infraweaver 0.1.0

package/dist/mcp/terraform/scannerJson.d.ts

@@ -0,0 +1,13 @@
+import { type Type } from "arktype";
+/**
+ * Parse + shape-validate JSON from an external subprocess (terraform, tflint,
+ * trivy, checkov, infracost, reviewer findings). MCP tool inputs are already
+ * arktype-validated at the tool boundary; this applies the same rigor to the
+ * other untrusted boundary — scanner stdout — so a version bump that changes a
+ * tool's output shape fails that scanner loudly (callers degrade to `skipped`
+ * / empty) instead of feeding silently-wrong fields into concerns.
+ *
+ * Throws on invalid JSON (exactly like the bare `JSON.parse` it replaces) and
+ * on a shape mismatch, with the offending paths in the message.
+ */
+export declare function parseScannerJson<t>(schema: Type<t>, stdout: string, tool: string): t;

package/dist/mcp/terraform/scanners.d.ts

@@ -0,0 +1,205 @@
+import { type ToolsNetworkDirective } from "#app/mcp/terraform/scannerEgress";
+import { type Concern, type ScannerOutcome } from "#app/mcp/terraform/types";
+import { type ResolvedToolSelection } from "#app/utils/toolSelection";
+export declare function scanFmt(cwd: string): ScannerOutcome;
+/** `terraform fmt -check -list=true` prints one unformatted file path per line. */
+export declare function parseFmtOutput(stdout: string, cwd?: string): Concern[];
+/**
+ * Run `terraform validate` across EVERY root and aggregate. `validate` is the
+ * one scanner that's per-root (fmt/tflint/trivy/checkov are recursive over the
+ * whole tree), so a multi-root repo only catches subdir-root validate errors
+ * when we visit each root.
+ */
+export declare function scanValidate(cwd: string, extraEnv?: Record<string, string>): ScannerOutcome;
+/** parse `terraform validate -json`; keeps real errors, drops uninitialized-dir noise. */
+export declare function parseValidateOutput(stdout: string, cwd?: string): Concern[];
+export interface ProviderRequirement {
+    /** local name, e.g. `aws`. */
+    name: string;
+    /** registry source, e.g. `hashicorp/aws`, or null (legacy string form). */
+    source: string | null;
+    /** raw version constraint, e.g. `~> 5.0`, or null when unconstrained. */
+    version: string | null;
+    /** the pinned MAJOR (the lower-bound major of the constraint) — the number a
+     * fix must target, since argument schemas differ across provider majors. */
+    major: number | null;
+}
+/**
+ * Parse every `required_providers { … }` block in some HCL text into the pinned
+ * provider requirements. Handles the modern object form
+ * (`aws = { source = "hashicorp/aws", version = "~> 5.0" }`) and the legacy
+ * string form (`aws = "~> 5.0"`). A repo's "correct" fix depends on the provider
+ * MAJOR — argument names and valid blocks differ across AWS/Azure majors — so
+ * surfacing the pinned major lets a fix target the right schema instead of
+ * breaking `plan`. Brace-matched (not a fragile single regex) so nested objects
+ * don't confuse it. First declaration of a name wins (dedup across files).
+ */
+export declare function parseRequiredProviders(hcl: string): ProviderRequirement[];
+/** read the repo's `*.tf` files (recursively — root + subdir roots + nested
+ * modules) and parse their pinned provider requirements (best-effort; an
+ * unreadable tree yields none). First declaration of a provider wins. */
+export declare function collectProviderRequirements(cwd: string): ProviderRequirement[];
+/** the top-level arguments of a single `resource` block. */
+export interface ResourceArguments {
+    resourceType: string;
+    /** the resource's local name (`resource "aws_s3_bucket" "<name>"`). */
+    name: string;
+    /** top-level attribute + nested-block names (meta-arguments excluded). */
+    args: string[];
+}
+/**
+ * Parse every `resource "<type>" "<name>" { … }` block's TOP-LEVEL argument
+ * names (attributes assigned with `=` and nested block labels) from some HCL.
+ * Conservative by design — it skips `"…"` strings and `#`/`//` line comments so
+ * an interpolation's braces or a commented line can't corrupt the brace depth or
+ * fabricate an argument, and only reports depth-0 names. A `dynamic "x"` block
+ * contributes `x` (the generated block type). Used to cross-check written
+ * arguments against the installed provider schema; pure.
+ */
