infraweaver 0.1.0

package/dist/mcp/terraform/azurePrices.d.ts

@@ -0,0 +1,8 @@
+/** Region these list prices were captured for. */
+export declare const AZURE_PRICE_REGION = "westeurope";
+/** Currency of every price below. */
+export declare const AZURE_PRICE_CURRENCY = "EUR";
+/** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
+export declare const AZURE_PRICE_FETCHED_AT = "2026-07-25";
+/** meter key → list price per HOUR. */
+export declare const AZURE_HOURLY_PRICES: Record<string, number>;

package/dist/mcp/terraform/baseline.d.ts

@@ -0,0 +1,57 @@
+import { type Concern, type Severity } from "#app/mcp/terraform/types";
+export declare const BASELINE_FILENAME = ".infraweaver.baseline.json";
+/** Findings at/above this severity fail the gate. High = high + critical. */
+export declare const DEFAULT_GATE_SEVERITY: Severity;
+export interface BaselineFile {
+    version: 1;
+    /** ISO date the baseline was taken (informational). */
+    created?: string;
+    /** line-independent concern keys (see `concernKeyOf`) present at baseline time. */
+    keys: string[];
+}
+/** The serialized baseline for the current concern set (what a `--write-baseline` emits). */
+export declare function serializeBaseline(concerns: Concern[], created: string): BaselineFile;
+/** Parse baseline JSON into a key set; tolerant of a malformed/old file (→ null). */
+export declare function parseBaseline(raw: string): Set<string> | null;
+/** Load `.infraweaver.baseline.json` under `cwd`; null when absent/unreadable/malformed. */
+export declare function loadBaseline(cwd: string | undefined): Set<string> | null;
+export interface LoadedBaseline {
+    keys: Set<string>;
+    /** ISO date the baseline was taken — the report's "since baseline (…)" label. */
+    created: string | null;
+}
+/** Load the baseline WITH its `created` date (the report's delta needs both the
+ *  keys to diff against and the date to label the comparison). Null when
+ *  absent/unreadable/malformed. `loadBaseline` stays the keys-only path the gate uses. */
+export declare function loadBaselineWithMeta(cwd: string | undefined): LoadedBaseline | null;
+export interface BaselineDelta {
+    /** active keys NOT in the baseline — new since the checkpoint. */
+    added: number;
+    /** baseline keys no longer present — cleared since the checkpoint. */
+    fixed: number;
+    /** keys in both — carried, unchanged. */
+    unchanged: number;
+}
+/**
+ * The new / fixed / unchanged split of the current ACTIVE concern set against a
+ * baseline checkpoint, keyed line-independently (`concernKeyOf`) so a line shift
+ * never reads as a fix or a regression. Pure — the report's "what changed" line.
+ */
+export declare function baselineDelta(concerns: Concern[], baselineKeys: Set<string>): BaselineDelta;
+export interface GateResult {
+    /** active concerns whose key is NOT in the baseline (or all, when no baseline). */
+    newConcerns: Concern[];
+    /** the new concerns at/above the gate severity — these fail the check. */
+    gating: Concern[];
+    /** true = the gate passes (no new finding at/above the gate severity). */
+    pass: boolean;
+    /** whether a baseline was supplied (false ⇒ every active concern is "new"). */
+    hasBaseline: boolean;
+}
+/**
+ * Evaluate the gate. `concerns` should already be the ACTIVE set (suppressed
+ * concerns excluded — a suppression keeps a finding out of the gate by design).
+ * With no baseline (`baselineKeys` null) every active concern counts as new, so
+ * the gate behaves as a plain High/Critical gate.
+ */
+export declare function evaluateGate(concerns: Concern[], baselineKeys: Set<string> | null, threshold?: Severity): GateResult;

