openlore 2.0.3 → 2.0.5

package/dist/core/analyzer/iac/kubernetes.js

@@ -0,0 +1,226 @@
+/**
+ * Kubernetes manifest extraction (spec-07).
+ *
+ * One node per YAML document (`---`-separated). Edges follow the typed
+ * references that operators reason about: label selectors, *KeyRef / envFrom,
+ * volume refs, serviceName, ownerReferences, Ingress→Service, serviceAccount.
+ * Unknown kinds (CRDs) still become nodes — only unresolved edges are dropped.
+ */
+import { LineCounter, parseAllDocuments } from 'yaml';
+import { emptyIacGraph } from './types.js';
+const WORKLOAD_KINDS = new Set([
+    'Deployment', 'StatefulSet', 'DaemonSet', 'ReplicaSet', 'ReplicationController',
+    'Pod', 'Job', 'CronJob',
+]);
+export function extractKubernetes(files) {
+    const graph = emptyIacGraph();
+    const objects = [];
+    for (const file of files) {
+        const lc = new LineCounter();
+        let docs;
+        try {
+            docs = parseAllDocuments(file.content, { lineCounter: lc });
+        }
+        catch {
+            continue;
+        }
+        for (const doc of docs) {
+            const obj = doc.toJS();
+            if (!obj || typeof obj !== 'object')
+                continue;
+            const kind = typeof obj.kind === 'string' ? obj.kind : '';
+            const meta = (obj.metadata ?? {});
+            const name = typeof meta.name === 'string' ? meta.name : '';
+            if (!kind || !name)
+                continue;
+            const namespace = typeof meta.namespace === 'string' ? meta.namespace : undefined;
+            const address = namespace ? `${namespace}/${kind}/${name}` : `${kind}/${name}`;
+            const start = doc.range?.[0] ?? 0;
+            const startLine = lc.linePos(start).line;
+            const resource = {
+                address,
+                type: kind,
+                kind: 'manifest',
+                filePath: file.path,
+                startLine,
+                module: namespace,
+                signature: `${kind}/${name}${namespace ? ` (ns: ${namespace})` : ''}`,
+                language: 'Kubernetes',
+            };
+            graph.resources.push(resource);
+            objects.push({
+                kind,
+                name,
+                namespace,
+                labels: asStringMap((meta.labels ?? {})),
+                templateLabels: asStringMap(podTemplateLabels(obj)),
+                raw: obj,
+                resource,
+            });
+        }
+    }
+    resolveEdges(objects, graph);
+    return graph;
+}
+function resolveEdges(objects, graph) {
+    // Index by (namespace, kind, name) → address for name-based refs.
+    const byKindName = new Map();
+    const key = (ns, kind, name) => `${ns ?? ''}\0${kind}\0${name}`;
+    for (const o of objects)
+        byKindName.set(key(o.namespace, o.kind, o.name), o.resource.address);
+    const ref = (from, to, kind = 'references') => {
+        if (!to || to === from)
+            return;
+        graph.references.push({ fromAddress: from, toAddress: to, kind });
+    };
+    const lookup = (ns, kind, name) => byKindName.get(key(ns, kind, name));
+    for (const o of objects) {
+        const ns = o.namespace;
+        const addr = o.resource.address;
+        // Service selector → matching workloads (Service depends on the pods it routes to).
+        if (o.kind === 'Service') {
+            const sel = asStringMap(((o.raw.spec ?? {}).selector ?? {}));
+            if (Object.keys(sel).length > 0) {
+                for (const target of objects) {
+                    if (!WORKLOAD_KINDS.has(target.kind) || target.namespace !== ns)
+                        continue;
+                    const labels = { ...target.labels, ...target.templateLabels };
+                    if (selectorMatches(sel, labels))
+                        ref(addr, target.resource.address);
+                }
+            }
+        }
+        // Workload references to ConfigMaps / Secrets / PVCs / ServiceAccount.
