infraweaver 0.1.0

package/src/mcp/terraform/idleFloor.ts

@@ -0,0 +1,304 @@
+import {
+  AZURE_HOURLY_PRICES,
+  AZURE_PRICE_CURRENCY,
+  AZURE_PRICE_FETCHED_AT,
+  AZURE_PRICE_REGION,
+} from "#app/mcp/terraform/azurePrices";
+import type { TfResourceEntry } from "#app/mcp/terraform/cspm";
+
+/**
+ * Idle-floor detection (§5.19) — the resources that cost money at ZERO traffic.
+ *
+ * WHY THIS AND NOT A TOTAL. The hard part of plan-based cost estimation is not
+ * the pricing API, it is that usage-dependent lines (GB, requests, egress) are
+ * simply NOT derivable from Terraform. Any tool publishing a precise monthly
+ * total from a plan is guessing at the usage half. The idle floor is the portion
+ * that is deterministic — true regardless of traffic — so it is both the most
+ * defensible number we can publish and the most actionable one: an App Service
+ * Premium plan or an Azure Firewall bills the same whether or not anyone calls it.
+ *
+ * CREDENTIAL-FREE AND OFFLINE. Prices come from the bundled snapshot
+ * (`azurePrices.ts`, public Azure list prices captured at build time), so a scan
+ * makes no network call and needs no cloud credentials or pricing API key.
+ *
+ * FLOOR SEMANTICS — WE UNDER-CLAIM ON PURPOSE, AND NEVER GUESS A TIER. A
+ * resource is priced ONLY when its tier is identifiable from source AND is one
+ * this catalog carries. There is deliberately NO cheapest-tier fallback: every
+ * one of these resource types has a cheap or free tier (App Service `F1`/`B1`,
+ * Bastion `Developer`, a Basic VPN gateway, Basic Redis), so falling back would
+ * invent a charge for a resource that may cost nothing — the single failure mode
+ * that discredits the whole number. An unidentifiable tier is reported as an
+ * explicit coverage gap instead. A floor that is too low is honest; one that is
+ * too high is a number the customer can disprove.
+ */
+
+/** Billable hours per month — the 365×24/12 convention list prices assume. */
+export const HOURS_PER_MONTH = 730;
+
+/** What an idle-floor rule knows about one chargeable resource type. */
+interface IdleFloorRule {
+  /** Bare rule token (namespaced to `reviewer:` by `buildConcern`). */
+  id: string;
+  /** The Terraform resource type this rule applies to. */
+  resourceType: string;
+  /** Why it bills at zero traffic — quoted verbatim into cost.md. */
+  why: string;
+  /** SKU literal (lower-cased, as it appears in the resource block) → meter key.
+   *  A resource whose tier is not one of these is NOT priced. */
+  meters: Record<string, string>;
+}
+
+/**
+ * The catalog. Every entry is a resource whose charge is a fixed hourly rate for
+ * merely existing, at the tiers listed. Usage-metered services (Functions
+ * consumption, storage, bandwidth) are deliberately absent — they have no floor
+ * to state. Cheap/free tiers are absent too: their floor is not worth claiming
+ * and pricing them wrongly would be worse than saying nothing.
+ *
+ * SKU matching runs against the resource block's string literals, which
+ * `indexTfResources` already collects lower-cased, so no new HCL parser is
+ * needed and the match is exact-token, never substring.
+ */
+const RULES: IdleFloorRule[] = [
+  {
+    id: "azure-app-service-premium-idle-floor",
+    resourceType: "azurerm_service_plan",
+    why: "A Premium v3 App Service plan bills for reserved compute for as long as it exists — requests do not change the bill.",
+    meters: {
+      p0v3: "app-service-p0v3",
+      p1v3: "app-service-p1v3",
+      p2v3: "app-service-p2v3",
+      p3v3: "app-service-p3v3",
+    },
+  },
+  {
+    id: "azure-firewall-idle-floor",
+    resourceType: "azurerm_firewall",
+    why: "Azure Firewall bills a fixed deployment charge per hour; data-processing fees are on top of it, never instead of it.",
+    meters: {
+      basic: "firewall-basic",
+      standard: "firewall-standard",
+      premium: "firewall-premium",
+    },
+  },
+  {
+    id: "azure-bastion-idle-floor",
+    resourceType: "azurerm_bastion_host",
+    why: "A Bastion host bills per hour for the deployed gateway whether or not anyone connects through it.",
+    // NB the `Developer` SKU is free and deliberately absent — it must never be
+    // priced at the Basic rate.