+export declare function parseResourceArguments(hcl: string): ResourceArguments[];
+export interface UnknownArgument {
+    resource_type: string;
+    /** the resource's local name. */
+    name: string;
+    /** repo-relative file the resource is declared in. */
+    file: string;
+    /** the argument names not present in the installed provider's schema. */
+    unknown: string[];
+}
+/**
+ * Cross-check every resource's written arguments against the
+ * INSTALLED provider's schema, so an argument that's invalid for the pinned
+ * provider major (a "correct" fix for the wrong version) is caught at validate
+ * time, not as a later `plan` failure. Degrades green: returns
+ * `{ checked: false }` when the schema is unavailable (terraform not installed /
+ * dir not init-ed). A resource type absent from the schema is skipped (can't
+ * judge), never flagged.
+ */
+export declare function checkArgumentsAgainstSchema(cwd: string): {
+    checked: boolean;
+    unknown_arguments: UnknownArgument[];
+};
+/** A parsed resource block plus the file it came from. `parseResourceArguments`
+ *  works on one file's text and so cannot carry a location; the transform-pack
+ *  matcher (TC-2.2) needs one to tell the agent WHERE to edit. */
+export interface LocatedResource extends ResourceArguments {
+    /** repo-relative file the resource is declared in. */
+    file: string;
+}
+/** Every `resource` block under `cwd`, with its file. Best-effort in the same
+ *  way as `collectProviderRequirements` — an unreadable file is skipped rather
+ *  than failing the walk. */
+export declare function collectResourceArguments(cwd: string): LocatedResource[];
+export declare function scanTflint(cwd: string, network?: ToolsNetworkDirective): ScannerOutcome;
+/** parse `tflint --format json` output into concerns. */
+export declare function parseTflintOutput(stdout: string, cwd?: string): Concern[];
+/**
+ * Parse `trivy config --format json` output into concerns. Trivy nests
+ * misconfigurations under `Results[].Misconfigurations[]`, keyed to the result's
+ * `Target` file. `trivy config` reports only failures by default, but we
+ * defensively drop any `Status: "PASS"` entry so an `--include-non-failures`
+ * run can't leak passing checks into the concern set. Each concern carries the
+ * IaC language from the result's `Type` (terraform / cloudformation / kubernetes
+ * / helm / dockerfile / azure-arm), which is what the read-only surfaces scope on
+ * — trivy scans every format it finds, and the language tag keeps that honest.
+ */
+export declare function parseTrivyOutput(stdout: string, cwd?: string): Concern[];
+/**
+ * Best-effort fallback so EVERY located finding shows its code, not only the
+ * trivy/checkov ones whose scanner emits a source window. For any concern that
+ * has a line but no scanner-attached snippet (terraform-validate, tflint, …),
+ * read the flagged line from disk. Files are read once and cached; a missing or
+ * unreadable file just leaves the snippet null. Pure-ish (read-only I/O).
+ */
+export declare function attachSourceSnippets(concerns: Concern[], cwd: string): Concern[];
+/** parse `checkov -o json` output (object for one framework, array for several).
+ *  Each block's `check_type` names the framework that produced it (terraform /
+ *  cloudformation / kubernetes / …) — carried onto every concern as its language. */
+export declare function parseCheckovOutput(stdout: string, cwd?: string): Concern[];
+/**
+ * Terraform files changed on the current branch vs the base. Returns null when
+ * the base can't be determined (caller then falls back to a full scan).
+ */
+export declare function changedTerraformFiles(cwd: string): Set<string> | null;
+export interface RunScannersOptions {
+    /** the resolved tool selection. A scanner whose tool is gated/disabled
+     * is reported as a `skipped` outcome (with the licence/disable reason) instead
+     * of running, so `terraform_scan` and the ✗→✓ verifier see the SAME toolchain. */
+    selection?: ResolvedToolSelection | undefined;
+    /** module-fetch credential env, threaded into `terraform validate`'s
+     * init so a private cross-repo `git::` module resolves during a scan. */
+    terraformEnv?: Record<string, string> | undefined;
+    /** when true, checkov resolves and scans INSIDE registry/git modules
