infraweaver 0.1.0

package/dist/mcp/terraform/paths.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Normalize a scanner-reported path to a repo-relative POSIX path. Each scanner
+ * reports the file differently — tflint gives `main.tf` (relative), trivy a
+ * scan-dir-relative `Target`, terraform an absolute path (`/repo/main.tf` or
+ * `D:\repo\main.tf`), checkov a leading-slash path (`/main.tf`). Left
+ * unnormalized, these leak into `location.file` AND the
+ * content-derived `concernId`, making the id (and the `remediate/<id>` branch)
+ * machine-dependent and breaking the ✗→✓ re-scan id match across environments.
+ * So normalize BEFORE building any Concern.
+ */
+export declare function toRepoRelative(raw: string | undefined, cwd: string): string;
+export interface ResolvedRoot {
+    /** absolute dir the per-root command (init/plan/validate) runs in. */
+    absDir: string;
+    /** that root's path relative to the scan `cwd` ("" when the root IS cwd) —
+     * prepended to per-root concern files so they stay cwd-relative. */
+    relDir: string;
+}
+/**
+ * The Terraform root modules to operate on under `cwd`. A repo can hold several
+ * roots (hepcare: `terraform/` + `terraform/core/`); `terraform validate` /
+ * `plan` are per-root, so they must run in EACH. Falls back to `cwd` itself as a
+ * single root when none is detected — so a normal single-root repo behaves
+ * exactly as before (no rebasing, one iteration).
+ */
+export declare function resolveRoots(cwd: string): ResolvedRoot[];
+/** the repo's base ref for diff-scope, or null when one can't be determined. */
+export declare function resolveBaseRef(cwd: string): string | null;

package/dist/mcp/terraform/plan.d.ts

@@ -0,0 +1,157 @@
+import type { BlastTier } from "#app/mcp/terraform/types";
+export interface PlanSummary {
+    /** resources to add / change / destroy, from the plan's change_summary. */
+    add: number;
+    change: number;
+    destroy: number;
+    /** every resource with a real action (create/update/delete/replace) — the set
+     * that powers blast-radius and plan-stability. */
+    changed: {
+        address: string;
+        action: string;
+    }[];
+    /** resources that would be deleted or replaced — the destructive set. */
+    destructive: {
+        address: string;
+        action: string;
+    }[];
+    hasDestroyOrReplace: boolean;
+    /** state-only moves (`moved {}` blocks / refactors): the new address and the
+     * address it came from. Moves don't mutate live infrastructure, so they are
+     * NOT in `changed` — they power the modularization gate (`isPureMovePlan`). */
+    moved: {
+        address: string;
+        previousAddress: string | null;
+    }[];
+}
+export declare function parseTerraformPlanJson(stdout: string): PlanSummary;
+/**
+ * modularization gate — true when the plan is PURELY state moves: at least
+ * one `moved` entry and zero create/update/delete/replace. That proves a
+ * resources→module refactor preserved every resource address (via `moved {}`
+ * blocks) and is a no-op on live infrastructure — the condition under which a
+ * modularization PR may proceed without human escalation.
+ */
+export declare function isPureMovePlan(plan: {
+    add: number;
+    change: number;
+    destroy: number;
+    changed: {
+        address: string;
+    }[];
+    moved: {
+        address: string;
+    }[];
+}): boolean;
+/**
+ * Resource types that hold data/state — destroying or replacing one of these
+ * means data loss, not just recreation. A remediation that would delete or
+ * replace one is hard-blocked at push time unless the operator opts in via the
+ * `allow_replace` input. Not exhaustive: it covers the common managed
+ * datastores across AWS / Azure / GCP; extend as new ones come up.
