infraweaver 0.1.0

package/dist/mcp/terraform/vex.d.ts

@@ -0,0 +1,115 @@
+import { TOOL_NAME } from "#app/brand";
+import type { LocalToolContext } from "#app/mcp/localContext";
+import type { EvidenceSubject } from "#app/mcp/terraform/evidence";
+import { type SignatureMetadata } from "#app/mcp/terraform/signing";
+import type { Concern, Severity } from "#app/mcp/terraform/types";
+import { type ConcernVerificationStatus } from "#app/mcp/terraform/verification";
+/**
+ * The spec version emitted. CycloneDX 1.7 is ECMA-424 2nd edition — the version
+ * SBOM/VEX consumers standardise on, so emitting 1.6 would date the artefact.
+ *
+ * The document deliberately stays inside the 1.6 STRUCTURAL SUBSET: every field
+ * used here exists in both schemas, so a 1.6-only consumer still parses it.
+ * `vex.test.ts` validates the same bytes against both schema fixtures, which is
+ * what turns that from an intention into a guarantee.
+ *
+ * The signing path is untouched by this: signatures cover the exact bytes on
+ * disk, not the schema they conform to.
+ */
+export declare const CYCLONEDX_SPEC_VERSION: "1.7";
+/** The older spec version the emitted document remains parseable as. */
+export declare const CYCLONEDX_COMPATIBLE_SPEC_VERSION: "1.6";
+export declare const DEFAULT_VEX_PATH = "compliance/infraweaver-vex.cdx.json";
+/** CycloneDX impact-analysis states this emitter may produce. `not_affected`
+ * is deliberately NOT in this union: absence of a finding is not proof, so an
+ * unfired control never becomes a clearance. */
+export type VexAnalysisState = "exploitable" | "in_triage";
+interface VexProperty {
+    name: string;
+    value: string;
+}
+interface VexComponent {
+    type: "file";
+    "bom-ref": string;
+    name: string;
+}
+interface VexVulnerability {
+    "bom-ref": string;
+    /** the scanner's rule id (trivy AVD-*, checkov CKV_*, tflint rule…). */
+    id: string;
+    source: {
+        name: string;
+    };
+    description: string;
+    ratings: {
+        severity: Severity;
+        method: "other";
+    }[];
+    analysis: {
+        state: VexAnalysisState;
+        detail: string;
+    };
+    affects: {
+        ref: string;
+    }[];
+    properties: VexProperty[];
+}
+export interface CycloneDxVexDocument {
+    bomFormat: "CycloneDX";
+    specVersion: typeof CYCLONEDX_SPEC_VERSION;
+    serialNumber: string;
+    version: number;
+    metadata: {
+        timestamp: string;
+        tools: {
+            components: {
+                type: "application";
+                name: typeof TOOL_NAME;
+                version: string;
+            }[];
+        };
+        component: {
+            type: "application";
+            "bom-ref": string;
+            name: string;
+        };
+        properties: VexProperty[];
+    };
+    components: VexComponent[];
+    vulnerabilities: VexVulnerability[];
+}
+/** the five-status verdict → CycloneDX impact-analysis state (honest subset). */
+export declare function vexAnalysisState(status: ConcernVerificationStatus): VexAnalysisState;
+/**
+ * Build the CycloneDX 1.7 VEX document from the assessment's OPEN concerns.
+ * Pure (clock/identity passed in); UUIDs are name-based, seeded like the OSCAL
+ * emitter — same inputs ⇒ identical bytes (the seed includes the generation
+ * timestamp, so ids are stable per generation, not across wall-clock re-runs).
+ * One vulnerability per concern; each affected file becomes a `file` component
+ * the vulnerability `affects` by bom-ref. When `signature` is supplied the
+ * public key + fingerprint are embedded in the document's metadata properties
+ * (inside the signed bytes), so a consumer holding only the artefact + `.sig`
+ * can verify it offline — the same self-contained contract as the evidence
+ * bundle.
+ */
+export declare function buildVexDocument(args: {
+    concerns: Concern[];
+    subject: EvidenceSubject;
+    generatedAt: string;
+    version?: string;
+    signature?: SignatureMetadata | null;
+}): CycloneDxVexDocument;
+export declare const TerraformEmitVexParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    output_path?: string;
+    severity_threshold?: "critical" | "high" | "info" | "low" | "medium";
+}, {}>;
+export declare function TerraformEmitVexTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    output_path?: string;
+    severity_threshold?: "critical" | "high" | "info" | "low" | "medium";
+}, {
+    output_path?: string;
+    severity_threshold?: "critical" | "high" | "info" | "low" | "medium";
+}>> & {
+    mutates?: boolean;
+};
+export {};