package/dist/mcp/terraform/concernResult.d.ts

@@ -0,0 +1,38 @@
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { annotateGroups, planBatches } from "#app/mcp/terraform/decisions";
+import { type Concern, type Severity } from "#app/mcp/terraform/types";
+export interface ConcernResult {
+    /** non-suppressed concerns ≥ threshold, sorted */
+    active: Concern[];
+    /** concerns that matched a suppression rule */
+    suppressed: Concern[];
+    /** active ∪ suppressed (post-suppression annotation) — scan stores this as lastScanConcerns */
+    annotated: Concern[];
+    groups: ReturnType<typeof annotateGroups>;
+    batchPlan: ReturnType<typeof planBatches>;
+    bySeverity: Record<string, number>;
+}
+/**
+ * The shared concerns→result pipeline behind `terraform_scan` and `read_findings`:
+ * capture the line-pinned + line-independent baseline (so verify's regression diff
+ * is apples-to-apples), filter to in-scope Terraform concerns ≥ threshold, apply
+ * suppressions, group + annotate autonomy, plan batches, and tally by severity.
+ * Both tools then wrap their own envelope around this. The diff-scope predicate is
+ * `scan`-only (defaults to "everything in scope"); `lastScanConcerns` is written by
+ * `scan` from `annotated`, not here, since `read_findings` does not set it.
+ */
+export declare function buildConcernResult(ctx: LocalToolContext, rawConcerns: Concern[], opts: {
+    cwd: string;
+    minRank: number;
+    grouping: "file" | "rule";
+    autonomyThreshold: Severity;
+    inScope?: (c: Concern) => boolean;
+    /** How this call affects the session's verify baseline. `replace` (default)
+     *  is for the full-workspace sources (`scan`, `read_findings`). The narrow
+     *  concern sources (`detect_plan_drift`, `ingest_external_findings`) pass
+     *  `merge`: their small set must JOIN an existing scan baseline, not clobber
+     *  it — otherwise a later `terraform_verify_remediation` diffs the full
+     *  re-scan against the narrow set and reports every pre-existing scanner
+     *  concern as a false regression. */
+    baselineMode?: "replace" | "merge";
+}): ConcernResult;

package/dist/mcp/terraform/cost.d.ts

@@ -0,0 +1,55 @@
+import { type RunResult } from "#app/mcp/terraform/subprocess";
+export interface CostBreakdown {
+    /** total estimated monthly cost, or null when no resources are priced. */
+    totalMonthlyCost: number | null;
+    currency: string;
+}
+/**
+ * Parse `infracost breakdown --format json`. The top-level `totalMonthlyCost`
+ * is a decimal string (absent / null when a project has no priced resources);
+ * `currency` defaults to USD. A missing/unparseable cost becomes null so the
+ * caller reports "unpriced" rather than a misleading $0.00.
+ */
+export declare function parseInfracostBreakdown(stdout: string): CostBreakdown;
+export interface ResourceCost {
+    name: string;
+    monthlyCost: number;
+}
+/**
+ * Parse the per-resource monthly costs from `infracost breakdown --format json`
+ * (`projects[].breakdown.resources[]`), so a cost increase can be attributed to
+ * the specific resources that drove it instead of just a total. Skips unpriced
+ * (null/zero) resources; returns them sorted most-expensive first. Pure.
+ */
+export declare function parseInfracostResources(stdout: string): ResourceCost[];
+export interface CostDelta {
+    currency: string;
+    baselineMonthly: number | null;
+    currentMonthly: number | null;
+    /** current − baseline, rounded to cents; null when either side is unknown. */
+    deltaMonthly: number | null;
+    direction: "increase" | "decrease" | "no-change" | "unknown";
+}
+/** Pure cost-delta computation: current (post-fix) vs the base-branch baseline. */
+export declare function computeCostDelta(baseline: CostBreakdown | null, current: CostBreakdown): CostDelta;
+export interface CostEscalation {
+    /** true when the monthly increase meets/exceeds the operator's threshold. */
+    escalate: boolean;
+    reason?: string;
+}
+/**
+ * decide whether a cost increase is large enough to escalate the PR
+ * to human review (`needs-human`). Compares the monthly delta against the
+ * operator's `cost_increase_block_usd` threshold. No threshold set, an unknown
+ * delta, or a decrease/no-change ⇒ no escalation. Pure + deterministic so the
+ * decision is auditable, not a model judgement.
+ */
+export declare function classifyCostEscalation(deltaMonthly: number | null, thresholdUsd: number | undefined): CostEscalation;
+export declare function runInfracostBreakdown(scanCwd: string, key: string): RunResult;
+/**
+ * Cost of the base-branch version of the same Terraform, computed in a detached
+ * git worktree so the current (fixed) checkout is never disturbed. Best-effort:
+ * any failure (no base ref, worktree add fails, infracost errors) returns null
+ * and the caller falls back to reporting current cost only.
+ */
+export declare function infracostBaseline(cwd: string, key: string, tmpdir: string): CostBreakdown | null;

