args[index + 1] ? args[index + 1] : null;
+    };
+    return {
+        statePath: get("--state"),
+        environmentOverride: get("--environment"),
+        dir: get("--dir") ?? process.cwd(),
+        projectRef: get("--project-ref"),
+        dryRun: args.includes("--dry-run"),
+        asJson: args.includes("--json"),
+    };
+}
+/**
+ * Chooses which root module to read.
+ *
+ * A repository routinely holds a root module per environment plus separate
+ * stacks for shared services, so the working directory is frequently not a root
+ * module at all. When it isn't, discovery decides: one candidate is used, and
+ * several are reported with the exact command for each — the caller is usually
+ * an agent, and an agent can act on a list of commands but not on a request to
+ * choose.
+ */
+function resolveRootModule(dir) {
+    const hasLocalTerraform = existsSync(dir) && readdirSync(dir).some((entry) => entry.endsWith(".tf"));
+    if (hasLocalTerraform)
+        return { dir, note: null };
+    const roots = discoverRootModules(dir);
+    if (roots.length === 1) {
+        return { dir: roots[0].dir, note: `no Terraform in the working directory; using the only root module found, ${roots[0].relative}` };
+    }
+    if (roots.length > 1) {
+        // Annotations go on their own line: the caller is usually an agent, and a
+        // command line with a parenthetical glued to it is not runnable as copied.
+        const lines = roots.flatMap((root) => {
+            const notes = [
+                root.environmentHint ? `${root.environmentHint} environment` : "shared stack",
+                root.initialised ? "initialised" : "run `terraform init` here first",
+            ].join(", ");
+            return [`    # ${root.relative} — ${notes}`, `    nexarch ingest-infra --dir ${root.relative}`];
+        });
+        throw new Error([
+            `This repository has ${roots.length} root modules, each with its own state.`,
+            `  Every root module is a separate estate, so ingest them one at a time:`,
+            ...lines,
+        ].join("\n"));
+    }
+    throw new Error([
+        `No Terraform root module found at or below ${dir}.`,
+        `  Run this inside the repository that provisions the estate, or pass --dir <path> or --state <file>.`,
+    ].join("\n"));
+}
+/** Reads state from a file, or asks Terraform for it when running inside the repo. */
+function loadState(statePath, dir) {
+    if (statePath) {
+        const full = resolve(statePath);
+        if (!existsSync(full))
+            throw new Error(`State file not found: ${full}`);
+        return { document: parseTerraformStateBuffer(readFileSync(full)), source: full };
+    }
+    try {
+        const stdout = execFileSync("terraform", ["show", "-json"], {
+            cwd: dir,
+            maxBuffer: 256 * 1024 * 1024,
+            encoding: "buffer",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return { document: parseTerraformStateBuffer(stdout), source: "terraform show -json" };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not read Terraform state. Run inside the infrastructure repo with terraform available, or pass --state <file>.\n  ${detail.split("\n")[0]}`);
+    }
+}
+function resolveEnvironment(projection, override, dir, rootModuleDir) {
+    if (override)
+        return { environment: override.trim().toLowerCase(), how: "--environment flag" };
+    // A root module living in environments/prod states which estate is being read
+    // more plainly than anything inside the state, and it is available whether or
+    // not anyone remembered to tag.
+    const fromPath = rootModuleDir ? environmentFromPath(rootModuleDir) : null;
+    if (fromPath)
+        return { environment: fromPath, how: "root module path" };
+    const inferred = inferEnvironmentFromTags(projection.resources);
+    if (inferred && inferred.confidence >= 0.6) {
+        return { environment: inferred.environment, how: `inferred from resource tags (${Math.round(inferred.confidence * 100)}% agreement)` };
+    }
+    try {
+        const workspace = execFileSync("terraform", ["workspace", "show"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        if (workspace && workspace !== "default")
+            return { environment: workspace.toLowerCase(), how: "terraform workspace" };
+    }
+    catch {
+        // Terraform not available; fall through to the error below.
