infraweaver 0.1.0

package/dist/mcp/terraform/iacLanguages.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Multi-language IaC support for the READ-ONLY surfaces (Assess / SARIF /
+ * evidence). One honest principle throughout: **breadth never dilutes the moat**
+ * — trivy and checkov already parse these formats, so Assess widens to them, but
+ * Remediate stays Terraform-first (the `✗→✓` proof + equivalence machinery is
+ * Terraform-specific and is never faked for other formats; `terraform_scan` and
+ * the fix loop keep their Terraform-only filter).
+ *
+ * Everything here is verified against the scanners' actual support matrices
+ * (checkov 3.3.x `--framework` values; trivy 0.7x `--misconfig-scanners`), and
+ * the matrix below records per-language coverage HONESTLY — including what is
+ * NOT scannable (Pulumi programs have no credible static scanner: checkov never
+ * shipped one, trivy has none, and `pulumi preview` requires the engine + a
+ * backend). A detected-but-unscannable language is REPORTED as such, never
+ * silently dropped and never given fabricated findings.
+ */
+export declare const IAC_LANGUAGES: readonly ["terraform", "cloudformation", "kubernetes", "helm", "kustomize", "dockerfile", "arm", "bicep", "serverless", "ansible", "pulumi"];
+export type IacLanguage = (typeof IAC_LANGUAGES)[number];
+export declare const LANGUAGE_LABEL: Record<IacLanguage, string>;
+/**
+ * Which of the two multi-format scanners genuinely covers each language, with
+ * the caveat an operator must know. This is the single source of the honesty
+ * notes the scorecard prints — a language whose only covering scanner didn't
+ * run is a COVERAGE GAP, not a pass, and a language neither covers is reported
+ * `unsupported`, never scanned-and-silent.
+ */
+export declare const LANGUAGE_COVERAGE: Record<IacLanguage, {
+    trivy: boolean;
+    checkov: boolean;
+    note?: string;
+}>;
+/** The checkov `--framework` list for a scanned-language set (sorted, deduped).
+ *  Always includes terraform so the scanner invocation can never regress the
+ *  core product even on an empty/odd scope. Pure. */
+export declare function checkovFrameworksFor(scanned: readonly IacLanguage[]): string[];
+/** Map a trivy result `Type` to a language; null for types we don't model. Pure. */
+export declare function trivyTypeToLanguage(type: string | undefined): IacLanguage | null;
+/** Map a checkov block `check_type` to a language; null for types we don't model. Pure. */
+export declare function checkovTypeToLanguage(checkType: string | undefined): IacLanguage | null;
+/**
+ * Classify a file by path alone (no content). Returns the language, or
+ * "needs-content" for yaml/json whose kind is only knowable by sniffing, or null
+ * for a file that is no IaC we model. Pure.
+ */
+export declare function classifyByPath(path: string): IacLanguage | "needs-content" | null;
+/**
+ * Classify a yaml/json file by its content (first few KB). Conservative: only
+ * unmistakable markers classify; anything ambiguous returns null (better to
+ * under-detect than to claim coverage of a file no scanner will read). Pure.
+ */
+export declare function classifyByContent(path: string, content: string): IacLanguage | null;
+/**