package/dist/mcp/terraform/cspm.d.ts

@@ -0,0 +1,80 @@
+import { type Concern, type Severity } from "#app/mcp/terraform/types";
+declare const ExternalFinding: import("arktype/internal/variants/object.ts").ObjectType<{
+    rule_id: string;
+    provider?: string;
+    severity?: string;
+    title?: string;
+    message?: string;
+    remediation?: string;
+    resource?: {
+        address?: string;
+        type?: string;
+        name?: string;
+        id?: string;
+        arn?: string;
+        tags?: string[];
+    };
+}, {}>;
+export declare const ExternalFindingsFile: import("arktype/internal/variants/object.ts").ObjectType<{
+    schema?: string;
+    findings: {
+        rule_id: string;
+        provider?: string;
+        severity?: string;
+        title?: string;
+        message?: string;
+        remediation?: string;
+        resource?: {
+            address?: string;
+            type?: string;
+            name?: string;
+            id?: string;
+            arn?: string;
+            tags?: string[];
+        };
+    }[];
+}, {}>;
+export type ExternalFinding = typeof ExternalFinding.infer;
+/** True for a parsed object that looks like an external-findings feed (vs a SARIF or
+ *  reviewer findings.json), so a dispatcher can route it. */
+export declare function isExternalFindings(parsed: unknown): boolean;
+export interface TfResourceEntry {
+    /** `type.name` — the Terraform address of the block. */
+    address: string;
+    type: string;
+    name: string;
+    file: string;
+    /** 1-based line of the `resource "type" "name" {` header. */
+    line: number;
+    /** String-literal values inside the block body (bucket names, tags, ids) — the
+     *  values a CSPM alert's cloud id / ARN is correlated against. Lower-cased. */
+    identifiers: string[];
+}
+/** Build a line-aware index of every `resource` block across the given `.tf` files. */
+export declare function indexTfResources(files: ReadonlyArray<{
+    file: string;
+    hcl: string;
+}>): TfResourceEntry[];
+/** Correlate one external finding to a resource block, best key first. Returns the
+ *  matched entry, or null when the alert can't be tied to code. */
+export declare function matchResource(finding: ExternalFinding, index: TfResourceEntry[]): TfResourceEntry | null;
+/** Why an alert couldn't be mapped to a resource in code (for honest reporting). */
+export interface UnmappedFinding {
+    rule_id: string;
+    provider: string | null;
+    resource: ExternalFinding["resource"] | null;
+    reason: string;
+}
+export interface MappedExternalFindings {
+    concerns: Concern[];
+    unmapped: UnmappedFinding[];
+}
+/** Normalise an external severity string (word or numeric CVSS) to our scale. */
+export declare function normalizeExternalSeverity(raw: string | undefined): Severity;
+/**
+ * Turn a batch of external findings into `reviewer`-source concerns by mapping each
+ * to its Terraform resource. Unmappable alerts are returned separately so the caller
+ * can report them honestly rather than drop them.
+ */
+export declare function mapExternalFindings(findings: ReadonlyArray<ExternalFinding>, index: TfResourceEntry[]): MappedExternalFindings;
+export {};