+    }
+    // Say what was actually seen. A pipeline failure that only restates the
+    // options costs an hour; one that reports the evidence costs a minute.
+    const tagged = projection.resources.filter((r) => Object.keys(r.tags).length > 0).length;
+    const detail = [
+        `read ${projection.stats.resourcesSeen} resources from state`,
+        `${projection.stats.resourcesProjected} matched the catalogue`,
+        `${tagged} of those carried any tags`,
+    ];
+    if (inferred)
+        detail.push(`environment tags disagreed (strongest: "${inferred.environment}" at ${Math.round(inferred.confidence * 100)}%)`);
+    else if (projection.stats.resourcesProjected > 0)
+        detail.push("none carried an environment or env tag");
+    throw new Error(`Could not determine the environment — ${detail.join("; ")}.\n` +
+        `  Fix by tagging resources with \`environment\`, selecting a named Terraform workspace, or passing --environment <name>.`);
+}
+/** Builds the entity and relationship payloads for the existing upsert contract. */
+export function buildIngestPayload(params) {
+    const { projection, environment, platformRef, platformName } = params;
+    const environmentRef = `environment:${slug(environment)}`;
+    const entities = [
+        {
+            entityRef: platformRef,
+            entityTypeCode: "platform",
+            name: platformName,
+            description: `Cloud platform hosting the ${environment} environment.`,
+            attributes: { source: "terraform_ingest" },
+        },
+        {
+            entityRef: environmentRef,
+            entityTypeCode: "environment",
+            entitySubtypeCode: environmentSubtypeFor(environment),
+            name: environment,
+            description: `The ${environment} environment, as provisioned by Terraform.`,
+            attributes: { source: "terraform_ingest", terraform_version: projection.terraformVersion },
+        },
+    ];
+    const relationships = [];
+    for (const resource of projection.resources) {
+        const entityRef = `${resource.entityTypeCode}:${slug(resource.name ?? resource.address)}`;
+        entities.push({
+            entityRef,
+            entityTypeCode: resource.entityTypeCode,
+            ...(resource.entitySubtypeCode ? { entitySubtypeCode: resource.entitySubtypeCode } : {}),
+            name: resource.name ?? resource.address,
+            description: `${resource.role.replace(/_/g, " ")} provisioned by Terraform (${resource.resourceType}) in ${environment}.`,
+            attributes: {
+                source: "terraform_ingest",
+                terraform_address: resource.address,
+                terraform_type: resource.resourceType,
+                terraform_mode: resource.mode,
+                infrastructure_role: resource.role,
+                environment,
+                ...resource.attributes,
+                ...(Object.keys(resource.tags).length > 0 ? { tags: resource.tags } : {}),
+                ...(resource.identityIds.length > 0 ? { identity_ids: resource.identityIds } : {}),
+            },
+        });
+        // Only the directions the ontology permits: components deploy to an
+        // environment and belong to a platform; data stores run on both.
+        if (resource.entityTypeCode === "platform_component") {
+            relationships.push({ relationshipTypeCode: "deployed_to", fromEntityRef: entityRef, toEntityRef: environmentRef });
+            relationships.push({ relationshipTypeCode: "part_of", fromEntityRef: entityRef, toEntityRef: platformRef });
+        }
+        else if (resource.entityTypeCode === "data_store") {
+            relationships.push({ relationshipTypeCode: "runs_on", fromEntityRef: entityRef, toEntityRef: environmentRef });
+            relationships.push({ relationshipTypeCode: "runs_on", fromEntityRef: entityRef, toEntityRef: platformRef });
+        }
+    }
+    return { entities, relationships, environmentRef };
+}
+function chunk(items, size) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+export async function ingestInfra(args) {
+    const { statePath, environmentOverride, dir, projectRef, dryRun, asJson } = parseArgs(args);
+    // Only resolve a root module when Terraform must be run; an explicit --state
+    // file is authoritative and needs no repository at all.