+        if (WORKLOAD_KINDS.has(o.kind)) {
+            const podSpec = findPodSpec(o.raw);
+            if (podSpec) {
+                for (const cm of collectRefs(podSpec, 'configMap', 'configMapKeyRef', 'configMapRef')) {
+                    ref(addr, lookup(ns, 'ConfigMap', cm));
+                }
+                for (const sec of collectRefs(podSpec, 'secret', 'secretKeyRef', 'secretRef', 'secretName')) {
+                    ref(addr, lookup(ns, 'Secret', sec));
+                }
+                for (const pvc of collectRefs(podSpec, 'persistentVolumeClaim')) {
+                    ref(addr, lookup(ns, 'PersistentVolumeClaim', pvc));
+                }
+                const sa = (podSpec.serviceAccountName ?? podSpec.serviceAccount);
+                if (typeof sa === 'string')
+                    ref(addr, lookup(ns, 'ServiceAccount', sa));
+            }
+        }
+        // StatefulSet.spec.serviceName → Service.
+        if (o.kind === 'StatefulSet') {
+            const svcName = ((o.raw.spec ?? {}).serviceName);
+            if (typeof svcName === 'string')
+                ref(addr, lookup(ns, 'Service', svcName));
+        }
+        // ownerReferences → owner (dependent child → owner).
+        const ownerRefs = (o.raw.metadata ?? {}).ownerReferences;
+        if (Array.isArray(ownerRefs)) {
+            for (const owner of ownerRefs) {
+                if (typeof owner.kind === 'string' && typeof owner.name === 'string') {
+                    ref(addr, lookup(ns, owner.kind, owner.name), 'depends_on');
+                }
+            }
+        }
+        // Ingress backend.service.name → Service.
+        if (o.kind === 'Ingress') {
+            for (const svc of ingressServices(o.raw))
+                ref(addr, lookup(ns, 'Service', svc));
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+function podTemplateLabels(obj) {
+    const spec = (obj.spec ?? {});
+    const template = (spec.template ?? {});
+    const meta = (template.metadata ?? {});
+    // CronJob nests one level deeper.
+    if (obj.kind === 'CronJob') {
+        const jobSpec = (spec.jobTemplate ?? {}).spec;
+        const jt = (jobSpec?.template ?? {}).metadata;
+        return (jt?.labels ?? {});
+    }
+    return (meta.labels ?? {});
+}
+function findPodSpec(obj) {
+    const spec = (obj.spec ?? {});
+    if (obj.kind === 'Pod')
+        return spec;
+    if (obj.kind === 'CronJob') {
+        const jobSpec = spec.jobTemplate?.spec;
+        return (jobSpec?.template?.spec ?? null);
+    }
+    const template = spec.template;
+    return (template?.spec ?? null);
+}
+/** Recursively collect string values stored under any of the given keys. */
+function collectRefs(node, ...keys) {
+    const out = [];
+    const keySet = new Set(keys);
+    const walk = (n) => {
+        if (Array.isArray(n)) {
+            for (const x of n)
+                walk(x);
+            return;
+        }
+        if (n && typeof n === 'object') {
+            for (const [k, v] of Object.entries(n)) {
+                if (keySet.has(k)) {
+                    if (typeof v === 'string')
+                        out.push(v);
+                    else if (v && typeof v === 'object') {
+                        const name = v.name;
+                        if (typeof name === 'string')
+                            out.push(name);
+                    }
+                }
+                walk(v);
+            }
+        }
+    };
+    walk(node);
+    return out;
+}
+function ingressServices(obj) {
+    const out = [];
+    const walk = (n) => {
+        if (Array.isArray(n)) {
+            for (const x of n)
+                walk(x);
+            return;
+        }
+        if (n && typeof n === 'object') {
+            const rec = n;
+            // networking.k8s.io/v1: backend.service.name
+            const svc = (rec.service ?? {});
+            if (typeof svc.name === 'string')
+                out.push(svc.name);
+            // extensions/v1beta1: backend.serviceName
+            if (typeof rec.serviceName === 'string')
+                out.push(rec.serviceName);
+            for (const v of Object.values(rec))
+                walk(v);
+        }
+    };
+    walk(obj.spec);
+    return out;
+}
+function selectorMatches(selector, labels) {
+    for (const [k, v] of Object.entries(selector)) {
+        if (labels[k] !== v)
+            return false;
+    }
+    return true;
+}
+function asStringMap(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (typeof v === 'string')
+            out[k] = v;
+        else if (typeof v === 'number' || typeof v === 'boolean')
+            out[k] = String(v);
+    }
+    return out;
+}
+//# sourceMappingURL=kubernetes.js.map

