infraweaver 0.1.0

package/src/utils/timer.ts

@@ -0,0 +1,72 @@
+import { performance } from "node:perf_hooks";
+import { log } from "#app/utils/cli";
+
+export class Timer {
+  private initialTimestamp: number;
+  private lastCheckpointTimestamp: number | null = null;
+
+  constructor() {
+    this.initialTimestamp = performance.now();
+  }
+
+  checkpoint(name: string): void {
+    const now = performance.now();
+    const duration = this.lastCheckpointTimestamp
+      ? now - this.lastCheckpointTimestamp
+      : now - this.initialTimestamp;
+
+    log.debug(`» ${name}: ${duration}ms`);
+    this.lastCheckpointTimestamp = now;
+  }
+}
+
+const THINKING_THRESHOLD = 3000; // ms
+
+/**
+ * Measures wall-clock gap between the last tool_result and the next tool_call,
+ * surfacing it as a "thought for Xs" log when over `THINKING_THRESHOLD`.
+ *
+ * Use one instance per logical session (orchestrator, each subagent) — sharing
+ * a single timer across sessions conflates cross-session interleaving as
+ * thinking time. The optional `formatLine` lets the caller prefix output with
+ * a session label so attribution is visible in the merged log stream.
+ */
+export class ThinkingTimer {
+  private readonly durationFormatter = new Intl.NumberFormat("en-US", {
+    style: "unit",
+    unit: "second",
+    unitDisplay: "long",
+    minimumFractionDigits: 0,
+    maximumFractionDigits: 1,
+  });
+
+  private lastToolResultTimestamp: number | null = null;
+  private readonly formatLine: (line: string) => string;
+
+  // node's native TS strip-only mode does not support parameter properties,
+  // so the formatter is declared as a field and assigned in the body.
+  constructor(formatLine: (line: string) => string = (l) => l) {
+    this.formatLine = formatLine;
+  }
+
+  markToolResult(): void {
+    this.lastToolResultTimestamp = performance.now();
+    log.debug(
+      this.formatLine(`» thinking timer: markToolResult at ${this.lastToolResultTimestamp}`),
+    );
+  }
+
+  markToolCall(): void {
+    const now = performance.now();
+    log.debug(
+      this.formatLine(
+        `» thinking timer: markToolCall at ${now}, lastToolResult=${this.lastToolResultTimestamp}`,
+      ),
+    );
+    if (this.lastToolResultTimestamp === null) return;
+    const elapsed = now - this.lastToolResultTimestamp;
+    if (elapsed < THINKING_THRESHOLD) return;
+    const seconds = elapsed / 1000;
+    log.info(this.formatLine(`» thought for ${this.durationFormatter.format(seconds)}`));
+  }
+}

package/src/utils/todoTracking.ts

@@ -0,0 +1,168 @@
+import { UPLOADS_URL } from "#app/brand";
+import { log } from "#app/utils/log";
+
+type TodoItem = {
+  id: string;
+  content: string;
+  status: "pending" | "in_progress" | "completed" | "cancelled";
+};
+
+function isValidTodoStatus(value: string): value is TodoItem["status"] {
+  return (
+    value === "pending" || value === "in_progress" || value === "completed" || value === "cancelled"
+  );
+}
+
+function parseTodowriteInput(input: unknown): { todos: unknown[]; merge: boolean } | undefined {
+  if (!input || typeof input !== "object" || !("todos" in input)) return undefined;
+  if (!Array.isArray(input.todos)) return undefined;
+  const merge = "merge" in input && input.merge === true;
+  return { todos: input.todos, merge };
+}
+
+function parseTodoItem(entry: unknown, index: number): TodoItem | undefined {
+  if (!entry || typeof entry !== "object") return undefined;
+  if (!("content" in entry) || typeof entry.content !== "string") return undefined;
+  const id = "id" in entry && typeof entry.id === "string" ? entry.id : String(index);
+  const status =
+    "status" in entry && typeof entry.status === "string" && isValidTodoStatus(entry.status)
+      ? entry.status
+      : "pending";
+  return { id, content: entry.content, status };
+}
+
+function renderTodoMarkdown(todos: TodoItem[]): string {
+  return todos
+    .map((todo) => {
+      switch (todo.status) {
+        case "completed":
+          return `- [x] ${todo.content}`;
+        case "cancelled":
+          return `- ~~${todo.content}~~`;
+        case "in_progress":
+          return `- [ ] <img src="${UPLOADS_URL}/Progress%20Indicator.gif"  width="11" style="visibility: visible; max-width: 100%;" />  ${todo.content}`;
+        case "pending":
+          return `- [ ] ${todo.content}`;
+        default:
+          todo.status satisfies never;
+          return `- [ ] ${todo.content}`;
+      }
+    })
+    .join("\n");
+}
+
+export type TodoTracker = {
+  update: (input: unknown) => void;
+  flush: () => Promise<void>;
+  cancel: () => void;
+  /** resolves when any in-flight onUpdate call completes */