+    meters: {
+      basic: "bastion-basic",
+      standard: "bastion-standard",
+      premium: "bastion-premium",
+    },
+  },
+  {
+    id: "azure-vpn-gateway-idle-floor",
+    resourceType: "azurerm_virtual_network_gateway",
+    why: "A VPN gateway bills per hour for the provisioned gateway SKU with no tunnels connected.",
+    // `Basic` and the ExpressRoute SKUs are absent: different meters, and pricing
+    // them from a VpnGw rate would overstate by several times.
+    meters: {
+      vpngw1: "vpn-gateway-vpngw1",
+      vpngw2: "vpn-gateway-vpngw2",
+      vpngw3: "vpn-gateway-vpngw3",
+      vpngw4: "vpn-gateway-vpngw4",
+      vpngw5: "vpn-gateway-vpngw5",
+    },
+  },
+  {
+    id: "azure-redis-idle-floor",
+    resourceType: "azurerm_redis_cache",
+    why: "A provisioned Redis cache bills per hour for reserved capacity independent of operations served.",
+    // `capacity` is numeric and so unreadable from string literals; each tier maps
+    // to its SMALLEST cache, a true lower bound for that tier. The Basic tier is
+    // absent — it is priced on a different meter than Standard C0.
+    meters: { premium: "redis-p1", standard: "redis-c0" },
+  },
+];
+
+/** One resource billing at zero traffic. */
+export interface IdleFloorItem {
+  /** `type.name` of the Terraform resource. */
+  address: string;
+  resourceType: string;
+  file: string;
+  line: number;
+  /** The rule that fired. */
+  rule_id: string;
+  why: string;
+  /** Meter key resolved from the bundled snapshot. */
+  meter: string;
+  monthly_cost: number;
+}
+
+/** A catalogued resource type whose tier could not be identified, so it was not
+ *  priced. Reported so the floor states exactly what it left out. */
+export interface UnpricedResource {
+  address: string;
+  resourceType: string;
+  file: string;
+  line: number;
+  reason: string;
+}
+
+export interface IdleFloorReport {
+  currency: string;
+  region: string;
+  /** ISO date the bundled price snapshot was captured. */
+  priced_at: string;
+  items: IdleFloorItem[];
+  /** Sum of every item's monthly cost, rounded to cents. */
+  monthly_floor: number;
+  /** Catalogued resources left unpriced because their tier wasn't identifiable —
+   *  the floor is a lower bound by exactly these. */
+  unpriced: UnpricedResource[];
+}
+
+/** Round to cents so the number is stable and printable. */
+function cents(n: number): number {
+  return Math.round(n * 100) / 100;
+}
+
+/**
+ * Detect every resource that bills at zero traffic, priced from the bundled
+ * snapshot. Pure and deterministic — no fs, no network, no credentials. Items
+ * come back in source order (file, then line) so `cost.md` is diff-stable.
+ */
+export function detectIdleFloor(
+  resources: ReadonlyArray<TfResourceEntry>,
+): IdleFloorReport {
+  const byType = new Map(RULES.map((r) => [r.resourceType, r]));
+  const items: IdleFloorItem[] = [];
+  const unpriced: UnpricedResource[] = [];
+  for (const entry of resources) {
+    const rule = byType.get(entry.type);
+    if (!rule) continue;
+    const literals = new Set(entry.identifiers);
+    // Exact-token match against the block's string literals — the same discipline
+    // the CSPM ARN matcher uses; a substring match would let an unrelated literal
+    // pick the wrong (and possibly pricier) SKU. When several tier words appear in
+    // one block (a tier literal plus a tag value, say) take the CHEAPEST match, so
+    // the result can only under-claim and never depends on declaration order.
