nexarch 0.12.6 → 0.12.7

package/dist/index.js

@@ -26,6 +26,7 @@ import { appliedPolicies } from "./commands/applied-policies.js";
 import { governanceSummary } from "./commands/governance-summary.js";
 import { proposalsStart } from "./commands/proposals-start.js";
 import { registerRuntime } from "./commands/register-runtime.js";
+import { ingestInfra } from "./commands/ingest-infra.js";
 const [, , command, ...args] = process.argv;
 const commands = {
     login,
@@ -37,6 +38,7 @@ const commands = {
     "init-agent": initAgent,
     "agent-identify": agentIdentify,
     "init-project": initProject,
+    "ingest-infra": ingestInfra,
     "update-project": (args) => initProject(["--refresh", ...args]),
     "update-entity": updateEntity,
     "add-relationship": addRelationship,
@@ -73,198 +75,202 @@ async function main() {
     }
     const handler = commands[command ?? ""];
     if (!handler) {
-        console.log(`
-nexarch — Your architecture workspace for AI delivery.
-
-Usage:
-  nexarch login         Authenticate in browser and store company-scoped credentials
-                        Option: --company <id>
-  nexarch logout        Remove stored credentials
-  nexarch status        Check connection and show architecture summary
-  nexarch setup         One-step onboarding: login (if needed) + MCP config + register agent
-  nexarch mcp-config    Print MCP server config block for manual setup
-                        Client list is registry-managed (see 'nexarch mcp-config --client <code>')
-  nexarch mcp-proxy     Run as stdio MCP proxy (used by MCP clients)
-  nexarch init-agent    Run handshake + mandatory agent registration in graph (advanced/manual)
-                        Options: --agent-id <id> --bind-to-external-key <key>
-                                 --bind-relationship-type <code> --redact-hostname
-                                 --json --strict
-  nexarch agent identify
-                      Capture richer coding-agent identity metadata
-                      Options: --agent-id <id> --provider <provider> --model <model>
-                               --client <name> [--framework <name>] [--session-id <id>]
-                               [--tool-version <v>] [--capabilities <csv>]
-                               [--notes <text>] [--json]
-  nexarch agent-identify
-                      Alias of 'nexarch agent identify'
-  nexarch init-project
-                      Scan a project directory, resolve detected packages/env vars/
-                      config files against the reference library, write entities and
-                      relationships to the architecture graph, and log unresolved
-                      names as reference candidates.
-                      Monorepos register a project entity plus one proposed
-                      application per deployable package (sourced_from the project).
-                      Single-package repos register the repo's one application; when
-                      similar applications exist they are listed, and the new
-                      application is created as proposed for review at activation.
-                      Options: --dir <path>  (default: cwd)
-                               --name <name>  override project name
-                               --entity-type <code>  (default: application)
-                               --application-ref <entityRef>  force mapping target
-                               --create-application  force new application entity
-                               --auto-map-application  auto-map only when high confidence
-                               --non-interactive  deprecated (mapping no longer prompts)
-                               --batch-size <n>  upsert batch size (default: 10)
-                               --profile  include timing/profile data in JSON output
-                               --dry-run  preview without writing
-                               --json
-  nexarch update-project
-                      Re-scan a previously registered project directory, refresh
-                      entities and relationships in the graph, and diff the new scan
-                      against the current graph state to surface stale relationships
-                      and removed sub-packages for the calling agent to review.
-                      Accepts all the same options as init-project plus:
-                               --application-ref <entityRef>  target project key (recommended)
-                               --auto-map-application  auto-select best-match application
-                      Output includes enrichmentRequired.diff with:
-                        newRelationships    — detected but not yet in graph
-                        staleRelationships  — in graph but absent from manifests
-                        removedSubPackages  — previously registered, no longer on disk
-                               --json
-  nexarch update-entity
-                      Update the name and/or description of an existing graph entity.
-                      Use this after init-project to enrich the entity with meaningful
-                      content from the project README or docs.
