nexarch 0.13.0 → 0.13.1

package/dist/lib/iac-detect.js

@@ -0,0 +1,414 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "fs";
+import { join, sep } from "path";
+const SCAN_DEPTH = 8;
+const IGNORED_DIRS = new Set(["node_modules", ".git", ".terraform", "dist", "build", ".next"]);
+/**
+ * Path segments whose contents demonstrate Terraform rather than run it.
+ *
+ * An `examples/complete` directory configures a provider and looks exactly like
+ * an estate root by every local signal — which is why terraform-aws-vpc
+ * reported thirteen of them as environments while missing the modules that are
+ * the point of the repository. Worse than missing the real architecture: the
+ * examples are mutually exclusive demonstrations, so graphing them together
+ * describes an estate that has never existed anywhere.
+ */
+const NON_ESTATE_SEGMENT = /(^|[\\/])(examples?|docs?|test|tests|fixtures?|testdata|_example|sample|samples)([\\/]|$)/i;
+function collectTerraformFiles(dir, depth = 0, out = []) {
+    if (depth > SCAN_DEPTH)
+        return out;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        if (IGNORED_DIRS.has(entry))
+            continue;
+        const full = join(dir, entry);
+        let isDir = false;
+        try {
+            isDir = statSync(full).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (isDir)
+            collectTerraformFiles(full, depth + 1, out);
+        else if (entry.endsWith(".tf"))
+            out.push(full);
+    }
+    return out;
+}
+function detectCiSystem(dir) {
+    if (existsSync(join(dir, ".gitlab-ci.yml")))
+        return { ciSystem: "gitlab", ciFile: ".gitlab-ci.yml" };
+    if (existsSync(join(dir, ".github", "workflows")))
+        return { ciSystem: "github", ciFile: ".github/workflows" };
+    const seen = [];
+    const visit = (current, depth) => {
+        if (depth > 3 || seen.length > 0)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(current);
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (IGNORED_DIRS.has(entry))
+                continue;
+            const full = join(current, entry);
+            let isDir = false;
+            try {
+                isDir = statSync(full).isDirectory();
+            }
+            catch {
+                continue;
+            }
+            if (isDir) {
+                visit(full, depth + 1);
+                continue;
+            }
+            const relative = full.slice(dir.length + 1).split(sep).join("/");
+            if (/azure-pipelines.*\.ya?ml$/i.test(entry)) {
+                seen.push({ ciSystem: "azure-pipelines", ciFile: relative });
+                return;
+            }
+            if (entry === ".gitlab-ci.yml") {
+                seen.push({ ciSystem: "gitlab", ciFile: relative });
+                return;
+            }
+        }
+    };
+    visit(dir, 0);
+    return seen[0] ?? { ciSystem: null, ciFile: null };
+}
+/** Collects reusable module directories wherever they live, not only at the root. */
+function collectModuleDirectories(dir, depth = 0, out = []) {
+    if (depth > 3)
+        return out;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        if (IGNORED_DIRS.has(entry))
+            continue;
+        const full = join(dir, entry);
+        try {
+            if (!statSync(full).isDirectory())
+                continue;
+        }
+        catch {
+            continue;
+        }
+        if (entry === "modules") {
+            // The children of a modules directory are the reusable building blocks:
+            // network, database, keyvault, and so on — the vocabulary of the estate.
+            try {
+                for (const child of readdirSync(full)) {
+                    if (statSync(join(full, child)).isDirectory())
+                        out.push(child);
+                }
+            }
+            catch {
+                // Unreadable modules directory is not fatal.
+            }
+            continue;
+        }
+        collectModuleDirectories(full, depth + 1, out);
+    }
+    return out;
+}
+/**
+ * Recognises a repository that publishes reusable modules rather than running an estate.
+ *
+ * The Terraform registry convention is a module at the repository root —
+ * `main.tf` with `variables.tf` and `outputs.tf` beside it — deliberately
+ * configuring no provider and no backend, because both are supplied by whoever
+ * calls it. Every signal that identifies an estate is therefore absent by
+ * design, and the signals that *are* present belong to the examples directory.