+ */
+export declare const STATEFUL_RESOURCE_TYPES: ReadonlySet<string>;
+/**
+ * Extract the Terraform resource TYPE from a plan address, stripping any
+ * `module.<name>.` prefixes and an instance index/key suffix:
+ *   `module.db.aws_db_instance.main`               -> `aws_db_instance`
+ *   `aws_s3_bucket.data["prod"]`                   -> `aws_s3_bucket`
+ *   `module.a.module.b.google_storage_bucket.x[0]` -> `google_storage_bucket`
+ * Returns "" when the address has no parseable `type.name` pair.
+ */
+export declare function resourceTypeOf(address: string): string;
+export interface DestroyClassification {
+    /** destroy/replace of a data-bearing type — high-risk, blocked by default. */
+    stateful: {
+        address: string;
+        action: string;
+        type: string;
+    }[];
+    /** destroy/replace of a recreatable type — recorded, not blocked. */
+    ephemeral: {
+        address: string;
+        action: string;
+        type: string;
+    }[];
+}
+/** partition a plan's destructive set into stateful (blocked) vs ephemeral. */
+export declare function classifyDestructive(destructive: {
+    address: string;
+    action: string;
+}[]): DestroyClassification;
+export interface BlastRadius {
+    tier: BlastTier;
+    /** count of resources the plan would create/update/delete/replace. */
+    resourceCount: number;
+    /** distinct module addresses touched (root resources count as `root`). */
+    modules: string[];
+}
+/**
+ * Extract the module address from a resource address: the `module.X[.module.Y]`
+ * call path, or `root` for a top-level resource. Strips instance index/key from
+ * EVERY segment — a `count`/`for_each` MODULE carries its key on the module
+ * segment (`module.net[0]`), so all instances of one module collapse to one
+ * address (else a single-module fix would look cross-module). Removing keys
+ * first also tolerates a `.` inside a `for_each` string key.
+ *   `aws_s3_bucket.b`                  -> `root`
+ *   `module.db.aws_db_instance.main`   -> `module.db`
+ *   `module.net[0].aws_vpc.main`       -> `module.net`
+ *   `module.a.module.b.google_x.y[0]`  -> `module.a.module.b`
+ */
+export declare function moduleAddressOf(address: string): string;
+/**
+ * Score how much a fix touches, to route large changes through stricter review:
+ * 1–2 resources = `low`, 3–10 = `medium`, more than 10 OR spanning more than one
+ * module = `high`. A `high` blast radius should force human-in-the-loop
+ * regardless of finding severity. 0 changes is `low` (nothing to do).
+ */
+export declare function computeBlastRadius(changed: {
+    address: string;
+}[]): BlastRadius;
+export interface StabilityResult {
+    /** true when a second plan produced the identical change set. */
+    stable: boolean;
+    reason?: string;
+}
+/**
+ * Compare two consecutive plans for stability. Infraweaver never `apply`s (it only
+ * opens PRs), so a true "no perpetual diff after apply" cannot be proven here —
+ * but a fix whose plan is non-deterministic (e.g. `timestamp()`, `uuid()`, an
+ * unkeyed `random_*`, or a data source that varies run-to-run) yields a DIFFERENT
+ * plan on the second run, and that is a real perpetual-diff smell we can catch
+ * without applying. Stable ⇒ the two plans matched; unstable ⇒ report it.
+ */
+export declare function comparePlanStability(first: PlanSummary, second: PlanSummary): StabilityResult;
+export interface RootPlan {
+    /** display label for the root ("." for the top-level root). */
+    dir: string;
+    summary: PlanSummary;
+    stable: boolean;
+}
+export interface AggregatedPlan {
+    add: number;
+    change: number;
+    destroy: number;
+    changed: {
+        address: string;
+        action: string;
+    }[];
+    destructive: {
+        address: string;
+        action: string;
+    }[];
+    hasDestroyOrReplace: boolean;
+    idempotent: boolean;
+    moved: {
+        address: string;
+        previousAddress: string | null;
+    }[];
+}
+/**
+ * Aggregate per-root plan results into one view: SUM the add/change/destroy
+ * counts, UNION the changed + destructive sets (so blast-radius and the
+ * destroy-block see every root's effect), and treat the whole run as
+ * non-idempotent if ANY root's plan was unstable. Pure. Single-root input passes
+ * straight through (identical to the pre-multi-root behaviour).