package/dist/mcp/terraform/writeOnly.d.ts

@@ -0,0 +1,67 @@
+import { type Concern } from "#app/mcp/terraform/types";
+/** Look up a resource type's attribute names in the installed provider schema.
+ *  Returns null when the type is unknown — the caller must then make NO claim. */
+export type ResourceAttributes = (resourceType: string) => ReadonlySet<string> | null;
+export interface WriteOnlySite {
+    resourceType: string;
+    resourceName: string;
+    /** the persisted argument as written, e.g. `password`. */
+    argument: string;
+    /** the counterpart the INSTALLED provider declares, e.g. `password_wo`. */
+    writeOnlyArgument: string;
+    /** the `_wo_version` companion, when the provider declares one. Null means the
+     *  provider takes the write-only argument without a version — do not invent it. */
+    versionArgument: string | null;
+    /** 1-based line of the offending assignment in the file. */
+    line: number;
+    /** true when the value is a bare string literal — a credential written into the
+     *  repo, not merely into state. Strictly worse, and not fixable by a rename. */
+    literal: boolean;
+    /** true when the value opens a heredoc, i.e. it continues past this line. The
+     *  finding is unaffected (the value is persisted either way) but a single-line
+     *  rewrite cannot express it, so none is offered. */
+    multiline: boolean;
+    /** the assignment as written. */
+    before: string;
+    /** the behaviour-equivalent write-only form. Empty for a `literal` or
+     *  `multiline` value: there is no correct one-line rewrite for either, and
+     *  offering one would imply the transform had solved a problem it hasn't. */
+    after: string;
+}
+/**
+ * Every argument in `hcl` that is persisted to state while the installed provider
+ * offers a write-only counterpart.
+ *
+ * Skipped without a finding: a resource type the schema doesn't know (we cannot
+ * judge it), a block that already assigns the counterpart (mid-migration, or the
+ * author set both — a provider-level conflict `terraform validate` reports better
+ * than we could), and meta-arguments.
+ */
+export declare function findPersistedSecrets(hcl: string, attributesFor: ResourceAttributes): WriteOnlySite[];
+/** The remediation hint for one site — the exact edit, or the reason there isn't
+ *  a mechanical one. */
+export declare function writeOnlyHint(site: WriteOnlySite): string;
+/**
+ * Turn detected sites into native concerns.
+ *
+ * Severity is the band floor (`medium`) for the mechanical case and `high` for a
+ * literal: a referenced secret in state is a real exposure with a one-line fix,
+ * whereas a committed literal needs rotation before anything else and should
+ * escalate. That split is also what keeps the mechanical case auto-remediable —
+ * `classifyAutonomy` routes high-severity security findings to a human, which is
+ * correct for the literal and wrong for the rename.
+ */
+export declare function persistedSecretsToConcerns(sites: WriteOnlySite[], file: string): Concern[];
+export interface WriteOnlyScan {
+    concerns: Concern[];
+    /** set when the provider schema was unavailable, so this rule did NOT run. An
+     *  honest coverage gap, never a silent pass. */
+    coverageGap: string | null;
+}
+/**
+ * The workspace-level entry point, over files ALREADY READ by the caller —
+ * `[repo-relative POSIX path, contents]` pairs. The native pack reads the tree
+ * once and passes the same text to every rule; re-reading each `.tf` per rule
+ * would double the I/O of every scan on exactly the monorepos where it hurts.
+ */
+export declare function scanWriteOnlyFiles(cwd: string, files: ReadonlyArray<readonly [string, string]>): WriteOnlyScan;