+ * The language a concern belongs to, for scope filtering: the scanner-reported
+ * language when present, else a path-only classification (fmt/validate/tflint
+ * only ever fire on Terraform), else terraform (the historical default — a
+ * reviewer-loaded concern with an unknowable file stays in the core scope
+ * rather than vanishing). Pure.
+ */
+export declare function languageOfConcern(c: {
+    language?: IacLanguage | undefined;
+    location: {
+        file: string;
+    };
+}): IacLanguage;
+export interface DetectedLanguages {
+    /** every language present in the tree, most files first. */
+    detected: IacLanguage[];
+    /** file count per detected language (the scorecard's breadth line). */
+    fileCounts: Partial<Record<IacLanguage, number>>;
+}
+/**
+ * Walk the workspace and detect which IaC languages are present. Bounded (depth
+ * + file cap + skip dirs) and read-only; yaml/json files are sniffed from their
+ * first bytes only. Terraform is detected by extension; everything else by
+ * basename or unmistakable content markers. Pure-ish (read-only I/O).
+ */
+export declare function detectIacLanguages(cwd: string): DetectedLanguages;
+export interface LanguageScope {
+    /** the languages this run's read-only surfaces report on (scope ∩ scannable). */
+    scanned: IacLanguage[];
+    /** every language detected in the tree (superset of scanned + unsupported). */
+    detected: IacLanguage[];
+    fileCounts: Partial<Record<IacLanguage, number>>;
+    /** detected languages NO installed scanner can statically assess — surfaced,
+     * never silently dropped (e.g. pulumi). */
+    unsupported: {
+        language: IacLanguage;
+        reason: string;
+    }[];
+    /** iac_languages tokens that matched no known language (operator typo). */
+    unknown_tokens: string[];
+}
+/** membership test for the scope filter (terraform is always in scope). */
+export declare function inLanguageScope(scope: Pick<LanguageScope, "scanned">): (c: {
+    language?: IacLanguage | undefined;
+    location: {
+        file: string;
+    };
+}) => boolean;
+/**
+ * Resolve the operator's `iac_languages` setting against what the tree actually
+ * contains. `auto` (the default) scans every detected language a scanner can
+ * read; `terraform` restores the historical Terraform-only behaviour; a comma
+ * list pins an explicit set (terraform is always included — the core product is
+ * never configured away). Detected-but-unscannable languages land in
+ * `unsupported` with the honest reason. Pure given the detection result.
+ */
+export declare function resolveLanguageScope(raw: string | undefined, detection: DetectedLanguages): LanguageScope;
+/**
+ * Enforce the matrix's own honesty rule AGAINST the run's actual scanner
+ * outcomes: a language whose every covering scanner was skipped/disabled this
+ * run (e.g. `tools_enabled: "-checkov"` on a Bicep repo — Bicep is checkov-only)
+ * moves from `scanned` to `unsupported` with the reason, instead of being
+ * reported as scanned-clean-with-zero-findings. Terraform always stays: the
+ * native toolchain (fmt/validate/tflint) covers it regardless of trivy/checkov.
+ */
+export declare function applyScannerAvailability(scope: LanguageScope, ran: {
+    trivy: boolean;
+    checkov: boolean;
+}): LanguageScope;