+ *
+ * This matters more than tidiness. terraform-aws-vpc has no estate to ingest:
+ * asking it for one and getting thirteen mutually exclusive demonstrations is
+ * worse than getting nothing, because nothing is honest.
+ */
+function detectPublishedModules(dir) {
+    const rootFiles = (() => {
+        try {
+            return readdirSync(dir);
+        }
+        catch {
+            return [];
+        }
+    })();
+    const hasRootModule = rootFiles.includes("variables.tf") && rootFiles.includes("outputs.tf") && rootFiles.some((f) => f.endsWith(".tf") && f !== "variables.tf" && f !== "outputs.tf");
+    const modules = [];
+    const modulesDir = join(dir, "modules");
+    try {
+        for (const child of readdirSync(modulesDir)) {
+            const full = join(modulesDir, child);
+            if (statSync(full).isDirectory() && readdirSync(full).some((f) => f.endsWith(".tf")))
+                modules.push(child);
+        }
+    }
+    catch {
+        // No modules directory; a single-module repository is still a library.
+    }
+    return { isLibrary: hasRootModule, modules: modules.sort() };
+}
+const ROOT_SCAN_DEPTH = 4;
+const ENVIRONMENT_DIR = /^(dev|development|test|qa|uat|sit|stag|staging|preprod|pre-prod|prod|production|live|dr)$/i;
+/**
+ * Infers an environment from a root module's path.
+ *
+ * A directory called `environments/prod` is a stronger statement about which
+ * environment is being ingested than anything inside the state, and it is
+ * available before Terraform is run at all.
+ */
+export function environmentFromPath(relativePath) {
+    const segments = relativePath.split(/[\\/]+/).filter(Boolean);
+    for (let i = segments.length - 1; i >= 0; i -= 1) {
+        if (ENVIRONMENT_DIR.test(segments[i]))
+            return segments[i].toLowerCase();
+    }
+    return null;
+}
+/**
+ * Finds the root modules in a repository.
+ *
+ * Real estates are not one directory with one state. A repository commonly
+ * carries a root module per environment plus separate stacks for shared
+ * services, each with its own state, so assuming the current directory is
+ * *the* root module fails on the first serious layout it meets.
+ *
+ * Distinguishing a root from a shared module is the crux: both contain `.tf`
+ * files and both may declare `required_providers`. A root is what configures a
+ * backend or a provider, is initialised, carries tfvars, or lives under a
+ * conventional stacks directory — and never lives under `modules/`.
+ */
+export function discoverRootModules(repoDir) {
+    const found = [];
+    const visit = (dir, relative, depth) => {
+        if (depth > ROOT_SCAN_DEPTH)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        const tfFiles = entries.filter((entry) => entry.endsWith(".tf"));
+        const isUnderModules = /(^|[\\/])modules([\\/]|$)/i.test(relative);
+        const isDemonstration = NON_ESTATE_SEGMENT.test(relative);
+        if (tfFiles.length > 0 && !isUnderModules && !isDemonstration) {
+            const signals = [];
+            let hasBackend = false;
+            let hasLocalBackend = false;
+            let hasProvider = false;
+            for (const file of tfFiles.slice(0, 25)) {
+                let content = "";
+                try {
+                    content = readFileSync(join(dir, file), "utf8");
+                }
+                catch {
+                    continue;
+                }
+                const backendMatch = content.match(/\bbackend\s+"([a-z0-9_]+)"\s*\{/);
+                if (backendMatch) {
+                    hasBackend = true;
+                    if (backendMatch[1] === "local")
+                        hasLocalBackend = true;
+                }
+                // A provider *configuration*, not a required_providers declaration —
+                // shared modules declare requirements but must not configure providers.
+                if (/^\s*provider\s+"[a-z0-9_]+"\s*\{/m.test(content))
+                    hasProvider = true;
+            }
+            // A `.terraform` directory only proves provider plugins were downloaded.
+            // The backend — the thing `terraform show` needs — is initialised when
+            // `.terraform/terraform.tfstate` records its configuration. Treating the
+            // directory as proof reports a root as ready, the caller runs ingest, and
+            // Terraform answers "Backend initialization required" from somewhere the
+            // caller was told not to expect it.