package/dist/mcp/terraform.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Facade for the Terraform MCP toolchain. The implementation lives in the
+ * per-concern modules under `./terraform/`; this file re-exports every symbol so
+ * existing importers (`#app/mcp/terraform`) keep resolving unchanged.
+ *
+ *   types     — Concern + shared types/helpers (ids, paths, roots, severity)
+ *   scanners  — fmt / validate / tflint / trivy / checkov + provider/arg schema
+ *   decisions — grouping, autonomy, confidence, refusal, prevention, co-location
+ *   cost      — infracost breakdown / delta / escalation
+ *   currency  — registry version currency (provider + module upgrade intel)
+ *   registry  — published-module lookup/search (public + private registries)
+ *   findings  — reviewer findings + SARIF ingest/emit
+ *   plan      — plan parsing + destroy/blast/stability/aggregation
+ *   tools     — the MCP Tool factories + their *Params schemas
+ *   verification — the five-status taxonomy (fail / not-code-verifiable / …)
+ *   evidence  — the backend-free compliance evidence bundle + emitter
+ *   signing   — detached Ed25519 signing for the compliance artefacts
+ *   vex       — the CycloneDX 1.7 VEX emitter
+ *   nativeRules  — the native rule pack's registry (ids, bands, honesty pairs)
+ *   writeOnly    — secret-persisted-to-state + its FP suppression
+ *   governance   — action triggers + dynamic destroy protection
+ *   tfquery      — *.tfquery.hcl discovery inventory (never remediation input)
+ *   hcl          — the shared, tolerant HCL block scanner every rule reads through
+ */
+export * from "#app/mcp/terraform/cost";
+export * from "#app/mcp/terraform/currency";
+export * from "#app/mcp/terraform/decisions";
+export * from "#app/mcp/terraform/evidence";
+export * from "#app/mcp/terraform/findings";
+export * from "#app/mcp/terraform/governance";
+export * from "#app/mcp/terraform/hcl";
+export * from "#app/mcp/terraform/moduleDocs";
+export * from "#app/mcp/terraform/nativeRules";
+export * from "#app/mcp/terraform/nativeScan";
+export * from "#app/mcp/terraform/normalization";
+export * from "#app/mcp/terraform/oscal";
+export * from "#app/mcp/terraform/paths";
+export * from "#app/mcp/terraform/plan";
+export * from "#app/mcp/terraform/policyAuthor";
+export * from "#app/mcp/terraform/refactor";
+export * from "#app/mcp/terraform/registry";
+export * from "#app/mcp/terraform/risk";
+export * from "#app/mcp/terraform/scanners";
+export * from "#app/mcp/terraform/signing";
+export * from "#app/mcp/terraform/subprocess";
+export * from "#app/mcp/terraform/tfquery";
+export * from "#app/mcp/terraform/tools";
+export * from "#app/mcp/terraform/types";
+export * from "#app/mcp/terraform/verification";
+export * from "#app/mcp/terraform/vex";
+export * from "#app/mcp/terraform/writeOnly";

