infraweaver 0.1.0

package/dist/mcp/terraform/prowlerOcsf.d.ts

@@ -0,0 +1,136 @@
+import type { ExternalFinding } from "#app/mcp/terraform/cspm";
+import type { Severity } from "#app/mcp/terraform/types";
+/**
+ * Prowler OCSF ingestion (CSPM phase 1).
+ *
+ * Prowler is an Apache-2.0 live-cloud CSPM scanner. Infraweaver CONSUMES its
+ * findings and never runs it: the customer runs Prowler in their own CI with
+ * their own cloud credentials and Infraweaver ingests the resulting JSON. The
+ * zero-credential invariant is unchanged — this module only parses a file.
+ *
+ * Prowler writes OCSF `DetectionFinding` objects (class_uid 2004) as a single
+ * JSON ARRAY, not NDJSON. Field locations follow the OCSF 1.x DetectionFinding
+ * schema; `severity_id` is the OCSF enum (0 Unknown, 1 Informational, 2 Low,
+ * 3 Medium, 4 High, 5 Critical, 6 Fatal), which is deliberately NOT routed
+ * through `normalizeExternalSeverity()` — that function reads bare numbers as
+ * CVSS scores and would silently downgrade a Critical (5) to medium.
+ *
+ * Output is the existing `ExternalFinding` shape, so everything downstream —
+ * correlation, concern building, grouping, the Cloud report — is unchanged.
+ */
+/** OCSF `type_uid` for DetectionFinding: Create — what Prowler emits. */
+export declare const DETECTION_FINDING_CREATE = 200401;
+declare const ProwlerFinding: import("arktype/internal/variants/object.ts").ObjectType<{
+    metadata?: {
+        event_code?: string;
+        product?: {
+            name?: string;
+            version?: string;
+        };
+    };
+    status_code?: string;
+    status?: string;
+    status_detail?: string;
+    message?: string;
+    severity?: string;
+    severity_id?: number;
+    finding_info?: {
+        title?: string;
+        desc?: string;
+    };
+    remediation?: {
+        desc?: string;
+        references?: string[];
+    };
+    resources?: {
+        uid?: string;
+        name?: string;
+        type?: string;
+        region?: string;
+        labels?: string[];
+    }[];
+    cloud?: {
+        provider?: string;
+        account?: {
+            uid?: string;
+        };
+        region?: string;
+    };
+    type_uid?: number;
+    unmapped?: object;
+}, {}>;
+export type ProwlerFindingInput = typeof ProwlerFinding.infer;
+/**
+ * True for a parsed value that looks like a Prowler OCSF feed: a non-empty array
+ * whose first item is a DetectionFinding or carries Prowler's product name.
+ * Checked BEFORE the native `infraweaver.external-findings/v1` validator, which is
+ * safe because the native feed is an OBJECT and this requires a non-empty ARRAY —
+ * the two shapes cannot collide, so existing feeds keep their exact behaviour.
+ */
+export declare function isProwlerOcsf(parsed: unknown): boolean;
+/**
+ * Detect a Prowler output file that was never closed. Prowler streams `[`, then
+ * findings, and only seeks back to write `]` when the scan completes — so a
+ * crashed or still-running scan leaves an unterminated array that `JSON.parse`
+ * rejects with a message no operator can act on.
+ */
+export declare function isUnterminatedJsonArray(raw: string): boolean;
+/**
+ * Resolve a finding's severity: the OCSF severity NAME first (what Prowler
+ * writes), then the numeric enum, then `medium` — matching the default the
+ * existing external-findings path uses when a feed says nothing.
+ */
+export declare function prowlerSeverity(finding: ProwlerFindingInput): Severity;
+/** True when a Prowler compliance key names a framework we may lawfully carry. */
+export declare function isFreeFrameworkKey(key: string): boolean;
+/**
+ * The free-framework compliance references a finding carries, as
+ * `FRAMEWORK: req-id` strings. Paywalled frameworks are dropped silently and by
+ * design. Returns [] when the finding carries none.
