infraweaver 0.1.0

package/src/mcp/staleFix.ts

@@ -0,0 +1,557 @@
+import { type } from "arktype";
+import { PRODUCT_NAME, PRODUCT_SLUG } from "#app/brand";
+import type { GitHubToolContext } from "#app/mcp/capabilityContext";
+import { addFooter } from "#app/mcp/comment";
+import { assertTargetInScope } from "#app/mcp/scope";
+import { execute, tool, toolOk } from "#app/mcp/shared";
+import { log } from "#app/utils/cli";
+
+/**
+ * Stale-fix self-healing. A Infraweaver remediation PR is "base + a minimal,
+ * proven fix". When the base branch advances after the PR is opened, the PR goes
+ * stale: its diff is computed against an old base, the concern may already be
+ * resolved upstream (a human fixed it, or the base changed the file), or the
+ * branch simply needs re-deriving on the new base. A scheduled `RefreshRemediation`
+ * run sweeps the open remediation PRs and, per PR, either re-derives the fix on
+ * the current base and force-updates it, closes it as already-resolved, or leaves
+ * it for a human when someone has added their own commits.
+ *
+ * This file is the GitHub-orchestration seam: a pure classifier (`assessStaleFix`)
+ * that decides what to do from git facts, the read tool that surfaces the open
+ * remediation PRs with their staleness, and the focused write tool that closes a
+ * now-redundant PR. The actual re-derive/validate/verify loop is driven by the
+ * mode prompt using the existing scan/validate/verify/push tools — no git merge
+ * is performed (re-deriving on the fresh base avoids conflict resolution entirely
+ * and keeps the PR diff to exactly the fix).
+ */
+
+// the branch-name conventions Infraweaver opens PRs under: `remediate/<group-id>`
+// (incl. `remediate/batch-<hash>`) for a fix and `infraweaver/generate-<slug>` for
+// a generation. The naming is the primary "this is Infraweaver's PR" signal.
+const REMEDIATION_BRANCH = /^(?:remediate\/|infraweaver\/generate-)/;
+
+/** true when `branch` is a Infraweaver remediation/generation branch. */
+export function isRemediationBranch(branch: string): boolean {
+  return REMEDIATION_BRANCH.test(branch);
+}
+
+/** the `<group-id>` of a `remediate/<group-id>` branch (the scan group id that
+ * keys the fix), or null for a generation branch / non-remediation branch. */
+export function groupIdFromBranch(branch: string): string | null {
+  return branch.match(/^remediate\/(.+)$/)?.[1] ?? null;
+}
+
+/** core matcher: a NON-EMPTY identity string (a GitHub login or a git author
+ * name) that belongs to a bot — Infraweaver's own, or any `[bot]` account. */
+function matchesBotIdentity(identity: string): boolean {
+  const normalized = identity.replace(/\[bot\]$/i, "").toLowerCase();
+  return (
+    normalized === PRODUCT_SLUG ||
+    normalized === `${PRODUCT_SLUG}dev` ||
+    /\[bot\]$/i.test(identity)
+  );
+}
+
+/** a git author email belonging to a bot noreply account, e.g.
+ * `infraweaver[bot]@users.noreply.github.com`. */
+function isBotEmail(email: string): boolean {
+  return /\[bot\]@/i.test(email);
+}
+
+/** true when a commit-author LOGIN is Infraweaver's bot (so a commit by it is NOT
+ * a human edit). A null/absent login is treated as non-human here for backward
+ * compatibility of this login-only helper — but prefer {@link isBotCommit}, which
+ * resolves an absent login via the commit's git identity rather than assuming
+ * bot (the assumption that caused a human commit with an unlinked email to be
+ * force-overwritten). */
+export function isBotActor(login: string | null | undefined): boolean {
+  if (!login) return true;
+  return matchesBotIdentity(login);
+}
+
+/** the authorship slice of a compareCommits entry that {@link isBotCommit} reads. */
+export interface CommitAuthorship {
+  /** the GitHub user GitHub resolved from the commit's author email, or null when
+   * the email isn't linked to any account — true for Infraweaver's own `[bot]`
+   * noreply email AND for a human committing under an unverified email. */
+  author?: { login?: string | null } | null;
+  /** the raw git author identity from the commit object, present even when the
+   * GitHub `author` account above is null. */
+  commit?: {
+    author?: { name?: string | null; email?: string | null } | null;
+  } | null;
+}
+
+/**
+ * Decide whether a remediation-branch commit is Infraweaver's own (a bot commit,
+ * safe to force-overwrite on refresh) or a human/third-party edit (must be
+ * preserved — escalate instead of refresh).