package/dist/mcp/terratest.d.ts

@@ -0,0 +1,85 @@
+import type { LocalToolContext } from "#app/mcp/localContext";
+/**
+ * Terratest scaffolding (opt-in via the `terratest` input). When Infraweaver
+ * GENERATES a reusable module, it can also scaffold a minimal Go
+ * [Terratest](https://terratest.gruntwork.io/) smoke test + a Terraform-native
+ * `*.tftest.hcl` so the generated infrastructure is testable from the first
+ * commit. Both tests plan the module **directly** — Infraweaver does not generate
+ * `examples/` fixtures.
+ *
+ * Design choices:
+ *  - **Plan-only, never apply.** The scaffolded tests run `terraform init` +
+ *    `plan` against the module and assert it plans cleanly. Infraweaver never
+ *    applies (no cloud credentials — the sovereignty stance), so the generated
+ *    tests mirror that: they're a deployability smoke test the USER runs in their
+ *    own pipeline (with creds) for real apply/assert coverage.
+ *  - **Pure generation.** The file contents are computed deterministically here
+ *    and unit-tested; the agent writes the returned files with its own tools.
+ *  - The Go test + native test files fall outside the Terraform-only default
+ *    allow-list, so the `terratest` input also widens the push guardrail (see
+ *    guardrails.ts).
+ */
+export interface ScaffoldFile {
+    /** repo-relative path to write. */
+    path: string;
+    content: string;
+}
+export interface TerratestScaffold {
+    files: ScaffoldFile[];
+    notes: string[];
+}
+/**
+ * Build a Terratest smoke-test + native test for a generated module. Pure:
+ * `moduleName` names the module, `modulePath` is its repo-relative dir, and
+ * `variables` (optional) are surfaced as TODO placeholders so the test author
+ * fills in real values. Both tests plan the module directly (no `examples/`
+ * fixture). Returns the files to write + operator notes.
+ */
+export declare function scaffoldTerratest(opts: {
+    moduleName: string;
+    modulePath: string;
+    variables?: {
+        name: string;
+        required?: boolean;
+    }[];
+}): TerratestScaffold;
+/**
+ * native variant — scaffold a Terraform-native test (Terraform 1.6+) that
+ * lives in the module's own `tests/` dir and plans the module in place. Lighter
+ * than Terratest: no Go toolchain, just HCL that Terraform runs with
+ * `terraform test`. Plan-only `run` block (no apply, so no cloud needed to
+ * construct the test). Pure.
+ */
+export declare function scaffoldTerraformTest(opts: {
+    moduleName: string;
+    modulePath: string;
+    variables?: {
+        name: string;
+        required?: boolean;
+    }[];
+}): ScaffoldFile;
+export declare const ScaffoldTerratestParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    module_name: string;
+    module_path: string;
+    variables?: {
+        name: string;
+        required?: boolean;
+    }[];
+}, {}>;
+export declare function ScaffoldTerratestTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    module_name: string;
+    module_path: string;
+    variables?: {
+        name: string;
+        required?: boolean;
+    }[];
+}, {
+    module_name: string;
+    module_path: string;
+    variables?: {
+        name: string;
+        required?: boolean;
+    }[];
+}>> & {
+    mutates?: boolean;
+};

