infraweaver 0.3.7 → 0.3.9

package/dist/mcp/terraform/localModules.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The `source` a module block in `fromDir` writes to call the module at
+ * `moduleDir`, both repo-relative POSIX paths. A local source is relative to the
+ * CALLER's directory, so `./modules/s3` is right only from the repo root; from
+ * `env/dev` the same module is `../../modules/s3`.
+ */
+export declare function localSourceFrom(fromDir: string, moduleDir: string): string;
+interface LocalModuleCall {
+    /** absolute path of the file declaring the call. */
+    file: string;
+    /** 1-based line of the `module` header; null in JSON configuration. */
+    line: number | null;
+    name: string;
+    source: string;
+    /** absolute directory the source resolves to. */
+    dir: string;
+    /** whether that directory holds any Terraform configuration. */
+    exists: boolean;
+}
+export interface LocalModuleClosure {
+    /** every local call reached from the root, missing ones included. */
+    calls: LocalModuleCall[];
+    /** the root and every existing local module directory it reaches. */
+    dirs: string[];
+}
+/** the configuration files directly in `dir` (not beneath it). */
+export declare function configFilesIn(dir: string): string[];
+export declare function localModuleClosure(rootDir: string): LocalModuleClosure;
+export {};

package/dist/mcp/terraform/moduleFindings.d.ts

@@ -0,0 +1,38 @@
+import { type Concern } from "./types.js";
+/** Where a scanner was told to put the modules it fetched, outside the tree. */
+export interface FetchDir {
+    /** the directory the scanner's paths are relative to. */
+    cwd: string;
+    dir: string;
+}
+/**
+ * True when a scanner-reported path is a fetched module's copy, not repository
+ * code: under terraform's or checkov's module directory in the tree, or under
+ * the directory a scan had checkov download into. A path that merely leaves the
+ * scanned directory is not enough — a scan of one root reports the repository's
+ * own local modules as `../../modules/x`.
+ */
+export declare function isFetchedModulePath(file: string, fetchedInto?: FetchDir): boolean;
+/** 1-based line of `module "<name>"` in `file`, or null when it is not there. */
+export declare function moduleCallLine(cwd: string, file: string, name: string): number | null;
+/** `module.<name>…` → `<name>`, the call in the root that instantiates it. */
+export declare function topModuleName(address: string): string | null;
+export interface ModuleFinding {
+    /** the concern as the scanner reported it, against the fetched copy. */
+    concern: Concern;
+    /** the call that instantiates the module, in the repository. */
+    call: {
+        file: string;
+        line: number | null;
+    };
+    /** the module resource the finding is about, e.g. `module.data.aws_s3_bucket.this`. */
+    address: string;
+}
+/**
+ * Re-locate each finding to its call, saying in the evidence which module
+ * resource it is about and where in the module. Findings that land on the same
+ * call under the same rule are one concern — a concern's identity is its rule
+ * and location — so they are merged, every resource named: one concern per
+ * resource would be collapsed by the dedupe anyway, and silently.
+ */
+export declare function relocateToCalls(findings: ModuleFinding[]): Concern[];

package/dist/mcp/terraform/refactor/attribution.d.ts

@@ -20,9 +20,9 @@
  * the walk rather than throwing — a truncated attribution makes the proof
  * refuse, which is the safe direction.
  */
-import type { FetchedModules } from "./workspace.js";
 import { type MovedBlock } from "./movedBlocks.js";
 import { type ResourceRef } from "./resources.js";
+import type { FetchedModules } from "./workspace.js";
 import type { SourceFile } from "../tree.js";
 export interface Attribution {
     resources: ResourceRef[];