+  settled: () => Promise<void>;
+  /** mark in-progress items as completed (for final snapshot before review/progress post) */
+  completeInProgress: () => void;
+  renderCollapsible: (options?: { completeInProgress?: boolean }) => string;
+  readonly enabled: boolean;
+  /** true after the tracker has successfully called onUpdate at least once */
+  readonly hasPublished: boolean;
+};
+
+const DEBOUNCE_MS = 2000;
+
+export function createTodoTracker(onUpdate: (body: string) => Promise<void>): TodoTracker {
+  const state = new Map<string, TodoItem>();
+  let enabled = true;
+  let hasPublished = false;
+  let debounceTimer: ReturnType<typeof setTimeout> | null = null;
+  let inflightPromise: Promise<void> = Promise.resolve();
+
+  function scheduleUpdate() {
+    if (!enabled) return;
+    if (debounceTimer) clearTimeout(debounceTimer);
+    debounceTimer = setTimeout(() => {
+      debounceTimer = null;
+      if (!enabled || state.size === 0) return;
+      const markdown = renderTodoMarkdown(Array.from(state.values()));
+      inflightPromise = inflightPromise
+        .then(async () => {
+          if (!enabled) return;
+          await onUpdate(markdown);
+          hasPublished = true;
+        })
+        .catch((err) => {
+          log.debug(`todo progress update failed: ${err}`);
+        });
+    }, DEBOUNCE_MS);
+  }
+
+  return {
+    update(input: unknown) {
+      if (!enabled) return;
+      const parsed = parseTodowriteInput(input);
+      if (!parsed) return;
+      if (!parsed.merge) state.clear();
+      for (const [index, entry] of parsed.todos.entries()) {
+        const item = parseTodoItem(entry, index);
+        if (item) state.set(item.id, item);
+      }
+      log.debug(`» todowrite: ${state.size} items tracked`);
+      scheduleUpdate();
+    },
+
+    async flush() {
+      if (debounceTimer) {
+        clearTimeout(debounceTimer);
+        debounceTimer = null;
+      }
+      if (!enabled || state.size === 0) return;
+      const markdown = renderTodoMarkdown(Array.from(state.values()));
+      inflightPromise = inflightPromise
+        .then(async () => {
+          if (!enabled) return;
+          await onUpdate(markdown);
+          hasPublished = true;
+        })
+        .catch((err) => {
+          log.debug(`todo progress flush failed: ${err}`);
+        });
+      await inflightPromise;
+    },
+
+    cancel() {
+      enabled = false;
+      if (debounceTimer) {
+        clearTimeout(debounceTimer);
+        debounceTimer = null;
+      }
+    },
+
+    async settled() {
+      await inflightPromise;
+    },
+
+    completeInProgress() {
+      for (const item of state.values()) {
+        if (item.status === "in_progress") item.status = "completed";
+      }
+    },
+
+    renderCollapsible(options?: { completeInProgress?: boolean }): string {
+      if (state.size === 0) return "";
+      const shouldCompleteInProgress = options?.completeInProgress === true;
+      const todos = Array.from(state.values()).map((item) =>
+        shouldCompleteInProgress && item.status === "in_progress"
+          ? { ...item, status: "completed" as const }
+          : item,
+      );
+      const completed = todos.filter((t) => t.status === "completed").length;
+      const markdown = renderTodoMarkdown(todos);
+      return `<details>\n<summary>Task list (${completed}/${todos.length} completed)</summary>\n\n${markdown}\n\n</details>`;
+    },
+
+    get enabled() {
+      return enabled;
+    },
+
+    get hasPublished() {
+      return hasPublished;
+    },
+  };
+}

package/src/utils/token.ts

@@ -0,0 +1,294 @@
+import assert from "node:assert/strict";
+import * as core from "@actions/core";
+import type { PushPermission } from "#app/external";
+import { log } from "#app/utils/cli";
+import { onExitSignal } from "#app/utils/exitHandler";
+import {
+  acquireNewToken,
+  type OidcCreds,
+  readOidcCreds,
+} from "#app/utils/github";
+import { isGitHubActions } from "#app/utils/globals";
+import { stashKeylessOidcCreds } from "#app/utils/keylessOidc";
+
+// re-export for `infraweaver gha token` subcommand
+export {
+  acquireNewToken as acquireInstallationToken,
+  revokeGitHubInstallationToken as revokeInstallationToken,
+};
+
+// store MCP token in memory for getGitHubInstallationToken()
+let mcpTokenValue: string | undefined;
+
+// single-flight refresher for the MCP installation token, installed by
+// resolveTokens when OIDC re-minting is possible. createOctokit calls it on a
+// 401 to swap in a fresh token mid-run (pullfrog #891). undefined off-CI, on the
+// external-GH_TOKEN path, or once tokens are disposed.