+ *
+ * A resolved GitHub `author.login` is authoritative: a positive bot match is a
+ * bot, a real login is a human. When the login is ABSENT — which happens both for
+ * Infraweaver's own commits (its `infraweaver[bot]` noreply email doesn't map to a
+ * GitHub account) and for a human committing under an unverified email — fall
+ * back to the commit's git identity: only a recognised bot name/email
+ * (`infraweaver[bot]`, any `[bot]`) counts as a bot; ANY other identity is treated
+ * as a human edit. This is the conservative direction on purpose — a missed bot
+ * commit costs one skipped auto-refresh, whereas a missed human commit is a
+ * force-push that destroys their work.
+ */
+export function isBotCommit(commit: CommitAuthorship): boolean {
+  const login = commit.author?.login;
+  if (login) return isBotActor(login);
+  const name = commit.commit?.author?.name ?? "";
+  const email = commit.commit?.author?.email ?? "";
+  return matchesBotIdentity(name) || isBotEmail(email);
+}
+
+export type StaleFixStatus =
+  | "current"
+  | "stale"
+  | "human_touched"
+  | "checks_failing";
+export type StaleFixAction = "skip" | "refresh" | "escalate";
+
+/** the latest CI conclusion on a remediation PR's head, used to self-heal a PR
+ * whose own checks are red (a failed `terraform plan`, a failing module test, a
+ * policy gate) even when its base hasn't moved. `unknown` = no checks reported or
+ * the read failed (treated as "no signal" — never manufactures a refresh). */
+export type ChecksState = "passing" | "failing" | "pending" | "unknown";
+
+/** check-run conclusions that count as a hard CI failure for self-heal purposes.
+ * `neutral`/`skipped`/`stale`/`cancelled`/`success` are NOT failures. */
+const FAILING_CONCLUSIONS = new Set([
+  "failure",
+  "timed_out",
+  "action_required",
+]);
+
+export interface StaleFixAssessment {
+  status: StaleFixStatus;
+  action: StaleFixAction;
+  reason: string;
+  /** a likely zombie: stale (base advanced), untouched by humans, and open past
+   * the staleness age threshold — surface it so the sweep prioritizes closing it
+   * once the concern is confirmed resolved. Advisory; the action stays `refresh`. */
+  zombie: boolean;
+}
+
+/** age (in days, PR open duration) past which a stale, untouched remediation PR
+ * is flagged as a likely zombie for prioritized cleanup. */
+export const DEFAULT_STALE_AFTER_DAYS = 30;
+
+/**
+ * How many times the sweep will auto re-derive a remediation PR to clear a FAILING
+ * CI check before it gives up and escalates to a human. Self-heal is on by default,
+ * but a fix the engine proves green locally yet that keeps failing the consumer's
+ * CI (a cloud-credentialled `terraform plan`, a flaky integration test) must not
+ * loop forever — past the cap the PR is labelled needs-human and left alone. Only
+ * the checks-failing path is capped; a genuine base move is always a fresh refresh.
+ */
+export const DEFAULT_SELF_HEAL_MAX_ATTEMPTS = 3;
+
+/** the per-attempt label the sweep stamps on a PR each time it self-heals a red
+ * CI, so the retry budget survives across stateless runs. Accumulating (add-only):
+ * the attempt count is how many are present. */
+const SELF_HEAL_ATTEMPT_LABEL = /^infraweaver-self-heal-attempt-\d+$/;
+
+/** count of self-heal attempts already recorded on a PR, from its accumulated
+ * `infraweaver-self-heal-attempt-N` labels. */
+export function selfHealAttempts(labels: string[]): number {
+  return labels.filter((l) => SELF_HEAL_ATTEMPT_LABEL.test(l)).length;
+}
+
+/** the label to stamp when recording the next self-heal attempt (1-based). */
+export function nextSelfHealLabel(attempts: number): string {
+  return `infraweaver-self-heal-attempt-${attempts + 1}`;
+}
+
+/**
+ * Decide what a refresh sweep should do with one open remediation PR, from git +
+ * CI facts alone. Pure.
