infraweaver 0.3.7 → 0.3.8

package/dist/mcp/pr.d.ts

@@ -1,41 +1,10 @@
 import type { GitHubWriteToolContext } from "./capabilityContext.js";
-import type { RunContextData } from "../utils/cloud/runContextData.js";
-import type { ResolvedPayload } from "../utils/config/payload.js";
-/**
- * The slice `resolveBaseBranch` reads: the declared base-branch input and the
- * repository's default branch. Shared with `terraform_change_summary`, which
- * resolves the same base without needing the rest of the GitHub surface.
- */
-export interface BaseBranchContext {
-    payload: ResolvedPayload;
-    repo: RunContextData["repo"];
-}
 export declare const PullRequest: import("arktype/internal/variants/object.ts").ObjectType<{
     title: string;
     body: string;
     base?: string;
     draft?: boolean;
 }, {}>;
-/**
- * Pure base-branch picker. Precedence: an explicit `base_branch` declaration
- * always wins; otherwise the repository's default branch (GitHub reports it —
- * normally `main`, sometimes `master`); otherwise prefer `main`, then `master`;
- * final fallback `main`. Split out from git/ctx so it's exhaustively testable.
- */
-export declare function pickBaseBranch(opts: {
-    declared?: string | undefined;
-    defaultBranch?: string | undefined;
-    mainExists: boolean;
-    masterExists: boolean;
-}): string;
-/**
- * Deterministically resolve the branch a PR targets, so the base is never left
- * to the agent's guess. Resolves to the repository's default branch (`main`, or
- * `master`), overridable by the `base_branch` input. Git is only probed for
- * main/master in the last-resort case where neither an explicit declaration nor
- * a GitHub default branch is available (essentially never).
- */
-export declare function resolveBaseBranch(ctx: BaseBranchContext): string;
 /**
  * Append the extraction detector's `selection_reason` for each adopted module
  * the body does not already state — pure half, so the rule is testable without

package/dist/mcp/reproveSuggestions.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Re-proving the open, proven suggestions a later push made stale.
+ *
+ * A proof holds for the commit it was made on, so the apply command commits a
+ * suggestion only at that head. After a push, the review's restatement of the
+ * same finding is withheld as a duplicate of its open thread — so without this
+ * step a proven suggestion could never be applied again once anything else was
+ * pushed.
+ *
+ * Each such thread's OWN suggestion is re-proved, by the same prover, at the
+ * thread's current lines on the new head. When it still holds, the thread gets
+ * a reply carrying a `reproof` marker for this head and those lines, which is
+ * what the apply command honours. One that no longer holds gets no reply, and
+ * apply keeps refusing it.
+ */
+import type { OpenInfraweaverThread } from "./reviewComments.js";
+import type { SuggestionCandidate, SuggestionProof } from "./suggestionProver.js";
+import { type GateDelta } from "./terraform/scanDelta.js";
+/** Returns how many threads were re-proved and replied to. */
+export declare function reproveStaleSuggestions(input: {
+    threads: readonly OpenInfraweaverThread[];
+    delta: GateDelta;
+    /** the head the review is submitted at */
+    headSha: string;
+    prove: (candidates: SuggestionCandidate[]) => Promise<SuggestionProof[]>;
+    reply: (rootCommentId: number, body: string) => Promise<void>;
+}): Promise<number>;