+    let workingDir = dir;
+    if (!statePath) {
+        const resolved = resolveRootModule(dir);
+        workingDir = resolved.dir;
+        if (resolved.note && !asJson)
+            console.log(`  ${resolved.note}`);
+    }
+    const { document, source } = loadState(statePath, workingDir);
+    const projection = projectTerraformState({ document, catalogue: TERRAFORM_CATALOGUE_SEED, environment: "unknown" });
+    // Terraform emits a valid but empty document when it cannot see state, which
+    // is a different problem from anything downstream and deserves its own
+    // message rather than surfacing later as a confusing tagging complaint.
+    if (projection.stats.resourcesSeen === 0) {
+        throw new Error(`No resources found in Terraform state (read from ${source}).\n` +
+            `  Terraform ran but reported an empty state. Establish which, in this order:\n` +
+            `    1. run \`terraform state list\` in ${workingDir} — empty output confirms there is no state here\n` +
+            `    2. if there is no .terraform directory, run \`terraform init\`, then retry\n` +
+            `    3. run \`terraform workspace list\` and select the one that was applied\n` +
+            `    4. if this repository has several root modules, ingest each separately with --dir\n` +
+            `  The estate may also simply not have been applied yet.`);
+    }
+    const { environment, how } = resolveEnvironment(projection, environmentOverride, workingDir, statePath ? null : workingDir);
+    projection.environment = environment;
+    // Azure is the only provider the seed catalogue covers today; resolving it
+    // through the reference library keeps the platform entity canonical rather
+    // than inventing a second "Azure" for every tenant.
+    let platformRef = "platform:azure";
+    let platformName = "Microsoft Azure";
+    if (!dryRun) {
+        try {
+            const raw = await callMcpTool("nexarch_resolve_reference", { names: ["azure"] });
+            const resolved = readResult(raw);
+            const hit = (resolved.results ?? []).find((r) => r.resolved && r.entityTypeCode === "platform" && r.canonicalExternalRef);
+            if (hit?.canonicalExternalRef) {
+                platformRef = hit.canonicalExternalRef;
+                platformName = hit.canonicalName ?? platformName;
+            }
+        }
+        catch {
+            // Reference resolution is an optimisation, not a requirement.
+        }
+    }
+    const { entities, relationships } = buildIngestPayload({ projection, environment, platformRef, platformName });
+    const report = {
+        ok: true,
+        source,
+        environment,
+        environmentSource: how,
+        terraformVersion: projection.terraformVersion,
+        resourcesSeen: projection.stats.resourcesSeen,
+        resourcesProjected: projection.stats.resourcesProjected,
+        attributesDropped: {
+            notAllowlisted: projection.stats.attributesDroppedNotAllowlisted,
+            flaggedSensitive: projection.stats.attributesDroppedSensitive,
+        },
+        entities: entities.length,
+        relationships: relationships.length,
+        unknownTypes: projection.unknownTypes,
+        dryRun,
+        projectRef: projectRef ?? null,
+        written: null,
+    };
+    if (dryRun) {
+        if (asJson)
+            process.stdout.write(`${JSON.stringify({ ...report, payload: { entities, relationships } }, null, 2)}\n`);
+        else
+            printHuman(report, entities.length, relationships.length);
+        return;
+    }
+    const policiesRaw = await callMcpTool("nexarch_get_applied_policies", {});
+    const policyBundleHash = readResult(policiesRaw).policyBundleHash ?? null;
+    if (!policyBundleHash)
+        throw new Error("Policy bootstrap is missing for this workspace. Complete workspace setup before ingesting infrastructure.");