+            const hasPluginDir = existsSync(join(dir, ".terraform"));
+            const initialised = existsSync(join(dir, ".terraform", "terraform.tfstate"));
+            const hasTfvars = entries.some((entry) => entry.endsWith(".tfvars") || entry.endsWith(".tfvars.json"));
+            const environmentHint = environmentFromPath(relative);
+            const underStacksDir = /(^|[\\/])(environments|envs|stacks|live)([\\/]|$)/i.test(relative);
+            if (hasBackend)
+                signals.push(hasLocalBackend ? "local backend" : "remote backend");
+            if (hasProvider)
+                signals.push("provider configuration");
+            if (initialised)
+                signals.push("initialised");
+            else if (hasPluginDir)
+                signals.push("providers downloaded, backend not initialised");
+            if (hasTfvars)
+                signals.push("tfvars");
+            if (underStacksDir)
+                signals.push("stacks directory");
+            // A provider block alone no longer qualifies. It is the one signal an
+            // example shares with a real estate, and treating it as sufficient is
+            // what let demonstration fixtures in. What distinguishes an estate is
+            // evidence that state exists or is configured somewhere: a backend, an
+            // initialised working directory, or a conventional stacks layout.
+            const isEstateRoot = hasBackend || initialised || hasPluginDir || (underStacksDir && (hasTfvars || Boolean(environmentHint)));
+            if (isEstateRoot) {
+                found.push({ dir, relative: relative || ".", signals, environmentHint, initialised, usesLocalBackend: hasLocalBackend });
+                // A root module's subdirectories are its own modules, not further roots.
+                return;
+            }
+        }
+        for (const entry of entries) {
+            if (IGNORED_DIRS.has(entry))
+                continue;
+            const full = join(dir, entry);
+            try {
+                if (!statSync(full).isDirectory())
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            visit(full, relative ? `${relative}/${entry}` : entry, depth + 1);
+        }
+    };
+    visit(repoDir, "", 0);
+    return found.sort((a, b) => a.relative.localeCompare(b.relative));
+}
+export function detectInfrastructureProject(dir) {
+    const files = collectTerraformFiles(dir);
+    const signals = [];
+    if (files.length > 0)
+        signals.push(`${files.length} Terraform file${files.length === 1 ? "" : "s"}`);
+    if (existsSync(join(dir, ".terraform.lock.hcl")))
+        signals.push("provider lock file");
+    if (existsSync(join(dir, ".terraform")))
+        signals.push("initialised working directory");
+    let hasRemoteBackend = false;
+    let hasProviderBlock = false;
+    // The cap guards against a pathological repo, not against a large one: now
+    // that the scan reaches the whole tree, a low cap would read only whichever
+    // subtree the walk happened to enter first and miss the backend entirely.
+    for (const file of files.slice(0, 400)) {
+        let content = "";
+        try {
+            content = readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        // `backend "local"` marks a root module but is emphatically not remote
+        // state — a bootstrap stack uses it precisely because it creates the remote
+        // backend everything else then uses.
+        const backendMatch = content.match(/\bbackend\s+"([a-z0-9_]+)"\s*\{/);
+        if (backendMatch && backendMatch[1] !== "local")
+            hasRemoteBackend = true;
+        if (/\bprovider\s+"[a-z0-9_]+"\s*\{/.test(content))
+            hasProviderBlock = true;
+    }
+    if (hasRemoteBackend)
+        signals.push("remote state backend");
+    if (hasProviderBlock)
+        signals.push("provider configuration");
+    const moduleDirectories = [...new Set(collectModuleDirectories(dir))].sort();
+    if (moduleDirectories.length > 0)
+        signals.push(`${moduleDirectories.length} reusable modules`);
+    // One stray .tf file inside an application repo is not an infrastructure
+    // repo. Requiring corroboration keeps the classification from hijacking
+    // onboarding for a project that merely ships a snippet of Terraform.
+    // Deep layouts keep every .tf file below the two-level scan above, so
+    // discovery is consulted as well: a repository whose roots live in
+    // infra/environments/<env> is unmistakably an infrastructure repository even
+    // though its top two levels contain no Terraform at all.
