infraweaver 0.1.0

package/dist/utils/instructions.d.ts

@@ -0,0 +1,48 @@
+import { type AgentId } from "#app/external";
+import type { Mode } from "#app/modes";
+import type { ResolvedPayload } from "#app/utils/payload";
+import type { LearningsHeading } from "#app/utils/runContext";
+import type { RunContextData } from "#app/utils/runContextData";
+interface InstructionsContext {
+    payload: ResolvedPayload;
+    repo: RunContextData["repo"];
+    modes: Mode[];
+    agentId: AgentId;
+    outputSchema?: Record<string, unknown> | undefined;
+    /** absolute path to the seeded learnings tmpfile, or null when the file
+     * couldn't be seeded for some reason. main.ts always seeds, so in
+     * practice this is always set; the null case keeps the type honest. */
+    learningsFilePath: string | null;
+    /** server-parsed TOC for the body of the learnings tmpfile. rendered
+     * inline into the LEARNINGS prompt section so the agent can `read_file`
+     * targeted line ranges instead of pulling the whole file into context. */
+    learningsHeadings: LearningsHeading[];
+    /** agent-facing description of a setup lifecycle hook failure (see
+     * `describeSetupFailure`), rendered as a SETUP HOOK FAILED banner. empty
+     * string when the hook succeeded, was skipped, or wasn't configured. */
+    setupHookFailure: string;
+}
+export interface ResolvedInstructions {
+    full: string;
+    system: string;
+    user: string;
+    eventInstructions: string;
+    event: string;
+    runtime: string;
+}
+/** render the heading list as an indented bullet TOC. ranges shown in
+ * parentheses (`(L3-L18)`); the start line is always the heading line
+ * itself, so reading the listed range gives the agent the heading +
+ * body together. shallowest heading depth in the body sits at the root
+ * column; deeper levels indent by `(depth - rootDepth) * 2` spaces. */
+export declare function renderLearningsToc(headings: LearningsHeading[]): string;
+/** assemble the LEARNINGS prompt section: file path + intro + either
+ * the rendered heading TOC (when the body has structure) or a no-headings
+ * affordance pointing the agent at the reflection turn for restructuring.
+ * empty string when the seed step failed and there's no path to surface. */
+export declare function buildLearningsSection(ctx: {
+    filePath: string | null;
+    headings: LearningsHeading[];
+}): string;
+export declare function resolveInstructions(ctx: InstructionsContext): ResolvedInstructions;
+export {};

package/dist/utils/keylessOidc.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Stash for the GitHub Actions OIDC request creds used by KEYLESS (Sigstore)
+ * evidence signing.
+ *
+ * The `terraform_emit_evidence` / `terraform_emit_vex` tools run DURING the agent
+ * loop — after `main.ts` scrubs `ACTIONS_ID_TOKEN_REQUEST_*` from the env (in
+ * every shell mode) — so they can't call `core.getIDToken()` / read those vars
+ * themselves. Infraweaver already snapshots the request creds early (see
+ * `resolveTokens` in `utils/token.ts`, which reads them for mid-run token
+ * re-mints); this module lets that same snapshot feed a `sigstore`-audience OIDC
+ * token to Fulcio at emit time.
+ *
+ * Fulcio requires the OIDC token's `aud` to be exactly `sigstore` (its configured
+ * audience), distinct from Infraweaver Cloud's own `cloudOidcAudience()`.
+ */
+import { type OidcCreds } from "#app/utils/github";
+/** Fulcio's required OIDC audience for the public-good instance. */
+export declare const SIGSTORE_OIDC_AUDIENCE: "sigstore";
+/** Record the OIDC request creds for later keyless signing. Call once at startup
+ *  (before the restricted-mode env scrub), passing `readOidcCreds()`. `undefined`
+ *  off-CI, which simply disables keyless signing (there is no ambient identity). */
+export declare function stashKeylessOidcCreds(creds: OidcCreds | undefined): void;
+/** True when an ambient GitHub Actions OIDC identity was captured — i.e. keyless
+ *  signing is possible (running in CI with `id-token: write`). */
+export declare function keylessOidcAvailable(): boolean;
+/** Fetch a fresh `sigstore`-audience OIDC JWT for Fulcio from the stashed creds.
+ *  Throws when no creds were stashed (off-CI, or the workflow lacks id-token:write). */
+export declare function fetchSigstoreOidcToken(): Promise<string>;