+ */
+export declare function aggregatePlans(roots: RootPlan[]): AggregatedPlan;

package/dist/mcp/terraform/planDrift.d.ts

@@ -0,0 +1,199 @@
+import { type Concern } from "#app/mcp/terraform/types";
+export declare const PlanDocument: import("arktype/internal/variants/object.ts").ObjectType<{
+    format_version?: string;
+    resource_changes?: {
+        address: string;
+        type?: string;
+        name?: string;
+        mode?: string;
+        change: {
+            actions: string[];
+            before?: unknown;
+            after?: unknown;
+        };
+    }[];
+    action_invocations?: {
+        address: string;
+        type?: string;
+        name?: string;
+        provider_name?: string;
+        lifecycle_action_trigger?: {
+            triggering_resource_address?: string;
+            action_trigger_event?: string;
+        };
+    }[];
+}, {}>;
+export type DriftKind = "modified" | "deleted" | "recreated" | "replaced";
+export interface DriftItem {
+    address: string;
+    type: string | null;
+    name: string | null;
+    /** the raw plan actions, e.g. ["update"] or ["delete","create"]. */
+    actions: string[];
+    kind: DriftKind;
+    /** top-level attributes whose value differs between `change.before` and
+     *  `change.after` — the input the provider-noise filter judges. `null` when
+     *  the plan carries no diffable before/after pair (the filter then makes no
+     *  claim about this item and always keeps it). */
+    changed_fields: string[] | null;
+}
+/**
+ * The plan-JSON document schema versions this parser understands. Terraform has
+ * only ever shipped 1.x for the `show -json` document form and adds keys within
+ * it additively, so any 1.x parses; a 2.x would be a redesign we have not read.
+ *
+ * Forward-compatibility is the DEFAULT here: an unknown 1.x minor (or an absent
+ * version on an old artifact) parses normally, because arktype ignores keys we
+ * do not declare. Only a MAJOR bump is called out — and even then as an honest
+ * coverage gap for the caller to surface, never a silent mis-parse.
+ */
+export declare const SUPPORTED_PLAN_FORMAT_MAJOR = 1;
+/** True when a plan document's `format_version` is one this parser understands.
+ *  An absent version is accepted (pre-versioning artifacts). Pure. */
+export declare function isSupportedPlanFormat(formatVersion: string | undefined): boolean;
+export interface ForgottenResource {
+    address: string;
+    type: string | null;
+    /** true when the type is data-bearing ([[governance]] `isStatefulResourceType`)
+     *  — forgetting a database is the case that must route through needs-human:
+     *  after it, the data-bearing object exists with NO destroy protection and no
+     *  drift visibility, and nothing in code says so. */
+    stateful: boolean;
+}
+/**
+ * Resources the plan would FORGET — dropped from state while the real cloud
+ * object keeps existing (Terraform `removed` blocks, OpenTofu `destroy = false`).
+ *
+ * A forget is deliberately NOT drift and NOT a destroy: nothing in the cloud
+ * changes, so reporting it as either would be a false positive. But it is not a
+ * non-event either — after a forget the resource is unmanaged, and every later
+ * drift scan is silently blind to it. Surfaced separately so the run can state
+ * the coverage gap instead of quietly shrinking what 'no drift' covers. Pure.
+ */
+export declare function classifyForgotten(doc: typeof PlanDocument.infer): ForgottenResource[];
+/** The forgotten addresses only — the compact form of {@link classifyForgotten}. */
+export declare function detectForgotten(doc: typeof PlanDocument.infer): string[];
+/** Every drifted resource in a plan document. A clean plan yields `[]`. */
+export declare function detectDrift(doc: typeof PlanDocument.infer): DriftItem[];
+/**
+ * Computed fields whose churn is PROVIDER bookkeeping, not an operator touching
+ * infrastructure — the documented, always-computed merge targets that generate
+ * perpetual "drift" whenever provider-level defaults shift:
+ *
+ *   - aws `tags_all`: the computed merge of `default_tags` into every resource's
+ *     tags (the canonical drift-noise field of the AWS provider).