package/dist/mcp/untrustedContent.d.ts

@@ -0,0 +1,76 @@
+/**
+ * The instruction/data boundary (OWASP **LLM01**).
+ *
+ * Infraweaver is an LLM agent that ingests repositories it does not trust and
+ * emits code and verdicts. Attacker-influenced text reaches the model from
+ * several directions — scanned `.tf` files, commit messages, scanner output,
+ * and (least obviously) the **description field of an external CSPM finding** —
+ * and none of it is instructions, however much of it is phrased that way.
+ *
+ * Two different defences, because the risk has two shapes:
+ *
+ * 1. **Framing** ({@link UNTRUSTED_DATA_NOTICE}) — a single shared statement of
+ *    the rule, applied wherever untrusted text enters the model's context. It
+ *    was previously written out once, inline, in the reviewer subagent prompt;
+ *    one channel framed and the rest silent is not a boundary. Framing is a
+ *    mitigation, not a guarantee: a determined injection can still be persuasive,
+ *    which is why it is paired with (2) and why the tool-scope invariant is
+ *    enforced structurally rather than by asking nicely (see below).
+ *
+ * 2. **Markup neutralisation** ({@link neutralizeMarkup}) — deterministic, and
+ *    the part that actually *cannot* be argued with. Externally-authored text
+ *    ends up rendered in PR bodies, review comments and SARIF, where GitHub
+ *    interprets Markdown and a useful subset of HTML. Injected markup there can
+ *    forge Infraweaver's own voice (`> [!NOTE] Infraweaver: approved`), hide content
+ *    from a human reviewer (`<details>`, HTML comments), or smuggle a tracking
+ *    pixel. Defusing the control characters costs nothing and removes the class.
+ *
+ * WHAT THIS DELIBERATELY DOES NOT DO. It does not try to *detect* prompt
+ * injection — no keyword list, no "suspicious phrasing" score. Such a detector
+ * is unbounded, fails silently, and would create exactly the false confidence
+ * this codebase avoids elsewhere. The invariant that actually matters — a
+ * read-only mode cannot perform a write — is enforced by construction: the
+ * per-run tool deny set is derived from each tool's `mutates` flag and the MCP
+ * server throws if it resolves empty, so an injected instruction has no write
+ * tool to reach for even if the model were fully persuaded.
+ */
+/**
+ * The shared framing for untrusted text. Written to be read by a model: it says
+ * what the text is, why it addresses you, and — critically — what the
+ * consequence of being steered would be, because "ignore instructions in the
+ * data" alone has repeatedly proven too abstract to hold.
+ */
+export declare const UNTRUSTED_DATA_NOTICE: string;
+/**
+ * Wrap untrusted text in a labelled, clearly-terminated fence.
+ *
+ * The delimiter is deliberately long and unlikely to occur naturally; any
+ * occurrence inside the payload is defanged so the content cannot close its own
+ * fence and continue as apparent prose outside it.
+ */
+export declare function fenceUntrusted(label: string, content: string): string;
+/**
+ * Neutralise Markdown/HTML control constructs in externally-authored text.
+ *
+ * Applied where third-party text enters OUR data model, so every downstream
+ * surface (PR body, review comment, job summary, SARIF message) is covered once
+ * rather than each having to remember. The transform is deliberately narrow —
+ * it defuses *structure*, not words, so the message stays readable:
+ *
+ *   - CR/LF → a single space      multi-line payloads posing as separate sections
+ *   - `\p{Cc}` / `\p{Cf}` stripped  invisible text a human reviewer cannot judge
+ *   - `<` → `&lt;`                HTML tags (`<details>`, `<img onerror>`, comments)
+ *   - fences/backticks defused    code blocks escaping their container
+ *   - leading `>` → `\>`          blockquotes + GitHub callouts (voice forgery)
+ *   - leading `#` → `\#`          headings that restructure a rendered report
+ *
+ * Idempotent in effect (re-running never corrupts already-safe text) and a no-op
+ * for the overwhelmingly common case of ordinary prose.
+ */
+export declare function neutralizeMarkup(text: string): string;
+/**
+ * `neutralizeMarkup` for an optional field, preserving "absent" as absent.
+ * Returns null for text that neutralises to nothing (e.g. a payload that was
+ * entirely zero-width characters), so a caller's `|| fallback` still fires.
+ */
+export declare function neutralizeOptional(text: string | null | undefined): string | null;

package/dist/mcp/upload.d.ts

@@ -0,0 +1,8 @@
+import type { CloudToolContext } from "#app/mcp/capabilityContext";
+export declare function UploadFileTool(ctx: CloudToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    path: string;
+}, {
+    path: string;
+}>> & {
+    mutates?: boolean;
+};