package/dist/utils/leapingComment.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The prefix text for the initial "leaping into action" comment.
+ * Used to detect whether a progress comment is still in its initial state
+ * and hasn't been updated with real progress or error messages.
+ *
+ * Lives in `utils/` (not `mcp/`) so it can be re-exported via `infraweaver/internal`
+ * without dragging the MCP server's transitive imports into the Next.js app's
+ * type-check graph.
+ */
+export declare const LEAPING_INTO_ACTION_PREFIX = "Leaping into action";
+export declare function isLeapingIntoActionCommentBody(body: string): boolean;

package/dist/utils/learnings.d.ts

@@ -0,0 +1,62 @@
+import type { ToolContext } from "#app/mcp/server";
+import { MAX_LEARNINGS_LENGTH, truncateAtLineBoundary } from "#app/utils/learningsTruncate";
+export { MAX_LEARNINGS_LENGTH, truncateAtLineBoundary };
+/**
+ * Repo-level learnings — operational facts about a repo (setup steps, test
+ * commands, conventions, gotchas) that accumulate across agent runs and feed
+ * back into future runs as durable context. Modeled on the PR-summary tmpfile
+ * pattern (see action/utils/prSummary.ts):
+ *
+ *   1. server seeds `infraweaver-learnings.md` with the verbatim body of
+ *      `Repo.learnings` (or empty for fresh repos), and parses headings
+ *      server-side (`utils/learningsToc.ts`) — the parsed TOC is rendered
+ *      into the LEARNINGS prompt section, not into the file
+ *   2. the agent reads the TOC in the prompt and uses listed line ranges
+ *      to read just the sections relevant to the current task — file can
+ *      grow large, but only targeted ranges hit the agent's context
+ *   3. agent edits the file in place at end-of-run during the reflection
+ *      turn (see action/agents/postRun.ts buildLearningsReflectionPrompt)
+ *   4. main.ts reads the file back at end-of-run and PATCHes
+ *      `/api/repo/[owner]/[repo]/learnings` if the body changed
+ *
+ * Edit-in-place avoids stuffing the entire learnings list into both the
+ * prompt context and an `update_learnings` MCP tool call (which previously
+ * required passing the FULL merged list as a string parameter — an
+ * output-token tax that grew linearly with the learnings size).
+ *
+ * Section structure is agent-curated. The reflection prompt teaches
+ * hierarchy + a soft 300-line-per-section cap to keep TOC ranges
+ * agent-targetable on long-lived repos; there is no fixed taxonomy.
+ */
+export declare const LEARNINGS_FILE_NAME = "infraweaver-learnings.md";
+export declare function learningsFilePath(tmpdir: string): string;
+/** seed the rolling learnings tmpfile with the verbatim DB body (or empty
+ * string for fresh repos). returns the absolute path. the parsed TOC is
+ * carried separately via `RepoSettings.learningsHeadings` and rendered
+ * into the prompt by `resolveInstructions`, so the file on disk is just
+ * the body — no markers, no scaffold, no in-file TOC. */
+export declare function seedLearningsFile(params: {
+    tmpdir: string;
+    current: string | null;
+}): Promise<string>;
+/** read the agent-edited learnings file. returns null when the file is
+ * missing or unreadable (treated as "no change"). caps content at the
+ * server's max length to avoid a 400 round-trip. */
+export declare function readLearningsFile(path: string): Promise<string | null>;
+/**
+ * Read the agent-edited repo-level learnings tmpfile and PATCH it to
+ * `Repo.learnings`.
+ *
+ * Best-effort: any failure is logged and does not affect the run's success
+ * status. Skips the PATCH when the file is byte-trim-identical to its seed —
+ * the agent didn't touch it, so writing the same content back would just
+ * burn a `LearningsRevision` row and an API round-trip.
+ *
+ * `ctx.toolState.model` is forwarded so `LearningsRevision.model` keeps
+ * populating; it powers the per-revision attribution badge in the UI
+ * history view.
+ *
+ * `learningsPersistAttempted` guards against double-execution between the
+ * normal end-of-run path and the SIGINT/SIGTERM handler.
+ */
+export declare function persistLearnings(ctx: ToolContext): Promise<void>;