+ *   - google `effective_labels` / `terraform_labels`: computed label merges
+ *     introduced by provider v5's default-labels model.
+ *
+ * The list is deliberately SHORT and only ever names fields a provider computes
+ * — a field an operator can hand-edit in the console never belongs here, because
+ * filtering it would be exactly the false no-drift the roadmap forbids.
+ */
+export declare const PROVIDER_NOISE_FIELDS: Readonly<Record<string, readonly string[]>>;
+/** A drift item excluded by the noise filter — retained for auditability, so the
+ *  run can show WHAT was filtered and by which fields rather than silently
+ *  shrinking the drift set. */
+export interface NoiseFilteredDrift {
+    address: string;
+    kind: DriftKind;
+    /** the noisy fields that were the entire diff. */
+    fields: string[];
+}
+/**
+ * Split drift into signal and provider noise. An item is noise ONLY when every
+ * condition holds: it is a pure in-place update (`modified`), the plan carried a
+ * diffable before/after pair, at least one field changed, and EVERY changed
+ * field is on the noise list (the per-provider defaults plus any operator-
+ * supplied extras). Anything else — a delete, a replace, an undiffable change,
+ * a mixed diff where one field is real — is kept. The bias is deliberate:
+ * "never a false no-drift" means the filter must prove noise, not assume it.
+ */
+export declare function filterProviderNoise(items: ReadonlyArray<DriftItem>, extraNoiseFields?: readonly string[]): {
+    kept: DriftItem[];
+    filtered: NoiseFilteredDrift[];
+};
+export interface ActionInvocationItem {
+    /** absolute action address, `action.<type>.<name>`. */
+    address: string;
+    action_type: string | null;
+    /** the resource whose lifecycle event fires this action, when the plan says. */
+    triggered_by: string | null;
+    /** the lifecycle event (`after_create`, …), when the plan says. */
+    event: string | null;
+}
+/**
+ * The provider actions this plan will invoke (TF 1.15's `action_invocations`).
+ * This is the RUNTIME counterpart of the static `imperative-action-trigger`
+ * finding ([[governance]]): the static rule says "an apply here can do work
+ * outside the resource graph"; this array is the plan saying "THIS apply will".
+ * Pure summarization — correlation to code happens in the tool, where the
+ * repo's HCL is available.
+ */
+export declare function summarizeActionInvocations(doc: typeof PlanDocument.infer): ActionInvocationItem[];
+/**
+ * The drift statement the evidence bundle carries — the 2.1 differentiator:
+ * *signed, verifiable proof that live cloud matched the committed IaC at the
+ * time the plan artifact was produced*, with every bound on that claim stated
+ * in the artifact itself rather than left to the reader's optimism.
+ */
+export interface DriftEvidenceStatement {
+    /** the plan artifact the claim is derived from. */
+    source_file: string;
+    /** drifted resources AFTER noise filtering — the signal set. */
+    detected: number;
+    by_kind: Record<DriftKind, number>;
+    items: {
+        address: string;
+        kind: DriftKind;
+    }[];
+    /** drift excluded as provider bookkeeping — listed field-by-field so the
+     *  filtering is auditable (the unfiltered diff stays in the plan artifact). */
+    noise_filtered: NoiseFilteredDrift[];
+    /** resources this plan drops from management — the standing blind spot every
+     *  later drift claim inherits, so it must ride the signed statement. */
+    forgotten: ForgottenResource[];
+    /** drifted addresses with no matching resource block in code. */
+    unlocated: number;
+    /** honest bounds: unsupported format major, etc. Empty = fully readable. */
+    coverage_gaps: string[];
+    asserts: string;
+    does_not_assert: string;
+}
+/**
+ * Build the drift evidence statement (pure). The asserts line is graded by what
+ * the inputs actually prove: a clean, fully-readable plan asserts the live-
+ * matches-code claim; drift asserts the detection; a coverage gap asserts
+ * nothing confident. INCONCLUSIVE-over-silence, in the signed artifact itself.