+    const agentContext = {
+        agentId: "nexarch-cli:ingest-infra",
+        agentRunId: `ingest-infra-${Date.now()}`,
+        repoRef: projectRef ?? dir,
+        repoPath: dir,
+        observedAt: new Date().toISOString(),
+        source: "nexarch-cli",
+        model: "n/a",
+        provider: "n/a",
+    };
+    const policyContext = { policyBundleHash, alignmentSummary: { score: 1, violations: [], waivers: [] } };
+    let failed = 0;
+    for (const batch of chunk(entities, ENTITY_BATCH)) {
+        const raw = await callMcpTool("nexarch_upsert_entities", { entities: batch, agentContext, policyContext });
+        failed += (readResult(raw).summary?.failed ?? 0);
+    }
+    for (const batch of chunk(relationships, ENTITY_BATCH)) {
+        const raw = await callMcpTool("nexarch_upsert_relationships", { relationships: batch, agentContext, policyContext });
+        failed += (readResult(raw).summary?.failed ?? 0);
+    }
+    report.written = { entities: entities.length, relationships: relationships.length, failed };
+    if (asJson)
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    else
+        printHuman(report, entities.length, relationships.length);
+}
+function printHuman(report, entityCount, relationshipCount) {
+    const dropped = report.attributesDropped;
+    console.log(`\nInfrastructure ingest — ${report.environment} (${report.environmentSource})`);
+    console.log(`  Source: ${report.source}${report.terraformVersion ? ` · terraform ${report.terraformVersion}` : ""}`);
+    console.log(`  Projected ${report.resourcesProjected} of ${report.resourcesSeen} resources to the contract surface.`);
+    console.log(`  Dropped ${dropped.notAllowlisted} attributes not on the allowlist, ${dropped.flaggedSensitive} flagged sensitive by Terraform.`);
+    const unknown = report.unknownTypes;
+    if (unknown.length > 0) {
+        console.log(`\n  Not yet in the catalogue (reported so coverage can grow):`);
+        for (const item of unknown.slice(0, 8))
+            console.log(`    ${String(item.count).padStart(3)}  ${item.resourceType}`);
+        if (unknown.length > 8)
+            console.log(`    …and ${unknown.length - 8} more types`);
+    }
+    if (report.dryRun) {
+        console.log(`\n  Dry run — nothing was written. Would send ${entityCount} entities and ${relationshipCount} relationships.`);
+        return;
+    }
+    const written = report.written;
+    if (written) {
+        console.log(`\n  Wrote ${written.entities} entities and ${written.relationships} relationships.`);
+        if (written.failed > 0)
+            console.log(`  ${written.failed} were refused — see the workspace dashboard for what governance blocked.`);
+    }
+}

package/dist/commands/init-project-infra.js

@@ -0,0 +1,170 @@
+import { basename } from "path";
+import { createInterface } from "readline";
+import { callMcpTool } from "../lib/mcp.js";
+import { detectInfrastructureProject, ciSnippetFor } from "../lib/terraform-detect.js";
+import { environmentSubtypeFor } from "../lib/terraform-projection.js";
+import { ingestInfra } from "./ingest-infra.js";
+function readResult(raw) {
+    return JSON.parse(raw.content?.[0]?.text ?? "{}");
+}
+function slugify(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 80);
+}
+async function confirm(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await new Promise((resolveAnswer) => rl.question(`${question} [Y/n] `, resolveAnswer));
+        return !/^n(o)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Shows what a real run would write.
+ *
+ * A preview that prints "✓ Registered" is worse than no preview: the caller
+ * reads a completed action and moves on, when the whole point was to decide
+ * whether to take it. Everything here is phrased as intent, and no MCP call is
+ * made — not even the policy read, since a dry run should be inert.