package/dist/mcp/terraform/refactor/equivalence.d.ts

@@ -91,6 +91,13 @@ export interface EquivalenceResult {
         before: string;
         after: string;
     }[];
+    /** relocations that changed the provider configuration managing the resource
+     *  (G16) — another region or account, with every argument unchanged. */
+    provider_diffs: {
+        resource: string;
+        before: string;
+        after: string;
+    }[];
     /** relocations where the repetition changed LEVEL — it sat on the resource and
      * now sits on a module call, or the reverse (G15). The instance key moves to a
      * different position in the address, so the same instances live at entirely

package/dist/mcp/terraform/refactor/expressions.d.ts

@@ -0,0 +1,62 @@
+/**
+ * A Terraform expression read into its SHAPE, for the refactor proof's value
+ * comparison ([[substitution]]).
+ *
+ * Not an evaluator and not a full HCL grammar. It recognises the forms whose
+ * value can be followed without running anything — literals, quoted templates,
+ * tuples, objects, traversals (`var.x`, `aws_s3_bucket.b.arn`, `data.t.n.json`)
+ * and a top-level conditional — and keeps everything else (function calls,
+ * operators, `for` expressions) as `raw`: the code text, with the traversals
+ * and strings inside it lifted out so they can still be resolved. A raw
+ * expression is only ever compared as "the same code over the same values",
+ * which can say equal, never different.
+ *
+ * Pure.
+ */
+export type Step = {
+    attr: string;
+} | {
+    index: Expr;
+};
+export type Expr = {
+    kind: "literal";
+    value: string | number | boolean | null;
+}
+/** a quoted string; `parts` alternate text and `${…}` interpolations. */
+ | {
+    kind: "template";
+    parts: (string | Expr)[];
+} | {
+    kind: "tuple";
+    items: Expr[];
+} | {
+    kind: "object";
+    entries: {
+        key: string;
+        value: Expr;
+    }[];
+}
+/** `root.step.step[index]…` — `root` is `var`, `local`, a resource type, … */
+ | {
+    kind: "traversal";
+    root: string;
+    steps: Step[];
+    text: string;
+} | {
+    kind: "conditional";
+    cond: Expr;
+    whenTrue: Expr;
+    whenFalse: Expr;
+}
+/** anything else: code text interleaved with the expressions found inside it. */
+ | {
+    kind: "raw";
+    parts: (string | Expr)[];
+}
+/** text whose inside cannot be read safely — a heredoc, a template directive. */
+ | {
+    kind: "opaque";
+    text: string;
+};
+/** read one expression's text into its shape. */
+export declare function parseExpression(text: string): Expr;

package/dist/mcp/terraform/refactor/references.d.ts

@@ -0,0 +1,15 @@
+import type { MovedBlock } from "./movedBlocks.js";
+import type { SourceFile } from "../tree.js";
+export interface StaleReference {
+    file: string;
+    line: number;
+    /** the relocated address the reference still names, without instance key. */
+    address: string;
+}
+/**
+ * Every place in a relocation's root that still names the address it moved
+ * away from. Each reference found is a defect the proof must refuse.
+ */
+export declare function staleReferences(after: readonly SourceFile[], relocations: readonly MovedBlock[]): StaleReference[];
+/** The proof's reason for a set of stale references; null when there are none. */
+export declare function staleReferenceReason(stale: readonly StaleReference[]): string | null;

package/dist/mcp/terraform/refactor/resources.d.ts

@@ -39,7 +39,17 @@ export interface ResourceRef {
      * single instance. See [[Multiplicity]] — this is deliberately NOT folded into
      * `argNames`, because a correct extraction MOVES it onto the module call. */
     multiplicity: Multiplicity[];
+    /** the provider configuration that manages the resource, as the ROOT names it
+     *  (`aws`, `aws.replica`): the resource's own `provider` meta-argument, or the
+     *  default for its type, resolved through every module call's `providers`
+     *  map. Absent on a hand-built ref, which is not compared. See
+     *  [[moduleCallProviders]]. */
+    provider?: string;
 }
+/** `module "<name>" { … }` call name → its `providers` map (the module's name
+ *  for a configuration → the caller's), or null when the call passes none and
+ *  the module inherits the caller's default configurations. */
+export declare function moduleCallProviders(hcl: string): Map<string, Map<string, string> | null>;
 /**
  * How many instances of a resource exist, and keyed by what.
  *
@@ -142,4 +152,5 @@ export declare function parseResourcesWithArgs(hcl: string): {
     name: string;
     argNames: string[];
     multiplicity: Multiplicity | null;
+    provider: string | null;
 }[];