+    const priced = Object.entries(rule.meters)
+      .filter(([sku]) => literals.has(sku))
+      .map(([, meter]) => ({ meter, hourly: AZURE_HOURLY_PRICES[meter] }))
+      .filter(
+        (m): m is { meter: string; hourly: number } =>
+          typeof m.hourly === "number",
+      )
+      .sort((a, b) => a.hourly - b.hourly)[0];
+    if (!priced) {
+      unpriced.push({
+        address: entry.address,
+        resourceType: entry.type,
+        file: entry.file,
+        line: entry.line,
+        reason:
+          "tier not identifiable from source, or not one this catalog prices — left unpriced " +
+          "because this resource type has cheap or free tiers and a guess could only overstate",
+      });
+      continue;
+    }
+    items.push({
+      address: entry.address,
+      resourceType: entry.type,
+      file: entry.file,
+      line: entry.line,
+      rule_id: rule.id,
+      why: rule.why,
+      meter: priced.meter,
+      monthly_cost: cents(priced.hourly * HOURS_PER_MONTH),
+    });
+  }
+  items.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+  unpriced.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+  return {
+    currency: AZURE_PRICE_CURRENCY,
+    region: AZURE_PRICE_REGION,
+    priced_at: AZURE_PRICE_FETCHED_AT,
+    items,
+    monthly_floor: cents(items.reduce((sum, i) => sum + i.monthly_cost, 0)),
+    unpriced,
+  };
+}
+
+/** What the idle-floor number does and does not assert — carried verbatim into
+ *  `cost.md` and the signed evidence bundle so the claim can never drift. */
+export const IDLE_FLOOR_ASSERTS =
+  "These resources bill at a fixed rate for as long as they exist, at public list prices " +
+  `for ${AZURE_PRICE_REGION} captured ${AZURE_PRICE_FETCHED_AT}.`;
+export const IDLE_FLOOR_DOES_NOT_ASSERT =
+  "This is NOT a total cost estimate and NOT your bill. It excludes all usage-dependent " +
+  "charges (data processed, requests, egress, storage), any discounts, reservations or " +
+  "enterprise agreement pricing, every resource type outside the idle-floor catalog, and " +
+  "any listed resource whose tier could not be identified. Actual spend is higher than " +
+  "this floor, never lower.";
+
+/**
+ * Render the `cost.md` artifact. Pure and deterministic — the same report always
+ * produces the same bytes, so re-running on an unchanged plan yields no diff.
+ */
+export function renderCostMarkdown(
+  report: IdleFloorReport,
+  toolVersion: string,
+): string {
+  const money = (n: number) => `${report.currency} ${n.toFixed(2)}`;
+  const lines: string[] = [
+    "# Cost analysis — idle floor",
+    "",
+    `**${money(report.monthly_floor)} / month** accrues from ${report.items.length} resource(s) ` +
+      "even at zero traffic.",
+    "",
+    IDLE_FLOOR_ASSERTS,
+    "",
+  ];
+  if (report.items.length === 0) {
+    lines.push(
+      "No resources from the idle-floor catalog were priced in this configuration.",
+      "",
+    );
+  } else {
+    lines.push(
+      "| Resource | Type | Location | Monthly |",
+      "| --- | --- | --- | --- |",
+      ...report.items.map(
+        (i) =>
+          `| \`${i.address}\` | ${i.resourceType} | ${i.file}:${i.line} | ${money(i.monthly_cost)} |`,
+      ),
+      "",
+      "## Why these bill at zero traffic",
+      "",
+    );
+    // One bullet per distinct rule, not per resource, so the section stays short.
+    const seen = new Set<string>();
+    for (const i of report.items) {
+      if (seen.has(i.rule_id)) continue;
+      seen.add(i.rule_id);
+      lines.push(`- **${i.resourceType}** — ${i.why}`);
+    }
+    lines.push("");
+  }
+  if (report.unpriced.length > 0) {
+    lines.push(
+      "## Not priced — the floor is a lower bound by these",
+      "",
+      ...report.unpriced.map(
+        (u) => `- \`${u.address}\` (${u.file}:${u.line}) — ${u.reason}`,
+      ),
+      "",
+    );
+  }
+  lines.push(
+    "## What this number does not include",
+    "",
+    IDLE_FLOOR_DOES_NOT_ASSERT,
+    "",
+    "---",
+    "",
+    `generated-by: infraweaver ${toolVersion} · prices: Azure list, ${report.region}, ${report.priced_at}`,
+    "",
+  );
+  return lines.join("\n");
+}

package/src/mcp/terraform/keyless.ts

@@ -0,0 +1,123 @@
+/**
+ * KEYLESS (Sigstore) signing — the SECOND evidence tier, alongside the Ed25519
+ * detached signature in [[signing]].
+ *
+ * Where the Ed25519 tier proves "signed by whoever holds INFRAWEAVER_SIGNING_KEY"
+ * (and needs that key distributed to verifiers), the keyless tier signs with the
+ * workflow's ephemeral GitHub Actions OIDC identity: Fulcio issues a short-lived
+ * X.509 cert bound to "this repo, this workflow, this run", the signature +
+ * cert + an inclusion proof go into a Sigstore **bundle**, and the signing event
+ * is recorded in the public **Rekor** transparency log. There is no key to
+ * distribute — a verifier checks the CERTIFICATE IDENTITY (the workflow ref +
+ * the GitHub OIDC issuer), not a pinned fingerprint. That converts the
+ * fingerprint-pinning problem into a certificate-identity check.
+ *
+ * The signed payload is an in-toto v1 attestation whose `subject` is the evidence
+ * artifact (by sha256 digest) and whose `predicate` is a compact summary — the
+ * same shape that slots into a CycloneDX/VEX attestation pipeline.