+     * (`--download-external-modules true`). Required by the refactor b.4 path so
+     * adopting a third-party module can't launder its internal findings; off by
+     * default to keep the normal scan fast and offline. */
+    downloadExternalModules?: boolean | undefined;
+    /** checkov `--framework` values (see checkovFrameworksFor). Defaults to the
+     * Terraform-only pair — the fix loop never widens; the read-only Assess path
+     * passes the language-scope-derived set for multi-language breadth. */
+    checkovFrameworks?: string[] | undefined;
+    /** per-scanner egress policy (supply-chain 0.2, the `tools_network` input).
+     * A denied tool runs under the blackhole-proxy env overlay and its outcome
+     * records `egress_isolation: "partial"`. Absent ⇒ open egress (today's
+     * behaviour) — deny is opt-in. */
+    toolsNetwork?: ToolsNetworkDirective | undefined;
+}
+/** run every scanner once over `cwd`. shared by `terraform_scan` and the
+ * deterministic remediation verifier so both see the identical toolchain. A
+ * scanner the selection has turned off is emitted as `skipped` (never run), so
+ * the gate applies identically to the scan and its verification re-scan. */
+export declare function runScanners(cwd: string, opts?: RunScannersOptions): ScannerOutcome[];
+export interface RemediationVerdict {
+    /** true only when every original concern id is absent from the re-scan. */
+    verified: boolean;
+    /** original ids no longer present (the fix cleared them). */
+    resolved: string[];
+    /** original ids still present (the fix did NOT clear them). */
+    remaining: string[];
+}
+/**
+ * Deterministic ✗→✓ check: partition the group's original `concern_ids` into
+ * those gone from a fresh scan (`resolved`) and those still present
+ * (`remaining`). Concern ids are content hashes (`sha1(source|rule|file|line)`),
+ * so a missing id means that exact concern is gone — the correct primitive for
+ * "did the fix clear it", independent of severity/scope filtering. This is the
+ * code-level replacement for the agent eyeballing a re-scan and self-reporting.
+ */
+export declare function computeRemediationVerdict(originalConcernIds: string[], currentConcernIds: Set<string>): RemediationVerdict;
+/**
+ * Regression guard. The full re-scan (`terraform_verify_remediation`)
+ * already sees the whole workspace, so a concern the fix *introduced* shows up
+ * in the current scan. Regressions are exactly the content ids present after the
+ * fix that were not in the pre-fix baseline — `current − baseline`. A non-empty
+ * result means the fix traded one defect for another (e.g. an encryption block
+ * that trips a different tflint rule) and must downgrade the PR to needs-human.
+ *
+ * Both id sets are computed the same way (the deduped union of every scanner's
+ * concern ids, unfiltered by severity) so the diff is apples-to-apples — a
+ * regression at ANY severity is caught, not just ones above the run threshold.
+ * Returns sorted ids for a stable PR body.
+ */
+export declare function computeRegressions(baselineConcernIds: Iterable<string>, currentConcernIds: Iterable<string>): string[];
+/**
+ * Line-INDEPENDENT ✗→✓ partition (the integrity-preserving replacement for the
+ * raw-id `computeRemediationVerdict` when scan context is available). Each
+ * requested entry carries its display `id` and its `key` (see `concernKeyOf`);
+ * a concern is `remaining` iff its KEY still appears in the re-scan, else
+ * `resolved`. Because a fix that shifts lines keeps the same (source|rule|file)
+ * key, an unfixed concern can no longer be mis-reported as resolved. Pure.
+ */
+export declare function partitionByKey(requested: {
+    id: string;
+    key: string;
+}[], currentKeys: Set<string>): RemediationVerdict;
+/**
+ * Line-INDEPENDENT regression set: one representative current concern id per KEY
+ * present in the re-scan but absent from the pre-fix baseline keys. A pre-existing
+ * concern that merely shifted to a new line (same key) is NOT a regression — only
+ * a genuinely new (rule, file) defect is. Replaces the raw-id `computeRegressions`
+ * for the integrity path. Pure; returns sorted ids for a stable PR body.
+ */
+export declare function regressionIdsByKey(current: {
+    id: string;
+    key: string;
+}[], baselineKeys: Set<string>): string[];