package/dist/models.d.ts

@@ -0,0 +1,181 @@
+/**
+ * model alias registry.
+ *
+ * slugs use the format `provider/model-id` (e.g. "anthropic/claude-opus").
+ * bump `resolve` when a new model generation ships — the alias (slug) stays stable.
+ */
+/**
+ * routing discriminant for entries whose `resolve` is dynamic — looked up
+ * from a separate env var at run time rather than fixed in the catalog.
+ *
+ * `"bedrock"` means the actual model ID comes from `BEDROCK_MODEL_ID`
+ * (an AWS-canonical Bedrock model ID like `eu.anthropic.claude-opus-4-7`
+ * or `amazon.nova-pro-v1:0`). `"vertex"` means the actual model ID comes
+ * from `VERTEX_MODEL_ID` (a Vertex AI model ID like
+ * `claude-opus-4-1@20250805` or `gemini-2.5-pro`). enterprise hosted-model
+ * customers self-select for version control — silent alias bumps would break
+ * compliance review, model-access enrollment, and provisioned-throughput
+ * contracts. so the single `bedrock/byok` and `vertex/byok` entries are
+ * routing slugs, not model aliases: the harness reads the backend-specific
+ * env var and routes to claude-code for Anthropic IDs or opencode for
+ * everything else.
+ *
+ * `"openai-compatible"` means the actual model ID comes from
+ * `OPENAI_COMPATIBLE_MODEL_ID` and the endpoint from `OPENAI_COMPATIBLE_BASE_URL`
+ * — a bring-your-own OpenAI-compatible server (a self-hosted vLLM / Ollama / TGI,
+ * a HuggingFace Inference Endpoint, Azure OpenAI, …). It always routes through
+ * opencode's custom-provider block (the AI SDK's `@ai-sdk/openai-compatible`
+ * adapter); claude-code is never involved.
+ */
+export type ModelRouting = "bedrock" | "vertex" | "openai-compatible";
+export interface ModelAlias {
+    /** stable alias stored in DB, e.g. "anthropic/claude-opus" */
+    slug: string;
+    /** provider key (matches providers keys) */
+    provider: string;
+    /** human-readable name shown in dropdowns */
+    displayName: string;
+    /** concrete models.dev specifier, e.g. "anthropic/claude-opus-4-6". sentinel for routing entries — never passed to a CLI directly. */
+    resolve: string;
+    /** full models.dev specifier for the OpenRouter equivalent (undefined for free models and routing entries) */
+    openRouterResolve: string | undefined;
+    /** top-tier pick for this provider — preferred during auto-select */
+    preferred: boolean;
+    /** whether this alias is free and requires no API key */
+    isFree: boolean;
+    /** slug of a replacement model — presence implies this model is deprecated */
+    fallback: string | undefined;
+    /** dynamic-resolution discriminant — see ModelRouting docs */
+    routing: ModelRouting | undefined;
+    /** alias key (within same provider) of the cheaper sibling loupe should
+     * use as its lens-fanout subagent. e.g. claude-opus → "claude-sonnet". */
+    subagentModel: string | undefined;
+    /** hide from selectable lists (UI dropdowns, CLI pickers). does NOT affect
+     * resolution — for that use `fallback`. used for internal-only tier targets
+     * (e.g. gpt-5.4 as a subagent target without exposing it to users). */
+    hidden: boolean;
+}
+interface ModelDef {
+    displayName: string;
+    /** concrete models.dev specifier, e.g. "anthropic/claude-opus-4-6" */
+    resolve: string;
+    /** full models.dev specifier for the OpenRouter equivalent, e.g. "openrouter/anthropic/claude-opus-4.6" */
+    openRouterResolve?: string;
+    preferred?: boolean;
+    envVars?: readonly string[];
+    isFree?: boolean;
+    /** slug of a replacement model — presence implies this model is deprecated */
+    fallback?: string;
+    /** dynamic-resolution discriminant — see ModelRouting docs */
+    routing?: ModelRouting;
+    /** alias key (within same provider) of the cheaper sibling loupe should
+     * use as its lens-fanout subagent (e.g. claude-opus → "claude-sonnet"). */
+    subagentModel?: string;
+    /** hide from selectable lists. does NOT affect resolution; for that use `fallback`. */
+    hidden?: boolean;
+}
+export interface ProviderConfig {
+    displayName: string;
+    envVars: readonly string[];
+    /** credentials authored only via `infraweaver auth <provider>` — never
+     * user-facing in `init`, never documented as a manual GHA secret. counted
+     * for hasAnyKey / log-redaction purposes but excluded from any prompt /
+     * paste flow. CLI-managed magic. see wiki/codex-auth.md. */
+    managedCredentials?: readonly string[];
+    models: Record<string, ModelDef>;
+}
+export declare const providers: {
+    anthropic: ProviderConfig;
+    openai: ProviderConfig;
+    google: ProviderConfig;
+    xai: ProviderConfig;
+    deepseek: ProviderConfig;
+    moonshotai: ProviderConfig;
+    opencode: ProviderConfig;
+    bedrock: ProviderConfig;
+    vertex: ProviderConfig;
+    "openai-compatible": ProviderConfig;
+    openrouter: ProviderConfig;
+};