package/dist/core/analyzer/iac/kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.js","sourceRoot":"","sources":["../../../../src/core/analyzer/iac/kubernetes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAY3C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,uBAAuB;IAC/E,KAAK,EAAE,KAAK,EAAE,SAAS;CACxB,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB,CAC/B,KAA+C;IAE/C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAoC,CAAC;YACzD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;YAC7D,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;gBAAE,SAAS;YAC7B,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;YAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YACzC,MAAM,QAAQ,GAAgB;gBAC5B,OAAO;gBACP,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,SAAS;gBACT,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,GAAG,IAAI,IAAI,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACrE,QAAQ,EAAE,YAAY;aACvB,CAAC;YACF,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,IAAI;gBACJ,SAAS;gBACT,MAAM,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;gBACnE,cAAc,EAAE,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACnD,GAAG,EAAE,GAAG;gBACR,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,OAAoB,EAAE,KAAe;IACzD,kEAAkE;IAClE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,EAAsB,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK,IAAI,EAAE,CAAC;IACpG,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE9F,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAsB,EAAE,OAA6B,YAAY,EAAE,EAAE;QAC9F,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO;QAC/B,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,EAAsB,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAE3G,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAEhC,oFAAoF;QACpF,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,WAAW,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA6B,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC,CAAC;YACrH,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;oBAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE;wBAAE,SAAS;oBAC1E,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC9D,IAAI,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC;wBAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,cAAc,CAAC,EAAE,CAAC;oBACtF,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;oBAC5F,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvC,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,uBAAuB,CAAC,EAAE,CAAC;oBAChE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,cAAc,CAAuB,CAAC;gBACxF,IAAI,OAAO,EAAE,KAAK,QAAQ;oBAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,CAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA6B,CAAC,WAAW,CAAuB,CAAC;YACpG,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,qDAAqD;QACrD,MAAM,SAAS,GAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA6B,CAAC,eAAe,CAAC;QACtF,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,SAA2C,EAAE,CAAC;gBAChE,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,GAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAClE,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IAClE,kCAAkC;IAClC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAA6B,CAAC,IAA2C,CAAC;QAClH,MAAM,EAAE,GAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAA6B,CAAC,QAA+C,CAAC;QAClH,OAAO,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,CAA4B,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;IACzD,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAI,IAAI,CAAC,WAAmD,EAAE,IAA2C,CAAC;QACvH,OAAO,CAAE,OAAO,EAAE,QAAgD,EAAE,IAAI,IAAI,IAAI,CAAmC,CAAC;IACtH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA+C,CAAC;IACtE,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAmC,CAAC;AACpE,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,IAAa,EAAE,GAAG,IAAc;IACnD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,KAAK,MAAM,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;gBAClE,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClB,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;yBAClC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACpC,MAAM,IAAI,GAAI,CAA6B,CAAC,IAAI,CAAC;wBACjD,IAAI,OAAO,IAAI,KAAK,QAAQ;4BAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAA4B;IACnD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE;QAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,KAAK,MAAM,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,6CAA6C;YAC7C,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrD,0CAA0C;YAC1C,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACnE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACf,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,QAAgC,EAAE,MAA8B;IACvF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;aACjC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/analyzer/iac/project.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Projection: normalized IaC graph → existing FunctionNode/CallEdge/ClassNode (spec-07).