+ *  - a branch carrying NON-bot commits is `human_touched` → `escalate` (never
+ *    force-overwrite a human's work; leave it for review).
+ *  - a branch whose base has NOT advanced AND whose checks are not failing is
+ *    `current` → `skip` (the fix is still derived against the live base).
+ *  - a branch whose own CI is red (and base unchanged) is `checks_failing` →
+ *    `refresh`: re-derive the fix on the current base and re-prove it (the
+ *    self-heal case — a failed plan/test/policy on Infraweaver's own PR). Two guards
+ *    stop this looping forever: (1) if it is ALREADY labelled needs-human and the
+ *    base hasn't moved, re-deriving would only reproduce the same failing fix, so
+ *    `skip`; (2) once `selfHealAttempts` reaches `maxSelfHealAttempts` (default 3)
+ *    the sweep gives up and `escalate`s instead of re-deriving again.
+ *  - otherwise the base moved → `stale` → `refresh`: re-derive the fix on the
+ *    current base, then close it if the concern is already resolved or update it.
+ *
+ * `ageDays` (PR open duration) is advisory: a stale, untouched PR open past
+ * `staleAfterDays` is additionally flagged `zombie` so the sweep can prioritize
+ * clearing the long-rotting ones. It never changes the action — a fix is only
+ * ever closed once a re-scan confirms its concern is actually resolved.
+ */
+export function assessStaleFix(input: {
+  baseBehindBy: number;
+  hasNonBotCommits: boolean;
+  /** the PR's CI is red (a failed plan/test/policy) — triggers a self-heal. */
+  checksFailing?: boolean;
+  /** the PR already carries `needs-human` — used as the self-heal loop guard. */
+  alreadyEscalated?: boolean;
+  /** self-heal attempts already recorded on this PR (from its attempt labels). */
+  selfHealAttempts?: number;
+  /** the retry ceiling for self-heal (default {@link DEFAULT_SELF_HEAL_MAX_ATTEMPTS}). */
+  maxSelfHealAttempts?: number;
+  ageDays?: number;
+  staleAfterDays?: number;
+}): StaleFixAssessment {
+  if (input.hasNonBotCommits) {
+    return {
+      status: "human_touched",
+      action: "escalate",
+      reason: `the PR branch has commit(s) not authored by ${PRODUCT_SLUG} — auto-refresh would overwrite a human's work; label it needs-human and leave it for review`,
+      zombie: false,
+    };
+  }
+  const baseMoved = input.baseBehindBy > 0;
+  const checksFailing = input.checksFailing === true;
+
+  if (!baseMoved && !checksFailing) {
+    return {
+      status: "current",
+      action: "skip",
+      reason:
+        "the base has not advanced since the PR was opened — the fix is still current",
+      zombie: false,
+    };
+  }
+
+  // self-heal loop guard: a still-failing PR we already escalated, with an
+  // unchanged base, would only re-derive the same failing fix — leave it.
+  if (!baseMoved && checksFailing && input.alreadyEscalated) {
+    return {
+      status: "checks_failing",
+      action: "skip",
+      reason:
+        "the PR's checks are failing but it is already labelled needs-human and the base has not moved — left for a human to avoid a refresh loop",
+      zombie: false,
+    };
+  }
+
+  // checks-failing only (base unchanged): self-heal — re-derive + re-prove. Bounded
+  // by the retry cap so a fix the engine proves green locally but that keeps failing
+  // the consumer's CI can't loop forever.