package/dist/mcp/terraform/idleFloor.d.ts

@@ -0,0 +1,78 @@
+import type { TfResourceEntry } from "#app/mcp/terraform/cspm";
+/**
+ * Idle-floor detection (§5.19) — the resources that cost money at ZERO traffic.
+ *
+ * WHY THIS AND NOT A TOTAL. The hard part of plan-based cost estimation is not
+ * the pricing API, it is that usage-dependent lines (GB, requests, egress) are
+ * simply NOT derivable from Terraform. Any tool publishing a precise monthly
+ * total from a plan is guessing at the usage half. The idle floor is the portion
+ * that is deterministic — true regardless of traffic — so it is both the most
+ * defensible number we can publish and the most actionable one: an App Service
+ * Premium plan or an Azure Firewall bills the same whether or not anyone calls it.
+ *
+ * CREDENTIAL-FREE AND OFFLINE. Prices come from the bundled snapshot
+ * (`azurePrices.ts`, public Azure list prices captured at build time), so a scan
+ * makes no network call and needs no cloud credentials or pricing API key.
+ *
+ * FLOOR SEMANTICS — WE UNDER-CLAIM ON PURPOSE, AND NEVER GUESS A TIER. A
+ * resource is priced ONLY when its tier is identifiable from source AND is one
+ * this catalog carries. There is deliberately NO cheapest-tier fallback: every
+ * one of these resource types has a cheap or free tier (App Service `F1`/`B1`,
+ * Bastion `Developer`, a Basic VPN gateway, Basic Redis), so falling back would
+ * invent a charge for a resource that may cost nothing — the single failure mode
+ * that discredits the whole number. An unidentifiable tier is reported as an
+ * explicit coverage gap instead. A floor that is too low is honest; one that is
+ * too high is a number the customer can disprove.
+ */
+/** Billable hours per month — the 365×24/12 convention list prices assume. */
+export declare const HOURS_PER_MONTH = 730;
+/** One resource billing at zero traffic. */
+export interface IdleFloorItem {
+    /** `type.name` of the Terraform resource. */
+    address: string;
+    resourceType: string;
+    file: string;
+    line: number;
+    /** The rule that fired. */
+    rule_id: string;
+    why: string;
+    /** Meter key resolved from the bundled snapshot. */
+    meter: string;
+    monthly_cost: number;
+}
+/** A catalogued resource type whose tier could not be identified, so it was not
+ *  priced. Reported so the floor states exactly what it left out. */
+export interface UnpricedResource {
+    address: string;
+    resourceType: string;
+    file: string;
+    line: number;
+    reason: string;
+}
+export interface IdleFloorReport {
+    currency: string;
+    region: string;
+    /** ISO date the bundled price snapshot was captured. */
+    priced_at: string;
+    items: IdleFloorItem[];
+    /** Sum of every item's monthly cost, rounded to cents. */
+    monthly_floor: number;
+    /** Catalogued resources left unpriced because their tier wasn't identifiable —
+     *  the floor is a lower bound by exactly these. */
+    unpriced: UnpricedResource[];
+}
+/**
+ * Detect every resource that bills at zero traffic, priced from the bundled
+ * snapshot. Pure and deterministic — no fs, no network, no credentials. Items
+ * come back in source order (file, then line) so `cost.md` is diff-stable.
+ */
+export declare function detectIdleFloor(resources: ReadonlyArray<TfResourceEntry>): IdleFloorReport;
+/** What the idle-floor number does and does not assert — carried verbatim into
+ *  `cost.md` and the signed evidence bundle so the claim can never drift. */
+export declare const IDLE_FLOOR_ASSERTS: string;
+export declare const IDLE_FLOOR_DOES_NOT_ASSERT: string;
+/**
+ * Render the `cost.md` artifact. Pure and deterministic — the same report always
+ * produces the same bytes, so re-running on an unchanged plan yields no diff.
+ */
+export declare function renderCostMarkdown(report: IdleFloorReport, toolVersion: string): string;