package/dist/mcp/terraform/currency.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Version currency (provider currency / module upgrades).
+ *
+ * Answers one question the scanners can't: "is a NEWER version available?"
+ * tflint checks that versions are *pinned*; nothing we run checks that they're
+ * *current*. This module compares the workspace's pinned provider requirements
+ * and registry-module pins against the Terraform Registry's published versions.
+ *
+ * Deliberately NOT a scanner source: results are advisory intelligence the
+ * Remediate mode turns into `chore(deps)` upgrade PRs, not `Concern`s — the
+ * finding baseline stays scanner-owned (see docs/workplan/04-implementation-plan.md).
+ *
+ * Degrades green everywhere: a per-source lookup failure is reported on that
+ * row (`lookup: "error" | "not_found" | "unsupported_source"`), and only a
+ * fully-unreachable registry (every lookup failed) becomes a tool-level skip.
+ */
+export declare const DEFAULT_REGISTRY_BASE_URL = "https://registry.terraform.io";
+/**
+ * Convert ONE Terraform version constraint string (comma-separated comparators,
+ * AND semantics) into an npm semver range, or null when any comparator is
+ * unparseable. `~>` is Terraform's pessimistic operator: the RIGHTMOST given
+ * component may float (`~> 5.0` → `>=5.0.0 <6.0.0`, `~> 5.1.2` → `>=5.1.2 <5.2.0`,
+ * `~> 5` → `>=5.0.0 <6.0.0`). `!=` comparators have no single-range npm
+ * equivalent and are skipped — acceptable here because the result only ranks
+ * candidate versions, it never selects what gets installed.
+ */
+export declare function terraformConstraintToRange(constraint: string): string | null;
+export interface CurrencyVerdict {
+    /** newest stable version the registry publishes (null: nothing published). */
+    latest: string | null;
+    /** newest published version the written constraint admits (null: no
+     * constraint, unparseable constraint, or nothing satisfies). */
+    newestSatisfying: string | null;
+    /** true when the registry has a stable version the constraint does NOT admit
+     * — i.e. an upgrade PR is available. Always false without a constraint. */
+    outdated: boolean;
+    /** how many MAJORs the constraint's best version trails the latest by —
+     * >0 signals an interface-risk upgrade that must be `needs-human`. */
+    majorsBehind: number;
+}
+export declare function classifyCurrency(params: {
+    constraint: string | null;
+    available: string[];
+}): CurrencyVerdict;
+export type LookupStatus = "ok" | "not_found" | "error" | "unsupported_source";
+/** strip a leading default-registry host; reject other hosts (private/TFE
+ * registries use different auth + paths — out of scope for the public check). */
+export declare function normalizeRegistryPath(base: string, expectedSegments: number): string | null;
+/**
+ * One registry GET that returns parsed JSON or a per-lookup status. Shared by
+ * the version-currency lookups here and the registry module-detail/search
+ * lookups in `./registry.ts` so every registry call degrades green identically:
+ * 404 → `not_found`, network/non-2xx/parse failure → `error`. `headers` carries
+ * the `Authorization: Bearer …` token for a private-registry call (public default
+ * registry calls pass none).
+ */
+export declare function fetchRegistryJson(url: string, headers?: Record<string, string>): Promise<{
+    status: LookupStatus;
+    body: unknown;
+}>;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/** GET /v1/providers/{namespace}/{type}/versions — provider release list. */
+export declare function fetchProviderVersions(source: string, opts?: {
+    baseUrl?: string;
+}): Promise<{
+    status: LookupStatus;
+    versions: string[];
+}>;
+/** GET /v1/modules/{namespace}/{name}/{provider}/versions — registry-module
+ * release list (the response nests per-module records; the first is the
+ * requested module, the rest are dependency records we don't want). */
+export declare function fetchModuleVersions(sourceBase: string, opts?: {
+    baseUrl?: string;
+}): Promise<{
+    status: LookupStatus;
+    versions: string[];
+}>;
+export interface ProviderCurrencyRow {
+    name: string;
+    source: string;
+    constraint: string | null;
+    latest: string | null;
+    newest_satisfying: string | null;
+    outdated: boolean;
+    majors_behind: number;
+    lookup: LookupStatus;
+}
+export interface ModuleCurrencyRow {
+    name: string;
+    source: string;
+    version: string | null;
+    latest: string | null;
+    newest_satisfying: string | null;
+    outdated: boolean;
+    /** registry module with no `version` attribute — pin it (to `latest`). */
+    unpinned: boolean;
+    lookup: LookupStatus;
+    declared_in: string;
+}
+export interface CurrencyReport {
+    providers: ProviderCurrencyRow[];
+    modules: ModuleCurrencyRow[];
+    outdated_count: number;
+    unpinned_count: number;
+    lookups_attempted: number;
+    lookups_failed: number;
+}
+export declare function checkVersionCurrency(cwd: string, opts?: {
+    baseUrl?: string;
+}): Promise<CurrencyReport>;