package/dist/mcp/review.d.ts

@@ -1,5 +1,6 @@
 import type { RestEndpointMethodTypes } from "@octokit/rest";
 import type { GitHubWriteToolContext } from "./capabilityContext.js";
+import { type Dismissal } from "./reviewProvenance.js";
 import type { CommentableLines } from "../toolState.js";
 export type { CommentableLines };
 /**
@@ -138,6 +139,127 @@ export declare function reviewSkipDecision(params: {
     prApproveEnabled: boolean;
 }): ReviewSkipDecision | null;
 export declare function formatDroppedCommentsNote(dropped: DroppedComment[]): string;
+/** One inline comment of a review, as `create_pull_request_review` and `stage_review` take it. */
+declare const ReviewComment: import("arktype/internal/variants/object.ts").ObjectType<{
+    path: string;
+    line: number;
+    side?: "LEFT" | "RIGHT";
+    body?: string;
+    suggestion?: string;
+    start_line?: number;
+    existing_code?: string;
+    finding_id?: string;
+    audit?: {
+        resource_address?: string;
+        coherence?: {
+            cited_code_exists?: "fail" | "not_applicable" | "pass" | "unknown";
+            config_reachable?: "fail" | "not_applicable" | "pass" | "unknown";
+            exposure_path?: "fail" | "not_applicable" | "pass" | "unknown";
+            not_mitigated_elsewhere?: "fail" | "not_applicable" | "pass" | "unknown";
+        };
+        exposure_path?: string;
+        impact: number;
+        likelihood: number;
+        exposure: "internal" | "internet" | "none" | "privileged";
+        caps?: {
+            defense_in_depth_only?: "applies" | "does_not_apply" | "unknown";
+            hygiene_only?: "applies" | "does_not_apply" | "unknown";
+            non_default_input?: "applies" | "does_not_apply" | "unknown";
+            non_production_scope?: "applies" | "does_not_apply" | "unknown";
+            requires_existing_admin?: "applies" | "does_not_apply" | "unknown";
+            requires_user_action?: "applies" | "does_not_apply" | "unknown";
+            single_resource_blast?: "applies" | "does_not_apply" | "unknown";
+        };
+    };
+}, {}>;
+type SubmittedComment = typeof ReviewComment.infer;
+/** Comments and dismissals `stage_review` holds for the next submission on one PR. */
+export interface StagedReview {
+    pullNumber: number;
+    comments: SubmittedComment[];
+    dismissed: Dismissal[];
+}
+export declare function StageReviewTool(ctx: GitHubWriteToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    pull_number: number;
+    comments?: {
+        path: string;
+        line: number;
+        side?: "LEFT" | "RIGHT";
+        body?: string;
+        suggestion?: string;
+        start_line?: number;
+        existing_code?: string;
+        finding_id?: string;
+        audit?: {
+            resource_address?: string;
+            coherence?: {
+                cited_code_exists?: "fail" | "not_applicable" | "pass" | "unknown";
+                config_reachable?: "fail" | "not_applicable" | "pass" | "unknown";
+                exposure_path?: "fail" | "not_applicable" | "pass" | "unknown";
+                not_mitigated_elsewhere?: "fail" | "not_applicable" | "pass" | "unknown";
+            };
+            exposure_path?: string;
+            impact: number;
+            likelihood: number;
+            exposure: "internal" | "internet" | "none" | "privileged";
+            caps?: {
+                defense_in_depth_only?: "applies" | "does_not_apply" | "unknown";
+                hygiene_only?: "applies" | "does_not_apply" | "unknown";
+                non_default_input?: "applies" | "does_not_apply" | "unknown";
+                non_production_scope?: "applies" | "does_not_apply" | "unknown";
+                requires_existing_admin?: "applies" | "does_not_apply" | "unknown";
+                requires_user_action?: "applies" | "does_not_apply" | "unknown";
+                single_resource_blast?: "applies" | "does_not_apply" | "unknown";
+            };
+        };
+    }[];
+    dismissed?: {
+        finding_id?: string;
+        finding_ids?: string[];
+        reason: string;
+    }[];
+}, {
+    pull_number: number;
+    comments?: {
+        path: string;
+        line: number;
+        side?: "LEFT" | "RIGHT";
+        body?: string;
+        suggestion?: string;
+        start_line?: number;
+        existing_code?: string;
+        finding_id?: string;
+        audit?: {
+            resource_address?: string;
+            coherence?: {
+                cited_code_exists?: "fail" | "not_applicable" | "pass" | "unknown";
+                config_reachable?: "fail" | "not_applicable" | "pass" | "unknown";
+                exposure_path?: "fail" | "not_applicable" | "pass" | "unknown";
+                not_mitigated_elsewhere?: "fail" | "not_applicable" | "pass" | "unknown";
+            };
+            exposure_path?: string;
+            impact: number;
+            likelihood: number;
+            exposure: "internal" | "internet" | "none" | "privileged";
+            caps?: {
+                defense_in_depth_only?: "applies" | "does_not_apply" | "unknown";
+                hygiene_only?: "applies" | "does_not_apply" | "unknown";
+                non_default_input?: "applies" | "does_not_apply" | "unknown";
+                non_production_scope?: "applies" | "does_not_apply" | "unknown";
+                requires_existing_admin?: "applies" | "does_not_apply" | "unknown";
+                requires_user_action?: "applies" | "does_not_apply" | "unknown";
+                single_resource_blast?: "applies" | "does_not_apply" | "unknown";
+            };
+        };
+    }[];
+    dismissed?: {
+        finding_id?: string;
+        finding_ids?: string[];
+        reason: string;
+    }[];
+}>> & {
+    mutates?: boolean;
+};
 export declare function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
     pull_number: number;
     body: string;
@@ -177,7 +299,8 @@ export declare function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext)
         };
     }[];
     dismissed?: {
-        finding_id: string;
+        finding_id?: string;
+        finding_ids?: string[];
         reason: string;
     }[];
 }, {
@@ -219,7 +342,8 @@ export declare function CreatePullRequestReviewTool(ctx: GitHubWriteToolContext)
         };
     }[];
     dismissed?: {
-        finding_id: string;
+        finding_id?: string;
+        finding_ids?: string[];
         reason: string;
     }[];
 }>> & {