package/dist/mcp/terraform/keyless.d.ts

@@ -0,0 +1,68 @@
+/**
+ * KEYLESS (Sigstore) signing — the SECOND evidence tier, alongside the Ed25519
+ * detached signature in [[signing]].
+ *
+ * Where the Ed25519 tier proves "signed by whoever holds INFRAWEAVER_SIGNING_KEY"
+ * (and needs that key distributed to verifiers), the keyless tier signs with the
+ * workflow's ephemeral GitHub Actions OIDC identity: Fulcio issues a short-lived
+ * X.509 cert bound to "this repo, this workflow, this run", the signature +
+ * cert + an inclusion proof go into a Sigstore **bundle**, and the signing event
+ * is recorded in the public **Rekor** transparency log. There is no key to
+ * distribute — a verifier checks the CERTIFICATE IDENTITY (the workflow ref +
+ * the GitHub OIDC issuer), not a pinned fingerprint. That converts the
+ * fingerprint-pinning problem into a certificate-identity check.
+ *
+ * The signed payload is an in-toto v1 attestation whose `subject` is the evidence
+ * artifact (by sha256 digest) and whose `predicate` is a compact summary — the
+ * same shape that slots into a CycloneDX/VEX attestation pipeline.
+ *
+ * OPT-IN + best-effort: enabled by `INFRAWEAVER_KEYLESS_SIGNING=true` and only when
+ * an ambient OIDC identity was captured (CI with `id-token: write`). It performs
+ * live network calls to Fulcio + Rekor, so a failure is logged and the emit still
+ * succeeds with the deterministic bundle + optional Ed25519 `.sig` — a transient
+ * Rekor outage must not block emitting evidence.
+ */
+import { type SerializedBundle } from "@sigstore/bundle";
+export declare const KEYLESS_SIGNING_ENV = "INFRAWEAVER_KEYLESS_SIGNING";
+/** The in-toto predicateType for a Infraweaver evidence attestation. */
+export declare const INFRAWEAVER_ATTESTATION_PREDICATE_TYPE: "https://infraweaver.dev/attestations/evidence/v1";
+/** in-toto Statement v1 — what actually gets DSSE-signed. */
+export interface InTotoStatement {
+    _type: "https://in-toto.io/Statement/v1";
+    subject: Array<{
+        name: string;
+        digest: {
+            sha256: string;
+        };
+    }>;
+    predicateType: string;
+    predicate: Record<string, unknown>;
+}
+/** Opt-in check — keyless signing performs live Fulcio/Rekor calls, so it never
+ *  runs unless explicitly enabled. Distinct from {@link keylessSigningPossible}. */
+export declare function keylessSigningEnabled(env?: NodeJS.ProcessEnv): boolean;
+/** True when keyless signing is both enabled AND an ambient OIDC identity was
+ *  captured (running in CI with id-token:write). The emit tools gate on this. */
+export declare function keylessSigningPossible(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Build the in-toto v1 Statement that attests `artifactBytes` by sha256 digest.
+ * Pure — the signable payload, independent of any network. The predicate carries
+ * a compact, non-authoritative summary (the artifact itself is the authority; the
+ * attestation binds it to the workflow identity).
+ */
+export declare function buildInTotoStatement(args: {
+    subjectName: string;
+    artifactBytes: string | Buffer;
+    predicate: Record<string, unknown>;
+    predicateType?: string;
+}): InTotoStatement;
+/** The sibling filename the Sigstore bundle is written to, next to `artifactPath`. */
+export declare function keylessBundlePath(artifactPath: string): string;
+/**
+ * Keyless-sign an in-toto statement: mint a `sigstore`-audience OIDC token, get a
+ * short-lived Fulcio signing cert for it, DSSE-sign the statement, and record the
+ * entry in Rekor. Returns the serialized Sigstore bundle (write it as
+ * `<artifact>.sigstore.json`). NETWORK — Fulcio + Rekor. Throws on any failure;
+ * callers treat keyless as best-effort and log rather than abort the emit.
+ */
+export declare function keylessSignStatement(statement: InTotoStatement): Promise<SerializedBundle>;

package/dist/mcp/terraform/moduleDocs.d.ts

@@ -0,0 +1,56 @@
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { type ModuleInterface } from "#app/mcp/modules";
+export type ModuleDocsVerdict = "equivalence-proven" | "equivalence-failed" | "proposed-unproven";
+export interface ModuleDocsRefactorInput {
+    /** every relocated address, `from → to` — from terraform_generate_moved. */
+    moves: {
+        from: string;
+        to: string;
+    }[];
+    /** worded exactly as the evidence layer's refactor statement. */
+    verdict: ModuleDocsVerdict;
+}
+export interface ModuleDocsInput {
+    /** repo-relative module dir, e.g. `modules/logging`. */
+    moduleDir: string;
+    iface: ModuleInterface;
+    /** present only for a refactor run (omits the section entirely otherwise). */
+    refactor?: ModuleDocsRefactorInput | undefined;
+    version?: string;
+    /** the repo HEAD the doc was generated at (footer metadata; drives the
+     * incremental refresh). null when git is unavailable. */
+    gitHead: string | null;
+}
+/**
+ * Build the README from tool outputs only (pure — same inputs, same bytes).
+ * No prose is invented: descriptions come verbatim from the HCL or stay empty.
+ */
+export declare function buildModuleReadme(input: ModuleDocsInput): string;
+/** the `git-head` recorded in an existing generated README's footer, or null
+ * (no README / not infraweaver-generated / no head recorded). */
+export declare function readFooterGitHead(readme: string | null): string | null;
+export declare const TerraformModuleDocsParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    module_dir: string;
+    moves?: {
+        from: string;
+        to: string;
+    }[];
+    proposed_unproven?: boolean;
+}, {}>;
+export declare function TerraformModuleDocsTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    module_dir: string;
+    moves?: {
+        from: string;
+        to: string;
+    }[];
+    proposed_unproven?: boolean;
+}, {
+    module_dir: string;
+    moves?: {
+        from: string;
+        to: string;
+    }[];
+    proposed_unproven?: boolean;
+}>> & {
+    mutates?: boolean;
+};