+ */
+export declare function freeComplianceRefs(finding: ProwlerFindingInput): string[];
+export interface ProwlerParseResult {
+    /** FAIL findings mapped into the shared external-finding shape. */
+    findings: ExternalFinding[];
+    summary: {
+        total: number;
+        /** mapped to concerns (status_code FAIL, not muted). */
+        failed: number;
+        passed: number;
+        manual: number;
+        /** muted by the customer's Prowler mutelist — user intent we honour. */
+        muted: number;
+        /** items that did not match the DetectionFinding shape at all. */
+        malformed: number;
+        /** items whose `status_code` is one we do not model — distinct from malformed,
+         *  so an operator can tell "new Prowler status" from "not a finding". */
+        unknown_status: number;
+        /** `metadata.product.version`, when the feed declared one. */
+        product_version: string | null;
+        /** set when type_uid drifted from the expected DetectionFinding value. */
+        schema_warning: string | null;
+    };
+}
+/**
+ * Parse a Prowler OCSF array into external findings + an honest tally.
+ *
+ * Only `status_code === "FAIL"` findings become concerns. PASS/MANUAL and muted
+ * findings are COUNTED but never mapped: a passing check is not a defect, and
+ * Prowler's mutelist is user-authored intent. The counts still matter — phase-2
+ * requirement coverage needs to say "3 checks FAIL, 12 PASS" rather than
+ * treating absence as unknown.
+ *
+ * Pure: no fs, no network.
+ */
+export declare function parseProwlerOcsf(items: readonly unknown[]): ProwlerParseResult;
+/**
+ * The identity-bearing cloud tags a Prowler finding carries, lower-cased, as
+ * last-resort correlation hints.
+ *
+ * Two filters, both about not mis-mapping: only identity keys (above), and only
+ * values long enough to identify something — a short value like `eu` would match
+ * half the repo. A wrong mapping is worse than an honest unmapped alert, because
+ * it puts a real cloud finding on an unrelated line of someone's code.
+ */
+export declare function tagHints(labels: readonly string[] | undefined): string[];
+export {};

package/dist/mcp/terraform/refactor.d.ts

@@ -0,0 +1,183 @@
+/**
+ * Refactor equivalence proof (Phase A — the "safe floor").
+ *
+ * The `refactor` verb relocates resources behind a module boundary and asserts
+ * behaviour is unchanged. The PROOF that backs that assertion has two layers:
+ *
+ *   - the keys-free STATIC proof in this file (no cloud creds): same managed
+ *     resource set, identical per-resource argument names, and — the highest-risk
+ *     invariant — EVERY relocated address covered by a `moved {}` block, plus
+ *     `terraform validate` and `terraform fmt -check` clean. `computeEquivalence`
+ *     hard-fails on a single uncovered move: a missed `moved {}` is a silent
+ *     destroy/create on live infrastructure (a sin of commission), so the gate
+ *     must refuse rather than warn.
+ *   - the OPTIONAL stronger proof (cloud creds present): a real `terraform plan`
+ *     that is a pure-move plan (`isPureMovePlan` in plan.ts). That is corroboration
+ *     layered on top of this floor, never a substitute for it.
+ *
+ * Everything here is pure parsing + set arithmetic over file contents — the tool
+ * wrapper supplies the before-tree (via `git show <base>:<path>`) and the
+ * after-tree (the working tree on disk), mirroring moduleExtraction.ts.
+ *
+ * `moved {}` semantics anchor:
+ * https://developer.hashicorp.com/terraform/language/modules/develop/refactoring
+ *   moved { from = aws_instance.example  to = module.ec2.aws_instance.example }
+ */
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { type ModuleSourceKind } from "#app/mcp/modules";
+export interface ResourceRef {
+    /** full Terraform address, module-prefixed: `module.x.aws_s3_bucket.logs`. */
+    address: string;
+    /** the resource's logical identity, module-path-independent: `aws_s3_bucket.logs`. */
+    key: string;
+    type: string;
+    name: string;
+    /** sorted top-level argument names (attributes + nested block labels). */
+    argNames: string[];
+}
+export interface MovedBlock {
+    from: string;
+    to: string;
+}
+export interface SourceFile {
+    /** repo-relative path, posix-separated. */
+    path: string;
+    hcl: string;
+}
+/**
+ * Parse every top-level `moved { from = <addr>  to = <addr> }` block from HCL.