-                      Options: --key <externalKey>  (required)
-                               --name <name>
-                               --description <text>
-                               --entity-type <code>  (default: application)
-                               --subtype <code>
-                               --icon <lucide-name>  (convenience; sets attributes.application_icon)
-                               --attributes-json '<json object>'
-                               --attributes-file <path.json>
-                               --json
-  nexarch add-relationship
-                      Add relationships between existing graph entities (single or batch).
-                      Single options: --from <externalKey>
-                                      --to <externalKey>
-                                      --type <code> (e.g. part_of, depends_on)
-                      Batch options:  --relationships-json '<json array>'
-                                      --relationships-file <path.json>
-                      --json
-  nexarch register-alias
-                      Register a company-scoped alias for an entity so future
-                      scans resolve it instead of logging it as a candidate.
-                      Use after enriching internal monorepo packages.
-                      Options: --alias <value>       (required, e.g. @scope/name)
-                               --key <externalKey>   (required)
-                               --name <name>         (required)
-                               --entity-type <code>  (required)
-                               --subtype <code>
-                               --description <text>
-                               --json
-  nexarch resolve-names
-                      Look up one or more raw names (package names, platform
-                      names) against the global reference library and return
-                      their canonical external keys. Useful for gap-check
-                      results before calling add-relationship.
-                      Options: --names <csv>  (required, e.g. "vercel,neon")
-                               --json
-  nexarch list-entities
-                      List entities from the workspace graph.
-                      Options: --type <entityTypeCode>
-                               --status <status>
-                               --query <text>
-                               --limit <1-500>
-                               --json
-  nexarch list-relationships
-                      List relationships from the workspace graph.
-                      Options: --type <relationshipTypeCode>
-                               --status <status>
-                               --from <fromExternalKey>
-                               --to <toExternalKey>
-                               --limit <1-500>
-                               --json
-  nexarch register-runtime
-                      Register or refresh runtime + optional application context
-                      without performing check-in.
-                      Options: --application-ref <entityRef>
-                               --client <name>
-                               --version <semver>
-                               --json
-  nexarch check-in    Preview pending application-target commands (no auto-claim)
-                      and report draft/proposed applications needing review so the
-                      agent can prompt the user to explore and instantiate them.
-                      Use command-claim to explicitly claim a specific command.
-                      Scope is resolved server-side from active company context.
-                      Options: --agent-key <key>   override stored agent key
-                               --application-ref <entityRef>  narrow preview scope
-                               --json              JSON output includes draftApplications[] and proposedApplications[]
-  nexarch proposals start
-                      Start a new application workspace from a proposed NexArch app.
-                      Lists proposed apps, shows policy review gates, writes a starter
-                      project scaffold, and activates the proposal to active once
-                      required policy controls are acknowledged.
-                      Options: --id <applicationId>
-                               --dir <path>
-                               --reason <text>
-                               --repo <url>
-                               --skip-activate
-                               --activate
-                               --force
-                               --non-interactive
-                               --json
-  nexarch command-claim
-                      Explicitly claim a pending command by ID.
-                      Options: --id <commandId>    (required)
-                               --agent-key <key>   override stored agent key
-                               --application-ref <entityRef>  required for application-target commands
-                               --json
-  nexarch command-done
-                      Mark a claimed command as completed.
-                      Options: --id <commandId>    (required)
-                               --summary <text>    short summary of what was done
-                               --summary-file <path.md|txt>
-                               --json
-  nexarch command-fail
-                      Mark a claimed command as failed.
-                      Options: --id <commandId>    (required)
-                               --error <message>   (required)
-                               --json
-  nexarch policy-controls
-                      Fetch policy controls/rules assigned to an entity (for policy audits).
-                      Options: --entity <externalKey>  (required, e.g. application:bad-driving)
-                               --json
-  nexarch policy-audit-template
-                      Generate a findings JSON template from policy controls/rules for an entity.