+let refreshMcpTokenFn: ((stale: string) => Promise<string>) | undefined;
+
+/** The live MCP-token refresher (see {@link refreshMcpTokenFn}), or undefined
+ *  when re-minting isn't possible. Passed into `createOctokit` as `refreshAuth`. */
+export function getMcpTokenRefresh():
+  | ((stale: string) => Promise<string>)
+  | undefined {
+  return refreshMcpTokenFn;
+}
+
+/**
+ * get the job-scoped token from action input.
+ * this token has permissions defined by the workflow's permissions block.
+ *
+ * fallback order:
+ * 1. INPUT_TOKEN (from workflow `with: token:`)
+ * 2. GH_TOKEN (external token override)
+ * 3. GITHUB_TOKEN (pre-acquired in tests or from GHA env)
+ */
+export function getJobToken(): string {
+  const inputToken = core.getInput("token");
+  if (inputToken) {
+    return inputToken;
+  }
+
+  // fallback for test environment and local dev
+  const fallbackToken = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+  if (fallbackToken) {
+    return fallbackToken;
+  }
+
+  throw new Error("token input is required");
+}
+
+export type TokenRef = {
+  /** Read live via the getter below: after a mid-run re-mint (`refreshGitToken`
+   *  recovers an auth-class push 401 with a fresh token, revoking the old one),
+   *  this reflects the CURRENT git token. Push-class tools (push_branch,
+   *  push_tags, delete_branch, git_fetch) that read it per call therefore never
+   *  reuse a stale/revoked snapshot. Mirrors the `getMcpTokenRefresh` /
+   *  `githubInstallationToken` live-getter pattern (pullfrog #891/#964). */
+  gitToken: string;
+  mcpToken: string;
+  /** single-flight re-mint of the git token, threaded into pushWithRetry so an
+   *  auth-class push 401 can recover with a fresh token (pullfrog #972). undefined
+   *  when re-minting isn't possible (off-CI or external GH_TOKEN). */
+  refreshGitToken?: (stale: string) => Promise<string>;
+  [Symbol.asyncDispose]: () => Promise<void>;
+};
+
+type ResolveTokensParams = {
+  push: PushPermission;
+};
+
+/**
+ * resolve tokens for the action run.
+ *
+ * creates two separate tokens:
+ * - gitToken: contents permission based on `push` setting (assumed exfiltratable)
+ *   - push: enabled → contents:write (can push)
+ *   - push: disabled → contents:read (read-only)
+ * - mcpToken: full installation token - used for GitHub API calls in MCP tools (not exfiltratable)
+ *
+ * security-conscious users can pass their own token via GH_TOKEN env var or inputs.token.