+ *
+ * This is the single place where infrastructure becomes ordinary graph nodes.
+ * Because we reuse the existing primitives, orient/search_code/get_subgraph/
+ * analyze_impact and the SCIP + federation exports all work on IaC unchanged.
+ */
+import type { CallEdge, ClassNode, FunctionNode } from '../call-graph.js';
+import type { IacGraph } from './types.js';
+export interface ProjectedIac {
+    nodes: FunctionNode[];
+    edges: CallEdge[];
+    classes: ClassNode[];
+}
+export declare function projectIacGraph(graph: IacGraph): ProjectedIac;
+//# sourceMappingURL=project.d.ts.map

package/dist/core/analyzer/iac/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../../src/core/analyzer/iac/project.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,OAAO,EAAE,SAAS,EAAE,CAAC;CACtB;AAOD,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,CA4F7D"}

package/dist/core/analyzer/iac/project.js

@@ -0,0 +1,97 @@
+/**
+ * Projection: normalized IaC graph → existing FunctionNode/CallEdge/ClassNode (spec-07).
+ *
+ * This is the single place where infrastructure becomes ordinary graph nodes.
+ * Because we reuse the existing primitives, orient/search_code/get_subgraph/
+ * analyze_impact and the SCIP + federation exports all work on IaC unchanged.
+ */
+/** Stable node id for a resource address. */
+function nodeId(filePath, address, isExternal, language) {
+    return isExternal ? `iac-external::${language}::${address}` : `${filePath}::${address}`;
+}
+export function projectIacGraph(graph) {
+    // address → FunctionNode (first declaration wins; deterministic via sorted input).
+    const byAddress = new Map();
+    const nodes = new Map();
+    const sortedResources = [...graph.resources].sort((a, b) => a.filePath.localeCompare(b.filePath) ||
+        a.startLine - b.startLine ||
+        a.address.localeCompare(b.address));
+    for (const r of sortedResources) {
+        const id = nodeId(r.filePath, r.address, !!r.isExternal, r.language);
+        if (!nodes.has(id)) {
+            const node = {
+                id,
+                name: r.address,
+                filePath: r.filePath,
+                className: r.type,
+                isAsync: false,
+                language: r.language,
+                startIndex: 0,
+                endIndex: 0,
+                fanIn: 0,
+                fanOut: 0,
+                signature: r.signature,
+                startLine: r.startLine,
+                endLine: r.endLine ?? r.startLine,
+                isExternal: r.isExternal || undefined,
+            };
+            nodes.set(id, node);
+        }
+        // First resource to claim an address owns it (for reference resolution).
+        if (!byAddress.has(r.address))
+            byAddress.set(r.address, nodes.get(id));
+    }
+    // References → edges (dependent → dependency). Drop unresolved targets.
+    const edgeSeen = new Set();
+    const edges = [];
+    const sortedRefs = [...graph.references].sort((a, b) => a.fromAddress.localeCompare(b.fromAddress) ||
+        a.toAddress.localeCompare(b.toAddress) ||
+        a.kind.localeCompare(b.kind) ||
+        (a.line ?? 0) - (b.line ?? 0));
+    for (const ref of sortedRefs) {
+        const from = byAddress.get(ref.fromAddress);
+        const to = byAddress.get(ref.toAddress);
+        if (!from || !to || from.id === to.id)
+            continue;
+        const key = `${from.id}\0${to.id}\0${ref.kind}`;
+        if (edgeSeen.has(key))
+            continue;
+        edgeSeen.add(key);
+        edges.push({
+            callerId: from.id,
+            calleeId: to.id,
+            calleeName: to.name,
+            line: ref.line,
+            confidence: 'import',
+            kind: ref.kind,
+        });
+    }
+    // Modules → ClassNodes (module-style grouping).