-                      Options: --entity <externalKey>   (required)
-                               --control-id <uuid>      (repeatable; optional filter)
-                               --default-result <pass|partial|fail> (default: fail)
-                               --output <path.json>
-                               --json
-  nexarch policy-audit-submit
-                      Submit structured policy findings (writes policy_audit_finding rows).
-                      Options: --command-id <id>        (required)
-                               --application-key <key>  (required)
-                               --agent-key <key>        (optional; defaults from identity)
-                               --finding <controlId|ruleId|result|rationale|missing1;missing2> (repeatable)
-                               --findings-json <json-array>
-                               --findings-file <path.json>
-                               --json
-  nexarch policy-audit-results
-                      Retrieve stored results of previous policy audits for an application.
-                      Options: --entity <applicationEntityRef>  (required)
-                               --limit <1-10>                   (default 1)
-                               --json
-  nexarch applied-policies
-                      List policy documents applied to this company account.
-                      Options: --pack <packCode>  filter to a specific pack
-                               --markdown        include full document markdown
-                               --json
-  nexarch governance-summary
-                      Print review queue, graph stats, and per-application policy
-                      audit rollup (latest run status, pass/partial/fail counts).
-                      Options: --json
+        console.log(`
+nexarch — Your architecture workspace for AI delivery.
+
+Usage:
+  nexarch login         Authenticate in browser and store company-scoped credentials
+                        Option: --company <id>
+  nexarch logout        Remove stored credentials
+  nexarch status        Check connection and show architecture summary
+  nexarch setup         One-step onboarding: login (if needed) + MCP config + register agent
+  nexarch mcp-config    Print MCP server config block for manual setup
+                        Client list is registry-managed (see 'nexarch mcp-config --client <code>')
+  nexarch mcp-proxy     Run as stdio MCP proxy (used by MCP clients)
+  nexarch init-agent    Run handshake + mandatory agent registration in graph (advanced/manual)
+                        Options: --agent-id <id> --bind-to-external-key <key>
+                                 --bind-relationship-type <code> --redact-hostname
+                                 --json --strict
+  nexarch agent identify
+                      Capture richer coding-agent identity metadata
+                      Options: --agent-id <id> --provider <provider> --model <model>
+                               --client <name> [--framework <name>] [--session-id <id>]
+                               [--tool-version <v>] [--capabilities <csv>]
+                               [--notes <text>] [--json]
+  nexarch agent-identify
+                      Alias of 'nexarch agent identify'
+  nexarch init-project
+                      Scan a project directory, resolve detected packages/env vars/
+                      config files against the reference library, write entities and
+                      relationships to the architecture graph, and log unresolved
+                      names as reference candidates.
+                      Monorepos register a project entity plus one proposed
+                      application per deployable package (sourced_from the project).
+                      Single-package repos register the repo's one application; when
+                      similar applications exist they are listed, and the new
+                      application is created as proposed for review at activation.
+                      Terraform repositories take a different path: no dependency
+                      scan and no applications. They register a project plus the
+                      environments their root modules define, and hand over the
+                      per-root ingest-infra commands that read the actual estate.
+                      Options: --dir <path>  (default: cwd)
+                               --name <name>  override project name
+                               --entity-type <code>  (default: application)
+                               --application-ref <entityRef>  force mapping target
+                               --create-application  force new application entity
+                               --auto-map-application  auto-map only when high confidence
+                               --non-interactive  deprecated (mapping no longer prompts)
+                               --batch-size <n>  upsert batch size (default: 10)
+                               --profile  include timing/profile data in JSON output
+                               --dry-run  preview without writing
+                               --json
+  nexarch update-project
+                      Re-scan a previously registered project directory, refresh
+                      entities and relationships in the graph, and diff the new scan
+                      against the current graph state to surface stale relationships
+                      and removed sub-packages for the calling agent to review.