+ * Addresses are unquoted Terraform traversals (`module.x.aws_s3_bucket.logs`,
+ * `aws_instance.example[0]`), so the value is captured raw up to the line end or
+ * a trailing comment. Brace-matched so a stray `{}` in a comment can't fool it.
+ * A block missing either `from` or `to` is skipped (incomplete, not a relocation).
+ */
+export declare function parseMovedBlocks(hcl: string): MovedBlock[];
+/** collapse incidental whitespace so two spellings of the same address compare
+ * equal (`module.x . aws_s3_bucket.logs` is not valid HCL, but defensive). */
+export declare function normaliseAddress(addr: string): string;
+/** the leaf `<type>.<name>` of an address, stripping leading `module.X.` hops and
+ * any `[index]`/`["key"]` instance suffix. `module.db.aws_db_instance.main[0]`
+ * → `aws_db_instance.main`. */
+export declare function addressKey(address: string): string;
+/**
+ * Attribute every resource in a file tree to its full Terraform address.
+ * A resource in a file under a single-caller local module dir is prefixed
+ * `module.<caller>.`; a resource at root keeps its bare `<type>.<name>`. A module
+ * dir with MULTIPLE callers (instantiated more than once) or NESTED module dirs
+ * can't be attributed to one address deterministically — those resources are
+ * returned in `ambiguous` so the caller degrades honestly rather than asserting a
+ * false address. Pure.
+ */
+export declare function attributeAddresses(files: SourceFile[]): {
+    resources: ResourceRef[];
+    ambiguous: string[];
+};
+export interface EquivalenceResult {
+    /** the overall keys-free verdict: all sub-checks below passed. The push
+     * guardrail hard-blocks when this is false. */
+    equivalent: boolean;
+    /** same multiset of `<type>.<name>` across the whole tree before and after. */
+    resource_set_equivalent: boolean;
+    /** identical top-level argument names for every resource present in both. */
+    arg_names_equivalent: boolean;
+    /** every relocated address is covered by a `moved {}` block (zero uncovered).
+     * THE highest-risk invariant — a false here means a silent destroy/create. */
+    moves_exhaustive: boolean;
+    /** count of address relocations detected between before and after. */
+    moves_detected: number;
+    /** the relocations we detected (the authoritative move set). */
+    expected_moves: MovedBlock[];
+    /** relocations with NO matching `moved {}` block — the hard-fail set. */
+    uncovered_moves: MovedBlock[];
+    /** `moved {}` blocks that match no detected relocation (likely a typo'd
+     * `to`/`from` — surfaced, but not on its own a hard-fail). */
+    spurious_moved_blocks: MovedBlock[];
+    /** logical keys added / removed between before and after (must be empty for
+     * an equivalence-preserving refactor; a non-empty `added` is the b.4 "adopting
+     * a module adds a KMS key" signal — that's an ALTERING change, not equivalence). */
+    resource_set_diff: {
+        added: string[];
+        removed: string[];
+    };
+    /** per-resource argument-name drift. */
+    arg_diffs: {
+        resource: string;
+        added: string[];
+        removed: string[];
+    }[];
+    /** addresses that couldn't be attributed deterministically (multi-instantiated
+     * or nested modules) — equivalence is reported but flagged incomplete. */
+    ambiguous: string[];
+    /** human-readable reasons the verdict is what it is. */
+    reasons: string[];
+}
+/**
+ * Compute the keys-free equivalence verdict from the before/after resource
+ * address sets and the `moved {}` blocks present in the after tree. Validate/fmt
+ * results are merged in by the tool wrapper (they need a subprocess); this pure
+ * core proves the three static invariants — resource-set preservation, argument
+ * preservation, and moved-block exhaustiveness.