package/dist/mcp/terraform/refactor/substitution.d.ts

@@ -1,13 +1,12 @@
 /**
- * The VALUE half of a refactor proof: did each relocated argument keep the value
- * it had?
+ * The VALUE half of a refactor proof: does every resource the change touches
+ * still say what it said?
  *
  * [[equivalence]] compares argument NAMES and never values, for a good reason —
- * the names are what survives being moved behind a module boundary, and a static
- * read cannot evaluate an expression. That reading is exactly right for a b.3
- * extraction whose arguments move verbatim. It is a HOLE the moment the refactor
- * PARAMETERISES those arguments, which is what consolidating N environments onto
- * one shared module does to every value that differs between them:
+ * the names are what survives being moved behind a module boundary. On its own
+ * that is a hole wherever the change PARAMETERISES a value, which is what
+ * consolidating N environments onto one shared module does to every value that
+ * differs between them:
  *
  *   before   env/dev/main.tf    bucket = "acme-dev-logs"
  *            env/prod/main.tf   bucket = "acme-prod-logs"
@@ -15,61 +14,80 @@
  *            env/dev/main.tf    module "logging" { bucket = "acme-prod-logs" }   ← swapped
  *            env/prod/main.tf   module "logging" { bucket = "acme-dev-logs"  }   ← swapped
  *
- * Every existing gate passes that tree. The resource set is identical, the
- * argument names are identical, the `moved {}` blocks are complete, `terraform
- * validate` is clean, and — because both roots still declare exactly one bucket
- * each — so is a plan. The apply destroys prod.
+ * Every name-level gate passes that tree, and so does a plan. The apply
+ * destroys prod. The same hole has other doors: a shared module whose body was
+ * edited on the way (every caller changes, moved or not), a nested block whose
+ * value now comes from a call input, a `dynamic` block fed one rule fewer, a
+ * data source the moved resource reads.
  *
- * WHAT THIS DOES, AND ONLY THIS. For an argument whose after-value is a single
- * bare `var.<X>`, it follows `X` back UP the call chain to the value written at
- * the call site, and compares that against the before-value as TEXT. Both sides
- * are then expressions in the SAME root's scope, so `var.bucket_name` on one
- * side and `var.bucket_name` on the other really are the same value — which is
- * why the walk stops the moment it reaches the root and never tries to resolve a
- * root variable further. Nothing is evaluated, here or anywhere else in the
- * proof.
+ * WHAT THIS DOES. Every resource present on both sides — matched through the
+ * relocations — is read into VALUES ([[expressions]]) and compared. A value is
+ * followed, never run: `var.x` back up the call chain to what the call site
+ * wrote (or the module's default), `local.x` to its definition, `module.m.o` to
+ * the output's expression, a `data` source to its body, a reference to another
+ * resource to that resource's identity (through the relocations, so
+ * `aws_s3_bucket.data.id` in the root and `aws_s3_bucket.this.id` in the module
+ * are the same value). A `dynamic` block is expanded when its `for_each`
+ * resolves to a literal collection; a conditional is folded when its condition
+ * does; a template whose parts are all literals is joined. Nothing else is
+ * evaluated — a function call or an operator is compared only as "the same
+ * code over the same values".
  *
- * AND WHAT IT REFUSES TO SAY. `null` is NOT CHECKED and is used freely: an
- * after-value that is not a bare `var.<X>`, an input the call site does not set
- * and the module does not default, a module whose directory does not resolve. A
- * mismatch is only ever reported when both sides were actually read — the trade