+                      Accepts all the same options as init-project plus:
+                               --application-ref <entityRef>  target project key (recommended)
+                               --auto-map-application  auto-select best-match application
+                      Output includes enrichmentRequired.diff with:
+                        newRelationships    — detected but not yet in graph
+                        staleRelationships  — in graph but absent from manifests
+                        removedSubPackages  — previously registered, no longer on disk
+                               --json
+  nexarch update-entity
+                      Update the name and/or description of an existing graph entity.
+                      Use this after init-project to enrich the entity with meaningful
+                      content from the project README or docs.
+                      Options: --key <externalKey>  (required)
+                               --name <name>
+                               --description <text>
+                               --entity-type <code>  (default: application)
+                               --subtype <code>
+                               --icon <lucide-name>  (convenience; sets attributes.application_icon)
+                               --attributes-json '<json object>'
+                               --attributes-file <path.json>
+                               --json
+  nexarch add-relationship
+                      Add relationships between existing graph entities (single or batch).
+                      Single options: --from <externalKey>
+                                      --to <externalKey>
+                                      --type <code> (e.g. part_of, depends_on)
+                      Batch options:  --relationships-json '<json array>'
+                                      --relationships-file <path.json>
+                      --json
+  nexarch register-alias
+                      Register a company-scoped alias for an entity so future
+                      scans resolve it instead of logging it as a candidate.
+                      Use after enriching internal monorepo packages.
+                      Options: --alias <value>       (required, e.g. @scope/name)
+                               --key <externalKey>   (required)
+                               --name <name>         (required)
+                               --entity-type <code>  (required)
+                               --subtype <code>
+                               --description <text>
+                               --json
+  nexarch resolve-names
+                      Look up one or more raw names (package names, platform
+                      names) against the global reference library and return
+                      their canonical external keys. Useful for gap-check
+                      results before calling add-relationship.
+                      Options: --names <csv>  (required, e.g. "vercel,neon")
+                               --json
+  nexarch list-entities
+                      List entities from the workspace graph.
+                      Options: --type <entityTypeCode>
+                               --status <status>
+                               --query <text>
+                               --limit <1-500>
+                               --json
+  nexarch list-relationships
+                      List relationships from the workspace graph.
+                      Options: --type <relationshipTypeCode>
+                               --status <status>
+                               --from <fromExternalKey>
+                               --to <toExternalKey>
+                               --limit <1-500>
+                               --json
+  nexarch register-runtime
+                      Register or refresh runtime + optional application context
+                      without performing check-in.
+                      Options: --application-ref <entityRef>
+                               --client <name>
+                               --version <semver>
+                               --json
+  nexarch check-in    Preview pending application-target commands (no auto-claim)
+                      and report draft/proposed applications needing review so the
+                      agent can prompt the user to explore and instantiate them.
+                      Use command-claim to explicitly claim a specific command.
+                      Scope is resolved server-side from active company context.
+                      Options: --agent-key <key>   override stored agent key
+                               --application-ref <entityRef>  narrow preview scope
+                               --json              JSON output includes draftApplications[] and proposedApplications[]
+  nexarch proposals start
+                      Start a new application workspace from a proposed NexArch app.
+                      Lists proposed apps, shows policy review gates, writes a starter
+                      project scaffold, and activates the proposal to active once
+                      required policy controls are acknowledged.
+                      Options: --id <applicationId>
+                               --dir <path>
+                               --reason <text>
+                               --repo <url>
+                               --skip-activate
+                               --activate
+                               --force
+                               --non-interactive
+                               --json
+  nexarch command-claim
+                      Explicitly claim a pending command by ID.
+                      Options: --id <commandId>    (required)
+                               --agent-key <key>   override stored agent key
+                               --application-ref <entityRef>  required for application-target commands
+                               --json
+  nexarch command-done
+                      Mark a claimed command as completed.
+                      Options: --id <commandId>    (required)
+                               --summary <text>    short summary of what was done
+                               --summary-file <path.md|txt>
+                               --json
+  nexarch command-fail
+                      Mark a claimed command as failed.