+ */
+export async function resolveTokens(
+  params: ResolveTokensParams,
+): Promise<TokenRef> {
+  assert(!mcpTokenValue, "tokens are already resolved");
+
+  const externalToken = process.env.GH_TOKEN;
+
+  // external token takes precedence - use for both git and MCP
+  if (externalToken) {
+    mcpTokenValue = externalToken;
+
+    if (isGitHubActions) {
+      core.setSecret(externalToken);
+    }
+
+    log.info("» using external GH_TOKEN for both git and MCP");
+
+    return {
+      gitToken: externalToken,
+      mcpToken: externalToken,
+      async [Symbol.asyncDispose]() {
+        mcpTokenValue = undefined;
+        // GH_TOKEN isn't acquired here, so it's not revoked here either
+      },
+    };
+  }
+
+  // create git token based on push permission (assumed exfiltratable)
+  // disabled = read-only, restricted/enabled = write (MCP tools enforce branch restrictions)
+  // workflows permission is write-only in the API, so only requested when pushing is allowed
+  const gitPermissions =
+    params.push === "disabled"
+      ? { contents: "read" as const }
+      : { contents: "write" as const, workflows: "write" as const };
+  let currentGitToken = await acquireNewToken({ permissions: gitPermissions });
+  if (isGitHubActions) {
+    core.setSecret(currentGitToken);
+  }
+  log.info(
+    `» acquired git token (${Object.entries(gitPermissions)
+      .map((e) => e.join(":"))
+      .join(", ")})`,
+  );
+
+  // MCP token scoped to only what MCP tools actually need.
+  // not exfiltratable (only accessible via MCP tools), but scoped as defense-in-depth
+  // so even a compromised tool context can't touch secrets, admin, etc.
+  const mcpPermissions = {
+    contents: "write",
+    pull_requests: "write",
+    issues: "write",
+    checks: "read",
+    actions: "read",
+  } as const;
+  let currentMcpToken = await acquireNewToken({ permissions: mcpPermissions });
+  if (isGitHubActions) {
+    core.setSecret(currentMcpToken);
+  }
+  log.info(
+    `» acquired scoped MCP token (${Object.entries(mcpPermissions)
+      .map((e) => e.join(":"))
+      .join(", ")})`,
+  );
+
+  mcpTokenValue = currentMcpToken;
+
+  // Stash the OIDC creds NOW — resolveTokens runs before main.ts scrubs the
+  // ACTIONS_ID_TOKEN_REQUEST_* env vars (in every shell mode), so without this the
+  // refreshers below couldn't re-mint mid-run. undefined off-CI (local GitHub-App
+  // path) → no refresher, which is fine: re-mint is a CI replication-lag cure.
+  const oidc: OidcCreds | undefined = readOidcCreds();
+  // Feed the same snapshot to keyless (Sigstore) evidence signing, which runs
+  // later in the agent loop after these env vars are scrubbed. No-op off-CI.
+  stashKeylessOidcCreds(oidc);
+
+  // Single-flight re-minters (pullfrog #891/#972). Each coalesces concurrent
+  // callers on the same stale token: a caller holding an already-superseded token
+  // gets the current one without minting, and only the first caller of a given
+  // stale token triggers acquireNewToken. The memo clears in `finally` so a
+  // transient mint failure doesn't permanently poison the run.
+  let gitRefreshPromise: Promise<string> | undefined;
+  const refreshGitToken = oidc
+    ? (stale: string): Promise<string> => {
+        assert(mcpTokenValue, "tokens already disposed");
+        if (stale !== currentGitToken) return Promise.resolve(currentGitToken);
+        gitRefreshPromise ??= acquireNewToken({
+          permissions: gitPermissions,
+          oidc,
+        })
+          .then((fresh) => {
+            if (isGitHubActions) core.setSecret(fresh);
+            const superseded = currentGitToken;
+            currentGitToken = fresh;
+            void revokeGitHubInstallationToken(superseded);
+            log.warning(
+              "» GitHub rejected the git token; re-acquired a fresh installation token",
+            );
+            return fresh;
+          })
+          .finally(() => {
+            gitRefreshPromise = undefined;
+          });
+        return gitRefreshPromise;
+      }
+    : undefined;
+
+  let mcpRefreshPromise: Promise<string> | undefined;
+  refreshMcpTokenFn = oidc
+    ? (stale: string): Promise<string> => {
+        assert(mcpTokenValue, "tokens already disposed");