package/dist/mcp/terraform/nativeRules.d.ts

@@ -0,0 +1,38 @@
+import type { Concern, Severity } from "#app/mcp/terraform/types";
+/** The `Concern.source` every native rule carries. Equal to the emitted-artifact
+ *  wordmark, so a SARIF report we produce round-trips back through
+ *  `read_findings` as native (not `reviewer`) and stays ✗→✓ verifiable. */
+export declare const NATIVE_SOURCE = "infraweaver";
+/** What a rule's finding is allowed to claim. See the module note. */
+export type NativeBand = "verified" | "review-required" | "advisory";
+export interface NativeRule {
+    /** bare rule id — the `rule_id` is `infraweaver:<id>` and the content hash uses
+     *  this bare form (see `buildConcern`). */
+    id: string;
+    title: string;
+    band: NativeBand;
+    category: Concern["category"];
+    /** the precise claim the finding makes. Copied into evidence/docs verbatim so
+     *  the report and the code can never drift apart. */
+    asserts: string;
+    /** the claim a reader might infer that this rule explicitly does NOT make. */
+    doesNotAssert: string;
+}
+export declare const SECRET_PERSISTED_TO_STATE = "secret-persisted-to-state";
+export declare const IMPERATIVE_ACTION_TRIGGER = "imperative-action-trigger";
+export declare const DYNAMIC_DESTROY_PROTECTION = "dynamic-destroy-protection";
+export declare const DEPRECATED_STATE_LOCKING = "deprecated-state-locking";
+export declare const NATIVE_RULES: readonly NativeRule[];
+/**
+ * The native rule a concern belongs to, or null when it isn't one of ours.
+ * Accepts both the namespaced `infraweaver:<id>` and the bare `<id>` form so it
+ * works on a concern before and after `buildConcern` namespaces it.
+ */
+export declare function nativeRuleOf(ruleId: string): NativeRule | null;
+/** The severity floor a band implies. A rule may report HIGHER than its floor for
+ *  a worse instance (a hardcoded literal secret beats a referenced one), but a
+ *  non-`verified` band can never present as a critical/high violation — that is
+ *  the loudness a code-verified `fail` has earned and these have not. */
+export declare const BAND_SEVERITY: Record<NativeBand, Severity>;
+/** The reason text a non-`verified` band carries into the five-status verdict. */
+export declare function bandVerdictReason(rule: NativeRule): string | null;

package/dist/mcp/terraform/nativeScan.d.ts

@@ -0,0 +1,11 @@
+import type { ScannerOutcome } from "#app/mcp/terraform/types";
+/**
+ * Run the native pack over `cwd`.
+ *
+ * `ran` is always true: the governance rules need nothing but the source text, so
+ * the pack itself never fails to run. When the persisted-secret half could not
+ * run (no provider schema) that is reported through `partial` — a coverage gap
+ * the verification summary surfaces as INCONCLUSIVE, rather than being folded
+ * into a silent "the native pack found nothing".
+ */
+export declare function scanNative(cwd: string): ScannerOutcome;