+                      Options: --id <commandId>    (required)
+                               --error <message>   (required)
+                               --json
+  nexarch policy-controls
+                      Fetch policy controls/rules assigned to an entity (for policy audits).
+                      Options: --entity <externalKey>  (required, e.g. application:bad-driving)
+                               --json
+  nexarch policy-audit-template
+                      Generate a findings JSON template from policy controls/rules for an entity.
+                      Options: --entity <externalKey>   (required)
+                               --control-id <uuid>      (repeatable; optional filter)
+                               --default-result <pass|partial|fail> (default: fail)
+                               --output <path.json>
+                               --json
+  nexarch policy-audit-submit
+                      Submit structured policy findings (writes policy_audit_finding rows).
+                      Options: --command-id <id>        (required)
+                               --application-key <key>  (required)
+                               --agent-key <key>        (optional; defaults from identity)
+                               --finding <controlId|ruleId|result|rationale|missing1;missing2> (repeatable)
+                               --findings-json <json-array>
+                               --findings-file <path.json>
+                               --json
+  nexarch policy-audit-results
+                      Retrieve stored results of previous policy audits for an application.
+                      Options: --entity <applicationEntityRef>  (required)
+                               --limit <1-10>                   (default 1)
+                               --json
+  nexarch applied-policies
+                      List policy documents applied to this company account.
+                      Options: --pack <packCode>  filter to a specific pack
+                               --markdown        include full document markdown
+                               --json
+  nexarch governance-summary
+                      Print review queue, graph stats, and per-application policy
+                      audit rollup (latest run status, pass/partial/fail counts).
+                      Options: --json
     `);
         process.exit(command ? 1 : 0);
     }

package/dist/lib/credentials.js

@@ -4,7 +4,35 @@ import { readFileSync, writeFileSync, mkdirSync, existsSync, rmSync } from "fs";
 function credentialsPath() {
     return join(homedir(), ".nexarch", "credentials.json");
 }
+/**
+ * Credentials supplied by the environment, for CI.
+ *
+ * A pipeline cannot run `nexarch login` — that flow needs a browser and a
+ * human — so unattended commands such as `ingest-infra` take a service
+ * credential from the environment instead. `NEXARCH_TOKEN` is the token issued
+ * by `init-agent`; the company is carried by the token itself, so
+ * `NEXARCH_COMPANY_ID` is only needed for legacy static tokens.
+ *
+ * No local expiry check: the gateway is the authority on whether a service
+ * credential is still valid, and a stale clock in a runner should not be able
+ * to fail a build with a misleading "session expired".
+ */
+function credentialsFromEnvironment() {
+    const token = process.env.NEXARCH_TOKEN?.trim();
+    if (!token)
+        return null;
+    return {
+        token,
+        email: process.env.NEXARCH_ACTOR ?? "ci",
+        company: "",
+        companyId: process.env.NEXARCH_COMPANY_ID?.trim() ?? "",
+        expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
+    };
+}
 export function loadCredentials() {
+    const fromEnv = credentialsFromEnvironment();
+    if (fromEnv)
+        return fromEnv;
     const path = credentialsPath();
     if (!existsSync(path))
         return null;
@@ -35,8 +63,12 @@ export function removeCredentials() {
 export function requireCredentials() {
     const creds = loadCredentials();
     if (!creds) {
-        throw new Error("Not logged in. Run `nexarch login` to authenticate.");
+        throw new Error("Not logged in. Run `nexarch login` to authenticate, or set NEXARCH_TOKEN for unattended use.");
     }
+    // Environment-supplied service credentials are validated by the gateway, not
+    // by this process; only the stored interactive session carries a local expiry.
+    if (process.env.NEXARCH_TOKEN?.trim())
+        return creds;
     if (new Date(creds.expiresAt) < new Date()) {
         throw new Error("Your session has expired. Run `nexarch login` to re-authenticate.");
     }