- * is missed instances, never false ones.
+ * AND WHAT IT REFUSES TO SAY. A comparison has three outcomes: equal, CHANGED,
+ * or NOT CHECKED. CHANGED is reported only when the difference is established
+ * — two literals that differ, a collection of a different length, a field one
+ * side lacks, a block that has no counterpart at all. Anything that would need
+ * evaluating is NOT CHECKED. The trade is missed instances, never false ones.
+ *
+ * Root-scoped values are never resolved further: `var.x` in a root means
+ * whatever tfvars says on both sides, so it is equal to itself and to nothing
+ * else.
  *
  * Pure: two already-read trees and the relocations in, findings out.
  */
 import type { MovedBlock } from "./movedBlocks.js";
 import type { SourceFile } from "../tree.js";
 interface ValueSubstitution {
-    /** the root the relocation happened in. */
+    /** the root module the resource belongs to. */
     root: string;
     /** the BEFORE address, as `expected_moves` spells it. */
     resource: string;
+    /** the argument, with a path into nested blocks: `versioning_configuration[0].status`. */
     argument: string;
-    /** the value the argument had before the refactor, in the root's scope. */
+    /** the value as the before tree writes it. */
     before: string;
-    /** the value written on the relocated resource — typically `var.<X>`. */
+    /** the value as the after tree writes it — often `var.<x>`. */
     after: string;
-    /** what `after` resolves to AT THE CALL SITE, i.e. back in the root's scope.
-     *  `null` means NOT CHECKED — see `not_checked` for which case. */
+    /** what `after` resolves to, followed back to the root's scope. `null` when
+     *  the comparison was NOT CHECKED. */
     after_resolved: string | null;
-    /** `true`/`false` only when both sides were read; `null` = NOT CHECKED. */
+    /** `true`/`false` only when the comparison settled; `null` = NOT CHECKED. */
     match: boolean | null;
-    /** why this argument was not checked, or null when it was. */
+    /** why this value was not checked, or null when it was. */
     not_checked: string | null;
 }
 export interface SubstitutionResult {
-    /** every argument considered, checked or not. `null` means the question did
-     *  not arise: no relocation put a resource inside a module call, so there was
-     *  no parameter substitution to verify. Distinct from `[]`, which means
-     *  relocations were examined and none had a comparable argument. */
+    /** every value compared on a RELOCATED resource, plus every established
+     *  change anywhere. `null` means the question did not arise: nothing moved
+     *  and nothing changed. */
     value_substitutions: ValueSubstitution[] | null;
-    /** the established mismatches — the subset with `match: false`. A non-empty
+    /** the established changes — the subset with `match: false`. A non-empty
      *  list is a violation, not a warning. */
     value_mismatches: ValueSubstitution[];
+    /** calls of a module this tree does not contain — a registry module, a git
+     *  module nothing fetched — whose `source` or `version` changed. The code the
+     *  resources come from was swapped outside the tree, so no comparison here
+     *  can say what changed: never a proof, in either direction. */
+    opaque_module_changes: {
+        root: string;
+        call: string;
+        before: string;
+        after: string;
+    }[];
     reasons: string[];
 }
 /**
- * Verify that every relocated argument's value survived being parameterised.
+ * Compare the values of every resource present on both sides.
  *
  * `moves` is `computeEquivalence`'s `expected_moves` — the authoritative set of
  * relocations, so this check and the proof it augments always speak about the