package/dist/mcp/reviewCommentLimit.d.ts

@@ -0,0 +1,17 @@
+interface LimitableComment {
+    path: string;
+    line?: number | undefined;
+    body?: string | undefined;
+}
+/**
+ * Split `comments` into those posted inline and those folded into the body.
+ * `limit` 0 or undefined means no limit. Both halves keep the input order, so
+ * the posted review reads in the order the reviewer wrote it.
+ */
+export declare function limitInlineComments<T extends LimitableComment>(comments: readonly T[], limit: number | undefined): {
+    kept: T[];
+    overflow: T[];
+};
+/** The review-body note listing the comments the limit folded, or "" for none. */
+export declare function formatOverflowNote(overflow: readonly LimitableComment[], limit: number): string;
+export {};

package/dist/mcp/reviewComments.d.ts

@@ -2,6 +2,7 @@ import type { Octokit } from "@octokit/rest";
 import type { GitHubToolContext } from "./capabilityContext.js";
 import type { ThreadSpan } from "./reviewDedup.js";
 import { type CommentMarker } from "./reviewMarkers.js";
+import { type HunkHeader } from "../utils/unifiedDiff.js";
 /**
  * A GraphQL review-thread fetch worth retrying: an HTTP 5xx / network blip
  * ({@link isTransientServerError}), OR GitHub's transient "Something went wrong
@@ -32,6 +33,9 @@ export type OutstandingThreadsResponse = {
                         nodes: ({
                             databaseId?: number | null;
                             body?: string | null;
+                            originalCommit?: {
+                                oid: string;
+                            } | null;
                             author: {
                                 login: string;
                                 __typename?: string;
@@ -53,6 +57,10 @@ export type OpenInfraweaverThread = {
     rootCommentId?: number;
     /** the marker the root comment carries, when the engine wrote one */
     marker?: CommentMarker;
+    /** the root comment's body */
+    rootBody?: string;
+    /** the commit the root comment was made on */
+    rootCommit?: string;
 };
 /**
  * Every unresolved review thread on a PR whose ROOT comment was authored by
@@ -125,12 +133,8 @@ export type ReviewThreadsQueryResponse = {
     } | null;
 };
 export declare function countRenderedLines(str: string): number;
-export type ParsedHunk = {
+export type ParsedHunk = HunkHeader & {
     header: string;
-    oldStart: number;
-    oldCount: number;
-    newStart: number;
-    newCount: number;
     content: string[];
 };
 export declare function parseFilePatches(patch: string): ParsedHunk[];