package/dist/mcp/terraform/noiseProfile.d.ts

@@ -0,0 +1,100 @@
+/**
+ * G7 — the noise-reduction learning loop.
+ *
+ * WHAT IT LEARNS FROM. Every time an org waives a rule it records a decision: a
+ * `rule`, a human `reason`, and (since the two-person gate) who proposed and who
+ * ratified it. When the SAME rule has been waived independently across several
+ * repos in a fleet, that is no longer a per-repo judgement — it is the org
+ * telling us, in writing and with reasons, that this finding type is noise for
+ * them. This module turns that record into a **surfacing** signal.
+ *
+ * WHAT IT IS NOT. Not suppression, and the distinction is the whole design:
+ *
+ *   - A down-ranked finding is still **reported**, still **gates CI**, still
+ *     appears in the **signed evidence** with an unchanged verdict. Only its
+ *     position in "the top N that matter" moves.
+ *   - The concern's `severity`, `category`, band and assessability are never
+ *     touched. Nothing derived from a scanner's judgement is rewritten.
+ *   - It applies to nothing at `critical` or `high`. A repeatedly-waived
+ *     critical is a governance problem that should get LOUDER, not quieter, and
+ *     an attacker who can get a rule waived across a fleet must not thereby be
+ *     able to bury it.
+ *
+ * A ranking model that could hide a finding would be a liability in an evidence
+ * product; one that can only reorder the low-severity tail is a genuine
+ * ergonomic win with no honesty cost.
+ *
+ * WHY A THRESHOLD. One waiver is a decision, not a pattern — a single repo
+ * silencing a rule says nothing about the fleet. The signal needs
+ * {@link MIN_DISMISSAL_REPOS} *distinct repos*, counted per repo rather than
+ * per policy so that one repo with five overlapping path-scoped waivers cannot
+ * masquerade as five repos agreeing.
+ *
+ * ALWAYS REASON-LOGGED. An adjustment carries the repo count and the actual
+ * human reasons, and the scan output surfaces them next to the finding. A
+ * ranking that quietly demotes things is indistinguishable from a bug; one that
+ * says "ranked lower: 4 repos waived this — 'managed by the platform team'" is
+ * reviewable, and can be argued with.
+ *
+ * Pure. The profile arrives from Cloud over run-context as an untrusted blob
+ * (same shape and trust posture as §5.12's proven-fix library) and is coerced
+ * here before anything reads it.
+ */
+import type { Concern } from "#app/mcp/terraform/types";
+/** Distinct repos that must have waived a rule before it is treated as fleet
+ *  noise rather than one team's decision. */
+export declare const MIN_DISMISSAL_REPOS = 3;
+/** The largest amount a score may be reduced, and the floor it may not cross.
+ *  Bounded so a down-rank reorders the tail rather than deleting a finding from
+ *  practical view: a heavily-waived medium still outranks an untouched info. */
+export declare const MAX_NOISE_PENALTY = 1.5;
+export declare const NOISE_SCORE_FLOOR = 1;
+/** One rule's dismissal history across an org's fleet. */
+export interface NoiseEntry {
+    /** the waived rule id, exactly as the org recorded it. */
+    rule: string;
+    /** DISTINCT repos that have waived it — never a raw policy count. */
+    repos: number;
+    /** the human reasons given, deduped, in the order Cloud returned them. */
+    reasons: string[];
+}
+/** The org's fleet-wide dismissal record, keyed by rule id. */
+export type NoiseProfile = ReadonlyMap<string, NoiseEntry>;
+export declare const EMPTY_NOISE_PROFILE: NoiseProfile;
+/**
+ * Coerce the untrusted run-context blob into a {@link NoiseProfile}.
+ *
+ * Every field is validated and anything malformed is dropped rather than
+ * defaulted: this data reorders a security report, so a blob that is not
+ * recognisably a dismissal record must produce NO adjustment instead of a
+ * plausible-looking one. Mirrors `fixMemory.coerceLibrary`.
+ */
+export declare function coerceNoiseProfile(raw: unknown): NoiseProfile;
+/** A ranking adjustment, with the evidence for it. Never produced silently. */
+export interface NoiseAdjustment {
+    /** how much the risk score was reduced (positive, ≤ {@link MAX_NOISE_PENALTY}). */
+    penalty: number;
+    /** distinct repos in the org that waived this rule. */
+    repos: number;
+    /** the human reasons they gave, truncated to {@link MAX_REASONS_SURFACED}. */
+    reasons: string[];
+}
+/**
+ * The adjustment for one concern, or null when none applies.
+ *
+ * Returns null — rather than a zero penalty — when the rule is unknown, below
+ * the threshold, or protected by severity, so a caller cannot accidentally
+ * report "adjusted by 0" as if a judgement had been made.
+ */
+export declare function noiseAdjustmentFor(concern: Pick<Concern, "rule_id" | "severity">, profile: NoiseProfile): NoiseAdjustment | null;
+/**
+ * Apply an adjustment to a risk score, clamped to {@link NOISE_SCORE_FLOOR}.
+ *
+ * The floor is what keeps this a re-ordering rather than a disappearance: a
+ * finding can be pushed down the list but never to zero, because zero reads as
+ * "nothing here" and something is definitely here.
+ */
+export declare function applyNoisePenalty(score: number, adjustment: NoiseAdjustment | null): number;
+/** One line explaining an adjustment, for the report. Deliberately states the
+ *  bound as well as the reason — a reader must not infer that we hid anything. */
+export declare function explainNoiseAdjustment(adjustment: NoiseAdjustment): string;