package/dist/mcp/terraform/signing.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Detached Ed25519 signing for the compliance artefacts (the evidence bundle in
+ * [[evidence]] and the CycloneDX VEX in [[vex]]) — the "signed evidence" story.
+ *
+ * Design constraints, in order:
+ *   - **Sign the exact bytes written to disk.** The builders are already
+ *     deterministic (same inputs ⇒ same bytes), so no JSON canonicaliser is
+ *     needed — the detached `.sig` covers the file verbatim.
+ *   - **`node:crypto` only** (`sign`/`verify` with a `null` digest — Ed25519 is
+ *     a pure signature scheme); no new dependency.
+ *   - **Honest when unsigned.** The private key arrives via env only
+ *     (`INFRAWEAVER_SIGNING_KEY`, a base64-encoded PKCS#8 PEM). Unset ⇒ the
+ *     artefact records an explicit `"signature": null` — never a fake or
+ *     self-referential signature. A key that is SET but malformed throws (a
+ *     mis-configured signer must fail loudly, not silently emit unsigned).
+ *   - The key name matches the `_KEY` suffix in `utils/secrets.ts`
+ *     SENSITIVE_PATTERNS, so it is redacted from logs and stripped from every
+ *     subprocess env by the default-deny filter.
+ *
+ * Verify side: `infraweaver verify-evidence <bundle> <sig> <pubkey>` (src/cli.ts →
+ * commands/verifyEvidence.ts) re-checks a bundle offline with only the public key.
+ */
+import { type KeyObject } from "node:crypto";
+export declare const SIGNING_KEY_ENV = "INFRAWEAVER_SIGNING_KEY";
+export declare const SIGNATURE_ALGORITHM: "Ed25519";
+export interface SigningKey {
+    privateKey: KeyObject;
+    /** the public half, SPKI PEM — embedded in artefact metadata so a consumer
+     * can verify without any other channel. */
+    publicKeyPem: string;
+    /** sha256 of the SPKI DER, hex — the short handle a PR body / log names. */
+    fingerprint: string;
+}
+/** metadata embedded in a signed artefact (never the signature itself — the
+ * signature covers these bytes, so it must live in the detached `.sig`). */
+export interface SignatureMetadata {
+    algorithm: typeof SIGNATURE_ALGORITHM;
+    public_key: string;
+    fingerprint_sha256: string;
+    /** sibling file carrying the base64 detached signature. */
+    detached_signature: string;
+}
+/**
+ * Load the signing key from the env (base64-encoded PKCS#8 PEM, Ed25519).
+ * Returns null when unset/empty (the honest-unsigned path); throws when a key
+ * is present but not a valid Ed25519 PKCS#8 PEM — a configured signer that
+ * can't sign is an operator error, never a silent downgrade.
+ */
+export declare function loadSigningKey(raw?: string | undefined): SigningKey | null;
+/** detached Ed25519 signature over the exact bytes, base64. */
+export declare function signBytes(bytes: string | Buffer, key: SigningKey): string;
+/** verify a detached base64 signature against the exact bytes + an SPKI PEM
+ * public key. Returns false (never throws) on a malformed signature/key, so a
+ * verifier can report FAILED rather than crash on garbage input. */
+export declare function verifyBytes(bytes: string | Buffer, signatureB64: string, publicKeyPem: string): boolean;
+/** sha256 fingerprint (hex) of an SPKI PEM public key — the same handle
+ * {@link loadSigningKey} derives, computable by a verifier from the PEM alone. */
+export declare function publicKeyFingerprint(publicKeyPem: string): string;
+/** the metadata block an artefact embeds when this key signs it. `sigFile` is
+ * the sibling `.sig` filename (relative — beside the artefact). */
+export declare function signatureMetadata(key: SigningKey, sigFile: string): SignatureMetadata;