+        if (stale !== currentMcpToken) return Promise.resolve(currentMcpToken);
+        mcpRefreshPromise ??= acquireNewToken({
+          permissions: mcpPermissions,
+          oidc,
+        })
+          .then((fresh) => {
+            if (isGitHubActions) core.setSecret(fresh);
+            const superseded = currentMcpToken;
+            currentMcpToken = fresh;
+            mcpTokenValue = fresh;
+            void revokeGitHubInstallationToken(superseded);
+            log.warning(
+              "» GitHub rejected the MCP token; re-acquired a fresh installation token",
+            );
+            return fresh;
+          })
+          .finally(() => {
+            mcpRefreshPromise = undefined;
+          });
+        return mcpRefreshPromise;
+      }
+    : undefined;
+
+  let disposingRef: PromiseWithResolvers<void> | undefined;
+
+  const dispose = async () => {
+    if (disposingRef) {
+      // this can happen if the signal arrives when disposing tokens
+      // we make sure to wait for the current dispose to complete
+      return disposingRef.promise;
+    }
+    disposingRef = Promise.withResolvers();
+    try {
+      mcpTokenValue = undefined;
+      refreshMcpTokenFn = undefined;
+      // revoke the freshest tokens (a re-mint already revoked any superseded one)
+      await Promise.all([
+        revokeGitHubInstallationToken(currentGitToken),
+        revokeGitHubInstallationToken(currentMcpToken),
+      ]);
+    } finally {
+      removeSignalHandler();
+      disposingRef.resolve();
+      disposingRef = undefined;
+    }
+  };
+
+  const removeSignalHandler = onExitSignal(dispose);
+
+  return {
+    // live getter (not a captured value): a mid-run re-mint advances
+    // `currentGitToken` and revokes the prior one, so any consumer that reads
+    // `tokenRef.gitToken` per call always sees the fresh token. see #964.
+    get gitToken() {
+      return currentGitToken;
+    },
+    mcpToken: currentMcpToken,
+    ...(refreshGitToken ? { refreshGitToken } : {}),
+    [Symbol.asyncDispose]: dispose,
+  };
+}
+
+/**
+ * get the MCP token from memory.
+ * this is the token used for GitHub API calls in MCP tools.
+ */
+export function getGitHubInstallationToken(): string {
+  assert(mcpTokenValue, "tokens not set. call resolveTokens first.");
+  return mcpTokenValue;
+}
+
+export async function revokeGitHubInstallationToken(
+  token: string,
+): Promise<void> {
+  const apiUrl = process.env.GITHUB_API_URL || "https://api.github.com";
+
+  try {
+    await fetch(`${apiUrl}/installation/token`, {
+      method: "DELETE",
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token}`,
+        "X-GitHub-Api-Version": "2022-11-28",
+      },
+      signal: AbortSignal.timeout(10_000),
+    });
+    log.debug("» installation token revoked");
+  } catch (error) {
+    log.info(
+      `Failed to revoke installation token: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+}

package/src/utils/toolLicensing.ts

@@ -0,0 +1,152 @@
+/**
+ * Tool-licence classification (dependency posture; the "non-permissive-tool
+ * confirmation gate").
+ *
+ * Infraweaver ORCHESTRATES external tools — it never bundles or redistributes
+ * their binaries ("be an orchestrator, not a redistributor"). This module
+ * makes the licence of every selectable tool explicit so the engine can DEFAULT
+ * to the permissively-licensed tools and treat a non-permissive one (tflint's
+ * embedded BUSL Terraform fork, HashiCorp's terraform-mcp-server) as an
+ * *informed, named opt-in* rather than something whose output is consumed
+ * silently. Pure data + pure predicates — the gate that consumes it lives in
+ * [[toolSelection]].
+ */
+
+/** every external tool the engine can be configured to run. */
+export type ToolId =
+  | "terraform"
+  | "tflint"
+  | "trivy"
+  | "checkov"
+  | "infracost"
+  | "gitleaks"
+  | "conftest"
+  | "terratest"
+  | "terraform_mcp"
+  | "opentofu_mcp";
+
+/**
+ * Coarse licence family the gate reasons about:
+ *   - `permissive`     — MIT / Apache-2.0 / BSD / ISC: default-enabled.
+ *   - `copyleft`       — MPL / (L)GPL / AGPL: gated (explicit opt-in).
+ *   - `source-available` — BUSL / SSPL / Elastic: gated (explicit opt-in).