package/dist/mcp/terraform/decisions.d.ts

@@ -0,0 +1,178 @@
+import type { CostDelta } from "#app/mcp/terraform/cost";
+import { type Autonomy, type BlastTier, type Concern, type ConcernGroup, type Severity } from "#app/mcp/terraform/types";
+/** group concerns by file into scoped units, sorted by max severity. */
+export declare function groupConcerns(concerns: Concern[]): ConcernGroup[];
+/**
+ * group concerns by RULE across files instead of by file. When a single
+ * rule fires in many files ("add `tags` to every resource", "enable encryption
+ * on every bucket"), fixing it as ONE coherent change is far better than N
+ * near-identical per-file PRs. Each group covers one `rule_id` and lists every
+ * `file` it spans; the branch key (`remediate/<id>`) is rule-derived and stable.
+ * Opt-in (scan `group_by: "rule"`) — by-file stays the default because it keeps
+ * each PR's blast radius smaller; by-rule suits sweeping, low-risk rules.
+ */
+export declare function groupConcernsByRule(concerns: Concern[]): ConcernGroup[];
+/**
+ * annotate each group with an autonomy decision. Works for BOTH grouping
+ * modes: it resolves a group's concerns by `concern_ids` membership (not by
+ * `file`, which is just a label for by-rule groups), so the severity/category
+ * policy applies identically. Blast radius isn't known until terraform_plan
+ * runs, so it can only escalate a group later (the plan tool + prompt apply the
+ * `high`-blast override); at scan time autonomy is severity/category-driven.
+ */
+export declare function annotateGroups(groups: ConcernGroup[], all: Concern[], threshold: Severity): ConcernGroup[];
+export interface BatchPlan {
+    /** group ids safe to combine into ONE low-risk PR (`remediate/batch-<hash>`). */
+    batchable: string[];
+    /** group ids that must each get their own PR (security / higher severity /
+     * needs-human / large blast). */
+    isolated: string[];
+    /** deterministic branch name for the batch (stable for the same member set). */
+    batch_branch: string | null;
+}
+/**
+ * split annotated groups into a single low-risk BATCH (merged into one
+ * easy-to-review PR) and the riskier groups that each stay ISOLATED in their own
+ * PR (so they can be reviewed/reverted independently). The batch branch name
+ * hashes the sorted member ids, so re-runs over the same set reuse the branch
+ * (idempotent). Returns `batch_branch: null` when fewer than two groups are
+ * batchable (one group is just a normal single-group PR, not a batch).
+ */
+export declare function planBatches(groups: ConcernGroup[]): BatchPlan;
+/**
+ * Resolve the canonical documentation URL for a concern's rule, for the PR's
+ * per-finding explanation. Prefers the scanner's own `remediation_hint` when it
+ * is already a URL (checkov guideline, tflint rule link, trivy reference).
+ * Otherwise derives the well-known page deterministically: a trivy `AVD-*` rule
+ * maps to its Aqua Vulnerability Database page. Returns null when no canonical
+ * URL is known (the agent then explains from `evidence` alone).
+ */
+export declare function ruleDocUrl(concern: Pick<Concern, "rule_id" | "remediation_hint">): string | null;