+ */
+function reportDryRun(params) {
+    const { asJson, projectRef, detection, entities, relationships } = params;
+    if (asJson) {
+        process.stdout.write(`${JSON.stringify({ ok: true, dryRun: true, wrote: false, projectRef, detection, plan: { entities, relationships } }, null, 2)}\n`);
+        return;
+    }
+    console.log(`\nWould write ${entities.length} entit${entities.length === 1 ? "y" : "ies"}:`);
+    for (const entity of entities)
+        console.log(`    ${entity.entityRef}  (${entity.entityTypeCode} / ${entity.entitySubtypeCode})`);
+    if (relationships.length > 0) {
+        console.log(`\nWould write ${relationships.length} relationship${relationships.length === 1 ? "" : "s"}:`);
+        for (const rel of relationships)
+            console.log(`    ${rel.fromEntityRef} --${rel.relationshipTypeCode}--> ${rel.toEntityRef}`);
+    }
+    console.log(`\nNothing was written. Re-run without --dry-run to register.`);
+}
+export async function runInfrastructureOnboarding(options, detection) {
+    const { dir, nameOverride, asJson, nonInteractive, skipIngest, dryRun } = options;
+    const displayName = nameOverride ?? basename(dir);
+    const projectRef = `project:${slugify(displayName)}`;
+    if (!asJson) {
+        console.log(`\nDetected an infrastructure repository — ${detection.signals.join(", ")}.`);
+        console.log(dryRun
+            ? `Dry run — nothing below is written. ${displayName} would be registered as ${projectRef} (project_infrastructure).`
+            : `Registering ${displayName} as ${projectRef} (project_infrastructure).`);
+        console.log("The dependency scan is skipped: this repo provisions infrastructure rather than consuming it.");
+    }
+    // Every environment the repository defines is sourced from it. Recording this
+    // at registration is what stops the project being an orphan: without it the
+    // graph holds a node that provisions nothing, and no reader can get from an
+    // environment back to the code that defines it. The root module paths carry
+    // this before any state is read, so it costs no Terraform run.
+    const environments = [...new Set(detection.rootModules.map((root) => root.environmentHint).filter((hint) => Boolean(hint)))];
+    const entities = [
+        {
+            entityRef: projectRef,
+            entityTypeCode: "project",
+            entitySubtypeCode: "project_infrastructure",
+            name: displayName,
+            description: `Infrastructure-as-code repository provisioning the estate (${detection.signals.join(", ")}).`,
+            attributes: {
+                source: "nexarch_cli_init_project",
+                iac_tool: "terraform",
+                terraform_file_count: detection.terraformFileCount,
+                has_remote_backend: detection.hasRemoteBackend,
+                root_module_count: detection.rootModules.length,
+                ...(detection.ciSystem ? { ci_system: detection.ciSystem } : {}),
+                ...(detection.moduleDirectories.length > 0 ? { terraform_modules: detection.moduleDirectories.slice(0, 25) } : {}),
+            },
+        },
+        ...environments.map((environment) => ({
+            entityRef: `environment:${environment}`,
+            entityTypeCode: "environment",
+            entitySubtypeCode: environmentSubtypeFor(environment),
+            name: environment,
+            description: `Environment defined by the ${displayName} infrastructure repository.`,
+            attributes: { source: "nexarch_cli_init_project", iac_tool: "terraform" },
+        })),
+    ];
+    const relationships = environments.map((environment) => ({
+        fromEntityRef: `environment:${environment}`,
+        toEntityRef: projectRef,
+        relationshipTypeCode: "sourced_from",
+        attributes: { source: "nexarch_cli_init_project" },
+    }));
+    if (dryRun) {
+        reportDryRun({ asJson, projectRef, detection, entities, relationships });
+        return;
+    }
+    const policiesRaw = await callMcpTool("nexarch_get_applied_policies", {});
+    const policyBundleHash = readResult(policiesRaw).policyBundleHash ?? null;
+    if (!policyBundleHash) {
+        throw new Error("Policy bootstrap is missing for this workspace. Complete workspace setup before registering a project.");
+    }
+    const agentContext = {
+        agentId: "nexarch-cli:init-project",
+        agentRunId: `init-project-infra-${Date.now()}`,
+        repoRef: dir,
+        repoPath: dir,
+        observedAt: new Date().toISOString(),
+        source: "nexarch-cli",
+        model: "n/a",
+        provider: "n/a",
+    };
+    const policyContext = { policyBundleHash, alignmentSummary: { score: 1, violations: [], waivers: [] } };
+    await callMcpTool("nexarch_upsert_entities", { entities, agentContext, policyContext });
+    if (relationships.length > 0) {
+        await callMcpTool("nexarch_upsert_relationships", { relationships, agentContext, policyContext });
+    }
+    if (!asJson) {
+        console.log(`  ✓ Registered ${projectRef}`);
+        for (const environment of environments) {
+            console.log(`  ✓ Registered environment:${environment} (sourced_from ${projectRef})`);
+        }
+    }
+    // Each root module owns its own state, so each is a separate ingest. Showing
+    // the map up front — rather than letting the caller discover it through a
+    // failure — is what lets an agent finish the job unaided.