+ *
+ * OPT-IN + best-effort: enabled by `INFRAWEAVER_KEYLESS_SIGNING=true` and only when
+ * an ambient OIDC identity was captured (CI with `id-token: write`). It performs
+ * live network calls to Fulcio + Rekor, so a failure is logged and the emit still
+ * succeeds with the deterministic bundle + optional Ed25519 `.sig` — a transient
+ * Rekor outage must not block emitting evidence.
+ */
+
+import { createHash } from "node:crypto";
+import { bundleToJSON, type SerializedBundle } from "@sigstore/bundle";
+import { DSSEBundleBuilder, FulcioSigner, RekorWitness } from "@sigstore/sign";
+import {
+  fetchSigstoreOidcToken,
+  keylessOidcAvailable,
+} from "#app/utils/keylessOidc";
+
+export const KEYLESS_SIGNING_ENV = "INFRAWEAVER_KEYLESS_SIGNING";
+
+/** The in-toto predicateType for a Infraweaver evidence attestation. */
+export const INFRAWEAVER_ATTESTATION_PREDICATE_TYPE =
+  "https://infraweaver.dev/attestations/evidence/v1" as const;
+
+/** DSSE payloadType for an in-toto statement (the Sigstore/in-toto convention). */
+const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+
+/** in-toto Statement v1 — what actually gets DSSE-signed. */
+export interface InTotoStatement {
+  _type: "https://in-toto.io/Statement/v1";
+  subject: Array<{ name: string; digest: { sha256: string } }>;
+  predicateType: string;
+  predicate: Record<string, unknown>;
+}
+
+/** Opt-in check — keyless signing performs live Fulcio/Rekor calls, so it never
+ *  runs unless explicitly enabled. Distinct from {@link keylessSigningPossible}. */
+export function keylessSigningEnabled(
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  const v = env[KEYLESS_SIGNING_ENV]?.trim().toLowerCase();
+  return v === "true" || v === "1" || v === "yes";
+}
+
+/** True when keyless signing is both enabled AND an ambient OIDC identity was
+ *  captured (running in CI with id-token:write). The emit tools gate on this. */
+export function keylessSigningPossible(
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  return keylessSigningEnabled(env) && keylessOidcAvailable();
+}
+
+/**
+ * Build the in-toto v1 Statement that attests `artifactBytes` by sha256 digest.
+ * Pure — the signable payload, independent of any network. The predicate carries
+ * a compact, non-authoritative summary (the artifact itself is the authority; the
+ * attestation binds it to the workflow identity).
+ */
+export function buildInTotoStatement(args: {
+  subjectName: string;
+  artifactBytes: string | Buffer;
+  predicate: Record<string, unknown>;
+  predicateType?: string;
+}): InTotoStatement {
+  const data =
+    typeof args.artifactBytes === "string"
+      ? Buffer.from(args.artifactBytes, "utf8")
+      : args.artifactBytes;
+  const sha256 = createHash("sha256").update(data).digest("hex");
+  return {
+    _type: "https://in-toto.io/Statement/v1",
+    subject: [{ name: args.subjectName, digest: { sha256 } }],
+    predicateType: args.predicateType ?? INFRAWEAVER_ATTESTATION_PREDICATE_TYPE,
+    predicate: args.predicate,
+  };
+}
+
+/** The sibling filename the Sigstore bundle is written to, next to `artifactPath`. */
+export function keylessBundlePath(artifactPath: string): string {
+  return `${artifactPath}.sigstore.json`;
+}
+
+/**
+ * Keyless-sign an in-toto statement: mint a `sigstore`-audience OIDC token, get a
+ * short-lived Fulcio signing cert for it, DSSE-sign the statement, and record the
+ * entry in Rekor. Returns the serialized Sigstore bundle (write it as
+ * `<artifact>.sigstore.json`). NETWORK — Fulcio + Rekor. Throws on any failure;
+ * callers treat keyless as best-effort and log rather than abort the emit.
+ */
+export async function keylessSignStatement(
+  statement: InTotoStatement,
+): Promise<SerializedBundle> {
+  const signer = new FulcioSigner({
+    identityProvider: { getToken: () => fetchSigstoreOidcToken() },
+  });
+  // Rekor v1 dsse entry — the transparency-log record. certificateChain:false
+  // keeps just the leaf cert in the bundle (the trust root supplies the chain).
+  const builder = new DSSEBundleBuilder({
+    signer,
+    witnesses: [new RekorWitness({ entryType: "dsse" })],
+    certificateChain: false,
+  });
+  const bundle = await builder.create({
+    data: Buffer.from(JSON.stringify(statement), "utf8"),
+    type: IN_TOTO_PAYLOAD_TYPE,
+  });
+  return bundleToJSON(bundle);
+}