package/dist/mcp/terraform/normalization.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Idiomatic-normalisation DETECTION — the Refactor verb's companion to
+ * moduleExtraction.ts. Module extraction lifts raw resources behind a boundary;
+ * this finds the OTHER provably-equivalent refactor: in-place idiomatic cleanup of
+ * legacy HCL that changes STRUCTURE/SYNTAX but not behaviour, so a repo that is
+ * already modular but stylistically dated still has a real refactor to ship.
+ *
+ * Every kind here is a no-op the keys-free equivalence check proves: the resource
+ * set and per-resource argument NAMES are untouched, addresses don't move (zero
+ * `moved {}` needed), and `terraform validate` + `fmt` stay clean. That is the hard
+ * boundary — anything that changes a resource TYPE or the managed-resource set
+ * (e.g. `aws_launch_configuration`→`aws_launch_template`, `aws_elb`→`aws_lb`) is
+ * behaviour-ALTERING modernisation and belongs to Remediate, NOT here; the
+ * equivalence check would reject it as a resource-set diff anyway.
+ *
+ * Pure parsing over files already on disk — no subprocess, no network — mirroring
+ * moduleExtraction.ts.
+ */
+import type { LocalToolContext } from "#app/mcp/localContext";
+export type NormalizationKind = "redundant_interpolation" | "legacy_block_assignment";
+export interface NormalizationSite {
+    kind: NormalizationKind;
+    /** 1-based line of the offending snippet. */
+    line: number;
+    /** the snippet as written. */
+    before: string;
+    /** the idiomatic, behaviour-identical rewrite (advisory — the agent writes the edit). */
+    after: string;
+}
+/**
+ * Find every string literal that is EXACTLY one full-span interpolation
+ * (`"${ expr }"`), where dropping the wrapper to a bare `expr` is a behaviour-
+ * identical HCL2 rewrite (the canonical 0.11→0.12 cleanup). Skips comments and
+ * heredocs, and naturally excludes `"$${literal}"` (an escaped, non-interpolated
+ * `${`) and partial templates like `"${a}-${b}"` (where the quotes are load-bearing).
+ */
+export declare function findRedundantInterpolations(hcl: string): NormalizationSite[];
+export declare function findLegacyBlockAssignments(hcl: string): NormalizationSite[];
+/** every normalisation site in one file, in line order. */
+export declare function scanNormalizations(hcl: string): NormalizationSite[];
+export interface NormalizationFile {
+    file: string;
+    count: number;
+    kind_counts: Record<NormalizationKind, number>;
+    /** a capped sample of the actual sites, for the agent to anchor its edits. */
+    sites: NormalizationSite[];
+}
+export declare function findNormalizationCandidates(cwd: string): NormalizationFile[];
+export declare const NormalizationCandidatesParams: import("arktype/internal/variants/object.ts").ObjectType<object, {}>;
+export declare function NormalizationCandidatesTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<object, object>> & {
+    mutates?: boolean;
+};