+    const rootModules = discoverRootModules(dir);
+    if (rootModules.length > 0) {
+        signals.push(`${rootModules.length} root module${rootModules.length === 1 ? "" : "s"}`);
+    }
+    const library = detectPublishedModules(dir);
+    // An estate is claimed only by root modules that survived the tightened
+    // acceptance above. A repository with a root module and no estate roots is
+    // publishing modules, not running anything.
+    const repoKind = rootModules.length > 0 ? "estate" : library.isLibrary ? "module_library" : "unknown";
+    if (repoKind === "module_library") {
+        signals.push(library.modules.length > 0 ? `publishes ${library.modules.length + 1} modules` : "publishes a reusable module");
+    }
+    const isInfrastructure = rootModules.length > 0 ||
+        repoKind === "module_library" ||
+        (files.length > 0 && (files.length >= 3 || hasRemoteBackend || hasProviderBlock || moduleDirectories.length > 0));
+    return {
+        isInfrastructure,
+        rootModules,
+        signals,
+        iacFileCount: files.length,
+        hasRemoteBackend,
+        hasProviderBlock,
+        moduleDirectories,
+        repoKind,
+        publishedModules: repoKind === "module_library" ? library.modules : [],
+        ...detectCiSystem(dir),
+    };
+}
+/**
+ * The pipeline step to add, for whichever CI system the repo already uses.
+ * Onboarding hands this over rather than pointing at documentation: an
+ * ingestion command nobody wires up is a graph that lies within a week.
+ */
+export function ciSnippetFor(ciSystem, ciFile = null, executable = "terraform") {
+    if (ciSystem === "github") {
+        return {
+            file: ".github/workflows/terraform.yml (in the apply job)",
+            snippet: [
+                "      - name: Sync architecture graph",
+                "        run: |",
+                "          terraform show -json > tfstate.json",
+                "          npx nexarch@latest ingest-infra --state tfstate.json",
+                "        env:",
+                "          NEXARCH_TOKEN: ${{ secrets.NEXARCH_TOKEN }}",
+            ].join("\n"),
+        };
+    }
+    if (ciSystem === "azure-pipelines") {
+        return {
+            file: `${ciFile ?? "azure-pipelines.yml"} (after the apply step)`,
+            snippet: [
+                "  - script: |",
+                "      terraform show -json > tfstate.json",
+                "      npx nexarch@latest ingest-infra --state tfstate.json",
+                "    displayName: Sync architecture graph",
+                "    env:",
+                "      NEXARCH_TOKEN: $(NEXARCH_TOKEN)",
+            ].join("\n"),
+        };
+    }
+    if (ciSystem === "gitlab") {
+        return {
+            file: ciFile ?? ".gitlab-ci.yml",
+            snippet: [
+                "nexarch-ingest:",
+                "  stage: .post",
+                "  script:",
+                "    - terraform show -json > tfstate.json",
+                "    - npx nexarch@latest ingest-infra --state tfstate.json",
+                "  variables:",
+                "    NEXARCH_TOKEN: $NEXARCH_TOKEN",
+            ].join("\n"),
+        };
+    }
+    // Nothing was detected. Handing over a GitLab job here — the previous
+    // behaviour — states as fact something never observed, and a team on another
+    // CI system has to work out why the advice does not fit. The two commands are
+    // the part that is actually known; the wrapper is not.
+    return {
+        file: "your IaC pipeline, after the apply step",
+        snippet: [`${executable} show -json > tfstate.json`, "npx nexarch@latest ingest-infra --state tfstate.json"].join("\n"),
+    };
+}

package/dist/lib/iac-projection.js

@@ -0,0 +1,231 @@
+/**
+ * Terraform state projector (ADR: infrastructure-as-code ingestion, v1).
+ *
+ * Turns `terraform show -json` into the small, safe projection that ingestion
+ * is allowed to send. This is the security-critical component of the feature:
+ * state files carry generated passwords, storage keys, connection strings and
+ * certificate material in clear text, verified against a real estate.
+ *
+ * Two independent gates, both deny-by-default:
+ *
+ *   1. The catalogue names, per resource type, the attributes that may be read.
+ *      Anything not named is dropped. The catalogue is reference data served by
+ *      the platform, not a list baked into this CLI, so support for a new Azure
+ *      service is a data change rather than a release.
