Importing infrastructure code

An import turns infrastructure code into a draft template that you review. One engine, orkstage-scan (written in Rust), does all detection and mapping. The ork CLI runs it natively, and the platform runs it compiled to WebAssembly (@orkstage/scan).

Supported sourcesCopy Anchor Link

Detected resources map to the nine OrkStage types: network, compute.container-service, container-registry, database.postgresql, cache.redis, queue, object-storage, ingress and dns. Anything else appears in the unmapped list with a reason. Nothing is dropped silently.

Mapping rules in shortCopy Anchor Link

• When several sources show the same component, it becomes one resource that keeps every source. For example, a Compose postgres service, pg in package.json and an aws_db_instance become one database.postgresql on AWS.
• Evidence strength, from strongest: IaC, then Kubernetes, then Compose, Dockerfiles and package hints.
• References become connections, for example a task definition that reads aws_db_instance.main.address.
• The engine adds a network when services or data stores need one. It adds an ingress and DNS when a public HTTP service runs on a cloud provider.
• Placement slots are chosen per provider: primary for the compute provider, and slots such as data, storage and messaging for the others. The engine also tags the template with its size (starter, growth or scale) and its contents.
• Each resource has a confidence of high, medium or low.

API flowCopy Anchor Link

POST /api/v1/imports
Authorization: Bearer ork_live_…          # scope imports:write
Content-Type: application/json

{ "tenantId": "8a1c…", "report": { "version": 1, "generator": "orkstage-scan/0.1.0", … } }

{ "tenantId": "8a1c…", "files": [ { "path": "infra/main.tf", "content": "resource \"aws_db_instance\" \"main\" { … }" } ] }

interface ImportDto {
  id: string;
  tenantId: string | null;
  createdAt: string;
  sourceKinds: string[];        // e.g. ["terraform", "compose"]
  report: ScanReport;
  validation: { valid: boolean; issues: { stage: string; severity: string; code: string; message: string; path?: string }[] };
  templateId: string | null;    // set once a template was created from it
}

POST /api/v1/imports/:id/template          # scope templates:write
Content-Type: application/json

{ "name": "shop", "displayName": "Shop" }

Then edit the draft in the builder, validate it and publish it. Both the import and the template creation are audited.

ScanReport (version 1)Copy Anchor Link

interface ScanReport {
  version: 1;
  generator: string;                 // "orkstage-scan/0.1.0"
  detectors: { kind: SourceKind; files: number }[];
  resources: DetectedResource[];     // mapped to OrkStage logical types
  unmapped: { source: SourceRef; type: string; reason: string }[];
  connections: { from: string; to: string; protocol: string; port?: number; evidence: string }[];
  template: string;                  // generated platform/v1 EnvironmentTemplate YAML
  warnings: string[];
}
type SourceKind = 'terraform' | 'cloudformation' | 'sam' | 'cdk' | 'serverless' | 'pulumi'
  | 'kubernetes' | 'helm' | 'compose' | 'dockerfile' | 'package' | 'bicep' | 'arm';
interface SourceRef { kind: SourceKind; file: string; line?: number; address: string } // e.g. aws_db_instance.main
interface DetectedResource {
  id: string;                        // template resource id, e.g. "database"
  type: 'network' | 'compute.container-service' | 'container-registry' | 'database.postgresql'
      | 'cache.redis' | 'queue' | 'object-storage' | 'ingress' | 'dns';
  provider: 'aws' | 'azure' | 'gcp' | 'oci' | null;   // null = provider-neutral evidence
  implementation?: string;           // capability id when evident, e.g. "ecs-fargate", "rds-postgres"
  properties: Record<string, unknown>; // mapped template fields (replicas, cpu, memoryMiB, port, …)
  sources: SourceRef[];
  confidence: 'high' | 'medium' | 'low';
}

Using the engine in Node.jsCopy Anchor Link

The WebAssembly build is packaged as @orkstage/scan. You build it from the cli/ folder with scripts/build-wasm.sh. It is not published to a registry yet.

const { scanFiles, version } = require('@orkstage/scan');
const report = scanFiles([{ path: 'main.tf', content }], { templateName: 'shop' });

scanFiles(files, options?) is synchronous and does no I/O. The options are templateName, displayName, templateVersion and maxFileBytes.