+ */
+export declare function buildDriftStatement(args: {
+    sourceFile: string;
+    kept: ReadonlyArray<DriftItem>;
+    filtered: ReadonlyArray<NoiseFilteredDrift>;
+    forgotten: ReadonlyArray<ForgottenResource>;
+    unlocated: number;
+    coverageGaps?: readonly string[];
+}): DriftEvidenceStatement;
+/** Resolve a Terraform address to its source location, or null when the address
+ *  isn't found in the repo's code (e.g. a resource removed from code but still in
+ *  state). Supplied by the tool from a `.tf` resource index. */
+export type LocationResolver = (address: string) => {
+    file: string;
+    line: number;
+} | null;
+/** A drift item that couldn't be tied to a resource block in code (reported, not dropped). */
+export interface UnlocatedDrift {
+    address: string;
+    kind: DriftKind;
+    reason: string;
+}
+export interface DriftConcerns {
+    concerns: Concern[];
+    unlocated: UnlocatedDrift[];
+}
+/**
+ * Turn drift items into `reviewer`-source concerns at each resource's file:line.
+ * Drift is honestly `not-code-verifiable` by the ✗→✓ re-scan (proving it fixed needs
+ * live cloud access, which Infraweaver refuses) — the `reviewer` source carries exactly
+ * that meaning. Items whose address isn't in code are returned under `unlocated`.
+ */
+export declare function driftToConcerns(items: ReadonlyArray<DriftItem>, resolve: LocationResolver): DriftConcerns;

package/dist/mcp/terraform/policyAuthor.d.ts

@@ -0,0 +1,191 @@
+import { type Severity } from "#app/mcp/terraform/types";
+/**
+ * The namespace an authored rule's id carries. Deliberately NOT the `infraweaver:`
+ * native-source prefix: these findings are produced by the customer's conftest
+ * running the customer's committed policy. We helped write it; we did not find
+ * it, and the label should not imply otherwise.
+ */
+export declare const AUTHORED_RULE_PREFIX = "policy";
+/** The fully-qualified rule id for an authored spec. */
+export declare function authoredRuleId(id: string): string;
+/** The closed predicate set. Anything not expressible here is not authorable —
+ *  which is the point: an operator we cannot evaluate in process is an operator
+ *  whose generated policy we cannot self-test. */
+export declare const POLICY_OPERATORS: readonly ["equals", "not_equals", "in", "not_in", "present", "absent", "is_true", "is_false", "matches", "gte", "lte", "non_empty"];
+export type PolicyOperator = (typeof POLICY_OPERATORS)[number];
+export type PolicyScalar = string | number | boolean;
+/**
+ * What the rule concludes when the attribute path resolves to nothing.
+ * Required, and deliberately not defaulted — see the module note.
+ */
+export type WhenAbsent = "violation" | "compliant";
+/**
+ * The reviewed intermediate representation. This — not Rego — is what the model
+ * produces from prose, and what a human reviews.
+ */
+export interface PolicyRuleSpec {
+    /** kebab-case, unique within the authored pack. Becomes the rule id in every emitted artifact. */
+    id: string;
+    /** one-line human title. */
+    title: string;
+    /** the sentence of the SOURCE STANDARD this rule was derived from, quoted. The
+     *  audit trail from prose to policy; carried into every emitted artifact. */
+    source_requirement: string;
+    /** the Terraform resource type the rule applies to, e.g. `aws_s3_bucket`. */
+    resource_type: string;
+    /** dotted path into the resource's planned values, e.g.
+     *  `server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm`.