+ *
+ *   2. Terraform's own `sensitive_values` map is consulted for every attribute
+ *      that survives gate 1, and anything flagged there is dropped even when the
+ *      catalogue names it. A mistake in the curated list is therefore not on its
+ *      own sufficient to leak a secret.
+ *
+ * Values are additionally restricted to scalars and shallow string arrays.
+ * Nested blocks are never emitted wholesale: a container app's `secret` block or
+ * an env var's `value` can hold credentials, so structure is only ever read by a
+ * named extractor that has been reviewed for that purpose.
+ */
+/**
+ * Parses a state document from raw bytes.
+ *
+ * PowerShell's `>` redirection writes UTF-16 with a BOM, which is what a Windows
+ * user gets from `terraform show -json > state.json` and what a naive reader
+ * chokes on. Both endiannesses and plain UTF-8 are accepted.
+ */
+export function parseIacStateBuffer(buffer) {
+    let text;
+    if (buffer[0] === 0xff && buffer[1] === 0xfe)
+        text = buffer.toString("utf16le");
+    else if (buffer[0] === 0xfe && buffer[1] === 0xff)
+        text = Buffer.from(buffer).swap16().toString("utf16le");
+    else
+        text = buffer.toString("utf8");
+    return JSON.parse(text.replace(/^/, ""));
+}
+/**
+ * Infers the environment from resource tags.
+ *
+ * Estates that tag at all tag consistently — the first real one carried
+ * `environment` on every resource — so the dominant value of a conventional tag
+ * key beats asking a human to pass a flag correctly in a pipeline. Returns null
+ * when there is no clear winner, leaving the caller to fall back to the
+ * Terraform workspace or an explicit flag.
+ */
+export function inferEnvironmentFromTags(resources) {
+    const TAG_KEYS = ["environment", "env", "Environment", "Env"];
+    const counts = new Map();
+    for (const resource of resources) {
+        for (const key of TAG_KEYS) {
+            const value = resource.tags[key];
+            if (typeof value !== "string" || !value.trim())
+                continue;
+            const normalised = value.trim().toLowerCase();
+            counts.set(normalised, (counts.get(normalised) ?? 0) + 1);
+            break;
+        }
+    }
+    if (counts.size === 0)
+        return null;
+    const ranked = [...counts.entries()].sort((a, b) => b[1] - a[1]);
+    const [environment, hits] = ranked[0];
+    const total = ranked.reduce((sum, [, n]) => sum + n, 0);
+    return { environment, confidence: hits / total };
+}
+/** Maps a free-text environment name onto an ontology environment subtype. */
+export function environmentSubtypeFor(environment) {
+    const name = environment.trim().toLowerCase();
+    if (/^(prod|production|live)$/.test(name))
+        return "env_production";
+    if (/^(stag|staging|preprod|pre-prod|uat)$/.test(name))
+        return "env_staging";
+    if (/^(test|qa|sit)$/.test(name))
+        return "env_test";
+    if (/^(dr|failover)$/.test(name))
+        return "env_dr";
+    return "env_development";
+}
+/** Longest value we will carry for any single attribute. */
+const MAX_VALUE_LENGTH = 400;
+const MAX_ARRAY_ITEMS = 12;
+function flattenResources(module, out = []) {
+    if (!module)
+        return out;
+    for (const resource of module.resources ?? [])
+        out.push(resource);
+    for (const child of module.child_modules ?? [])
+        flattenResources(child, out);
+    return out;
+}
+/**
+ * True when Terraform flagged this attribute as sensitive. The map mirrors the
+ * shape of `values`, so a `true` anywhere beneath the attribute — an env var's
+ * value inside a container template, for instance — disqualifies the whole
+ * attribute rather than just the leaf.