package/dist/utils/learningsTruncate.d.ts

@@ -0,0 +1,25 @@
+/**
+ * pure string helpers for capping and line-boundary-truncating the
+ * `Repo.learnings` body. lives in its own module (vs alongside
+ * `learnings.ts`) so the proprietary root app can re-export it through
+ * `action/internal/index.ts` without dragging the entire MCP type graph
+ * along — `learnings.ts` imports `ToolContext` for its runtime helpers,
+ * and pulling that into the SDK-facing `internal` barrel expands the
+ * type graph reachable from root `tsc` and `cf-worker-indexing` to every
+ * tool module under `action/mcp/`. keeping these helpers MCP-free is the
+ * cheap structural fix.
+ *
+ * see `action/utils/learnings.ts` for the full learnings-file lifecycle.
+ */
+/** maximum size of `Repo.learnings` body in chars. action truncates the
+ * read-back BEFORE the PATCH to avoid sending an oversized payload; the
+ * server applies the same truncation as a defense-in-depth backstop (any
+ * caller that misses the client-side step would otherwise persist a
+ * mid-line tail, breaking the next-run TOC parse).
+ *
+ * raised from 10k → 100k once the TOC affordance landed: with line-range
+ * reads via the server-parsed TOC the agent doesn't ingest the whole
+ * file, so the cap is governed by curation discipline rather than a
+ * tight byte ceiling. 100k holds ~400-500 short bullets. */
+export declare const MAX_LEARNINGS_LENGTH = 100000;
+export declare function truncateAtLineBoundary(body: string, cap: number): string;

package/dist/utils/lifecycle.d.ts

@@ -0,0 +1,57 @@
+export interface ExecuteLifecycleHookParams {
+    event: string;
+    script: string | null;
+    /**
+     * when true, after the hook runs (success or failure), discard tracked-file
+     * mods so the agent doesn't see hook-generated drift (e.g. `pnpm install`
+     * rewriting a lockfile). untracked files are preserved — hooks that
+     * intentionally materialize files (e.g. a `.env` from a template) stay
+     * visible to the agent. skipped (with a warning) if the tree had
+     * pre-existing tracked changes before the hook ran, so we never clobber
+     * pre-existing work; pre-existing untracked files are ignored for this
+     * gate because `git restore --staged --worktree .` doesn't touch them
+     * anyway. no-op when no script was configured.
+     */
+    normalizeWorkingTreeAfter?: boolean;
+}
+/** structured failure info — `output` on the `exit` variant is trimmed
+ * stderr, falling back to stdout when stderr is empty. */
+export type LifecycleHookFailure = {
+    kind: "exit";
+    exitCode: number;
+    output: string;
+} | {
+    kind: "timeout";
+} | {
+    kind: "spawn";
+    spawnError: string;
+};
+/** one-line, agent-facing description of a hook failure. empty string when
+ * there was no failure, so callers can pass the result straight through to a
+ * prompt section that omits itself on empty. */
+export declare function describeSetupFailure(failure: LifecycleHookFailure | undefined): string;
+export interface LifecycleHookResult {
+    /**
+     * human-readable warning when the hook failed. includes retry guidance:
+     * transient spawn/exit errors are worth retrying, timeouts and
+     * persistent failures are not. absent when the hook succeeded or was
+     * skipped. setup/post-checkout callers surface this verbatim; prepush
+     * builds its own message from `failure` instead.
+     */
+    warning?: string;
+    /**
+     * structured failure info — undefined when the hook succeeded or was
+     * skipped. lets callers compose their own messaging without parsing the
+     * `warning` string.
+     */
+    failure?: LifecycleHookFailure;
+}
+/**
+ * execute a lifecycle hook script if one is configured.
+ *
+ * soft-fails: instead of throwing on hook errors, returns a warning string
+ * (and structured failure info) so callers can choose how to surface it
+ * (mcp tools relay it to the agent; setup logs it and adds a prompt banner).
+ * timeouts are flagged as non-retryable in the warning text.
+ */
+export declare function executeLifecycleHook(params: ExecuteLifecycleHookParams): Promise<LifecycleHookResult>;