+ */
+export declare function computeEquivalence(before: ResourceRef[], after: ResourceRef[], movedBlocks: MovedBlock[], ambiguous?: string[]): EquivalenceResult;
+/**
+ * Generate one `moved {}` block per resource being relocated under a module call,
+ * and the authoritative `expected_moves` list (the denominator
+ * `computeEquivalence` checks coverage against). Each input address keeps its
+ * leaf `<type>.<name>[index]`; the new address prefixes it with `module.<to_module>.`.
+ * Works for root→module and module→module — the
+ * leaf is taken after stripping any existing `module.X.` hops.
+ */
+export declare function generateMovedBlocks(addresses: string[], toModule: string): {
+    hcl: string;
+    expected_moves: MovedBlock[];
+};
+export interface ModuleProvenance {
+    /** the local `module "<name>"` call name. */
+    name: string;
+    source: string;
+    /** the pinned version (registry `version`, or a git `?ref=`), or null. */
+    version: string | null;
+    kind: ModuleSourceKind;
+    /** true when the source is pinned to an exact version/ref — the provenance
+     * discipline for adopting a third-party module (the analog to a SHA-pinned
+     * action). An unpinned external module is a supply-chain risk to flag. */
+    pinned: boolean;
+}
+/**
+ * Record the provenance of every EXTERNAL module the config calls (registry /
+ * git / remote — local modules have in-tree code, no provenance to record).
+ * Used by the refactor b.4 evidence: "adopted `<source>` at `<version>`",
+ * with `pinned` flagging an unpinned adoption. Pure over the file tree.
+ */
+export declare function collectModuleProvenance(files: SourceFile[]): ModuleProvenance[];
+/** read the workspace's `.tf`/`.tfvars` tree and record external-module
+ * provenance (the impure wrapper the evidence bundle calls). */
+export declare function collectWorkspaceProvenance(cwd: string): ModuleProvenance[];
+/** the GitHub label an UNPROVEN b.4 change carries so it is never mistaken for a
+ * proven one. Applied to the PR and surfaced in the evidence bundle. */
+export declare const PROPOSED_UNPROVEN_LABEL = "proposed-unproven";
+/**
+ * The unmissable PR-body banner for a behaviour-ALTERING b.4 change that ran
+ * WITHOUT opt-in read creds (the default): Infraweaver proposes the change but
+ * proves nothing about its runtime effect. It must never silently read as a
+ * proven/equivalence change. Used verbatim at the top of such a PR's body and
+ * mirrored as the `proposed_unproven` marker in the evidence bundle.
+ */
+export declare const PROPOSED_UNPROVEN_BANNER: string;
+export declare const TerraformEquivalenceCheckParams: import("arktype/internal/variants/object.ts").ObjectType<object, {}>;
+export declare function TerraformEquivalenceCheckTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<object, object>> & {
+    mutates?: boolean;
+};
+export declare const TerraformGenerateMovedParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    resources: string[];
+    to_module: string;
+}, {}>;
+export declare function TerraformGenerateMovedTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    resources: string[];
+    to_module: string;
+}, {
+    resources: string[];
+    to_module: string;
+}>> & {
+    mutates?: boolean;
+};

package/dist/mcp/terraform/registry.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Registry module intelligence — look up a PUBLISHED module's interface and
+ * search the public registry for modules to reuse.
+ *
+ * Complements `./currency.ts` (which answers "is a newer VERSION available?"):
+ * this answers "what does this module EXPECT and EXPOSE?" (root inputs/outputs)
+ * and "what published modules exist for this need?". It exists so the agent can
+ * wire a `module {}` block against a real, published interface — an organisation's
+ * own published modules included — instead of guessing variable names.
+ *
+ * Read-only, public default registry only (private/TFE hosts are rejected, same
+ * scope as the currency check), and degrades green on every failure.