package/dist/mcp/reviewDedup.d.ts

@@ -61,6 +61,7 @@ export type DuplicateComment = {
      */
     gist?: string;
 };
+export declare function gistOf(body: unknown): string | undefined;
 /**
  * Split comments into those to post and those that restate an open thread.
  *

package/dist/mcp/reviewMarkers.d.ts

@@ -4,9 +4,19 @@ export type CommentMarker = {
     proven: boolean;
 } | {
     kind: "judgement";
+}
+/** a reply re-proving its thread's suggestion on a later head, at the
+ *  thread's current lines — what lets the apply command take it there */
+ | {
+    kind: "reproof";
+    head: string;
+    startLine: number;
+    line: number;
 };
 export declare function renderCommentMarker(marker: CommentMarker): string;
 export declare function parseCommentMarker(body: string | null | undefined): CommentMarker | null;
+/** The text of a comment's `suggestion` block, without its closing newline. */
+export declare function suggestionText(body: string): string | undefined;
 /**
  * A review comment the engine wrote: by the Infraweaver app, or by any Bot
  * account when it carries the marker (the workflow-token path).

package/dist/mcp/reviewProvenance.d.ts

@@ -1,11 +1,11 @@
 import { type WithheldFinding } from "./findingAudit.js";
 import { type DeltaVerdict } from "./terraform/deltaSummary.js";
-import type { DeltaFinding, GateDelta } from "./terraform/scanDelta.js";
-export declare const Dismissal: import("arktype/internal/variants/object.ts").ObjectType<{
+import { type DeltaFinding, type GateDelta } from "./terraform/scanDelta.js";
+/** An introduced finding the reviewer decided needs no comment, and why. */
+export interface Dismissal {
     finding_id: string;
     reason: string;
-}, {}>;
-export type Dismissal = typeof Dismissal.infer;
+}
 interface ProvenanceComment {
     path: string;
     line: number;
@@ -35,8 +35,19 @@ export declare function classifyComments<T extends ProvenanceComment>(comments:
  *  comment nor dismissed. One past the per-review limit was never the reviewer's
  *  to answer, so it is not counted against them. */
 export declare function unaddressedFindings(delta: GateDelta, citedIds: Iterable<string>, dismissed: readonly Dismissal[]): DeltaFinding[];
-/** The provenance line closing an inline comment. */
-export declare function provenanceLine(kind: CommentKind): string;
+/**
+ * The provenance line closing an inline comment.
+ *
+ * A scanner-backed comment carries two severities, and the line says which one
+ * decides what. The marker it opens with (🚨 ⚠️ ℹ️) is the reviewer's reading of
+ * the risk in this configuration; the gate counts the scanner's severity and
+ * the required controls. When the two disagree, the line says so, so an ℹ️ that
+ * still blocks the merge — or a 🚨 that does not — reads as intended.
+ */
+export declare function provenanceLine(kind: CommentKind, opts?: {
+    requiredControls?: string[];
+    reviewerMarker?: string | null;
+}): string;
 /** How a suggestion is rendered once the prover has judged it. */
 export declare function renderSuggestion(suggestion: string, proof: {
     proven: boolean;
@@ -59,6 +70,9 @@ export declare function renderReviewVerdict(input: {
         resolved: number;
         unresolved: number;
     } | undefined;
+    /** the run's `required_controls`, so findings on renamed resources can be told
+     *  apart among the ones the gate fails on. */
+    requiredControls?: readonly string[];
 }): string;
 /** The engine-written section closing a customer-PR review body. */
 export declare function renderReviewSummarySection(input: {