package/dist/utils/log.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Logging utilities that work well in both local and GitHub Actions environments
+ */
+import { type AgentUsage } from "#app/agents/shared";
+/** run `fn` with every log line prefixed by `prefix` (e.g. "[task-label]") in magenta */
+export declare function withLogPrefix<T>(prefix: string, fn: () => Promise<T>): Promise<T>;
+type LogSink = "actions" | "stderr";
+/**
+ * Route ALL log output to stderr instead of `@actions/core` (which writes to
+ * stdout). Required before starting a stdio MCP server: stdout is the JSON-RPC
+ * channel there, and a single stray diagnostic line corrupts the framing.
+ * The GitHub Action path never calls this — its sink stays `@actions/core`.
+ */
+export declare function setLogSink(next: LogSink): void;
+/**
+ * Start a collapsed group (GitHub Actions) or regular group (local)
+ */
+declare function startGroup(name: string): void;
+/**
+ * End a collapsed group
+ */
+declare function endGroup(): void;
+/**
+ * Run a callback within a collapsed group
+ */
+declare function group(name: string, fn: () => void): void;
+/**
+ * Print a formatted box with text
+ */
+declare function box(text: string, options?: {
+    title?: string;
+    maxWidth?: number;
+}): void;
+/**
+ * Overwrite the job summary with the given text.
+ * Skips if:
+ * - Not in GitHub Actions
+ * - Running inside Docker (CI tests inherit host env vars but can't access host paths)
+ * - GITHUB_STEP_SUMMARY not set
+ */
+export declare function writeSummary(text: string): Promise<void>;
+/**
+ * Print a formatted table using the table package
+ */
+declare function printTable(rows: Array<Array<{
+    data: string;
+    header?: boolean;
+} | string>>, options?: {
+    title?: string;
+}): void;
+/**
+ * Print a separator line
+ */
+declare function separator(length?: number): void;
+/**
+ * Main logging utility object - import this once and access all utilities
+ */
+export declare const log: {
+    /** Print info message */
+    info: (...args: unknown[]) => void;
+    /** Print a warning message. Use only for warnings that should be displayed in the job summary. */
+    warning: (...args: unknown[]) => void;
+    /** Print an error message. Use only for errors that should be displayed in the job summary. */
+    error: (...args: unknown[]) => void;
+    /** Print success message */
+    success: (...args: unknown[]) => void;
+    /** Print debug message (only when debug mode is enabled) */
+    debug: (...args: unknown[]) => void;
+    /** Print a formatted box with text */
+    box: typeof box;
+    /** Print a formatted table using the table package */
+    table: typeof printTable;
+    /** Print a separator line */
+    separator: typeof separator;
+    /** Start a collapsed group (GitHub Actions) or regular group (local) */
+    startGroup: typeof startGroup;
+    /** End a collapsed group */
+    endGroup: typeof endGroup;
+    /** Run a callback within a collapsed group */
+    group: typeof group;
+    /** Log tool call information to console with formatted output */
+    toolCall: ({ toolName, input }: {
+        toolName: string;
+        input: unknown;
+    }) => void;
+};
+/**
+ * Format a value as JSON, using compact format for simple values and pretty-printed for complex ones
+ */
+export declare function formatJsonValue(value: unknown): string;
+/**
+ * Format a multi-line string with proper indentation for tool call output
+ * First line has the label, subsequent lines are indented 4 spaces
+ */
+export declare function formatIndentedField(label: string, content: string): string;
+/**
+ * format aggregated usage data as a markdown table for the GitHub step summary.
+ *
+ * columns mirror the per-run stdout token table emitted by `logTokenTable`
+ * (Input / Cache Read / Cache Write / Output / Total / Cost ($)) so the job
+ * summary and the in-run logs can be compared row-for-row.
+ *
+ * notes:
+ *   - `AgentUsage.inputTokens` is the sum of non-cached input + cache read
+ *     + cache write (set that way by both agent harnesses' `buildUsage`),
+ *     so the non-cached Input column is recovered by subtracting cache fields.
+ *   - `costUsd` is sourced from models.dev (OpenCode) or `total_cost_usd`
+ *     (Claude CLI). absent rows show `—` so per-agent coverage is obvious.
+ */
+export declare function formatUsageSummary(entries: AgentUsage[]): string;
+export {};