package/dist/mcp/terraform/stateLocking.d.ts

@@ -0,0 +1,18 @@
+import { type Concern } from "#app/mcp/terraform/types";
+export interface DeprecatedLockingSite {
+    /** 1-based line of the `backend "s3"` block. */
+    line: number;
+    /** the `dynamodb_table` value as written (a literal, or an expression). */
+    table: string;
+}
+/**
+ * Every `terraform { backend "s3" { … } }` that locks via `dynamodb_table`
+ * without `use_lockfile = true`.
+ *
+ * Walks `terraform` → `backend` explicitly rather than matching `dynamodb_table`
+ * anywhere: `aws_dynamodb_table` resources and module inputs of the same name
+ * are common, and a currency finding fabricated from one of those would be
+ * indistinguishable from a real one to whoever reads the report.
+ */
+export declare function findDeprecatedStateLocking(hcl: string): DeprecatedLockingSite[];
+export declare function deprecatedStateLockingToConcerns(sites: DeprecatedLockingSite[], file: string): Concern[];

package/dist/mcp/terraform/subprocess.d.ts

@@ -0,0 +1,43 @@
+export type RunResult = {
+    status: number;
+    stdout: string;
+    stderr: string;
+    missing: boolean;
+};
+/**
+ * Hard wall-clock cap on any single scanner/terraform invocation. Bounds a hung
+ * subprocess (e.g. `terraform init`/`plan` stalling on a private registry, a
+ * tflint plugin fetch that never returns) so it can't block the run forever.
+ * Generous (5 min) so it only ever fires on a genuine hang, never a slow-but-
+ * progressing plan. A timeout surfaces as a non-zero/`-1` status the caller
+ * already treats as "this scanner did not produce results".
+ */
+export declare const SUBPROCESS_TIMEOUT_MS = 300000;
+/**
+ * Run a scanner without throwing. Terraform tools exit non-zero when they FIND
+ * issues, so a non-zero status is normal, not an error. `missing` is set when
+ * the binary isn't on PATH (ENOENT) — the scanner then degrades to "skipped"
+ * rather than failing the run (a tool being absent must not block).
+ *
+ * `extraEnv` opts a specific command back into a needed credential: the scanners
+ * run with a restricted env that strips every `*_KEY`/secret, but infracost
+ * legitimately needs its `INFRACOST_API_KEY`. resolveEnv(object) merges the
+ * restricted base with the explicit vars, so only the named keys get through.
+ */
+export declare function run(cmd: string, args: string[], cwd: string, extraEnv?: Record<string, string>): RunResult;
+/** test seam — forget the resolved CLI so a test can exercise both branches. */
+export declare function resetTerraformCliCache(): void;
+/**
+ * Run a Terraform CLI command, preferring `terraform` and transparently falling
+ * back to OpenTofu (`tofu`) when `terraform` is ABSENT from PATH (ENOENT). The two
+ * share the exact surface the engine uses (fmt / validate / init / plan / show),
+ * and the licence posture already prefers OpenTofu (Terraform is BUSL) — so an
+ * OpenTofu-only runner keeps full fmt/validate/plan coverage instead of reporting
+ * everything skipped. The fallback is probed via the FIRST real command (no
+ * separate `version` call, so a mocked runner that answers `fmt`/`init`/`plan`
+ * needs no extra stubbing) and the chosen binary is memoised for the rest of the
+ * process — the one-time resolution to `tofu` is logged so the operator sees which
+ * CLI ran. When BOTH are absent the terraform result (missing) is returned so the
+ * caller degrades to "skipped" exactly as before. `runner` is injectable for tests.
+ */
+export declare function runTf(args: string[], cwd: string, extraEnv?: Record<string, string>, runner?: typeof run): RunResult;