+  if (!baseMoved && checksFailing) {
+    const attempts = input.selfHealAttempts ?? 0;
+    const max = input.maxSelfHealAttempts ?? DEFAULT_SELF_HEAL_MAX_ATTEMPTS;
+    if (attempts >= max) {
+      return {
+        status: "checks_failing",
+        action: "escalate",
+        reason: `self-heal exhausted its retry budget (${attempts}/${max} attempts) without clearing CI — escalate to needs-human and STOP; no further auto-retry on this PR`,
+        zombie: false,
+      };
+    }
+    return {
+      status: "checks_failing",
+      action: "refresh",
+      reason:
+        `the PR's checks are failing while the base is unchanged — self-heal attempt ${attempts + 1} of ${max}: ` +
+        "re-derive the fix on the current base and re-prove it (✗→✓), then stamp the attempt label. " +
+        "If the re-derived fix still can't be proven green, escalate to needs-human instead of force-pushing a known-failing fix.",
+      zombie: false,
+    };
+  }
+
+  // base moved (the original staleness case; checks may also be red).
+  const threshold = input.staleAfterDays ?? DEFAULT_STALE_AFTER_DAYS;
+  const ageDays = input.ageDays;
+  const zombie = ageDays !== undefined && ageDays >= threshold;
+  const ageNote =
+    zombie && ageDays !== undefined
+      ? ` It has been open ${Math.floor(ageDays)} day(s) (≥ ${threshold}) with no human commits — a likely zombie; prioritize closing it once the concern is confirmed resolved.`
+      : "";
+  return {
+    status: "stale",
+    action: "refresh",
+    reason:
+      `the base advanced ${input.baseBehindBy} commit(s) since the PR was opened — re-scan on the current base, ` +
+      "then close the PR if the concern is already resolved or re-derive + force-update the fix otherwise." +
+      (checksFailing
+        ? " Its checks are also failing — re-prove the fix is green before force-updating."
+        : "") +
+      ageNote,
+    zombie,
+  };
+}
+
+/** Minimal shape of `octokit.rest.checks.listForRef` — typed as optional so a
+ * mock/older client without the Checks API degrades to `unknown` rather than
+ * throwing. */
+type ChecksListForRef = (args: {
+  owner: string;
+  repo: string;
+  ref: string;
+  per_page?: number;
+}) => Promise<{
+  data: { check_runs?: Array<{ status?: string; conclusion?: string | null }> };
+}>;
+
+/**
+ * Best-effort read of the latest CI conclusion on a PR head SHA via the Checks
+ * API, for self-healing a remediation PR whose own checks are red. A missing
+ * `sha`, an absent Checks API, or any read error returns `unknown` — a failed
+ * read must never manufacture a refresh.
+ */
+async function readChecksState(
+  ctx: GitHubToolContext,
+  owner: string,
+  repo: string,
+  sha: string | undefined,
+): Promise<ChecksState> {
+  const listForRef = (
+    ctx.octokit.rest.checks as { listForRef?: ChecksListForRef } | undefined
+  )?.listForRef;
+  if (!sha || !listForRef) return "unknown";
+  try {
+    const res = await listForRef({ owner, repo, ref: sha, per_page: 100 });
+    const runs = res.data?.check_runs ?? [];
+    if (runs.length === 0) return "unknown";
+    if (runs.some((c) => c.status !== "completed")) return "pending";
+    if (runs.some((c) => FAILING_CONCLUSIONS.has(c.conclusion ?? "")))
+      return "failing";
+    return "passing";
+  } catch (e) {
+    log.info(
+      `» checks read skipped for ${sha.slice(0, 7)}: ${e instanceof Error ? e.message : e}`,
+    );
+    return "unknown";
+  }
+}
+
+interface AssessedRemediationPr {
+  number: number;
+  url: string;
+  title: string;
+  branch: string;
+  base: string;
+  group_id: string | null;
+  base_behind_by: number;
+  head_ahead_by: number;
+  has_non_bot_commits: boolean;
+  commit_authors: string[];
+  labels: string[];