package/dist/utils/modelResolver.d.ts

@@ -0,0 +1,63 @@
+import type { Agent } from "#app/agents/index";
+import { type ProxyMint } from "#app/utils/proxyModel";
+import type { AccountPlan } from "#app/utils/runContext";
+/**
+ * The single owner of the model decision. "Which model runs, on which harness,
+ * with what auth" used to be smeared across main.ts and four utils; the two
+ * entry points here are the whole story:
+ *
+ *   1. {@link captureModelAuthority} — the ordered BYOK-authority capture
+ *      (baseline → Codex auth.json → authorized set), returned as an explicit
+ *      value instead of hidden module state the caller must remember to
+ *      sequence correctly.
+ *   2. {@link resolveRunModel} — BYOK gate → managed-proxy overlay → env
+ *      patch → api-key validation, returning the routed model + harness.
+ *
+ * The building blocks stay where they are (catalog in models.ts, gate in
+ * agent.ts, proxy overlay in proxyModel.ts); this module owns their
+ * composition and ordering.
+ */
+/**
+ * Capture the BYOK model authority in the one order that is correct:
+ * the BASELINE set (what OpenCode can route from the runner's pre-existing
+ * env alone) must be snapshotted BEFORE Codex auth.json is materialized, and
+ * the AUTHORIZED set after — their diff is the Codex credential's
+ * contribution, logged by the capture. Returns the authorized set, the
+ * authoritative input for {@link resolveRunModel}.
+ */
+export declare function captureModelAuthority(opencodeCliPath: string): Set<string>;
+export interface RoutedRunModel {
+    /** the effective model that will run (post-fallback); undefined → auto-select */
+    model: string | undefined;
+    /** the slug to surface in footers/logs */
+    effectiveSlug: string | undefined;
+    /** the harness resolved for the effective model */
+    agent: Agent;
+    /** set only when the free safety-net fallback engaged */
+    fallback?: {
+        from: string;
+        to: string;
+    };
+    /** operator warnings for the caller to log */
+    warnings: string[];
+}
+/**
+ * Resolve the model + auth for this run in one call: the BYOK gate (resolve
+ * slug → pick harness → free-fallback decision), the managed EU Bedrock proxy
+ * overlay (a no-op unless PAYG with no BYO key), the env patch the routing
+ * needs, and the api-key validation the gate asks for. Throws the actionable
+ * authorized-model list on an unavailable model, a `BillingError` when the
+ * managed path needs a payment method, and the missing-key error when
+ * validation fails — all before any agent runs.
+ */
+export declare function resolveRunModel(input: {
+    slug: string | undefined;
+    plan: AccountPlan;
+    credential: string;
+    authorized: Set<string>;
+    repo: {
+        owner: string;
+        name: string;
+    };
+    mint?: ProxyMint;
+}): Promise<RoutedRunModel>;