package/dist/mcp/terraform/suppressions.d.ts

@@ -0,0 +1,90 @@
+import type { Concern, ConcernSuppression } from "#app/mcp/terraform/types";
+export type SuppressionSource = ConcernSuppression["source"];
+export interface Suppression {
+    source: SuppressionSource;
+    rule: string;
+    reason: string;
+    expires: string | null;
+    paths: string[];
+    file: string | null;
+    /** Set when this came from a NATIVE scanner skip directive (checkov/tfsec/trivy)
+     *  rather than a `#infraweaver:ignore`. The owning scanner already honours it; we
+     *  carry the provenance so the unified audit trail shows where it came from. */
+    tool?: string;
+}
+export interface ParsedSuppressions {
+    suppressions: Suppression[];
+    warnings: string[];
+}
+export declare function parseInlineSuppressions(content: string, file: string): ParsedSuppressions;
+/** A native scanner-skip directive with its source location — the line-aware shape
+ *  behind both the suppression pipeline and the orphan-skip audit. */
+export interface NativeSkip {
+    tool: string;
+    /** namespaced rule, e.g. "checkov:CKV_AWS_20" — matches a concern's `rule_id`. */
+    rule: string;
+    reason: string;
+    expires: string | null;
+    file: string;
+    /** 1-based line of the directive. */
+    line: number;
+}
+/** Collect every native scanner-skip directive in a file, WITH line numbers. The
+ *  single source of truth for native-skip parsing (used by the suppression pipeline
+ *  and the orphan-skip audit). At most one directive per line. */
+export declare function collectNativeSkips(content: string, file: string): NativeSkip[];
+/**
+ * Parse native scanner skip directives (`#checkov:skip=…`, `#tfsec:ignore:…`,
+ * `#trivy:ignore:…`) into the unified `Suppression` shape so they can be honoured
+ * and audited alongside `#infraweaver:ignore`. Native skips don't mandate a reason
+ * (their tools don't), so a synthetic one records the provenance. The rule is
+ * namespaced (`checkov:CKV_AWS_20`) so it matches a surviving concern's `rule_id`.
+ */
+export declare function parseNativeSuppressions(content: string, file: string): ParsedSuppressions;
+/**
+ * Native skips that NO concern corresponds to — the owning scanner already dropped
+ * the finding (or the rule never fired), so the skip is invisible to Infraweaver's
+ * gate and posture. Surfacing these keeps scanner-native suppressions auditable
+ * (a `#checkov:skip` can silently hide a real issue forever). A skip "matches" a
+ * concern when its rule matches (exact / bare / `:suffix`) AND the file is the same.
+ * Canonical cross-rule matching (a trivy skip vs a checkov concern for the *same*
+ * issue) is a future taxonomy refinement — see `taxonomy.ts`.
+ */
+export declare function findOrphanNativeSkips(skips: NativeSkip[], concerns: Concern[]): NativeSkip[];
+export interface NativeSkipAudit {
+    /** every native skip found in the scanned tree. */
+    skips: NativeSkip[];
+    /** the subset with no corresponding concern (the audit signal). */
+    orphans: NativeSkip[];
+}
+/**
+ * Walk a file list, collect native skips, and partition them against the scan's
+ * concern set. `read` returns a file's content or null (missing). Pure given its
+ * inputs, so it's unit-testable without a real tree.
+ */
+export declare function auditNativeSkips(files: string[], concerns: Concern[], read: (relPath: string) => string | null): NativeSkipAudit;
+export declare function parseSuppressionPolicy(raw: string, format: "yaml" | "json"): ParsedSuppressions;
+export declare function loadSuppressionPolicy(cwd: string | undefined): ParsedSuppressions;
+/**
+ * The suppression policy that APPLIES to this run.
+ *
+ * On a pull-request run the `suppressions:` block is read from the **base ref**,
+ * not the PR's head: a waiver is an accepted risk, and accepting it is exactly
+ * what the review is for. Letting a PR silence the finding that would otherwise
+ * block it is the self-approval hole the two-person SoD on waivers (§5.3) exists
+ * to close — this closes the file-shaped version of it. A PR that adds a waiver
+ * still sees the finding; the waiver applies from the next run on the merged base.
+ *
+ * Everything degrades to the head value with a warning when the base ref can't
+ * be read (shallow clone) or the run isn't a PR — stated, never silent.
+ */
+export declare function loadSuppressionPolicyForRun(cwd: string | undefined): ParsedSuppressions;
+export interface ApplySuppressionsOptions {
+    policy: Suppression[];
+    cwd: string;
+    now?: Date;
+    readFile?: (relPath: string) => string | null;
+    onWarn?: (warning: string) => void;
+}
+export declare function applySuppressions(concerns: Concern[], opts: ApplySuppressionsOptions): Concern[];
+export declare function suppressConcerns(concerns: Concern[], cwd: string, now?: Date): Concern[];