+export type ModelProvider = keyof typeof providers;
+export declare function parseModel(slug: string): {
+    provider: string;
+    model: string;
+};
+export declare function getModelProvider(slug: string): string;
+export declare function getProviderDisplayName(slug: string): string | undefined;
+export declare function getModelEnvVars(slug: string): string[];
+/** managed credentials are authored only via `infraweaver auth <provider>` — they
+ * count as "configured" for hasAnyKey-style UI checks but are never offered as
+ * a manual-paste option in `init` or the AgentSettings env-var button row.
+ * see `provider.managedCredentials` and wiki/codex-auth.md. */
+export declare function getModelManagedCredentials(slug: string): string[];
+export declare const modelAliases: ModelAlias[];
+export declare const DEFAULT_PROXY_MODEL: string;
+/** short label for the model auto-select picks today (console hint copy). */
+export declare function getAutoSelectHintModel(): string;
+/** resolve a model slug to its concrete models.dev specifier (e.g. "anthropic/claude-opus-4-6") */
+export declare function resolveModelSlug(slug: string): string | undefined;
+/**
+ * walk the fallback chain to the terminal (non-deprecated) alias.
+ * returns undefined if the chain is broken, exhausted, or cyclic.
+ *
+ * use this in UI display sites (dropdown trigger labels, PR-comment footers,
+ * etc.) so a deprecated stored slug renders as the model the user actually
+ * runs against — not the historical name. selectable lists should still hide
+ * deprecated and internal-only aliases by filtering on `!a.fallback && !a.hidden`.
+ */
+export declare function resolveDisplayAlias(slug: string): ModelAlias | undefined;
+/**
+ * resolve a model slug to the CLI-ready model string, following the fallback
+ * chain when a model is deprecated. returns the first non-deprecated resolve
+ * target, or undefined if the chain is exhausted or broken.
+ */
+export declare function resolveCliModel(slug: string): string | undefined;
+/**
+ * resolve a model slug to the OpenRouter-ready model string, following the
+ * fallback chain when a model is deprecated. returns undefined if the chain
+ * is exhausted/broken or the terminal alias has no openrouter equivalent
+ * (e.g. free opencode models).
+ */
+export declare function resolveOpenRouterModel(slug: string): string | undefined;
+/** env var that supplies the Bedrock model ID for the `bedrock/byok` slug. */
+export declare const BEDROCK_MODEL_ID_ENV = "BEDROCK_MODEL_ID";
+/** env var that supplies the Vertex AI model ID for the `vertex/byok` slug. */
+export declare const VERTEX_MODEL_ID_ENV = "VERTEX_MODEL_ID";
+/** env var that supplies the model ID for the `openai-compatible/byok` slug. */
+export declare const OPENAI_COMPATIBLE_MODEL_ID_ENV = "OPENAI_COMPATIBLE_MODEL_ID";
+/**
+ * the Bedrock model ID passed to claude-code or opencode is whatever the
+ * user set in `BEDROCK_MODEL_ID` — Infraweaver never resolves or upgrades it.
+ * we route by checking whether the ID names an Anthropic model: claude-code
+ * handles Anthropic-on-Bedrock natively (with `CLAUDE_CODE_USE_BEDROCK=1`),
+ * everything else goes through opencode's `amazon-bedrock` provider.
+ *
+ * AWS Bedrock IDs come in two shapes:
+ *   - dotted foundation IDs: `eu.anthropic.claude-opus-4-7`,
+ *     `anthropic.claude-haiku-4-5-20251001-v1:0`, `amazon.nova-pro-v1:0`,
+ *     `meta.llama4-scout-17b-instruct-v1:0`. AWS-published, lowercase, the
+ *     foundation provider always appears as a discrete dot-segment.
+ *   - inference-profile ARNs: `arn:aws:bedrock:eu-west-2:<acct>:application-inference-profile/<user-name>`.
+ *     `<user-name>` is operator-chosen, so a naive substring check is fragile
+ *     in both directions (Anthropic profile named without "anthropic" → routes
+ *     to opencode and misses CLAUDE_CODE_USE_BEDROCK; non-Anthropic profile
+ *     whose name happens to contain "anthropic" → routes to claude-code).
+ *
+ * we anchor on a discrete dot-segment match (case-insensitive). this catches
+ * every published foundation ID and is conservative for ARN-form IDs: ARN
+ * names that don't include "anthropic" as their own dot-segment route to
+ * opencode by default. operators using ARN-form IDs whose backing model is
+ * Anthropic should set `INFRAWEAVER_AGENT=claude` to force the right route, or
+ * include the foundation segment in the profile name.
+ */
+export declare function isBedrockAnthropicId(bedrockModelId: string): boolean;
+/**
+ * Vertex Anthropic model IDs start with the Claude family name, e.g.
+ * `claude-opus-4-1@20250805`. partner-model resource paths can contain the
+ * substring "anthropic" elsewhere, so the Bedrock segment check does not
+ * transfer — anchor on the model ID prefix instead.
+ */
+export declare function isVertexAnthropicId(vertexModelId: string): boolean;
+export {};