package/dist/mcp/terraform/scanDelta.d.ts

@@ -8,6 +8,11 @@ export interface DeltaFinding {
     block?: string;
     /** an introduced finding whose resource may be an undeclared rename. */
     possiblyPreexisting?: true;
+    /** with `possiblyPreexisting`: the vanished resource it pairs with on the base. */
+    renamedFrom?: {
+        address: string;
+        file: string;
+    };
 }
 export interface ScanDelta {
     introduced: DeltaFinding[];
@@ -60,6 +65,29 @@ export interface ScanDeltaInput {
  */
 export declare function findingKey(f: DeltaFinding): string;
 export declare function computeScanDelta(input: ScanDeltaInput): ScanDelta;
+/** One resource that looks renamed (or moved to another directory) without a
+ *  `moved` block, and how many introduced findings ride on it. */
+export interface UndeclaredRename {
+    from: {
+        address: string;
+        dir: string;
+    };
+    to: {
+        address: string;
+        dir: string;
+    };
+    findings: number;
+}
+/**
+ * The possibly-pre-existing findings grouped by the rename behind them.
+ *
+ * Fifteen findings on one renamed bucket are one thing for the author to do —
+ * add a `moved` block — not fifteen, and without that block `terraform apply`
+ * destroys the old resource and creates the new one. So a verdict reads better
+ * naming the resource once than listing every rule it carries. Order follows
+ * the findings (which are sorted by location), so the output is stable.
+ */
+export declare function undeclaredRenames(introduced: readonly DeltaFinding[]): UndeclaredRename[];
 /** Every `resource` / `data` address declared in one file. */
 export declare function declaredAddresses(hcl: string): string[];
 /** A scan delta pinned to the commits it compared. */

package/dist/mcp/terraform/scanSession.d.ts

@@ -43,6 +43,7 @@ export interface ScanSession {
     baselineConcernKeys?: string[];
     baselineFmtDriftFiles?: string[];
     lastScanConcerns?: Concern[];
+    concernsById?: Map<string, Concern>;
     gateConcerns?: Concern[];
     policyRules?: unknown[] | null;
     policyGate?: PolicyGateResult;
@@ -73,6 +74,7 @@ export interface ScanSession {
     lastCostDirection?: "increase" | "decrease" | "no-change" | "unknown";
     lastIdleFloor?: IdleFloorReport | undefined;
     lastDrift?: DriftEvidenceStatement | undefined;
+    emittedArtefacts?: Record<string, string[]>;
     emittedSarifPath?: string;
     refactorEquivalence?: {
         equivalent: boolean;
@@ -129,6 +131,10 @@ export interface ScanSession {
         fingerprint: string;
         pairs: PairAnalysis;
     };
+    baselineValidateErrors?: {
+        base: string;
+        errors: string[];
+    };
     planFollowedUpgradeDetection?: boolean;
 }
 /**
@@ -153,6 +159,13 @@ export declare function createScanSession(): ScanSession;
 export declare function scanSessionOf(toolState: {
     scanSession?: ScanSession;
 }): ScanSession;
+/** Publish a scan's reported concern set, and remember each concern for the
+ *  rest of the run (see `concernsById`). */
+export declare function recordScanConcerns(session: ScanSession, concerns: Concern[]): void;
+/** Remember each concern for the rest of the run, so
+ *  terraform_verify_remediation can key an id from ANY concern source — a
+ *  findings file or an external report as much as a scan. */
+export declare function recordConcernKeys(session: ScanSession, concerns: Concern[]): void;
 /**
  * true once terraform_scan / read_findings captured a pre-fix baseline this
  * session. terraform_verify_remediation key-maps requested ids against the