package/dist/mcp/terraform/taxonomy.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Cross-scanner canonical taxonomy (2c, v1).
+ *
+ * Different scanners flag the SAME real misconfiguration under different rule IDs
+ * — trivy `AVD-AWS-0088`, checkov `CKV_AWS_19` and tfsec
+ * `aws-s3-enable-bucket-encryption` are all "S3 bucket not encrypted". Without a
+ * mapping, that one issue surfaces as up-to-three findings. This module maps known
+ * rule IDs onto a canonical resource+misconfig class so the same issue at the same
+ * resource collapses into ONE finding tagged with every tool that caught it.
+ *
+ * v1 scope: a curated table of high-value AWS misconfigs (the long tail + non-AWS
+ * providers expand the table over time). The merge is conservative — it only
+ * collapses concerns that share a canonical class AND a file AND were reported by
+ * DIFFERENT tools, so two distinct same-tool resources in one file are never
+ * silently merged.
+ */
+import { type Concern } from "#app/mcp/terraform/types";
+export interface CanonicalClass {
+    /** stable id, e.g. "aws-s3-encryption". */
+    id: string;
+    /** short human title for the merged finding. */
+    title: string;
+    /** member rule IDs (bare, lowercased — no scanner namespace). */
+    rules: string[];
+}
+/** The curated taxonomy. Each entry's `rules` are the equivalent rule IDs across
+ *  scanners. Keep `rules` lowercased + namespace-free; lookup normalises both. */
+export declare const CANONICAL_CLASSES: readonly CanonicalClass[];
+/** The canonical class id this concern maps to, or null when it isn't in the table. */
+export declare function canonicalClassOf(concern: Concern): string | null;
+/**
+ * Collapse cross-scanner duplicates. Concerns sharing a canonical class + file,
+ * reported by ≥2 DIFFERENT tools, merge into one (highest severity wins, the
+ * canonical title is used, `flagged_by` lists every contributing tool). Concerns
+ * with a class but only one tool are tagged (class + `flagged_by`) but kept
+ * separate; concerns with no canonical class pass through untouched. Input order
+ * is otherwise preserved.
+ */
+export declare function dedupeCrossScanner(concerns: Concern[]): Concern[];

package/dist/mcp/terraform/tfquery.d.ts

@@ -0,0 +1,47 @@
+import type { LocalToolContext } from "#app/mcp/localContext";
+/** The extension Terraform reserves for query configuration. */
+export declare const TFQUERY_SUFFIX = ".tfquery.hcl";
+/** True for a path Terraform would execute as a query configuration. */
+export declare function isQueryFile(path: string): boolean;
+/** One `list "<type>" "<name>" { … }` block — a declared intent to discover
+ *  unmanaged resources of that type. */
+export interface QueryListBlock {
+    /** the resource type being searched for, e.g. `google_compute_instance`. */
+    resourceType: string;
+    /** the query's local name, unique within the directory. */
+    name: string;
+    /** the `provider` argument as written — which provider configuration is
+     *  queried. Null when absent (Terraform requires it; we report, not validate). */
+    provider: string | null;
+    /** the `limit` as written, or null when defaulted (Terraform's default is 100). */
+    limit: string | null;
+    /** whether the block asks for full resource bodies (`include_resource`). */
+    includeResource: boolean;
+    /** 1-based line of the block header. */
+    line: number;
+}
+export interface QueryFileInventory {
+    file: string;
+    lists: QueryListBlock[];
+}
+/** Parse one query file's `list` blocks. Pure. */
+export declare function parseQueryFile(hcl: string): QueryListBlock[];
+export interface QueryInventory {
+    files: QueryFileInventory[];
+    /** total `list` blocks across the tree. */
+    total: number;
+    /** distinct resource types being searched for, sorted. */
+    resourceTypes: string[];
+}
+/**
+ * Every query file under `cwd` and the `list` blocks it declares.
+ *
+ * Returns an inventory, never findings — see the module note. An unreadable file
+ * is skipped rather than reported: a query file we cannot read is a gap in the
+ * inventory, and inventing an entry for it would be worse than a shorter list.
+ */
+export declare function collectQueryInventory(cwd: string): QueryInventory;
+export declare const TerraformQueryInventoryParams: import("arktype/internal/variants/object.ts").ObjectType<object, {}>;
+export declare function TerraformQueryInventoryTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<object, object>> & {
+    mutates?: boolean;
+};