+  checks_state: ChecksState;
+  /** self-heal attempts already recorded (from the accumulated attempt labels). The
+   * sweep stops auto-retrying a red PR once this hits the cap (default 3). */
+  self_heal_attempts: number;
+  age_days: number;
+  status: StaleFixStatus;
+  recommended_action: StaleFixAction;
+  zombie: boolean;
+  reason: string;
+}
+
+export const ListRemediationPrsParams = type({
+  "limit?": type.number.describe(
+    "max open remediation PRs to assess (default 30). Each is one compare-commits API call.",
+  ),
+});
+
+export function ListRemediationPrsTool(ctx: GitHubToolContext) {
+  return tool({
+    name: "list_remediation_prs",
+    description:
+      `List the repo's OPEN ${PRODUCT_NAME} remediation/generation PRs (branches \`remediate/<id>\` or ` +
+      "`infraweaver/generate-<slug>`) with their staleness, so a refresh sweep knows which to act on. For each " +
+      "PR it compares the head branch against its base and returns `base_behind_by` (how many commits the " +
+      "base advanced since the PR was opened), `head_ahead_by`, `has_non_bot_commits` (a human pushed to the " +
+      "branch), the `group_id`, labels, and a `recommended_action`: `skip` (still current), `refresh` (base " +
+      "moved — re-derive the fix on the current base, then close-if-resolved or force-update), or `escalate` " +
+      "(human-touched — label needs-human, don't overwrite). It also returns `age_days` and a `zombie` flag " +
+      "(stale + no human commits + open ≥ 30 days) so you can prioritize clearing long-rotting PRs. It also " +
+      "reports each PR's `checks_state` (passing/failing/pending/unknown): a PR whose OWN CI is failing (a red " +
+      "`terraform plan`, a failing module test, a policy gate) is recommended for `refresh` even when its base " +
+      "hasn't moved — self-heal — unless it's already labelled needs-human (then it's left for a human to avoid " +
+      "a loop). Self-heal is bounded: each PR carries `self_heal_attempts` (counted from its " +
+      "`infraweaver-self-heal-attempt-N` labels) and after the cap (3) a still-red PR is recommended for `escalate`, " +
+      "not `refresh`, so it can't loop forever. Read-only. Use it as the first step of RefreshRemediation.",
+    parameters: ListRemediationPrsParams,
+    execute: execute(async ({ limit }) => {
+      const cap = limit ?? 30;
+      const owner = ctx.repo.owner;
+      const repo = ctx.repo.name;
+
+      const open = await ctx.octokit.paginate(ctx.octokit.rest.pulls.list, {
+        owner,
+        repo,
+        state: "open",
+        per_page: 100,
+      });
+      const remediation = open
+        .filter((pr) => isRemediationBranch(pr.head.ref))
+        .slice(0, cap);
+
+      const prs: AssessedRemediationPr[] = [];
+      const errors: { number: number; error: string }[] = [];
+      for (const pr of remediation) {
+        try {
+          // base..head: ahead_by = the PR's own commits, behind_by = commits on
+          // the base the PR lacks (how far the base moved since the fork point).
+          const cmp = await ctx.octokit.rest.repos.compareCommits({
+            owner,
+            repo,
+            base: pr.base.ref,
+            head: pr.head.ref,
+          });
+          const commitAuthors = [
+            ...new Set(
+              (cmp.data.commits ?? [])
+                .map((c) => c.author?.login ?? c.commit.author?.name ?? null)
+                .filter((a): a is string => a !== null),
+            ),
+          ];
+          // resolve each commit via login when present, else its git identity —
+          // a human commit whose email isn't linked to a GitHub account (null
+          // login) must NOT be mistaken for Infraweaver's bot and force-overwritten.