+/** distinct rule→doc-url map for a group, for the PR body's per-finding links. */
+export declare function docUrlsForGroup(g: ConcernGroup, all: Concern[]): Record<string, string>;
+export interface AutonomyDecision {
+    autonomy: Autonomy;
+    /** human-readable reasons a group was escalated (empty for `auto`). */
+    reasons: string[];
+}
+/**
+ * Decide whether a group of concerns can be auto-fixed and opened as a normal
+ * PR (`auto`), or must be flagged for human review (`needs-human`). Trivial
+ * findings (style/correctness, deprecated args, missing tags, formatting) open
+ * as normal; high-severity SECURITY findings escalate by default, as does a
+ * `high` blast radius regardless of finding severity (overrides upward).
+ *
+ * `threshold` is the minimum severity at which a *security* concern escalates
+ * (default `high`, so critical/high security → human; medium/low → auto). The
+ * decision is deterministic and computed from the `Concern` model's existing
+ * `severity` + `category` — no model self-assessment.
+ */
+export declare function classifyAutonomy(concerns: Pick<Concern, "severity" | "category">[], threshold?: Severity, blastTier?: BlastTier): AutonomyDecision;
+export interface SuggestionDecision {
+    /** true ⇒ post a GitHub one-click `suggestion` instead of opening a full PR. */
+    suggest: boolean;
+    reason: string;
+}
+/**
+ * decide whether a fix is small/low-risk enough to post as a GitHub
+ * one-click **suggested change** (a ` ```suggestion ` block on the existing PR)
+ * rather than opening a whole `remediate/*` branch + PR. Much lower friction for
+ * trivial fixes. Only when ALL hold: there IS an existing PR context (a comment
+ * trigger on a PR); the group is `low`/`info` severity; the fix is a single hunk
+ * in a single file; and the blast radius (when known) is `low`. Anything bigger
+ * keeps full-PR mode.
+ */
+export declare function shouldSuggestInline(opts: {
+    hasPrContext: boolean;
+    severity: Severity;
+    fileCount: number;
+    hunkCount: number;
+    blastTier?: BlastTier | undefined;
+}): SuggestionDecision;
+export type Confidence = "high" | "medium" | "low";
+export interface ConfidenceSignals {
+    /** every targeted concern id was cleared by the re-scan. */
+    verified: boolean;
+    /** count of NEW concern ids the fix introduced (0 is good). */
+    regressionCount: number;
+    /** second plan matched the first. undefined when plan didn't run. */
+    idempotent?: boolean | undefined;
+    /** blast tier. undefined when plan didn't run. */
+    blastTier?: BlastTier | undefined;
+    /** cost direction. undefined when infracost didn't run. */
+    costDirection?: CostDelta["direction"] | undefined;
+}
+export interface ConfidenceResult {
+    level: Confidence;
+    reasons: string[];
+}
+/**
+ * Derive a fix's confidence DETERMINISTICALLY from the verification evidence
+ * already gathered — never a model self-assessment, which keeps it honest.
+ *
+ * - A fix that didn't verify or introduced a regression is `low`:
+ *   the proof failed, full stop.
+ * - Otherwise it starts `high` and is capped to `medium` by any weaker signal:
+ *   a non-deterministic plan (`idempotent: false`), a `high` blast radius,
+ *   a cost increase, or a signal that was *skipped* (plan /
+ *   infracost didn't run, so we have less proof — `high` requires the full
+ *   stack). A skipped signal lowers confidence but does not, by itself, make a
+ *   verified, regression-free fix `low`.
+ */
+export declare function computeConfidence(signals: ConfidenceSignals): ConfidenceResult;
+export interface RefusalDecision {
+    /** true ⇒ this concern needs a human decision; prefer a structured non-fix
+     * (an issue) over guessing a fix that could break the stack. */
+    refuse: boolean;
+    reason?: string;
+}
+/**
+ * advisory check: would auto-fixing this concern require a judgement only
+ * a human can make? If so, the Remediate flow should post a STRUCTURED refusal
+ * (an issue describing the concern, why it won't auto-fix, and what a human
+ * should do) rather than guess a fix that could break the stack. Deterministic
+ * and conservative — it only flags the well-known human-decision classes.
+ */
+export declare function classifyRefusal(concern: Pick<Concern, "rule_id" | "evidence">): RefusalDecision;
+/**
+ * format a structured non-fix for a concern Infraweaver won't auto-fix. The
+ * output is a Markdown issue body: what's wrong, why it isn't auto-fixed, and
+ * the concrete next step for a human. Pure (string in → string out).
+ */
+export declare function buildRefusalReport(input: {
+    concern: Pick<Concern, "rule_id" | "evidence" | "location">;
+    whyNoAutoFix: string;
+    humanAction: string;
+}): string;
+export interface PreventiveControl {
+    /** the mechanism that stops this class of concern recurring. */
+    mechanism: string;
+    /** a copy-pasteable config/CI snippet. */
+    snippet: string;
+    note: string;
+}
+/**
+ * alongside the patch, suggest the guardrail that stops the concern
+ * RECURRING: a CI gate keyed on the producing scanner. Deterministic by source
+ * (the scanner is the right enforcement point), parameterised by the rule id.
+ * Returns null for sources with no natural preventive gate.
+ */
+export declare function preventiveControlFor(concern: Pick<Concern, "source" | "rule_id">): PreventiveControl | null;
+export interface LocationCluster {
+    file: string;
+    line: number | null;
+    /** the concern ids at this exact location (likely the same underlying defect). */
+    concern_ids: string[];
+    /** the distinct scanners that flagged this location. */
+    sources: string[];
+}
+/**
+ * surface concerns that DIFFERENT scanners flagged at the same `file:line`
+ * — almost always the same underlying defect (trivy ∩ checkov overlap heavily on
+ * e.g. S3 encryption). Reported so the agent writes ONE canonical fix + ONE
+ * explanation for the cluster rather than treating each as separate work. This
+ * is purely advisory: it NEVER removes a concern from the verification set (a
+ * missing id must still provably clear), so it can't drop a real finding. Only
+ * clusters spanning more than one scanner are returned.
+ */
+export declare function clusterByLocation(concerns: Concern[]): LocationCluster[];