+ */
+import { type LookupStatus } from "#app/mcp/terraform/currency";
+export interface ModuleInput {
+    name: string;
+    type: string | null;
+    description: string | null;
+    default: string | null;
+    required: boolean;
+}
+export interface ModuleOutput {
+    name: string;
+    description: string | null;
+}
+export interface ModuleDetail {
+    source: string;
+    version: string | null;
+    description: string | null;
+    verified: boolean;
+    downloads: number | null;
+    published_at: string | null;
+    provider_dependencies: string[];
+    inputs: ModuleInput[];
+    outputs: ModuleOutput[];
+}
+/** the default public registry host — a bare `namespace/name/provider` (or a
+ * `registry.terraform.io/`-prefixed source) resolves here with no auth. */
+export declare const PUBLIC_REGISTRY_HOST = "registry.terraform.io";
+/** a module lookup's outcome: the shared `LookupStatus` plus two private-registry
+ * policy outcomes the tool surfaces with their own message. */
+export type ModuleLookupStatus = LookupStatus | "host_not_allowed" | "auth_required";
+/**
+ * Split a module source into its optional registry `host` and the
+ * `namespace/name/provider` path. A host-prefixed source
+ * (`app.terraform.io/acme/vpc/aws`) targets a PRIVATE registry; a bare
+ * `namespace/name/provider` targets the public default registry (host === null).
+ * `path` is null when the source isn't a valid module address (the detected host,
+ * if any, is still returned for the caller's error message).
+ */
+export declare function splitModuleAddress(source: string): {
+    host: string | null;
+    path: string | null;
+};
+export interface PrivateRegistryAuth {
+    /** the host(s) `token` authorises — a private source's host must be one of them.
+     * This is the security boundary: the agent names the source, but we only ever
+     * send the token to a host the operator allow-listed via `registry_host`. */
+    allowedHosts: string[];
+    /** the bearer token, or undefined when the run supplied no `registry_token`. */
+    token: string | undefined;
+}
+/** test seam: drop the per-host discovery cache. */
+export declare function _clearModuleDiscoveryCache(): void;
+/**
+ * Look up a published module's interface. A bare `namespace/name/provider` hits
+ * the public default registry (no auth). A host-prefixed `host/namespace/name/
+ * provider` targets a PRIVATE registry (HCP Terraform / Terraform Enterprise / any
+ * protocol-compliant registry): the host must be in `auth.allowedHosts` AND a token
+ * supplied, then the API base is resolved via service discovery and the detail
+ * fetched with `Authorization: Bearer …`. Pass `version` to pin the lookup; omit it
+ * for the latest.
+ */
+export declare function fetchModuleDetail(source: string, opts?: {
+    version?: string | undefined;
+    auth?: PrivateRegistryAuth | undefined;
+    /** public-base override (tests). */
+    baseUrl?: string;
+}): Promise<{
+    status: ModuleLookupStatus;
+    module: ModuleDetail | null;
+}>;
+export interface ModuleSearchResult {
+    address: string;
+    version: string | null;
+    description: string | null;
+    downloads: number | null;
+    verified: boolean;
+}
+export interface ModuleSearchQuery {
+    query: string;
+    namespace?: string | undefined;
+    provider?: string | undefined;
+    verified?: boolean | undefined;
+    limit?: number | undefined;
+}
+/**
+ * GET /v1/modules/search — discover published modules (the organisation's own
+ * namespace included) to REUSE instead of writing raw resources. Public default
+ * registry only. `limit` is clamped to a small range to keep the result tight.
+ */
+export declare function searchRegistryModules(params: ModuleSearchQuery, opts?: {
+    baseUrl?: string;
+}): Promise<{
+    status: LookupStatus;
+    modules: ModuleSearchResult[];
+    limit: number;
+}>;

package/dist/mcp/terraform/risk.d.ts

@@ -0,0 +1,41 @@
+import { type NoiseAdjustment, type NoiseProfile } from "#app/mcp/terraform/noiseProfile";
+import { type Concern } from "#app/mcp/terraform/types";
+export interface RiskFactors {
+    severity: number;
+    exposure: number;
+    fixability: number;
+    /** G7: the fleet-noise down-rank applied, as a NEGATIVE contribution. Present
+     *  only when one applied, so a reader can always reconstruct the score from
+     *  its parts and see that nothing was adjusted invisibly. */
+    noise?: number;
+}
+export interface RiskScore {
+    score: number;
+    factors: RiskFactors;
+    /** the dismissal history behind `factors.noise`, when there is one. */
+    noise?: NoiseAdjustment;
+}
+/**
+ * Score a concern for SURFACING order.