+ */
+export type LicenseClass = "permissive" | "copyleft" | "source-available";
+
+export interface ToolLicense {
+  id: ToolId;
+  /** display name for logs / PR notes. */
+  name: string;
+  /** human-facing SPDX-ish identifier (shown, never parsed). */
+  license: string;
+  class: LicenseClass;
+  /**
+   * The core Terraform CLI is the SUBSTRATE the engine cannot run without and
+   * which the operator installs themselves — invoking it is never
+   * redistribution. It is licence-classified for honesty (Terraform moved to
+   * BUSL-1.1 at v1.6) but EXEMPT from the opt-in gate, so a Terraform fixer
+   * always has Terraform.
+   */
+  required?: boolean;
+}
+
+/**
+ * The single source of truth for what each tool is licensed under. Verified
+ * against the "third-party dependency posture" note (June 2026). Keep in sync
+ * when a tool's licence changes (e.g. a vendor relicensing event).
+ */
+export const TOOL_LICENSES: Readonly<Record<ToolId, ToolLicense>> = {
+  terraform: {
+    id: "terraform",
+    name: "Terraform CLI",
+    license: "BUSL-1.1",
+    class: "source-available",
+    required: true,
+  },
+  // tflint is MPL-2.0, but it embeds a BUSL Terraform fork — flagged as the
+  // canonical "never bundle/redistribute; invoke as an external process" case.
+  tflint: {
+    id: "tflint",
+    name: "TFLint",
+    license: "MPL-2.0",
+    class: "copyleft",
+  },
+  trivy: {
+    id: "trivy",
+    name: "Trivy",
+    license: "Apache-2.0",
+    class: "permissive",
+  },
+  checkov: {
+    id: "checkov",
+    name: "Checkov",
+    license: "Apache-2.0",
+    class: "permissive",
+  },
+  infracost: {
+    id: "infracost",
+    name: "Infracost CLI",
+    license: "Apache-2.0",
+    class: "permissive",
+  },
+  gitleaks: {
+    id: "gitleaks",
+    name: "gitleaks",
+    license: "MIT",
+    class: "permissive",
+  },
+  conftest: {
+    id: "conftest",
+    name: "Conftest (OPA)",
+    license: "Apache-2.0",
+    class: "permissive",
+  },
+  terratest: {
+    id: "terratest",
+    name: "Terratest",
+    license: "Apache-2.0",
+    class: "permissive",
+  },
+  // HashiCorp's terraform-mcp-server, run as a Docker image — a redistribution-
+  // sensitive HashiCorp surface, so it is gated like tflint.
+  terraform_mcp: {
+    id: "terraform_mcp",
+    name: "terraform-mcp-server",
+    license: "MPL-2.0",
+    class: "copyleft",
+  },
+  // The OpenTofu project's registry MCP server — the permissively-preferred
+  // sibling to terraform-mcp-server (OpenTofu is the MPL fork; Terraform is BUSL).
+  // MPL-2.0 → gated as an explicit opt-in, same class as terraform_mcp. Reached
+  // as OpenTofu's own hosted endpoint (public registry data, no credentials), so
+  // there's no binary to redistribute — but kept behind the opt-in gate for
+  // parity and because it's an external network surface the operator chooses.
+  opentofu_mcp: {
+    id: "opentofu_mcp",
+    name: "opentofu-mcp-server",
+    license: "MPL-2.0",
+    class: "copyleft",
+  },
+} as const;
+
+export const ALL_TOOL_IDS = Object.keys(TOOL_LICENSES) as ToolId[];
+
+/** a permissively-licensed tool can be enabled by default; anything else needs
+ * an explicit, licence-named opt-in. */
+export function isPermissive(c: LicenseClass): boolean {
+  return c === "permissive";
+}
+
+/**
+ * A tool whose output must NOT be consumed without an explicit, licence-named
+ * opt-in: non-permissive AND not the required substrate. This is the predicate
+ * the confirmation gate is built on.
+ */
+export function isLicenseGated(id: ToolId): boolean {
+  const t = TOOL_LICENSES[id];
+  return !t.required && !isPermissive(t.class);
+}
+
+/** every tool currently behind the licence gate (for docs / reporting). */
+export const LICENSE_GATED_TOOLS: ToolId[] =
+  ALL_TOOL_IDS.filter(isLicenseGated);