package/dist/modes/address-reviews.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function addressReviewsMode(t: ToolRef): Mode;

package/dist/modes/assess.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function assessMode(t: ToolRef): Mode;

package/dist/modes/build.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function buildMode(t: ToolRef): Mode;

package/dist/modes/compliance-audit.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function complianceAuditMode(t: ToolRef): Mode;

package/dist/modes/cost-optimization.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function costOptimizationMode(t: ToolRef): Mode;

package/dist/modes/drift-detect.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function driftDetectMode(t: ToolRef): Mode;

package/dist/modes/fix.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function fixMode(t: ToolRef): Mode;

package/dist/modes/incremental-review.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function incrementalReviewMode(t: ToolRef): Mode;

package/dist/modes/index.d.ts

@@ -0,0 +1,24 @@
+import { type AgentId } from "#app/external";
+import type { Mode } from "./types.ts";
+export { PR_SUMMARY_FORMAT, REFACTOR_PR_FORMAT, REMEDIATION_PR_FORMAT, } from "./prFormats.ts";
+export type { Mode, ToolRef } from "./types.ts";
+export declare function computeModes(agentId: AgentId): Mode[];
+export declare const modes: Mode[];
+/** built-in mode names in canonical casing. used to validate / canonicalize the
+ * `mode` action input so a CI run can pin a mode deterministically instead of
+ * relying on the agent's prompt-driven `select_mode` choice. mode names are
+ * agent-independent (only the embedded tool refs differ per agent), so the
+ * opencode-rendered list is the authoritative name set. */
+export declare const BUILTIN_MODE_NAMES: readonly string[];
+/**
+ * modes that legitimately never modify the working tree. used by the post-run
+ * dirty-tree gate to suppress the "commit and push" nudge — those modes
+ * complete by submitting a review, posting a comment, or reporting a verdict,
+ * not by touching files. any leftover in the tree at end-of-run is incidental
+ * tool noise (e.g. a `node_modules/` from a stray install attempt) on an
+ * ephemeral worktree; nudging the agent to commit it would produce a spurious
+ * PR. derived from the `nonCommitting` flag each read-only mode declares in
+ * its own factory, so a new mode carries its committing-ness with it instead
+ * of needing a second edit here.
+ */
+export declare const NON_COMMITTING_MODES: ReadonlySet<string>;

package/dist/modes/modernize-deprecated.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function modernizeDeprecatedMode(t: ToolRef): Mode;

package/dist/modes/plan.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function planMode(t: ToolRef): Mode;

package/dist/modes/policy-gate.d.ts

@@ -0,0 +1,2 @@
+import type { Mode, ToolRef } from "./types.ts";
+export declare function policyGateMode(t: ToolRef): Mode;