+          const hasNonBotCommits = (cmp.data.commits ?? []).some(
+            (c) => !isBotCommit(c),
+          );
+          const labels = pr.labels
+            .map((l) => (typeof l === "string" ? l : l.name))
+            .filter(Boolean);
+          const checksState = await readChecksState(
+            ctx,
+            owner,
+            repo,
+            pr.head.sha,
+          );
+          const attempts = selfHealAttempts(labels);
+          const createdMs = new Date(pr.created_at).getTime();
+          const ageDays = Number.isFinite(createdMs)
+            ? (Date.now() - createdMs) / 86_400_000
+            : 0;
+          const assessment = assessStaleFix({
+            baseBehindBy: cmp.data.behind_by,
+            hasNonBotCommits,
+            checksFailing: checksState === "failing",
+            alreadyEscalated: labels.includes("needs-human"),
+            selfHealAttempts: attempts,
+            ageDays,
+          });
+          prs.push({
+            number: pr.number,
+            url: pr.html_url,
+            title: pr.title,
+            branch: pr.head.ref,
+            base: pr.base.ref,
+            group_id: groupIdFromBranch(pr.head.ref),
+            base_behind_by: cmp.data.behind_by,
+            head_ahead_by: cmp.data.ahead_by,
+            has_non_bot_commits: hasNonBotCommits,
+            commit_authors: commitAuthors,
+            labels,
+            checks_state: checksState,
+            self_heal_attempts: attempts,
+            age_days: Math.round(ageDays),
+            status: assessment.status,
+            recommended_action: assessment.action,
+            zombie: assessment.zombie,
+            reason: assessment.reason,
+          });
+        } catch (e) {
+          errors.push({
+            number: pr.number,
+            error: e instanceof Error ? e.message : String(e),
+          });
+        }
+      }
+
+      const counts = {
+        refresh: prs.filter((p) => p.recommended_action === "refresh").length,
+        skip: prs.filter((p) => p.recommended_action === "skip").length,
+        escalate: prs.filter((p) => p.recommended_action === "escalate").length,
+        checks_failing: prs.filter((p) => p.checks_state === "failing").length,
+        zombie: prs.filter((p) => p.zombie).length,
+      };
+      log.info(
+        `» list_remediation_prs: ${prs.length} open remediation PR(s) — ` +
+          `${counts.refresh} refresh, ${counts.skip} skip, ${counts.escalate} escalate` +
+          (counts.checks_failing
+            ? `, ${counts.checks_failing} checks-failing`
+            : "") +
+          (counts.zombie ? `, ${counts.zombie} zombie` : "") +
+          (errors.length ? ` (${errors.length} errored)` : ""),
+      );
+      return toolOk({
+        count: prs.length,
+        action_counts: counts,
+        pull_requests: prs,
+        ...(errors.length ? { errors } : {}),
+        note:
+          prs.length === 0
+            ? `No open ${PRODUCT_NAME} remediation PRs to refresh.`
+            : "Act on the `refresh` PRs (re-derive on the current base, then close-if-resolved or force-update — a `checks_failing` PR is refreshed to self-heal its red CI: re-prove the fix is green, else escalate to needs-human); `escalate` PRs get a needs-human label and are left for a human; `skip` PRs are already current.",
+      });
+    }),
+  });
+}
+
+export const ClosePullRequest = type({
+  pull_number: type.number.describe(
+    "the pull request number to close (not merge).",
+  ),
+  "comment?": type.string.describe(
+    "an optional comment explaining why it's being closed — posted before closing (e.g. 'concern already resolved on the base; this fix is now redundant').",
+  ),
+});
+
+export function ClosePullRequestTool(ctx: GitHubToolContext) {
+  return tool({
+    mutates: true,
+    name: "close_pull_request",
+    description:
+      `Close (NOT merge) a pull request. Use: a ${PRODUCT_NAME} remediation PR whose concern is already ` +
+      "resolved on the current base — the fix is redundant, so close it (optionally with an explanatory " +
+      "comment) instead of leaving a stale PR open. Blocked under `push: disabled`, and bound to the run's " +
+      "scope (a comment-triggered run can only close the PR it was triggered on or one it opened; a " +
+      "standalone scheduled sweep may close any). Never merges — closing is reversible.",
+    parameters: ClosePullRequest,
+    execute: execute(async ({ pull_number, comment }) => {
+      // permission gate: closing a PR is a repo write — block it under read-only.
+      if (ctx.payload.push === "disabled") {
+        throw new Error(
+          "Closing a pull request is disabled. This repository is configured for read-only access (push: disabled).",
+        );
+      }
+      // scope gate: same binding as comment/label/PR-body writes (mcp/scope.ts).