package/dist/mcp/terraform/toolchainIntegrity.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Compromised-scanner gate (supply-chain phase 0.1).
+ *
+ * THE THREAT, CONCRETELY. In March 2026 the Trivy project was compromised
+ * (TeamPCP): a malicious **v0.69.4** was published across GHCR, ECR Public,
+ * Docker Hub, deb/rpm and `get.trivy.dev` on 19 Mar; 76 of 77 `trivy-action`
+ * tags and all 7 `setup-trivy` tags were repointed at infostealer commits;
+ * malicious 0.69.5 / 0.69.6 images followed on 22 Mar. The payload dumped
+ * runner memory and called home. Advisory: GHSA-69fq-xp46-6x23. Last clean
+ * release before the incident: 0.69.3.
+ *
+ * WHY THIS LIVES HERE. Infraweaver does not download the toolchain — it executes
+ * whatever `trivy`/`checkov`/`tflint` the customer's CI put on PATH, inside the
+ * customer's runner, alongside their credentials. So the registry-side controls
+ * that failed in this incident are not ours to fix; what we CAN do is refuse to
+ * execute a build we know is malicious. A scanner is the one subprocess whose
+ * output we trust, so running a known-backdoored one is the worst case for an
+ * attestation product: we would be both the execution vector and the notary.
+ *
+ * FAIL-CLOSED, NOT SKIP. Every other scanner problem here degrades to
+ * "skipped" (absent binary, unparseable output) because a missing tool must not
+ * block a run. A KNOWN-COMPROMISED tool is the opposite: continuing would mean
+ * knowingly executing malware, so this throws and the run stops.
+ */
+/** A published release known to be malicious. */
+interface CompromisedRelease {
+    /** Binary name as invoked (matches the `run()` command). */
+    tool: string;
+    /** Exact affected versions — never a range, so a fix release can't be caught. */
+    versions: readonly string[];
+    /** Advisory id to name in the failure message. */
+    advisory: string;
+    /** Shortest safe instruction for the operator. */
+    guidance: string;
+}
+/**
+ * The denylist. Deliberately EXACT versions: a range would sweep up the fixed
+ * release and turn a security control into an outage. Add an entry per advisory.
+ */
+export declare const COMPROMISED_RELEASES: readonly CompromisedRelease[];
+/**
+ * Extract a semantic version from a tool's `--version` output. Tools disagree
+ * wildly on format (`Version: 0.55.0`, `TFLint version 0.52.0`, a bare
+ * `3.2.0`), so take the first `x.y.z` that appears. Returns null when the output
+ * carries no recognisable version. Pure.
+ */
+export declare function parseToolVersion(output: string): string | null;
+/**
+ * The advisory matching a tool+version, or null when the pair is not known to be
+ * compromised. Pure — the whole decision is table-driven and testable without a
+ * subprocess.
+ */
+export declare function compromisedRelease(tool: string, version: string | null): CompromisedRelease | null;
+/** The operator-facing failure text for a compromised tool. Pure. */
+export declare function compromisedToolMessage(rel: CompromisedRelease, version: string): string;
+/** Reset the probe cache — tests only. */
+export declare function resetToolVersionCache(): void;
+/**
+ * Every tool version probed this process, sorted by tool name — the scanner
+ * half of the evidence bundle's PROVENANCE block (A.3). These are the versions
+ * the integrity gate actually observed before executing each scanner, so the
+ * signed bundle records the toolchain that genuinely ran — nothing is probed
+ * retroactively and nothing is fabricated for a tool that never ran. `null`
+ * means the tool ran a probe but printed no recognisable version.
+ */
+export declare function probedToolVersions(): {
+    tool: string;
+    version: string | null;
+}[];
+/**
+ * Detect a tool's version by running `<tool> --version`. Returns null when the
+ * binary is absent or prints nothing recognisable (both are non-events — the
+ * caller's normal "skipped" path handles an absent tool).
+ */
+export declare function detectToolVersion(tool: string, cwd: string): string | null;
+/**
+ * Fail-closed gate: throws when `tool` on PATH is a known-compromised release.
+ * A no-op for an absent tool, an unknown version, or any tool with no advisory —
+ * this must never become a reason a clean run fails.
+ */
+export declare function assertToolchainIntegrity(tool: string, cwd: string): void;
+export {};