+ *
+ * `profile` is the org's fleet-wide dismissal record (G7). It can only ever
+ * lower a score, is bounded and floored, and never applies to critical/high —
+ * see `noiseProfile.ts` for why a ranking model in an evidence product is
+ * allowed to reorder and nothing else. Defaults to empty, so every existing
+ * caller keeps the exact scores it had.
+ */
+export declare function scoreConcern(concern: Concern, profile?: NoiseProfile): RiskScore;
+export declare function riskScore(concern: Concern, profile?: NoiseProfile): number;
+export interface RankedConcern {
+    concern_id: string;
+    rule_id: string;
+    severity: Concern["severity"];
+    category: Concern["category"];
+    location: Concern["location"];
+    risk_score: number;
+    risk_factors: RiskFactors;
+    /** G7: why this was ranked lower, in the org's own words. Present only when a
+     *  down-rank applied — an unexplained demotion is indistinguishable from a bug. */
+    noise_reason?: string;
+}
+export declare function topRisks(concerns: Concern[], n?: number, profile?: NoiseProfile): RankedConcern[];

package/dist/mcp/terraform/scanSession.d.ts

@@ -0,0 +1,116 @@
+import type { ProvenFixPattern } from "#app/mcp/terraform/fixMemory";
+import type { IdleFloorReport } from "#app/mcp/terraform/idleFloor";
+import type { NoiseProfile } from "#app/mcp/terraform/noiseProfile";
+import type { DriftEvidenceStatement } from "#app/mcp/terraform/planDrift";
+import { type ProvenTransform, type TransformMatch, type UpgradeEvidenceStatement, type UpgradeIntent } from "#app/mcp/terraform/transformPacks";
+import type { Concern } from "#app/mcp/terraform/types";
+/**
+ * The terraform tool-to-tool session: the explicit, typed channel the terraform
+ * MCP tools use to hand results to one another (and to end-of-run reporting)
+ * across separate, agent-mediated invocations.
+ *
+ * This used to be ~11 loose fields on the 69-field `ToolState` god-bag, where
+ * the coupling was invisible in every signature and the ordering was silently
+ * load-bearing. Naming the channel makes the contract greppable and testable:
+ *
+ *   - `terraform_scan` / `terraform_assess` / `read_findings` POPULATE the
+ *     baseline (`baselineConcernIds` / `baselineConcernKeys` /
+ *     `baselineFmtDriftFiles`) and the acted-on set (`lastScanConcerns`).
+ *   - `terraform_plan` POPULATES `plannedDestroy` + the confidence signals
+ *     (`lastBlastTier`, `lastIdempotent`); `infracost_diff` populates
+ *     `lastCostDirection`; `terraform_emit_sarif` sets `emittedSarifPath`;
+ *     the refactor equivalence check sets `refactorEquivalence` and
+ *     `terraform_emit_evidence` sets `refactorProposedUnproven`.
+ *   - `terraform_verify_remediation` CONSUMES the baseline + confidence signals;
+ *     `terraform_validate` consumes `baselineFmtDriftFiles`; the push guardrails
+ *     consume `plannedDestroy` / `refactorEquivalence`; end-of-run reporting
+ *     (`runLifecycle`, `cloudReport`) consumes `lastScanConcerns` /
+ *     `emittedSarifPath` / the refactor markers.
+ *
+ * Every field is still LITERAL (records a thing that happened) and every
+ * consumer degrades gracefully when its producer didn't run this session
+ * (`undefined`), so the ordering is documented here rather than assumed.
+ * Reach it through {@link scanSessionOf} so a partially-constructed `ToolState`
+ * (chiefly in tests) lazily gets a session rather than throwing.