+     *  A segment that resolves to an array is flattened — every element contributes
+     *  a candidate value, and the rule must hold for ALL of them. */
+    attribute: string;
+    operator: PolicyOperator;
+    /** the operand. Scalar for equals/not_equals/matches/gte/lte, a list for
+     *  in/not_in, omitted for the rest. */
+    value?: PolicyScalar | PolicyScalar[];
+    when_absent: WhenAbsent;
+    severity: Severity;
+    /** one of the reviewed crosswalk themes — this is what earns the control citation. */
+    theme: string;
+    /** the violation message a reviewer and an engineer both read. */
+    message: string;
+    /** a compliant value for the generated fixtures. REQUIRED for `matches`, where
+     *  no value can be synthesised from the pattern; optional elsewhere. */
+    example_compliant?: PolicyScalar;
+    /** a violating value for the generated fixtures. REQUIRED for `matches`. */
+    example_violating?: PolicyScalar;
+}
+/**
+ * Structural validation of a spec. Returns the list of problems — empty means
+ * valid. Kept separate from the self-test: this catches "the spec is malformed",
+ * the self-test catches "the spec is well-formed but says nothing".
+ */
+export declare function validateSpec(spec: PolicyRuleSpec): string[];
+/**
+ * Resolve a dotted path against a planned-values object, flattening arrays: at
+ * each segment, an array contributes each of its elements as a candidate parent.
+ * Returns every leaf value the path reaches. An empty array means the path
+ * resolved to nothing — which is what `when_absent` decides on.
+ *
+ * `null` leaves are dropped: Terraform writes an unset optional argument as
+ * `null`, and "present but null" is the same fact as "absent" to a reader.
+ */
+export declare function resolvePath(root: unknown, path: string): unknown[];
+/** Does one resolved value satisfy the rule? Pure; mirrored by the emitted Rego. */
+export declare function valueSatisfies(spec: PolicyRuleSpec, value: unknown): boolean;
+export interface SpecVerdict {
+    violates: boolean;
+    /** why — the sentence a test failure prints. */
+    reason: string;
+}
+/**
+ * Evaluate a spec against ONE resource's planned values. Universal over the
+ * resolved values: every matched value must satisfy the rule, so a list where
+ * one element is wrong is a violation.
+ */
+export declare function evaluateSpec(spec: PolicyRuleSpec, values: unknown): SpecVerdict;
+/** Build the nested object a dotted path implies, with `leaf` at the end. */
+export declare function nestValue(path: string, leaf: unknown): Record<string, unknown>;
+export interface PolicyFixture {
+    /** `compliant` | `violating` | `absent` — the mock's role in the self-test. */
+    kind: "compliant" | "violating" | "absent";
+    /** the resource's planned values. */
+    values: Record<string, unknown>;
+    /** what the rule MUST conclude about it. */
+    expect_violation: boolean;
+}
+/**
+ * The three fixtures every authored rule is tested against. The `absent` case is
+ * the one that matters most: it is both the commonest real shape (an optional
+ * block simply not written) and the case a hand-written policy most often gets
+ * wrong.
+ */
+export declare function buildFixtures(spec: PolicyRuleSpec): PolicyFixture[];
+export interface SelfTestCase {
+    kind: PolicyFixture["kind"];
+    expected: boolean;
+    actual: boolean;
+    passed: boolean;
+    reason: string;
+}
+export interface SelfTestReport {
+    /** every case behaved as its fixture demanded AND the rule denies something.
+     *  Both, deliberately: a rule that agrees with all three fixtures by never
+     *  firing has passed nothing. */
+    passed: boolean;
+    cases: SelfTestCase[];
+    /** true when the rule denied at least one fixture — the vacuity check. A rule
+     *  that denies nothing is not a rule. */
+    denies_something: boolean;
+}
+/**
+ * Run the spec against its own fixtures. A spec that fails here is never
+ * emitted: the caller refuses it rather than hand a human a policy that does
+ * not do what its own description says.