package/dist/mcp/terraform/scanners.d.ts

@@ -1,20 +1,40 @@
 import { type ToolsNetworkDirective } from "./scannerEgress.js";
+import { type TreeLayout, type VarFileMapping } from "./treeLayout.js";
 import { type Concern, type ScannerOutcome } from "./types.js";
 import { type ResolvedToolSelection } from "../../utils/prompt/toolSelection.js";
-/**
- * Run `terraform init -backend=false` once per dir so `terraform validate` has
- * provider schemas to check against (Bug 3 / gap B). Without init, validate only
- * emits "missing required provider" — which VALIDATE_NOISE drops — so it was
- * effectively inert. `-backend=false` avoids needing real backend credentials;
- * `-input=false` keeps it non-interactive. Network-dependent and best-effort: if
- * it fails (offline, private module, etc.) validate still runs, just shallow.
- */
 /** Forget every init, so the next validate re-runs it — after its artefacts were removed. */
 export declare function resetTerraformInitCache(): void;
-export declare function scanFmt(cwd: string): ScannerOutcome;
+/**
+ * The roots under `cwd` whose last `terraform init` failed, with init's error.
+ * Their validate is shallow — "Module not installed" is all it can say, and that
+ * is dropped as noise — so nothing that leans on validate may count them as
+ * checked.
+ */
+export declare function initFailures(cwd: string): {
+    root: string;
+    error: string;
+}[];
+/** {@link initFailures}, the roots only. */
+export declare function initFailedRoots(cwd: string): string[];
+/**
+ * `terraform` when installed, else `tofu` — OpenTofu-only runners keep fmt
+ * coverage (identical CLI surface; the source label stays "terraform-fmt" so
+ * rule ids and content hashes never fork on the binary name).
+ *
+ * Safe to run alongside `terraform init`: `fmt -recursive` skips dot-directories,
+ * so it never reads the `.terraform/` tree init is writing (verified against the
+ * installed CLI — an unformatted file planted under `.terraform/` is not reported).
+ */
+export declare function scanFmt(cwd: string): Promise<ScannerOutcome>;
 /** `terraform fmt -check -list=true` prints one unformatted file path per line. */
 export declare function parseFmtOutput(stdout: string, cwd?: string): Concern[];
-export declare function scanValidate(cwd: string, extraEnv?: Record<string, string>): ScannerOutcome;
+/**
+ * Run `terraform validate` across EVERY root and aggregate. `validate` is the
+ * one scanner that's per-root (fmt/tflint/trivy/checkov are recursive over the
+ * whole tree), so a multi-root repo only catches subdir-root validate errors
+ * when we visit each root. Inits first, through the same queue a scan uses.
+ */
+export declare function scanValidate(cwd: string, extraEnv?: Record<string, string>): Promise<ScannerOutcome>;
 /** parse `terraform validate -json`; keeps real errors, drops uninitialized-dir noise. */
 export declare function parseValidateOutput(stdout: string, cwd?: string): Concern[];
 export interface ProviderRequirement {
@@ -84,17 +104,30 @@ export interface LocatedResource extends ResourceArguments {
  *  way as `collectProviderRequirements` — an unreadable file is skipped rather
  *  than failing the walk. */
 export declare function collectResourceArguments(cwd: string): LocatedResource[];
-export declare function scanTflint(cwd: string, network?: ToolsNetworkDirective): ScannerOutcome;
+export declare function scanTflint(cwd: string, network?: ToolsNetworkDirective): Promise<ScannerOutcome>;
 /** parse `tflint --format json` output into concerns. */
 export declare function parseTflintOutput(stdout: string, cwd?: string): Concern[];
+/** One `trivy config` run: the variable files it loads, the directories it skips. */
+interface TrivyRun {
+    tfVars: string[];
+    skipDirs: string[];
+    /** a root's run keeps only findings in that root's closure */