package/dist/utils/moduleFetch.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Build the `GIT_CONFIG_*` env that authorises `git clone` of a private module
+ * over HTTPS for each host. Pure (token + hosts in, env out) so it is unit-
+ * testable without a real git. Empty/whitespace hosts are dropped; hosts are
+ * de-duplicated case-insensitively. Returns an empty object only when no usable
+ * host remains (the caller treats that as "no module-fetch credential").
+ */
+export declare function buildModuleFetchGitEnv(token: string, hosts: string[]): Record<string, string>;
+/**
+ * The hosts a module-fetch credential should authorise: always github.com, plus
+ * the GitHub host the run executes against (a GitHub Enterprise Server instance
+ * via `GITHUB_SERVER_URL`) when it differs. Reads the env; pure given it.
+ */
+export declare function moduleFetchHosts(serverUrl?: string | undefined): string[];
+/**
+ * Build the SSH env for fetching a private `git::ssh://…` module. The key MUST be
+ * a file for `ssh -i`, so it is written 0600 into `keyDir` (the run's tmpdir,
+ * wiped at run end) — never the home dir, never committed. `IdentitiesOnly=yes`
+ * stops ssh falling back to an agent or other keys; `StrictHostKeyChecking=accept-new`
+ * trusts the host on first use rather than the interactive prompt that would hang a
+ * headless run. Pure given an injected writer (so it is unit-testable without fs).
+ * Returns `{}` for a blank key.
+ */
+export declare function buildModuleFetchSshEnv(sshKey: string, keyDir: string, writeKey?: (path: string, contents: string) => void): Record<string, string>;
+/**
+ * Resolve the module-fetch git env for a run, or undefined when neither a
+ * `module_fetch_token` (HTTPS) nor a `module_fetch_ssh_key` (SSH) was supplied
+ * (the common case — public/registry/local modules need no credential). The result
+ * is merged into the env of the `terraform init`/`plan` invocations so private
+ * cross-repo modules resolve. SSH activates only when `opts.sshKeyDir` is given (a
+ * writable scratch dir for the ephemeral key — the run's tmpdir at the real sites).
+ */
+export declare function resolveModuleFetchEnv(payload: {
+    moduleFetchToken?: string | undefined;
+    moduleFetchSshKey?: string | undefined;
+}, opts?: {
+    sshKeyDir?: string;
+    writeKey?: (path: string, contents: string) => void;
+}): Record<string, string> | undefined;

package/dist/utils/normalizeEnv.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Trim surrounding whitespace from a sensitive value and register it as a
+ * GitHub Actions log mask. Trailing newlines from terminal-copy paste are a
+ * common footgun: the value travels through GH Actions logs and any tool
+ * that re-emits parts of it leaks the unmasked tail. Trimming canonicalises
+ * the value so the mask matches exactly what downstream tools will print.
+ *
+ * Masking is delegated to `core.setSecret` (not raw `console.log`) so the
+ * toolkit percent-encodes `\r`/`\n`; the runner V2 parser decodes them and
+ * registers the full value plus every non-empty line as separate masks. That
+ * keeps us safe for embedded-newline values (PEMs, kubeconfigs, JSON blobs)
+ * even though they aren't currently used.
+ *
+ * Returns the trimmed value, or `null` when the input was whitespace-only —
+ * callers must leave `process.env` untouched in that case so a misconfigured
+ * value surfaces as a clear "missing key" downstream rather than silently
+ * mutating to the empty string.
+ */
+export declare function sanitizeSecret(key: string, value: string): string | null;
+/**
+ * Normalize environment variables to uppercase.
+ * This handles case-insensitive env var names (e.g., `anthropic_api_key` -> `ANTHROPIC_API_KEY`).
+ *
+ * If there are conflicts (same key with different capitalizations but different values),
+ * logs a warning and keeps the uppercase version.
+ *
+ * Also trims and masks sensitive values so accidental trailing whitespace
+ * doesn't defeat GitHub Actions log masking.
+ */
+export declare function normalizeEnv(): void;