package/dist/mcp/shared.d.ts

@@ -102,4 +102,19 @@ export declare const handleToolError: (error: unknown) => ToolResult;
  * @param toolName - optional tool name for error logging
  */
 export declare const execute: <T, R extends Record<string, any> | string>(fn: (params: T) => Promise<R>, toolName?: string) => (params: T) => Promise<ToolResult>;
+/**
+ * How often a running tool tells the client it is still working. Claude Code
+ * aborts a call that sends neither a response nor a progress notification for
+ * five minutes, and a scan that downloads external modules, or a plan, can run
+ * longer than that while working normally.
+ */
+export declare const PROGRESS_HEARTBEAT_MS = 30000;
+/**
+ * Send a progress notification every {@link PROGRESS_HEARTBEAT_MS} while the
+ * tool runs, carrying the seconds elapsed (the spec requires `progress` to
+ * increase). It only reaches the client while the event loop is free, so a tool
+ * that blocks on a synchronous subprocess still looks idle — which is why the
+ * Terraform and scanner paths spawn asynchronously.
+ */
+export declare function withProgressHeartbeat(tool: InfraweaverTool): InfraweaverTool;
 export declare const addTools: (ctx: ToolContext, server: FastMCP<any>, tools: InfraweaverTool[]) => FastMCP<any>;

package/dist/mcp/suggestionProver.d.ts

@@ -19,8 +19,9 @@ export interface SuggestionProof {
     reason: string;
 }
 export interface ProverDeps {
-    /** a gate-configured scan of the tree at `cwd`, ACTIVE concerns only */
-    scan: (cwd: string) => Promise<Concern[]>;
+    /** a gate-configured scan of the tree at `cwd`, ACTIVE concerns only, covering
+     *  at least the root modules that `files` (relative to `cwd`) reach */
+    scan: (cwd: string, files: string[]) => Promise<Concern[]>;
 }
 /**
  * Prove `candidates` against the commit checked out in `repoCwd`. `prefix` is

package/dist/mcp/terraform/checkovSeverities.d.ts

@@ -0,0 +1,7 @@
+import type { Severity } from "./types.js";
+/**
+ * A severity for each checkov Terraform check, which open-source checkov does
+ * not report. Each line names its basis: a reviewer's rating, the severity
+ * trivy gives the same misconfiguration, a title rule, or the medium default.
+ */
+export declare const CHECKOV_SEVERITIES: Readonly<Record<string, Severity>>;

package/dist/mcp/terraform/consolidation.d.ts

@@ -40,6 +40,15 @@
  *     the expression as text. Multiplicity is part of the key, so those dirs
  *     simply never group.
  *
+ * MODULE CALLS IN THE SHAPE. A root's call of a LOCAL module that the
+ * cluster's resources read is part of the stack as much as they are, so it can
+ * join the cluster: the proposed module then wraps the call (`module.data` → `module.<new>.module.data`, one
+ * `moved {}` block) and a reference into it stays inside the module instead of
+ * crossing the boundary as an input. Only calls the proof can follow make it
+ * in — a local source, no `count`/`for_each`/`providers`/`depends_on` — and a
+ * cluster that wraps calls is only the WIDER offer: when it cannot be
+ * proposed, the same roots are still considered without their calls.
+ *
  * Pure: an already-read tree in, structure out. No filesystem, no subprocess.
  */
 import { type MovedBlock } from "./refactor/movedBlocks.js";
@@ -65,6 +74,12 @@ export interface MemberResource {
     invisibleMeta: string[];
     /** attributes whose value did not parse to a close — a truncated file. */
     unreadable: string[];
+    /** set on a module CALL (`type` is `module`): the repo-relative directory its
+     *  local source resolves to. Part of the shape key — two calls of different
+     *  modules are not the same shape, whatever their inputs. */
+    call?: {
+        dir: string;
+    };
 }
 /**
  * The canonical shape of a set of resources: types, names, argument names and
@@ -100,13 +115,24 @@ interface ConsolidationGroup {
         dir: string;
         environment: string | null;
         name_prefix: string | null;
+        /** the `source` this member's call writes: `proposed_module.path` is
+         *  repo-relative, and a local source is relative to the caller. */
+        call_source: string;
     }[];
+    /** a module CALL the shape includes is here too, as type `module`. */
     resources: {
         type: string;
         name: string;
         arg_names: string[];
         multiplicity: string | null;
     }[];
+    /** the module calls the new module wraps: each moves into it keeping its
+     *  name, and `source` is what it writes THERE — relative to the new module's
+     *  directory, not to the roots it came from. */
+    wrapped_calls: {
+        name: string;
+        source: string;
+    }[];
     proposed_module: {
         name: string;
         path: string;