+    const roots = detection.rootModules;
+    if (!asJson && roots.length > 1) {
+        console.log(`\nThis repository has ${roots.length} root modules, each with its own state.`);
+        console.log("Ingest them one at a time — every root module is a separate estate:\n");
+        for (const root of roots) {
+            const notes = [root.environmentHint ? `${root.environmentHint} environment` : "shared stack", root.initialised ? "initialised" : "run `terraform init` here first"].join(", ");
+            console.log(`    # ${root.relative} — ${notes}`);
+            console.log(`    nexarch ingest-infra --dir ${root.relative} --project-ref ${projectRef}`);
+        }
+    }
+    let ingested = false;
+    if (!skipIngest && roots.length <= 1) {
+        const shouldIngest = nonInteractive ? false : await confirm("\nRead the current state and populate the graph now?");
+        if (shouldIngest) {
+            try {
+                await ingestInfra(["--dir", dir, "--project-ref", projectRef]);
+                ingested = true;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.log(`\n  Could not ingest now — ${message}`);
+                console.log("  This is not a problem: the pipeline step below is what keeps the graph true.");
+            }
+        }
+    }
+    const { file, snippet } = ciSnippetFor(detection.ciSystem, detection.ciFile);
+    if (asJson) {
+        process.stdout.write(`${JSON.stringify({ ok: true, projectRef, detection, ingested, ci: { file, snippet } }, null, 2)}\n`);
+        return;
+    }
+    console.log(`\nInfrastructure changes continuously, so ingestion belongs in the pipeline, not in someone's memory.`);
+    console.log(`Add this to ${file}:\n`);
+    console.log(snippet);
+    console.log(`\nNEXARCH_TOKEN is a service credential — create one in the workspace under`);
+    console.log(`Discovery → Agents, then store it as a masked CI variable.`);
+}
+export { detectInfrastructureProject };

package/dist/commands/init-project.js

@@ -1,11 +1,12 @@
 import process from "process";
-import * as readline from "node:readline/promises";
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, join, relative, resolve as resolvePath } from "node:path";
 import { requireCredentials } from "../lib/credentials.js";
 import { callMcpTool } from "../lib/mcp.js";
 import { buildVersionAttributes } from "../lib/version-normalization.js";
+import { detectInfrastructureProject } from "../lib/terraform-detect.js";
+import { runInfrastructureOnboarding } from "./init-project-infra.js";
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 function parseFlag(args, flag) {
     return args.includes(flag);
@@ -1069,43 +1070,6 @@ export function scoreApplicationCandidate(app, projectName, repoUrl) {
         return null;
     return { entityRef, name: app.name, score: Math.min(1, score), reasons };
 }
-async function promptApplicationChoice(matches, allApps, suggested) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-    try {
-        console.log("\nExisting application entities found.");
-        if (suggested) {
-            console.log(`Suggested match: ${suggested.name} (${suggested.entityRef}) score=${suggested.score.toFixed(2)} [${suggested.reasons.join(", ")}]`);
-        }
-        console.log("\nChoose target application:");
-        const options = [];
-        let index = 1;
-        for (const m of matches.slice(0, 5)) {
-            options.push({
-                key: String(index++),
-                label: `${m.name} (${m.entityRef}) score=${m.score.toFixed(2)}`,
-                value: m.entityRef,
-            });
-        }
-        options.push({ key: String(index++), label: "Show all applications", value: "__show_all__" });
-        options.push({ key: String(index), label: "Create a new application", value: "__create__" });