+ */
+export interface ScanSession {
+    baselineConcernIds?: string[];
+    baselineConcernKeys?: string[];
+    baselineFmtDriftFiles?: string[];
+    lastScanConcerns?: Concern[];
+    plannedDestroy?: {
+        stateful: {
+            address: string;
+            action: string;
+            type: string;
+        }[];
+        ephemeral: {
+            address: string;
+            action: string;
+            type: string;
+        }[];
+    };
+    lastBlastTier?: "low" | "medium" | "high";
+    lastIdempotent?: boolean;
+    lastCostDirection?: "increase" | "decrease" | "no-change" | "unknown";
+    lastIdleFloor?: IdleFloorReport | undefined;
+    lastDrift?: DriftEvidenceStatement | undefined;
+    emittedSarifPath?: string;
+    refactorEquivalence?: {
+        equivalent: boolean;
+        resource_set_equivalent: boolean;
+        arg_names_equivalent: boolean;
+        moves_exhaustive: boolean;
+        moves_detected: number;
+        validate_passed: boolean;
+        fmt_clean: boolean;
+        uncovered_moves: {
+            from: string;
+            to: string;
+        }[];
+        reasons: string[];
+    };
+    refactorProposedUnproven?: boolean;
+    fixMemoryLibrary?: ProvenFixPattern[];
+    noiseProfile?: NoiseProfile;
+    provenFixCaptures?: ProvenFixPattern[];
+    provenTransformLibrary?: ProvenTransform[];
+    transformMatches?: TransformMatch[];
+    upgradeIntent?: UpgradeIntent;
+    lastPlanTotals?: {
+        to_add: number;
+        to_change: number;
+        to_destroy: number;
+        destructive: number;
+    };
+    planFollowedUpgradeDetection?: boolean;
+}
+/**
+ * The TC-2.2 upgrade statement for this session, or undefined when no provider
+ * pack applied.
+ *
+ * Deliberately computed in ONE place. Two consumers need it — the signed
+ * evidence bundle and the fleet report — and if each assembled the plan facts
+ * itself they could disagree, which would mean telling an org that a transform
+ * planned cleanly while the signed artefact for that same run said otherwise.
+ */
+export declare function upgradeStatementOf(session: ScanSession): UpgradeEvidenceStatement | undefined;
+/** A fresh, empty terraform session. */
+export declare function createScanSession(): ScanSession;
+/**
+ * The single entry point to the terraform session on a `ToolState`. Lazily
+ * initializes it, so a partially-constructed `ToolState` (chiefly test fixtures
+ * that cast `{}`) still reads and writes safely rather than dereferencing
+ * `undefined`. In production `initToolState` seeds it, so this only ever
+ * lazy-creates for such fixtures.
+ */
+export declare function scanSessionOf(toolState: {
+    scanSession?: ScanSession;
+}): ScanSession;
+/**
+ * true once terraform_scan / read_findings captured a pre-fix baseline this
+ * session. terraform_verify_remediation key-maps requested ids against the
+ * baseline when this holds, and reports regressions on that basis; otherwise it
+ * falls back to raw-id matching and marks regressions as unchecked.
+ */
+export declare function hasBaseline(session: ScanSession): boolean;

package/dist/mcp/terraform/scannerCache.d.ts

@@ -0,0 +1,15 @@
+import { type RunScannersOptions } from "#app/mcp/terraform/scanners";
+import type { ScannerOutcome } from "#app/mcp/terraform/types";
+/** Content hash of every Terraform file under `cwd` (sorted for determinism),
+ *  mixed with an `extra` signature (the toolchain). Reading the files is cheap
+ *  next to running Trivy/Checkov, and hashing CONTENT (not mtime) means an edit
+ *  that rewrites a file in place still busts the key. */
+export declare function treeHash(cwd: string, extra: string): string;
+/**
+ * `runScanners` with a per-process, tree-content-keyed cache — ONLY for the
+ * read-only scan path. Identical signature to `runScanners`. Never call this from
+ * the verifier; call `runScanners` there so it always re-scans fresh.
+ */
+export declare function runScannersCached(cwd: string, opts?: RunScannersOptions): ScannerOutcome[];
+/** Drop the cache (test isolation / explicit invalidation). */
+export declare function clearScannerCache(): void;

package/dist/mcp/terraform/scannerEgress.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Per-scanner network egress control (supply-chain phase 0.2).