package/dist/mcp/terraform/cost.d.ts

@@ -45,11 +45,11 @@ export interface CostEscalation {
  * decision is auditable, not a model judgement.
  */
 export declare function classifyCostEscalation(deltaMonthly: number | null, thresholdUsd: number | undefined): CostEscalation;
-export declare function runInfracostBreakdown(scanCwd: string, key: string): RunResult;
+export declare function runInfracostBreakdown(scanCwd: string, key: string): Promise<RunResult>;
 /**
  * Cost of the base-branch version of the same Terraform, computed in a detached
  * git worktree so the current (fixed) checkout is never disturbed. Best-effort:
  * any failure (no base ref, worktree add fails, infracost errors) returns null
  * and the caller falls back to reporting current cost only.
  */
-export declare function infracostBaseline(cwd: string, key: string, tmpdir: string): CostBreakdown | null;
+export declare function infracostBaseline(cwd: string, key: string, tmpdir: string): Promise<CostBreakdown | null>;

package/dist/mcp/terraform/currency.d.ts

@@ -42,6 +42,12 @@ export interface CurrencyVerdict {
     /** how many MAJORs the constraint's best version trails the latest by —
      * >0 signals an interface-risk upgrade that must be `needs-human`. */
     majorsBehind: number;
+    /** the newest stable version in the major the constraint already admits,
+     * when the constraint does not admit it — the upgrade that crosses no major.
+     * An exact pin `3.15.1` with `3.15.2` published is outdated even when the
+     * latest release is two majors on; reporting only `latest` hides the one
+     * bump that needs nobody's sign-off. Null when there is none. */
+    latestInMajor: string | null;
 }
 export declare function classifyCurrency(params: {
     constraint: string | null;
@@ -127,6 +133,8 @@ interface ProviderCurrencyRow {
     constraint: string | null;
     latest: string | null;
     newest_satisfying: string | null;
+    /** see {@link CurrencyVerdict.latestInMajor}. */
+    latest_in_major: string | null;
     outdated: boolean;
     majors_behind: number;
     lookup: LookupStatus;
@@ -137,7 +145,10 @@ interface ModuleCurrencyRow {
     version: string | null;
     latest: string | null;
     newest_satisfying: string | null;
+    /** see {@link CurrencyVerdict.latestInMajor}. */
+    latest_in_major: string | null;
     outdated: boolean;
+    majors_behind: number;
     /** registry module with no `version` attribute — pin it (to `latest`). */
     unpinned: boolean;
     lookup: ModuleLookupStatus;