package/dist/utils/openCodeModels.d.ts

@@ -0,0 +1,11 @@
+/** Snapshot the set of models OpenCode can serve from the current env, BEFORE
+ * Infraweaver-stored credentials are merged in. Call once early in `main.ts`. */
+export declare function captureBaselineModels(cliPath: string): void;
+/** Snapshot the set of models OpenCode can serve AFTER dbSecrets +
+ * Codex auth.json are in place. Logs the diff against the baseline as
+ * `» BYOK auth enabled N model(s): …`. */
+export declare function captureAuthorizedModels(cliPath: string): void;
+/** Authorized set captured after Infraweaver-stored auth is applied. Throws if
+ * called before `captureAuthorizedModels` — the call sites (fallback gate,
+ * api-key validation, auto-select) all run strictly after capture. */
+export declare function getAuthorizedModels(): Set<string>;

package/dist/utils/openaiCompatible.d.ts

@@ -0,0 +1,26 @@
+/** endpoint base URL for the `openai-compatible/byok` route (e.g. an Ollama, vLLM,
+ *  TGI, HuggingFace Inference Endpoint, or Azure OpenAI base URL). */
+export declare const OPENAI_COMPATIBLE_BASE_URL_ENV = "OPENAI_COMPATIBLE_BASE_URL";
+/** API key for the endpoint. Optional — keyless self-hosted servers (a local
+ *  Ollama) omit it and the adapter is handed a placeholder instead. */
+export declare const OPENAI_COMPATIBLE_API_KEY_ENV = "OPENAI_COMPATIBLE_API_KEY";
+/** opencode provider name for the injected custom endpoint. */
+export declare const OPENAI_COMPATIBLE_PROVIDER = "openai-compatible";
+/**
+ * Is `model` the resolved id for the `openai-compatible/byok` route? Detected by
+ * the env sentinel — after `resolveModel`, a routing slug becomes its raw backing
+ * id (here `OPENAI_COMPATIBLE_MODEL_ID`), so this is how the harness re-identifies
+ * the route downstream (same pattern as `isVertexRoute` / the Bedrock sentinel).
+ * A HuggingFace model id can itself contain a `/`, so callers must NOT rely on the
+ * slash heuristic that distinguishes raw Bedrock/Vertex ids — use this instead.
+ */
+export declare function isOpenAiCompatibleRoute(model: string | undefined): boolean;
+/** When the route is active, the opencode model string is `openai-compatible/<id>`. */
+export declare function resolveOpenAiCompatibleOpenCodeModel(model: string | undefined): string | undefined;
+/**
+ * The opencode `provider` block that registers the user's OpenAI-compatible
+ * endpoint via the AI SDK's `@ai-sdk/openai-compatible` adapter. Returns undefined
+ * unless both the model id and base URL are set. `apiKey` falls back to a non-empty
+ * placeholder so keyless self-hosted endpoints still satisfy the adapter.
+ */
+export declare function openAiCompatibleProviderBlock(): Record<string, unknown> | undefined;