+ *
+ * THE THREAT. The TeamPCP trivy payload dumped runner memory and *called home* —
+ * the breach was the exfiltration, not the dump. The 0.1 integrity gate refuses
+ * builds we KNOW are compromised; this bounds the ones we don't: a scanner that
+ * cannot egress is a local nuisance, not a breach.
+ *
+ * THE MECHANISM. Env-level proxy denial: the scanner subprocess gets
+ * `HTTP(S)_PROXY` pointed at a blackhole (a local port nothing listens on, so
+ * every proxied connection fails fast) and `NO_PROXY` naming only the hosts that
+ * tool legitimately needs (trivy's DB registries, tflint's ruleset releases —
+ * which bypass the proxy and connect directly). Go and Python HTTP stacks both
+ * honour these variables, which covers all three scanners.
+ *
+ * HONESTY. This is the *degrade path* of the roadmap item — an env contract,
+ * not a kernel boundary: a malicious binary can ignore proxy vars. So an
+ * outcome produced under this control records `egress_isolation: "partial"`,
+ * never a stronger claim. The netns default-deny (a real kernel boundary) is
+ * the unbuilt upgrade; when it lands, this stays as the fallback for runners
+ * that can't grant namespace privileges. Deny is OPT-IN (`tools_network`
+ * input): turning it on by default would break DB pulls on runners whose
+ * mirrors we can't know about.
+ */
+export type EgressPolicy = "open" | "deny";
+/** the parsed `tools_network` input: a base policy + per-tool overrides. */
+export interface ToolsNetworkDirective {
+    base: EgressPolicy;
+    perTool: Map<string, EgressPolicy>;
+    /** unrecognised tokens (warn, never fatal — matching `tools_enabled`). */
+    unknown: string[];
+    /** extra NO_PROXY hosts admitted for every denied tool (private mirrors). */
+    extraAllowedHosts: string[];
+}
+/**
+ * Hosts each scanner legitimately needs when its egress is denied. Deliberately
+ * MINIMAL — every entry is a documented, first-party distribution endpoint, not
+ * a convenience:
+ *
+ *   - trivy: vulnerability-DB / checks-bundle OCI registries (`trivy-db`,
+ *     `trivy-checks` live on GHCR with the ECR Public mirror as fallback).
+ *   - tflint: ruleset plugins are GitHub release assets, fetched by
+ *     `tflint --init`.
+ *   - checkov: scans fully offline — needs nothing.
+ *
+ * An operator whose runner uses a private mirror adds it via
+ * `tools_network: "deny,allow=<host>"`.
+ */
+export declare const SCANNER_EGRESS_ALLOWLIST: Readonly<Record<string, readonly string[]>>;
+/**
+ * Parse the `tools_network` input (comma- or newline-separated). Grammar
+ * mirrors `tools_enabled`:
+ *
+ *   - `deny` / `open`      — base policy for every scanner (default open);
+ *   - `<tool>=deny|open`   — per-tool override (`trivy=deny`);
+ *   - `allow=<host>`       — extra NO_PROXY host admitted for every denied tool
+ *     (private DB mirrors).
+ *
+ * Unrecognised tokens are collected, never fatal — a typo must not silently
+ * change a security posture NOR fail the run.
+ */
+export declare function parseToolsNetwork(raw: string | undefined): ToolsNetworkDirective;
+/** The effective policy for one tool under a directive. */
+export declare function egressPolicyFor(tool: string, directive: ToolsNetworkDirective | undefined): EgressPolicy;
+/**
+ * The env overlay that denies a tool's egress, or null when its policy is open.
+ * Both case spellings are set — Go reads either, Python's requests prefers
+ * lowercase. `NO_PROXY` admits the tool's documented endpoints (plus loopback,
+ * which is never egress) so the tool keeps working while everything else dies
+ * at the blackhole.
+ */
+export declare function egressEnvFor(tool: string, directive: ToolsNetworkDirective | undefined): Record<string, string> | null;