+    keep?: string[];
+}
 /**
- * `trivy config` arguments for `cwd`. trivy evaluates variables from their
- * defaults unless told otherwise, so a value set in `terraform.tfvars` — an open
- * CIDR, a public flag — is invisible to it. With ONE root module its auto-loaded
- * variable files are passed, exactly as `terraform plan` would load them. With
- * several, trivy would apply one root's values to every root, so none are.
+ * The trivy runs that cover `layout`. trivy evaluates variables from their
+ * defaults unless told otherwise, so a value set in a `.tfvars` file is
+ * invisible to a plain run, and a file passed to a whole-tree run applies to
+ * every root in it. So the whole tree is scanned once without variable files,
+ * then each root that has some once per file set, with every other root
+ * skipped (a root's own directory alone would lose its `../modules`): its
+ * auto-loaded files, then those plus each `-var-file` file in turn, as each
+ * `terraform plan` would load them. A tree with a single root loads its
+ * auto-loaded files in the whole-tree run.
  */
-export declare function trivyArgs(cwd: string): string[];
+export declare function trivyRuns(layout: TreeLayout, scope: readonly string[] | undefined): TrivyRun[];
+/** `trivy config` arguments for one run over the scan directory. */
+export declare function trivyArgs(run: TrivyRun): string[];
 /**
  * Parse `trivy config --format json` output into concerns. Trivy nests
  * misconfigurations under `Results[].Misconfigurations[]`, keyed to the result's
@@ -114,10 +147,19 @@ export declare function parseTrivyOutput(stdout: string, cwd?: string): Concern[
  * unreadable file just leaves the snippet null. Pure-ish (read-only I/O).
  */
 export declare function attachSourceSnippets(concerns: Concern[], cwd: string): Concern[];
+/**
+ * checkov `--skip-path` values for the directories a scoped scan leaves out.
+ * checkov matches each as a regular expression against a path whose form
+ * depends on how it walked there, so a pattern is anchored at a path
+ * separator and the end; one that would also match a directory the scan
+ * keeps (`envs/prod` and `nested/envs/prod`) is not passed — the scope filter
+ * still drops its findings, the scan just reads it.
+ */
+export declare function checkovSkipPaths(tfDirs: readonly string[], skip: readonly string[]): string[];
 /** parse `checkov -o json` output (object for one framework, array for several).
  *  Each block's `check_type` names the framework that produced it (terraform /
  *  cloudformation / kubernetes / …) — carried onto every concern as its language. */
-export declare function parseCheckovOutput(stdout: string, cwd?: string): Concern[];
+export declare function parseCheckovOutput(stdout: string, cwd?: string, downloadDir?: string): Concern[];
 /**
  * Terraform files changed on the current branch vs the base. Returns null when
  * the base can't be determined (caller then falls back to a full scan).
@@ -150,6 +192,12 @@ export interface RunScannersOptions {
      * `"partial"` accordingly. Absent ⇒ open egress (today's behaviour) — deny is
      * opt-in. */
     toolsNetwork?: ToolsNetworkDirective | undefined;
+    /** the directories a scoped scan covers (`scopeFor`), relative to the scan
+     * directory; a finding elsewhere is dropped and roots outside are not
+     * initialised. Undefined scans the whole tree. */
+    scope?: string[] | undefined;
+    /** `-var-file` files whose root the `var_files` setting names. */
+    varFiles?: VarFileMapping[] | undefined;
 }
 /** run every scanner once over `cwd`. shared by `terraform_scan` and the
  * deterministic remediation verifier so both see the identical toolchain. A
@@ -210,3 +258,4 @@ export declare function regressionIdsByKey(current: {
     id: string;
     key: string;
 }[], baselineKeys: Set<string>): string[];
+export {};