package/dist/utils/opentofuMcp.d.ts

@@ -0,0 +1,50 @@
+/**
+ * OpenTofu MCP server integration — the permissively-licensed sibling to
+ * [[terraformMcp]].
+ *
+ * When the `opentofu_mcp` input is on, the agent harness registers the OpenTofu
+ * project's registry MCP server next to infraweaver's. It gives the fixing agent
+ * live OpenTofu Registry knowledge — provider/resource docs, module details,
+ * current versions — which powers module-source-aware fixes and generation on an
+ * OpenTofu repo, the same way `terraform_mcp` does for the Terraform Registry.
+ * It's the natural pairing for the OpenTofu-first stance the engine already takes
+ * (the scanners fall back to the `tofu` CLI; the licence posture prefers OpenTofu's
+ * MPL fork over BUSL Terraform).
+ *
+ * Why the HOSTED endpoint (not a Docker image like terraform_mcp):
+ *   - the OpenTofu MCP server has NO official Docker image; it's published as a
+ *     hosted streamable-HTTP endpoint (OpenTofu's own first-party infrastructure)
+ *     plus an npx package. The hosted endpoint is the zero-install path — no
+ *     docker on the runner, no npm supply-chain surface to pin.
+ *   - it serves PUBLIC registry data and needs NO credentials, so pointing the
+ *     agent at it exposes no repo content or secrets — the queries are the same
+ *     class of public lookups a `tofu init` already makes.
+ *
+ * Security posture:
+ *   - opt-in + licence-gated (MPL-2.0): on only via the `opentofu_mcp` input or by
+ *     naming "opentofu_mcp" in tools_enabled — the explicit, licence-aware
+ *     acknowledgement (an external network surface the operator chooses).
+ *   - read-only registry knowledge only; the server exposes no state/apply/deploy
+ *     tools, so there is nothing mutating for the agent to reach.
+ */
+import { type ToolSelectionFlags } from "#app/utils/toolSelection";
+/** OpenTofu's hosted streamable-HTTP MCP endpoint (first-party; public registry
+ *  data; no credentials). The zero-install path — no docker, no npm pin. */
+export declare const OPENTOFU_MCP_URL = "https://mcp.opentofu.org/mcp";
+/** the registry name the server is registered under in agent MCP configs —
+ *  matches the OpenTofu docs' own client-config examples, so agent guidance
+ *  written against "the opentofu MCP server" finds it under the expected key. */
+export declare const OPENTOFU_MCP_SERVER_NAME = "opentofu";
+export type OpenTofuMcpResolution = {
+    kind: "disabled";
+} | {
+    kind: "available";
+    url: string;
+};
+/**
+ * Decide whether the run gets the OpenTofu registry MCP server. Unlike
+ * `resolveTerraformMcp` there is no docker probe: the server is a hosted HTTP
+ * endpoint, so it's either opted-in (available) or off. A discriminated union so
+ * every harness handles both outcomes explicitly.
+ */
+export declare function resolveOpenTofuMcp(payload: ToolSelectionFlags): OpenTofuMcpResolution;

package/dist/utils/overrides.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Parse + apply the action's `unsafe_overrides` input — a JSON object of env
+ * var overrides that mutate `process.env` at the start of a run. Designed for
+ * e2e testing / debugging from `workflow_dispatch`; only callers with
+ * `actions:write` on the repo can supply it.
+ *
+ * The `unsafe` prefix is load-bearing: GH Actions echoes the value verbatim
+ * in the runner's step-header log, so the raw JSON (including any values
+ * passed in) is visible to anyone with `actions:read` on the calling repo.
+ * Treat the run log as compromised for any value placed in `unsafe_overrides`.
+ */
+/**
+ * Names refused even when present in the input. Overriding these would let a
+ * caller escape infraweaver's scope (GITHUB_TOKEN), break runner internals
+ * (ACTIONS_RUNTIME_*), forge OIDC tokens (ACTIONS_ID_TOKEN_REQUEST_*), or
+ * substitute our server-side auth (INFRAWEAVER_API_SECRET). Customer-facing
+ * provider keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, CLAUDE_CODE_OAUTH_TOKEN,
+ * etc.) are intentionally NOT denied — overriding those is the use case.
+ */
+export declare const DENIED_OVERRIDE_NAMES: ReadonlySet<string>;
+export interface ApplyOverridesResult {
+    applied: string[];
+    denied: string[];
+}
+/** Parse the JSON input. Returns `{}` for empty/whitespace. Throws on shape errors. */
+export declare function parseOverrides(raw: string): Record<string, string>;
+/**
+ * Mutate `params.env` in place with the supplied JSON overrides, skipping any
+ * names in `DENIED_OVERRIDE_NAMES`. Each applied value is registered with
+ * `core.setSecret` so the runner masks it in subsequent log output, and the
+ * raw `UNSAFE_OVERRIDES` env var is deleted so spawned subprocesses don't
+ * inherit the original JSON (which would defeat both the deny-list and the
+ * masking by exposing the values verbatim).
+ *
+ * Returns the applied/denied breakdown so the caller can render an audit log.
+ */
+export declare function applyOverrides(params: {
+    raw: string;
+    env: NodeJS.ProcessEnv;
+}): ApplyOverridesResult;