package/dist/mcp/terraform/deltaSummary.d.ts

@@ -1,4 +1,4 @@
-import type { DeltaFinding, GateDelta } from "./scanDelta.js";
+import { type DeltaFinding, type GateDelta, type UndeclaredRename } from "./scanDelta.js";
 /**
  * How many introduced findings one review answers individually. Past this the
  * rest are only counted: a review of hundreds of comments is read by no one,
@@ -17,6 +17,16 @@ export interface DeltaVerdict {
 }
 /** The gate's verdict on a delta: the same two halves `findings-gate` applies. */
 export declare function deltaVerdict(delta: GateDelta, requiredControls: string[]): DeltaVerdict;
+/** Whether one introduced finding fails the gate on its own — the same two
+ *  halves `deltaVerdict` applies to the whole delta. */
+export declare function failsGate(finding: DeltaFinding, requiredControls: string[]): boolean;
+/**
+ * The undeclared renames in a delta as one paragraph — what happened, what it
+ * costs at apply, and the one thing to do about it — or "" when there are none.
+ * `fmt` code-spans a value the way the caller's surface does: every address and
+ * directory came out of the PR's own files.
+ */
+export declare function renderUndeclaredRenames(renames: readonly UndeclaredRename[], fmt: (text: string) => string): string;
 /** The compliance controls the introduced findings touch, sorted and unique. */
 export declare function controlsTouched(findings: readonly DeltaFinding[]): string[];
 export declare function renderDeltaSummary(input: {

package/dist/mcp/terraform/emittedArtefacts.d.ts

@@ -0,0 +1,11 @@
+import { scanSessionOf } from "./scanSession.js";
+/** The id git gives a blob with these contents — what `git rev-parse HEAD:<path>` prints. */
+export declare function gitBlobId(bytes: string): string;
+/** Write an emit tool's artefact to `path` (absolute) and remember the bytes written. */
+export declare function writeEmittedArtefact(toolState: Parameters<typeof scanSessionOf>[0], path: string, bytes: string): void;
+/**
+ * True when `file` — repo-relative, as `git diff` names it — is an artefact an
+ * emit tool wrote this run and `committedBlob` (its blob id at the pushed
+ * commit, null when absent) is one of the versions it wrote.
+ */
+export declare function isUnchangedEmittedArtefact(toolState: Parameters<typeof scanSessionOf>[0], repoTop: string, file: string, committedBlob: string | null): boolean;

package/dist/mcp/terraform/evidence.d.ts

@@ -161,6 +161,13 @@ export interface RefactorEquivalenceInput {
      * actually happened, so a bundle never claims a value check that did not run. */
     values_verified?: number;
 }
+/**
+ * What a proposed-unproven change IS, named from the mode that made it. The
+ * agent's flag says only that the change is unproven; a signed statement that
+ * called a version bump a module adoption would misdescribe the artefact it
+ * signs.
+ */
+export declare function proposedChangeOf(mode: string | undefined): string;
 /**
  * Build the refactor evidence statement (pure). Returns undefined when nothing
  * refactor-related happened (no equivalence proof, not a proposed-unproven b.4,
@@ -183,6 +190,9 @@ export declare function buildRefactorStatement(args: {
     } | undefined;
     /** the agent recorded the reviewed-plan outcome (b.4 with credentials). */
     reviewedPlan?: boolean;
+    /** what the unproven change is (`proposedChangeOf`); a module adoption when
+     * absent. */
+    change?: string;
 }): EvidenceRefactorStatement | undefined;
 /** The egress bound each third-party scanner that ran was held to. */
 export interface EvidenceEgressStatement {