+    const classes = [];
+    const sortedModules = [...graph.modules].sort((a, b) => a.address.localeCompare(b.address));
+    for (const m of sortedModules) {
+        const id = nodeId(m.filePath, m.address, !!m.isExternal, m.language);
+        const methodIds = m.members
+            .map((addr) => byAddress.get(addr)?.id)
+            .filter((x) => !!x)
+            .sort();
+        classes.push({
+            id,
+            name: m.address,
+            filePath: m.filePath,
+            language: m.language,
+            parentClasses: [],
+            interfaces: [],
+            methodIds,
+            fanIn: 0,
+            fanOut: 0,
+            isModule: true,
+        });
+    }
+    return {
+        nodes: [...nodes.values()].sort((a, b) => a.id.localeCompare(b.id)),
+        edges,
+        classes: classes.sort((a, b) => a.id.localeCompare(b.id)),
+    };
+}
+//# sourceMappingURL=project.js.map

package/dist/core/analyzer/iac/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../../../src/core/analyzer/iac/project.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,6CAA6C;AAC7C,SAAS,MAAM,CAAC,QAAgB,EAAE,OAAe,EAAE,UAAmB,EAAE,QAAgB;IACtF,OAAO,UAAU,CAAC,CAAC,CAAC,iBAAiB,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,OAAO,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAe;IAC7C,mFAAmF;IACnF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAE9C,MAAM,eAAe,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAC/C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QACpC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS;QACzB,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CACrC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,GAAiB;gBACzB,EAAE;gBACF,IAAI,EAAE,CAAC,CAAC,OAAO;gBACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,IAAI;gBACjB,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC;gBACb,QAAQ,EAAE,CAAC;gBACX,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,CAAC;gBACT,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,SAAS;gBACjC,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,SAAS;aACtC,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,yEAAyE;QACzE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;IAC1E,CAAC;IAED,wEAAwE;IACxE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAC3C,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAChC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YAAE,SAAS;QAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,QAAQ,EAAE,EAAE,CAAC,EAAE;YACf,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,QAAQ;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED,gDAAgD;IAChD,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,aAAa,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO;aACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;aAC/B,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC;YACX,EAAE;YACF,IAAI,EAAE,CAAC,CAAC,OAAO;YACf,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,EAAE;YACd,SAAS;YACT,KAAK,EAAE,CAAC;YACR,MAAM,EAAE,CAAC;YACT,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnE,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/core/analyzer/iac/pulumi.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Pulumi framework detector (spec-07, lightest ecosystem).
+ *
+ * Pulumi programs are written in TS/JS/Python/Go — already parsed for the call
+ * graph. We do NOT add a grammar; we recognize Pulumi resource constructions
+ * over the existing source and emit extra `Pulumi` resource nodes + reference
+ * edges, without touching the normal call graph for those files.
+ *
+ * Scope conservatively: only the common provider SDKs (@pulumi/aws, /gcp,
+ * /azure-native, /kubernetes). Unknown SDKs → no resource nodes.
+ * CDK / CDKTF are intentionally out of scope (deferred to a future spec).
+ */
+import type { IacGraph } from './types.js';
+interface InFile {
+    path: string;
+    content: string;
+    language: string;
+}
+export declare function extractPulumi(files: InFile[]): IacGraph;
+export {};
+//# sourceMappingURL=pulumi.d.ts.map

package/dist/core/analyzer/iac/pulumi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pulumi.d.ts","sourceRoot":"","sources":["../../../../src/core/analyzer/iac/pulumi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAe,MAAM,YAAY,CAAC;AAGxD,UAAU,MAAM;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAepE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAYvD"}

package/dist/core/analyzer/iac/pulumi.js

@@ -0,0 +1,190 @@
+/**
+ * Pulumi framework detector (spec-07, lightest ecosystem).
+ *
+ * Pulumi programs are written in TS/JS/Python/Go — already parsed for the call
+ * graph. We do NOT add a grammar; we recognize Pulumi resource constructions
+ * over the existing source and emit extra `Pulumi` resource nodes + reference
+ * edges, without touching the normal call graph for those files.