-        for (const o of options)
-            console.log(`  ${o.key}) ${o.label}`);
-        const answer = (await rl.question("Select option: ")).trim();
-        const chosen = options.find((o) => o.key === answer)?.value;
-        if (chosen === "__show_all__") {
-            console.log("\nAll applications:");
-            allApps.forEach((a, i) => console.log(`  ${i + 1}) ${a.name} (${a.entityRef ?? a.externalKey ?? "n/a"})`));
-            const pick = Number((await rl.question("Pick application number or 0 to create new: ")).trim());
-            if (!Number.isFinite(pick) || pick <= 0 || pick > allApps.length)
-                return "__create__";
-            return allApps[pick - 1].entityRef ?? allApps[pick - 1].externalKey ?? "__create__";
-        }
-        return chosen && chosen !== "__show_all__" ? chosen : "__create__";
-    }
-    finally {
-        rl.close();
-    }
-}
 // ─── Main command ─────────────────────────────────────────────────────────────
 export async function initProject(args) {
     const asJson = parseFlag(args, "--json");
@@ -1153,6 +1117,23 @@ export async function initProject(args) {
     const refreshMode = parseFlag(args, "--refresh");
     const creds = requireCredentials();
     const mcpOpts = { companyId: creds.companyId };
+    // An infrastructure repository is onboarded differently: its content lives in
+    // Terraform state, not in a manifest, so the dependency scan below would
+    // describe the wrong thing entirely (ADR: infrastructure-as-code ingestion).
+    if (!parseFlag(args, "--as-application")) {
+        const infrastructure = detectInfrastructureProject(dir);
+        if (infrastructure.isInfrastructure) {
+            await runInfrastructureOnboarding({
+                dir,
+                nameOverride,
+                asJson,
+                nonInteractive: parseFlag(args, "--non-interactive"),
+                skipIngest: parseFlag(args, "--no-ingest"),
+                dryRun,
+            }, infrastructure);
+            return;
+        }
+    }
     if (!asJson)
         console.log(`Scanning ${dir}…`);
     logProgress("scan.start", dir);
@@ -1293,6 +1274,27 @@ export async function initProject(args) {
                 console.log(`\nUsing --application-ref target: ${projectExternalKey}`);
         }
         else {
+            // Seed S2 auto-map: when a reviewer previously declined a proposal with
+            // this name as a duplicate, a company alias maps it to the surviving
+            // application. Resolving the name first means the human's "no" is
+            // honoured automatically — the scan maps instead of re-proposing.
+            try {
+                const aliasRaw = await callMcpProfiled("nexarch_resolve_reference", { names: [displayName], companyId: creds.companyId }, { batchSize: 1 });
+                const aliasData = parseToolText(aliasRaw);
+                const aliasHit = (aliasData.results ?? []).find((r) => r.resolved && r.entityTypeCode === "application" && r.canonicalExternalRef?.startsWith("application:"));
+                if (aliasHit?.canonicalExternalRef) {
+                    projectExternalKey = aliasHit.canonicalExternalRef;
+                    if (!asJson) {
+                        console.log(`\nAuto-mapped via workspace alias: "${displayName}" → ${projectExternalKey} (${aliasHit.canonicalName ?? "existing application"})`);
+                        console.log("  A reviewer previously mapped this name to an existing application. To create a separate application anyway, re-run with --create-application.");
+                    }
+                }
+            }
+            catch {
+                // Alias resolution is best-effort; fall through to candidate scoring.