package/dist/mcp/terraform/gateScan.d.ts

@@ -1,5 +1,4 @@
 import type { LocalToolContext } from "../localContext.js";
-import { type GateDelta } from "./scanDelta.js";
 import { type ScanScanners } from "./tools/scan.js";
 import { type Concern } from "./types.js";
 import type { PullRequestRunContext } from "../../utils/github/pullRequestEvent.js";
@@ -22,20 +21,7 @@ import type { PullRequestRunContext } from "../../utils/github/pullRequestEvent.
  * Returns undefined when the checkout has no Terraform: the outputs then stay
  * unset, which is how a workflow tells "not scanned" from "scanned clean".
  */
-export declare function runGateScan(ctx: LocalToolContext, scanners?: ScanScanners, isTerraform?: (c: Concern) => boolean): Promise<Concern[] | undefined>;
-/**
- * The scan delta of a pull request: the base scanned with the same scanners and
- * configuration as the head, in a detached worktree so the checkout the agent
- * works in is never touched, and the two concern sets matched (`scanDelta.ts`).
- *
- * The base is the merge base of the PR's base commit and HEAD, which is the base
- * commit itself on GitHub's `refs/pull/N/merge` checkout and the fork point on a
- * head checkout — "what this PR changed" either way.
- *
- * Undefined when the base commit is not in the clone (a shallow checkout) or the
- * worktree cannot be made. The run then gates as it always has, and says why.
- */
-export declare function runScanDelta(ctx: LocalToolContext, pr: Pick<PullRequestRunContext, "baseSha" | "headSha">, headConcerns: Concern[], scanners?: ScanScanners): Promise<GateDelta | undefined>;
+export declare function runGateScan(ctx: LocalToolContext, scanners?: ScanScanners): Promise<Concern[] | undefined>;
 /**
  * Record the gate scan on the session. A failure leaves `gateConcerns` unset —
  * the outputs then read "not scanned", never a pass — and must not stop the run.
@@ -50,4 +36,4 @@ export declare function captureGateScan(ctx: LocalToolContext, scanners?: ScanSc
  * compares two trees, so scoping would only hide what a suggestion broke).
  * Active concerns only.
  */
-export declare function scanForProof(ctx: LocalToolContext, cwd: string, scanners?: ScanScanners): Promise<Concern[]>;
+export declare function scanForProof(ctx: LocalToolContext, cwd: string, files?: string[], scanners?: ScanScanners): Promise<Concern[]>;

package/dist/mcp/terraform/hcl.d.ts

@@ -181,6 +181,21 @@ export declare function hclParseStats(): HclParseStats;
  *  across scans needs only this. */
 export declare function resetHclParseStats(): void;
 export declare function parseBlocks(hcl: string, keywords: readonly string[]): HclBlock[];
+/**
+ * One block label: a quoted string or, as the HCL grammar also allows, a bare
+ * identifier — `resource aws_vpc main {` is the same block as
+ * `resource "aws_vpc" "main" {`, and pre-0.12 code is full of it. A reader that
+ * knew only the quoted form saw none of those resources, so a proof read a
+ * `terraform fmt` that quoted them as resources being ADDED.
+ */
+export declare const BLOCK_LABEL: string;
+/** a label as written, without its quotes. */
+export declare function unquoteLabel(label: string): string;
+/** a `resource <type> <name> {` header in either label style; groups 1 and 2
+ *  are the labels as written ({@link unquoteLabel}). */
+export declare const RESOURCE_HEADER: string;
+/** a `module <name> {` header in either label style; group 1 is the label as written. */
+export declare const MODULE_HEADER: string;
 /** One `name = <value>` assignment found at the top level of a block body. */
 export interface HclAssignment {
     name: string;

package/dist/mcp/terraform/initArtefacts.d.ts

@@ -0,0 +1,21 @@
+export interface InitArtefacts {
+    /** init output git neither tracks nor ignores. */
+    untracked: Set<string>;
+    /** committed lock files with uncommitted changes. */
+    modifiedLocks: Set<string>;
+}
+/**
+ * The `terraform init` output in the checkout, as repo-relative paths; null
+ * outside a git checkout. A committed lock file counts once it is modified:
+ * init adds the runner's platform hash to one made on another platform (a
+ * lock file from a Mac lacks the linux hash).
+ */
+export declare function initArtefacts(cwd: string): InitArtefacts | null;
+/**
+ * Undo what the gate scan's init did to the checkout: remove the artefacts it
+ * created and restore the committed lock files it changed. Validate inits every
+ * root in place, and a checkout that is dirty before the agent starts makes
+ * `checkout_pr` refuse — or, on a committing run, ships the change in the fix.
+ * What was there before the scan is left alone.
+ */
+export declare function removeNewInitArtefacts(cwd: string, before: InitArtefacts | null, by: string): void;