+ *
+ * Scope conservatively: only the common provider SDKs (@pulumi/aws, /gcp,
+ * /azure-native, /kubernetes). Unknown SDKs → no resource nodes.
+ * CDK / CDKTF are intentionally out of scope (deferred to a future spec).
+ */
+import { emptyIacGraph } from './types.js';
+const PROVIDER_PKGS = ['@pulumi/aws', '@pulumi/gcp', '@pulumi/azure', '@pulumi/azure-native', '@pulumi/kubernetes', '@pulumi/pulumi'];
+const PY_PROVIDER_MODS = ['pulumi_aws', 'pulumi_gcp', 'pulumi_azure', 'pulumi_azure_native', 'pulumi_kubernetes', 'pulumi'];
+const GO_PROVIDER_PATHS = ['pulumi-aws', 'pulumi-gcp', 'pulumi-azure', 'pulumi-azure-native', 'pulumi-kubernetes', 'pulumi/pulumi/sdk'];
+export function extractPulumi(files) {
+    const graph = emptyIacGraph();
+    for (const file of files) {
+        if (file.language === 'TypeScript' || file.language === 'JavaScript') {
+            ingest(file, detectTsProviderNames(file.content), true, graph);
+        }
+        else if (file.language === 'Python') {
+            ingest(file, detectPyProviderNames(file.content), false, graph);
+        }
+        else if (file.language === 'Go') {
+            ingestGo(file, detectGoProviderNames(file.content), graph);
+        }
+    }
+    return graph;
+}
+/** Go: `bucket, _ := s3.NewBucket(ctx, "logs", &s3.BucketArgs{…})`. */
+function ingestGo(file, providerNames, graph) {
+    if (providerNames.size === 0)
+        return;
+    const re = /(?:(\w+)\s*(?:,\s*\w+\s*)?:?=\s*)?([A-Za-z_]\w*)\.New([A-Z]\w*)\(\s*[\w.]+\s*,\s*"([^"]+)"/g;
+    const constructions = [];
+    for (const m of file.content.matchAll(re)) {
+        const [, varName, pkg, service, name] = m;
+        if (!providerNames.has(pkg))
+            continue;
+        const callParen = (m.index ?? 0) + m[0].indexOf('(');
+        constructions.push({
+            address: `${service}:${name}`, service, name,
+            line: lineOf(file.content, m.index ?? 0), varName, argsText: sliceArgs(file.content, callParen),
+        });
+    }
+    emitConstructions(constructions, file, graph);
+}
+/** Go provider package local names (alias or last import-path segment). */
+function detectGoProviderNames(content) {
+    const names = new Set();
+    for (const m of content.matchAll(/(?:(\w+)\s+)?"(github\.com\/pulumi\/[^"]+)"/g)) {
+        const alias = m[1];
+        const path = m[2];
+        if (!GO_PROVIDER_PATHS.some((p) => path.includes(p)))
+            continue;
+        names.add(alias ?? path.split('/').pop());
+    }
+    return names;
+}
+function ingest(file, providerNames, isTs, graph) {
+    if (providerNames.size === 0)
+        return;
+    emitConstructions(findConstructions(file.content, providerNames, isTs), file, graph);
+}
+/** Emit resource nodes + variable-reference edges for detected constructions. */
+function emitConstructions(constructions, file, graph) {
+    const byVar = new Map();
+    for (const c of constructions) {
+        if (c.varName)
+            byVar.set(c.varName, c.address);
+    }
+    for (const c of constructions) {
+        const r = {
+            address: c.address, type: c.service, kind: 'resource', filePath: file.path,
+            startLine: c.line, signature: `new ${c.service}("${c.name}")`, language: 'Pulumi',
+        };
+        graph.resources.push(r);
+    }
+    // Reference edges: a construction's args mention another resource's variable.