package/dist/mcp/terraform/eidas.d.ts

@@ -0,0 +1,100 @@
+/**
+ * §5.16 (first half) — the eIDAS assurance-level declaration.
+ *
+ * WHAT PROBLEM THIS SOLVES TODAY. The evidence bundle carries
+ * `signature: { algorithm: "ed25519", … }`, and a reader in a procurement or
+ * audit context can very reasonably over-read that as a legal seal. Under
+ * eIDAS (Reg. (EU) 910/2014 as amended by 2024/1183) an *electronic seal* is a
+ * defined legal instrument with three tiers, and ours is at the bottom one:
+ *
+ *   - **simple** — data attached to other data to ensure origin and integrity.
+ *     A raw Ed25519 signature over the bytes is exactly this, and no more.
+ *   - **advanced** (Art. 36) — additionally uniquely linked to, and capable of
+ *     identifying, the creating legal person, using seal-creation data that
+ *     person controls. That requires a certificate binding the key to an
+ *     identity; a bare public key in a JSON file binds it to nobody.
+ *   - **qualified** (Art. 35) — an advanced seal created by a qualified
+ *     seal-creation device with a **qualified certificate** from a QTSP on the
+ *     EU Trusted List. Only this tier gets the Art. 35(2) presumption of
+ *     integrity and correctness of origin.
+ *
+ * Art. 41's qualified electronic **time stamp** is a separate qualified service
+ * again, and is what gives a presumption about the *date and time*.
+ *
+ * SO THE BUNDLE SAYS SO, IN MACHINE-READABLE FORM. This block is not a
+ * disclaimer in prose that a parser skips — it is a field with a closed
+ * vocabulary, inside the signed bytes, that a buyer's tooling can assert on.
+ * Declaring a limit precisely is worth more than implying a capability we do
+ * not have, and this is the same correction the `suppressions` block made: the
+ * human-readable report and the signed artifact must not disagree about what a
+ * claim covers.
+ *
+ * ⚠️ WHAT IS DELIBERATELY NOT HERE. No ASiC-E container, no CAdES-LTA, no
+ * RFC 3161 timestamping, no QTSP integration. Those are the rest of §5.16 and
+ * they are blocked on a commercial and legal step — onboarding with a qualified
+ * trust service provider — that has not started. Building seal machinery we
+ * cannot exercise against a real QTSP would produce artifacts nobody can
+ * verify, and in an attestation product an unverifiable seal is worse than no
+ * seal. What this module does instead is make the CURRENT claim exact, and give
+ * the future qualified seal a schema slot to land in without a breaking change:
+ * `level` gains `"advanced"` / `"qualified"` and the optional fields fill in.
+ *
+ * Pure — no I/O, no ambient reads.
+ */
+import type { SignatureMetadata } from "#app/mcp/terraform/signing";
+/**
+ * The eIDAS electronic-seal tier this bundle's signature actually reaches.
+ * A closed vocabulary so a consumer can branch on it rather than parse prose.
+ *
+ * `"none"` is distinct from `"simple"` and is not a synonym for it: an unsigned
+ * bundle has no integrity protection at all, whereas a `"simple"` seal really
+ * does prove the bytes have not changed. Collapsing the two would understate a
+ * signed bundle and overstate an unsigned one.
+ */
+export type EidasSealLevel = "none" | "simple" | "advanced" | "qualified";
+export interface EidasSeal {
+    level: EidasSealLevel;
+    /** the precise claim this level supports. */
+    asserts: string;
+    /** the claim a reader might infer that this level does NOT support. Always
+     *  present — the whole point of the block is the second half. */
+    does_not_assert: string;
+    /**
+     * True only for `"qualified"`: whether Art. 35(2)'s presumption of integrity
+     * and of correctness of origin applies. Stated explicitly rather than left to
+     * be inferred from `level`, because that presumption is the entire commercial
+     * difference between the tiers.
+     */
+    eu_presumption: boolean;
+    /**
+     * The qualified trust service provider that issued the seal certificate, and
+     * its EU Trusted List entry. Absent until §5.16's QTSP onboarding completes —
+     * and its absence is itself the honest signal that no QTSP is involved.
+     */
+    qtsp?: {
+        name: string;
+        trusted_list_url: string;
+    };
+    /** Art. 41 qualified electronic time stamp, when one has been obtained.
+     *  Absent today: we apply no timestamp of any kind, qualified or not. */
+    timestamp?: {
+        authority: string;
+        obtained_at: string;
+        token_path: string;
+    };
+}
+/**
+ * Declare the eIDAS assurance level for a bundle, from its signature metadata.
+ *
+ * Derived from what is actually present rather than configured, so the
+ * declaration cannot drift from reality: there is no input that makes an
+ * unsigned bundle claim a seal, and no way to assert `qualified` without the
+ * QTSP fields that do not yet exist.
+ */
+export declare function eidasSealFor(signature: SignatureMetadata | null): EidasSeal;
+/**
+ * Whether a level may claim the Art. 35(2) presumption. Only `"qualified"` may,
+ * and today nothing produces that level — this exists so the invariant is
+ * asserted in one place rather than re-derived when the QTSP work lands.
+ */
+export declare function grantsEuPresumption(level: EidasSealLevel): boolean;