+ */
+export declare function selfTestSpec(spec: PolicyRuleSpec): SelfTestReport;
+/**
+ * The shared helper every emitted policy imports by inclusion. Kept as ONE
+ * reviewed block rather than inlined per rule, because the array-flattening
+ * semantics are the part a reader must check — and they should only have to
+ * check it once.
+ *
+ * Rego forbids recursion, so per-rule path traversal is unrolled at generation
+ * time (see `pathComprehension`); `_members` is the non-recursive primitive that
+ * makes each step uniform.
+ */
+export declare const REGO_PRELUDE = "# Shared helpers for Infraweaver-authored policies. Reviewed once, used by every rule.\n# _members normalises a node to a list so an array-valued block and a single\n# block traverse identically \u2014 the same rule Infraweaver's own evaluator applies.\n_members(x) := x if is_array(x)\n_members(x) := [x] if not is_array(x)\n\n# Only plan actions that produce or change configuration are judged. A delete\n# leaves no \"after\" to assert on, and a no-op has already been judged.\n_relevant(rc) if {\n\tsome action in rc.change.actions\n\taction in {\"create\", \"update\"}\n}\n";
+/**
+ * Emit conftest-ready Rego for one spec. Pure and byte-stable — the same spec
+ * always yields the same file, so a re-run produces no diff and a diff means the
+ * spec changed.
+ *
+ * Targets `terraform show -json` output (`input.resource_changes`), which is what
+ * `policy_check` already feeds conftest.
+ */
+export declare function emitRego(spec: PolicyRuleSpec, opts?: {
+    packageName?: string;
+}): string;
+/**
+ * How faithful the `.policy.hcl` translation is to the spec.
+ *
+ * `exact` — a single-segment attribute path, where `attrs.<name>` means exactly
+ * what our resolver means.
+ * `approximate` — a nested path. tfpolicy's `attrs` traversal does not flatten
+ * arrays the way our resolver does, so a nested block that Terraform represents
+ * as a list needs `[0]` indexing and the translation asserts on the FIRST
+ * element rather than all of them. We emit it, we say so in the file, and the
+ * generated `.policytest.hcl` is how the customer confirms it before relying
+ * on it.
+ *
+ * This axis is about PATH SHAPE only. A second, unavoidable difference applies
+ * to every rule and is stated in the emitted header instead: HCL converts
+ * between types where it can, so a comparison there can succeed on an operand
+ * the Rego — which is explicitly type-guarded — rejects.
+ */
+export type PolicyHclFidelity = "exact" | "approximate";
+export declare function policyHclFidelity(spec: PolicyRuleSpec): PolicyHclFidelity;
+/**
+ * Emit a HashiCorp tfpolicy `.policy.hcl` for one spec.
+ *
+ * We AUTHOR this dialect; we do not enforce it. `tfpolicy` has no
+ * credential-free local plan evaluation and its binary is source-closed, so it
+ * cannot replace the OPA gate — the value is that an HCP customer gets a native
+ * artifact they can validate and run in their own pipeline.
+ */
+export declare function emitPolicyHcl(spec: PolicyRuleSpec): string;
+/**
+ * Emit the `.policytest.hcl` companion — the same three fixtures the in-process
+ * self-test used, expressed as tfpolicy mocks. This is what turns "we authored
+ * it" into something the customer can verify in one command.
+ */
+export declare function emitPolicyTestHcl(spec: PolicyRuleSpec): string;
+/**
+ * The generated fixtures as a `terraform show -json`-shaped document, so the
+ * emitted Rego can be executed against them by conftest without a real plan.
+ * One resource per fixture, named for its role.
+ */
+export declare function emitPlanFixture(spec: PolicyRuleSpec): string;
+export declare function regoFileName(spec: PolicyRuleSpec): string;
+export declare function policyFileName(spec: PolicyRuleSpec): string;
+export declare function policyTestFileName(spec: PolicyRuleSpec): string;
+export declare function planFixtureFileName(spec: PolicyRuleSpec): string;