+    for (const c of constructions) {
+        const seen = new Set();
+        for (const tok of c.argsText.matchAll(/\b([A-Za-z_]\w*)\b/g)) {
+            const target = byVar.get(tok[1]);
+            if (target && target !== c.address && !seen.has(target)) {
+                seen.add(target);
+                graph.references.push({ fromAddress: c.address, toAddress: target, kind: 'references', line: c.line });
+            }
+        }
+    }
+}
+function findConstructions(content, providerNames, isTs) {
+    const out = [];
+    // TS: `new aws.s3.Bucket("logs", {...})`; Py: `aws.s3.Bucket("logs", ...)`.
+    const re = isTs
+        ? /(?:(?:const|let|var)\s+(\w+)\s*=\s*)?new\s+([A-Za-z_]\w*(?:\.\w+)*)\s*\(\s*["']([^"']+)["']/g
+        : /(?:(\w+)\s*=\s*)?([A-Za-z_]\w*(?:\.\w+)*)\s*\(\s*["']([^"']+)["']/g;
+    for (const m of content.matchAll(re)) {
+        const varName = m[1];
+        const dotted = m[2];
+        const name = m[3];
+        const segs = dotted.split('.');
+        const root = segs[0];
+        const service = segs[segs.length - 1];
+        if (!providerNames.has(root))
+            continue;
+        // Service must be a class-like capitalized identifier.
+        if (!/^[A-Z]/.test(service))
+            continue;
+        const callParen = (m.index ?? 0) + m[0].lastIndexOf('(');
+        out.push({
+            address: `${service}:${name}`,
+            service,
+            name,
+            line: lineOf(content, m.index ?? 0),
+            varName,
+            argsText: sliceArgs(content, callParen),
+        });
+    }
+    return out;
+}
+/** Local names bound to a Pulumi provider import (TS/JS). */
+function detectTsProviderNames(content) {
+    const names = new Set();
+    for (const pkg of PROVIDER_PKGS) {
+        const esc = pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        // import * as aws from "@pulumi/aws";  /  import aws from "@pulumi/aws";
+        for (const m of content.matchAll(new RegExp(`import\\s+(?:\\*\\s+as\\s+)?(\\w+)\\s+from\\s+["']${esc}["']`, 'g')))
+            names.add(m[1]);
+        // import { s3 } from "@pulumi/aws";
+        for (const m of content.matchAll(new RegExp(`import\\s+\\{([^}]+)\\}\\s+from\\s+["']${esc}["']`, 'g'))) {
+            for (const part of m[1].split(',')) {
+                const n = (part.match(/\bas\s+(\w+)/) ?? part.match(/(\w+)/))?.[1]?.trim();
+                if (n)
+                    names.add(n);
+            }
+        }
+        // const aws = require("@pulumi/aws");
+        for (const m of content.matchAll(new RegExp(`(\\w+)\\s*=\\s*require\\(\\s*["']${esc}["']`, 'g')))
+            names.add(m[1]);
+    }
+    return names;
+}
+/** Local names bound to a Pulumi provider import (Python). */
+function detectPyProviderNames(content) {
+    const names = new Set();
+    for (const mod of PY_PROVIDER_MODS) {
+        const esc = mod.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        // import pulumi_aws as aws  /  import pulumi_aws
+        for (const m of content.matchAll(new RegExp(`import\\s+${esc}(?:\\s+as\\s+(\\w+))?`, 'g'))) {
+            names.add(m[1] ?? mod);
+        }
+        // from pulumi_aws import s3, ec2
+        for (const m of content.matchAll(new RegExp(`from\\s+${esc}\\s+import\\s+([^\\n#]+)`, 'g'))) {
+            for (const part of m[1].split(',')) {
+                const n = (part.match(/\bas\s+(\w+)/) ?? part.match(/(\w+)/))?.[1]?.trim();
+                if (n)
+                    names.add(n);
+            }
+        }
+    }
+    return names;
+}
+/** Slice the argument list starting at the opening paren (paren-matched). */
+function sliceArgs(content, parenIndex) {
+    let depth = 0;
+    let i = parenIndex;
+    for (; i < content.length; i++) {
+        const c = content[i];
+        if (c === '(')
+            depth++;
+        else if (c === ')') {
+            depth--;
+            if (depth === 0) {
+                i++;
+                break;
+            }
+        }
+    }
+    return content.slice(parenIndex, i);
+}
+function lineOf(content, index) {
+    let n = 1;
+    for (let i = 0; i < index && i < content.length; i++)
+        if (content[i] === '\n')
+            n++;
+    return n;
+}
+//# sourceMappingURL=pulumi.js.map