package/dist/mcp/terraform/oscal.d.ts

@@ -0,0 +1,103 @@
+import { type AssessmentScorecard } from "#app/mcp/assess";
+import type { CrosswalkReport } from "#app/mcp/crosswalk";
+import type { LocalToolContext } from "#app/mcp/localContext";
+import type { EvidenceSubject } from "#app/mcp/terraform/evidence";
+export declare const OSCAL_VERSION: "1.1.2";
+interface OscalProp {
+    name: string;
+    value: string;
+    ns?: string;
+}
+interface OscalObservation {
+    uuid: string;
+    title: string;
+    description: string;
+    methods: string[];
+    collected: string;
+    "relevant-evidence"?: {
+        description: string;
+    }[];
+}
+interface OscalFinding {
+    uuid: string;
+    title: string;
+    description: string;
+    target: {
+        type: "objective-id";
+        "target-id": string;
+        status: {
+            state: "satisfied" | "not-satisfied";
+            reason?: string;
+        };
+    };
+    "related-observations"?: {
+        "observation-uuid": string;
+    }[];
+    props?: OscalProp[];
+}
+export interface OscalAssessmentResults {
+    "assessment-results": {
+        uuid: string;
+        metadata: {
+            title: string;
+            "last-modified": string;
+            version: string;
+            "oscal-version": typeof OSCAL_VERSION;
+            props: OscalProp[];
+            remarks: string;
+        };
+        "import-ap": {
+            href: string;
+            remarks: string;
+        };
+        results: Array<{
+            uuid: string;
+            title: string;
+            description: string;
+            start: string;
+            "reviewed-controls": {
+                "control-selections": Array<{
+                    "include-controls"?: {
+                        "control-id": string;
+                    }[];
+                    "include-all"?: Record<string, never>;
+                }>;
+            };
+            observations: OscalObservation[];
+            findings: OscalFinding[];
+        }>;
+    };
+}
+/** name-based (v5-shaped) UUID from a seed, so output is reproducible.
+ * Shared with the CycloneDX VEX emitter ([[vex]]) — both artefacts keep the
+ * pure/deterministic stance of the evidence builder. */
+export declare function deterministicUuid(seed: string): string;
+/**
+ * Build a strict OSCAL 1.1.2 Assessment Results document from an assessment's
+ * scorecard + crosswalk. Pure (clock/identity passed in). Each crosswalk entry
+ * (an open concern) yields one observation and one `not-satisfied` finding per
+ * control objective it maps to; the finding's verification status + severity ride
+ * as props so an OSCAL consumer keeps the five-status nuance.
+ */
+export declare function buildOscalAssessmentResults(args: {
+    scorecard: AssessmentScorecard;
+    crosswalk: CrosswalkReport;
+    subject: EvidenceSubject;
+    generatedAt: string;
+    version?: string;
+}): OscalAssessmentResults;
+export declare const DEFAULT_OSCAL_PATH = "compliance/infraweaver-oscal.json";
+export declare const TerraformEmitOscalParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    output_path?: string;
+    severity_threshold?: "critical" | "high" | "info" | "low" | "medium";
+}, {}>;
+export declare function TerraformEmitOscalTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    output_path?: string;
+    severity_threshold?: "critical" | "high" | "info" | "low" | "medium";
+}, {
+    output_path?: string;
+    severity_threshold?: "critical" | "high" | "info" | "low" | "medium";
+}>> & {
+    mutates?: boolean;
+};
+export {};

package/dist/mcp/terraform/packs/azurerm-3-4.d.ts

@@ -0,0 +1,2 @@
+import type { TransformPack } from "#app/mcp/terraform/transformPacks";
+export declare const AZURERM_3_TO_4: TransformPack;

package/dist/mcp/terraform/packs/cloudflare-4-5.d.ts

@@ -0,0 +1,2 @@
+import type { TransformPack } from "#app/mcp/terraform/transformPacks";
+export declare const CLOUDFLARE_4_TO_5: TransformPack;