+      assertTargetInScope(ctx, pull_number, "close");
+
+      const owner = ctx.repo.owner;
+      const repo = ctx.repo.name;
+
+      if (comment) {
+        await ctx.octokit.rest.issues.createComment({
+          owner,
+          repo,
+          issue_number: pull_number,
+          body: addFooter(ctx, comment),
+        });
+        log.info(`» commented before closing PR #${pull_number}`);
+      }
+
+      const result = await ctx.octokit.rest.pulls.update({
+        owner,
+        repo,
+        pull_number,
+        state: "closed",
+      });
+      ctx.toolState.wasUpdated = true;
+      log.info(`» closed pull request #${result.data.number}`);
+
+      return {
+        success: true,
+        number: result.data.number,
+        state: result.data.state,
+        url: result.data.html_url,
+      };
+    }),
+  });
+}

package/src/mcp/terraform/__snapshots__/moduleDocs.test.ts.snap

@@ -0,0 +1,40 @@
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
+
+exports[`buildModuleReadme > is deterministic — identical inputs produce byte-identical output (snapshot) 1`] = `
+"# \`logging\` module
+
+Evidence-backed documentation generated by Infraweaver from the module's parsed interface and the refactor's recorded proof. Descriptions are quoted verbatim from the HCL (empty when the HCL has none).
+
+## Interface
+
+### Inputs
+
+| Name | Type | Required | Description |
+| ---- | ---- | :------: | ----------- |
+| \`bucket_name\` | \`string\` | **yes** | Name of the log bucket |
+| \`retention_days\` | \`number\` | no |  |
+
+### Outputs
+
+| Name | Description |
+| ---- | ----------- |
+| \`bucket_arn\` | ARN of the created bucket |
+
+## Refactor provenance
+
+Verdict: \`equivalence-proven\`
+
+The relocation was **proven behaviour-preserving** by \`terraform_equivalence_check\`: same resource set, identical arguments, every relocated address covered by a \`moved {}\` block, validate + fmt clean.
+
+Relocated addresses:
+
+- \`aws_s3_bucket.logs\` → \`module.logging.aws_s3_bucket.logs\`
+
+<!--
+generated-by: infraweaver
+infraweaver-version: 0.3.0
+git-head: abc1234def5678
+diagram: placeholder — link a Infragram-rendered architecture diagram of this module here
+-->
+"
+`;

package/src/mcp/terraform/azurePrices.ts

@@ -0,0 +1,38 @@
+// Generated by `pnpm run gen:azure-prices` — do not edit by hand.
+// Public list prices from the unauthenticated Azure Retail Prices API
+// (https://prices.azure.com), pinned so scan-time is offline with zero egress.
+// Every entry is a FIXED hourly charge that accrues at zero traffic — the
+// deterministic "idle floor". Usage-metered lines are deliberately not here.
+
+/** Region these list prices were captured for. */
+export const AZURE_PRICE_REGION = "westeurope";
+/** Currency of every price below. */
+export const AZURE_PRICE_CURRENCY = "EUR";
+/** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
+export const AZURE_PRICE_FETCHED_AT = "2026-07-25";
+
+/** meter key → list price per HOUR. */
+export const AZURE_HOURLY_PRICES: Record<string, number> = {
+  "app-service-p0v3": 0.0781,
+  "app-service-p1v3": 0.1562,
+  "app-service-p2v3": 0.3124,
+  "app-service-p3v3": 0.6248,
+  "bastion-basic": 0.1667,
+  "bastion-premium": 0.3949,
+  "bastion-standard": 0.2545,
+  "firewall-basic": 0.3466,
+  "firewall-premium": 1.5358,
+  "firewall-standard": 1.097,
+  "redis-c0": 0.0241,
+  "redis-c1": 0.0606,
+  "redis-c2": 0.0983,
+  "redis-c3": 0.1975,
+  "redis-p1": 0.2431,
+  "redis-p2": 0.4871,
+  "redis-p3": 0.9732,
+  "vpn-gateway-vpngw1": 0.1667,
+  "vpn-gateway-vpngw2": 0.43,
+  "vpn-gateway-vpngw3": 1.097,
+  "vpn-gateway-vpngw4": 1.8429,
+  "vpn-gateway-vpngw5": 3.2032,
+};