package/dist/core/analyzer/iac/pulumi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pulumi.js","sourceRoot":"","sources":["../../../../src/core/analyzer/iac/pulumi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;AACtI,MAAM,gBAAgB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;AAC5H,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;AAWxI,MAAM,UAAU,aAAa,CAAC,KAAe;IAC3C,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,IAAY,EAAE,aAA0B,EAAE,KAAe;IACzE,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACrC,MAAM,EAAE,GAAG,6FAA6F,CAAC;IACzG,MAAM,aAAa,GAAmB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrD,aAAa,CAAC,IAAI,CAAC;YACjB,OAAO,EAAE,GAAG,OAAO,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI;YAC5C,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;SAChG,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,2EAA2E;AAC3E,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,8CAA8C,CAAC,EAAE,CAAC;QACjF,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/D,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,aAA0B,EAAE,IAAa,EAAE,KAAe;IACtF,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACrC,iBAAiB,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACvF,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB,CAAC,aAA6B,EAAE,IAAY,EAAE,KAAe;IACrF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAgB;YACrB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI;YAC1E,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,EAAE,QAAQ,EAAE,QAAQ;SAClF,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,8EAA8E;IAC9E,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,aAA0B,EAAE,IAAa;IACnF,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,4EAA4E;IAC5E,MAAM,EAAE,GAAG,IAAI;QACb,CAAC,CAAC,8FAA8F;QAChG,CAAC,CAAC,oEAAoE,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACvC,uDAAuD;QACvD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,GAAG,OAAO,IAAI,IAAI,EAAE;YAC7B,OAAO;YACP,IAAI;YACJ,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACnC,OAAO;YACP,QAAQ,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6DAA6D;AAC7D,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACvD,yEAAyE;QACzE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,qDAAqD,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,oCAAoC;QACpC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,0CAA0C,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvG,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBAC3E,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QACD,sCAAsC;QACtC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,oCAAoC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8DAA8D;AAC9D,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACvD,iDAAiD;QACjD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,aAAa,GAAG,uBAAuB,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3F,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,iCAAiC;QACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,0BAA0B,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5F,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBAC3E,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAAC,OAAe,EAAE,UAAkB;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,MAAM;YAAC,CAAC;QAAC,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,KAAa;IAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,CAAC,EAAE,CAAC;IACnF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/core/analyzer/iac/terraform.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Terraform / HCL extraction (spec-07, reference implementation).
+ *
+ * Parser choice: a tolerant, hand-rolled HCL block scanner rather than a
+ * tree-sitter grammar. Rationale (per spec): `tree-sitter-hcl` is a native
+ * addon with an extra build/install surface, and IaC extraction only needs
+ * block boundaries + dotted-reference detection — not a full AST. A pure-JS
+ * scanner keeps the dependency tree flat and install-clean, and is fully
+ * deterministic. We never evaluate HCL; we only read declared blocks + refs.
+ *
+ * Files: *.tf, *.tf.json, *.tfvars. (The JSON variant is handled tolerantly by
+ * the same reference scan; structural JSON parsing is a spec-07 follow-up.)
+ */
+import type { IacGraph } from './types.js';
+export declare function extractTerraform(files: Array<{
+    path: string;
+    content: string;
+}>): IacGraph;
+//# sourceMappingURL=terraform.d.ts.map

package/dist/core/analyzer/iac/terraform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../../../src/core/analyzer/iac/terraform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAwC,MAAM,YAAY,CAAC;AAiBjF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAC9C,QAAQ,CAgCV"}