+            }
+        }
+        if (!applicationRefOverride && projectExternalKey === `${entityTypeOverride}:${projectSlug}`) {
             const appsRaw = await callMcpProfiled("nexarch_list_entities", { entityTypeCode: "application", status: "active", limit: 500, companyId: creds.companyId }, { entityTypeCode: "application", limit: 500 });
             const appsData = parseToolText(appsRaw);
             const apps = (appsData.entities ?? []).filter((e) => (e.entityRef ?? e.externalKey));
@@ -1303,58 +1305,25 @@ export async function initProject(args) {
                     .sort((a, b) => b.score - a.score);
                 const suggested = matches.length > 0 ? matches[0] : null;
                 const highConfidence = suggested && suggested.score >= 0.85;
-                const interactiveAllowed = !nonInteractive && process.stdin.isTTY;
+                // ADR 8d: the interactive "Choose target application" prompt is gone.
+                // It demanded an architectural judgement from whoever happened to run
+                // the command, in a terminal, sixty seconds into using the product —
+                // and blocked non-interactive runs entirely. The default is now to
+                // create a new application, which arrives as PROPOSED (8b): the
+                // mapping judgement moves to the activation card, where similarity
+                // evidence renders for the human reviewing it (8c). Explicit mapping
+                // remains available via --application-ref and --auto-map-application.
                 if (autoMapApplication && highConfidence) {
                     projectExternalKey = suggested.entityRef;
                     if (!asJson)
                         console.log(`\nAuto-mapped to existing application: ${suggested.name} (${projectExternalKey})`);
                 }
-                else if (!interactiveAllowed) {
-                    const message = "Application mapping requires explicit choice in non-interactive mode. Pass --application-ref <entityRef> or --create-application (or run interactively).";
-                    const existingApplications = apps.slice(0, 25).map((a) => ({
-                        entityRef: a.entityRef ?? a.externalKey,
-                        name: a.name,
-                        entityTypeCode: a.entityTypeCode,
-                    }));
-                    if (asJson) {
-                        process.stdout.write(`${JSON.stringify({
-                            ok: true,
-                            status: "input_required",
-                            code: "APPLICATION_MAPPING_REQUIRED",
-                            message,
-                            suggested: suggested ?? null,
-                            candidates: matches.slice(0, 10),
-                            existingApplications,
-                            requiredInput: {
-                                applicationRefOption: "--application-ref <entityRef>",
-                                createOption: "--create-application",
-                            },
-                        }, null, 2)}\n`);
-                        return;
-                    }
-                    console.log("\nInput required before continuing:");
-                    console.log(`  ${message}`);
-                    if (suggested) {
-                        console.log(`  Suggested: ${suggested.name} (${suggested.entityRef}) score=${suggested.score.toFixed(2)}`);
-                    }
-                    if (existingApplications.length > 0) {
-                        console.log("  Existing applications:");
-                        for (const app of existingApplications) {
-                            console.log(`    - ${app.name} (${app.entityRef})`);
-                        }
-                    }
-                    return;
-                }
-                else {
-                    const chosen = await promptApplicationChoice(matches, apps, highConfidence ? suggested : null);
-                    if (chosen !== "__create__") {
-                        projectExternalKey = chosen;
-                        if (!asJson)
-                            console.log(`Mapped to existing application: ${projectExternalKey}`);
-                    }
-                    else if (!asJson) {
-                        console.log("Creating a new application entity for this project.");
+                else if (matches.length > 0 && !asJson) {
+                    console.log("\nSimilar existing applications found (registering a new proposed application anyway — the reviewer sees these again at activation):");
+                    for (const m of matches.slice(0, 5)) {
+                        console.log(`  - ${m.name} (${m.entityRef}) score=${m.score.toFixed(2)} [${m.reasons.join(", ")}]`);
                     }
+                    console.log("  To map to one instead, re-run with: --application-ref <entityRef>");
                 }
             }
         }