+ */
+function isSensitive(sensitiveValues, attribute) {
+    if (!sensitiveValues || typeof sensitiveValues !== "object" || Array.isArray(sensitiveValues))
+        return false;
+    const flag = sensitiveValues[attribute];
+    if (flag === undefined)
+        return false;
+    if (flag === true)
+        return true;
+    return JSON.stringify(flag).includes("true");
+}
+/** Scalars and shallow string arrays only; anything structural is refused. */
+function safeValue(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value === "boolean" || typeof value === "number")
+        return value;
+    if (typeof value === "string")
+        return value.length > MAX_VALUE_LENGTH ? value.slice(0, MAX_VALUE_LENGTH) : value;
+    if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+        return value.slice(0, MAX_ARRAY_ITEMS).map((item) => item.slice(0, MAX_VALUE_LENGTH));
+    }
+    return null;
+}
+/**
+ * Tags carry the binding convention, so they are read — but a tag whose value
+ * Terraform flagged, or which does not look like a label, is left behind.
+ */
+function projectTags(values, sensitiveValues) {
+    if (isSensitive(sensitiveValues, "tags"))
+        return {};
+    const raw = values.tags;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return {};
+    const tags = {};
+    for (const [key, value] of Object.entries(raw)) {
+        if (typeof value !== "string")
+            continue;
+        if (value.length > 200)
+            continue;
+        tags[key] = value;
+    }
+    return tags;
+}
+/**
+ * User-assigned identity references. Reviewed extractor: identity ids are
+ * resource paths, never credentials, and they are how a workload is tied to the
+ * role assignments that define what it may reach.
+ */
+function projectIdentityIds(values) {
+    const identity = values.identity;
+    if (!Array.isArray(identity))
+        return [];
+    const ids = [];
+    for (const block of identity) {
+        if (!block || typeof block !== "object")
+            continue;
+        const identityIds = block.identity_ids;
+        if (!Array.isArray(identityIds))
+            continue;
+        for (const id of identityIds)
+            if (typeof id === "string")
+                ids.push(id);
+    }
+    return ids.slice(0, MAX_ARRAY_ITEMS);
+}
+export function projectIacState(params) {
+    const { document, catalogue, environment } = params;
+    const byType = new Map(catalogue.map((entry) => [entry.resourceType, entry]));
+    const resources = flattenResources(document.values?.root_module);
+    const projected = [];
+    const unknown = new Map();
+    let attributesDroppedNotAllowlisted = 0;
+    let attributesDroppedSensitive = 0;
+    for (const resource of resources) {
+        const resourceType = typeof resource.type === "string" ? resource.type : "";
+        if (!resourceType)
+            continue;
+        const entry = byType.get(resourceType);
+        if (!entry) {
+            unknown.set(resourceType, (unknown.get(resourceType) ?? 0) + 1);
+            continue;
+        }
+        const values = (resource.values && typeof resource.values === "object" ? resource.values : {});
+        const sensitiveValues = resource.sensitive_values;
+        const attributes = {};
+        for (const [key, value] of Object.entries(values)) {
+            if (!entry.attributes.includes(key)) {
+                attributesDroppedNotAllowlisted += 1;
+                continue;
+            }
+            if (isSensitive(sensitiveValues, key)) {
+                attributesDroppedSensitive += 1;
+                continue;
+            }
+            const safe = safeValue(value);
+            if (safe === null) {
+                attributesDroppedNotAllowlisted += 1;
+                continue;
+            }
+            attributes[key] = safe;
+        }
+        projected.push({
+            address: typeof resource.address === "string" ? resource.address : `${resourceType}.${resource.name ?? "unknown"}`,
+            resourceType,
+            entityTypeCode: entry.entityTypeCode,
+            entitySubtypeCode: entry.entitySubtypeCode ?? null,
+            role: entry.role,
+            mode: typeof resource.mode === "string" ? resource.mode : "managed",
+            name: typeof values[entry.nameAttribute ?? "name"] === "string" ? values[entry.nameAttribute ?? "name"] : null,
+            attributes,
+            tags: projectTags(values, sensitiveValues),
+            identityIds: projectIdentityIds(values),
+        });
+    }
+    return {
+        environment,
+        iacToolVersion: typeof document.terraform_version === "string" ? document.terraform_version : null,
+        resources: projected,
+        unknownTypes: [...unknown.entries()]
+            .map(([resourceType, count]) => ({ resourceType, count }))
+            .sort((a, b) => b.count - a.count),
+        stats: {
+            resourcesSeen: resources.length,
+            resourcesProjected: projected.length,
+            attributesDroppedNotAllowlisted,
+            attributesDroppedSensitive,
+        },
+    };
+}