package/dist/mcp/terraform/secretScan.d.ts

@@ -0,0 +1,19 @@
+import { type Concern } from "./types.js";
+export interface SecretScan {
+    ran: boolean;
+    /** why it did not run */
+    reason?: string;
+    concerns: Concern[];
+}
+/**
+ * Parse a betterleaks v2 JSON report into concerns, paths made relative to the
+ * scan directory (`prefix` is its path in the repository), and whether the
+ * scan completed: an incomplete one keeps the findings it made before it
+ * stopped. Throws on a report that is not v2's.
+ */
+export declare function parseBetterleaksReport(json: string, prefix?: string): {
+    concerns: Concern[];
+    complete: boolean;
+};
+/** Scan the lines the commits after `mergeBase` add, from the scan directory `cwd`. */
+export declare function scanAddedSecrets(cwd: string, mergeBase: string, tmp: string): Promise<SecretScan>;

package/dist/mcp/terraform/standardsReport.d.ts

@@ -212,7 +212,7 @@ export declare function buildStandardsReport(files: SourceFile[], concerns: Conc
  * offered — `buildStandardsReport` is the pure seam for a caller that already
  * holds both.
  */
-export declare function standardsReport(cwd: string): StandardsReport;
+export declare function standardsReport(cwd: string): Promise<StandardsReport>;
 /**
  * The report as Markdown — the handover artefact.
  *

package/dist/mcp/terraform/tools/plan.d.ts

@@ -17,7 +17,7 @@ export declare function collectCloudCredentials(): Record<string, string>;
 export interface PlanRunners {
     /** `tmpdir` is where the saved plan file goes — outside the repository,
      *  because it holds attribute values. */
-    planOneRoot: (absDir: string, creds: Record<string, string>, tmpdir?: string) => RootPlanOutcome;
+    planOneRoot: (absDir: string, creds: Record<string, string>, tmpdir?: string) => Promise<RootPlanOutcome>;
     hasCloudCredentials: () => boolean;
 }
 export declare function runPlan(ctx: LocalToolContext, runners?: PlanRunners): Promise<Record<string, any> | import("../../shared.js").ToolOk<{

package/dist/mcp/terraform/tools/scan.d.ts

@@ -21,9 +21,9 @@ export declare function runScan(ctx: LocalToolContext, { scan_scope, severity_th
     scope: string;
     scope_note?: string;
     grouping: "file" | "rule";
-    scanners_ran: ("checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy")[];
+    scanners_ran: ("betterleaks" | "checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy")[];
     scanners_skipped: {
-        source: "checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy";
+        source: "betterleaks" | "checkov" | "infraweaver" | "reviewer" | "terraform-fmt" | "terraform-validate" | "tflint" | "trivy";
         reason: string | undefined;
     }[];
     scanners_partial?: import("../types.js").CoverageGap[];
@@ -41,7 +41,6 @@ export declare function runScan(ctx: LocalToolContext, { scan_scope, severity_th
         by_severity: Record<string, number>;
     };
     groups: {
-        doc_urls: Record<string, string>;
         id: string;
         file: string;
         files?: string[];
@@ -53,6 +52,7 @@ export declare function runScan(ctx: LocalToolContext, { scan_scope, severity_th
         autonomy?: import("../types.js").Autonomy;
         autonomy_reasons?: string[];
         priority?: import("../types.js").PriorityBand;
+        doc_urls: Record<string, string>;
     }[];
     batch_plan: import("../decisions.js").BatchPlan;
     co_located: import("../decisions.js").LocationCluster[];
@@ -64,11 +64,8 @@ export declare function runScan(ctx: LocalToolContext, { scan_scope, severity_th
     top_risks: import("../risk.js").RankedConcern[];
     reintroduced?: import("../lineage.js").ReintroducedFinding[];
     concerns: {
-        doc_url: string | null;
-        risk_score: number;
-        noise_reason?: string;
         id: string;
-        source: "terraform-fmt" | "terraform-validate" | "tflint" | "trivy" | "checkov" | "infraweaver" | "reviewer";
+        source: "terraform-fmt" | "terraform-validate" | "tflint" | "trivy" | "checkov" | "infraweaver" | "betterleaks" | "reviewer";
         rule_id: string;
         severity: Severity;
         category: "security" | "style" | "correctness" | "cost";
@@ -83,6 +80,9 @@ export declare function runScan(ctx: LocalToolContext, { scan_scope, severity_th
         suppression?: import("../types.js").ConcernSuppression;
         canonical_class?: string;
         flagged_by?: string[];
+        doc_url: string | null;
+        risk_score: number;
+        noise_reason?: string;
     }[];
     orphan_native_skips?: {
         file: string;