terramend 0.2.0

package/dist/mcp/moduleExtraction.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Modularization-as-remediation (M2, the hepcare pattern) — DETECTION.
+ *
+ * Finds clusters of raw resources that look like they should be a module call,
+ * and matches each cluster against the modules the repo already trusts: the
+ * operator's `module_catalogue` and the repo's own local ("house") modules.
+ * The agent turns a candidate into a refactor PR; `terraform_plan`'s
+ * `refactor_safe` gate (pure `moved {}` plan) is what makes that PR provably a
+ * no-op on live infrastructure.
+ *
+ * Everything here is pure parsing + set arithmetic over files already on disk —
+ * no subprocess, no network — mirroring the modules.ts design.
+ */
+import type { LocalToolContext } from "#app/mcp/localContext";
+import { type ModuleCatalogueEntry, type ModuleSourceKind } from "#app/mcp/modules";
+export interface ParsedResource {
+    type: string;
+    name: string;
+}
+/** parse every `resource "<type>" "<name>" {` header in some HCL. Headers are
+ * enough here — clustering and signature matching only need type + name. */
+export declare function parseResourceBlocks(hcl: string): ParsedResource[];
+export interface ExtractionCluster {
+    /** the file the resources live in (clusters never span files — one file is
+     * the unit a reviewer can hold in their head, and the unit `moved {}` blocks
+     * keep reviewable). */
+    file: string;
+    /** the shared resource-NAME prefix that bound the cluster, or null for a
+     * whole-file cluster. */
+    name_prefix: string | null;
+    resources: ParsedResource[];
+    /** distinct resource types, sorted — the cluster's signature. */
+    resource_types: string[];
+}
+/**
+ * Cluster one file's resources into extraction candidates:
+ *   - groups sharing a name prefix with ≥ MIN_CLUSTER_SIZE members, else
+ *   - the whole file when it holds ≥ MIN_CLUSTER_SIZE+1 resources of ≥2 types
+ *     (a single-type pile is usually `count`/`for_each` material, not a module).
+ * Prefix clusters that would equal the whole-file cluster collapse into one.
+ */
+export declare function clusterResources(file: string, resources: ParsedResource[]): ExtractionCluster[];
+export interface CandidateModule {
+    name: string;
+    source: string;
+    version: string | null;
+    kind: ModuleSourceKind;
+    /** how the match was made: a house module's actual resource types, or a
+     * catalogue module's name matching the cluster's service keywords. */
+    match: "resource_signature" | "name_keyword";
+    /** fraction of the cluster's resource types the candidate covers (signature
+     * matches) or whose service keyword hits the candidate's name (keyword). */
+    overlap: number;
+    /** house modules only — what the call site must wire up. */
+    required_variables?: string[];
+}
+/** service keywords of a resource type: `aws_s3_bucket` → ["s3", "bucket"]. */
+export declare function serviceKeywords(resourceType: string): string[];
+export interface HouseModuleSignature {
+    dir: string;
+    resourceTypes: string[];
+    requiredVariables: string[];
+}
+export declare function matchCluster(cluster: ExtractionCluster, houseModules: HouseModuleSignature[], catalogue: ModuleCatalogueEntry[]): CandidateModule[];
+export interface ExtractionCandidate {
+    cluster: ExtractionCluster;
+    candidates: CandidateModule[];
+}
+export declare function findExtractionCandidates(cwd: string, rawCatalogue: string | undefined): ExtractionCandidate[];
+export declare const ModuleExtractionCandidatesParams: import("arktype/internal/variants/object.ts").ObjectType<object, {}>;
+export declare function ModuleExtractionCandidatesTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<object, object>>;

package/dist/mcp/moduleTests.d.ts

@@ -0,0 +1,104 @@
+import type { LocalToolContext } from "#app/mcp/localContext";
+/**
+ * §28 (remediation slice) — keep a reusable module's EXISTING tests/examples
+ * consistent with a fix. `scaffold_terratest` covers the GENERATION direction
+ * (new module → new plan-only tests). This is the inverse: when Remediate fixes
+ * an existing local/house module and the fix changes the module's public
+ * interface (adds a required `variable`, renames or removes one, tightens a
+ * type), the module's `examples/` fixtures and `terraform test` / Terratest
+ * files that CALL it can silently go stale — a missing required variable breaks
+ * `terraform test`/`plan`, and a reference to a removed variable is an error.
+ *
+ * This module finds those test/example assets for a module dir and computes the
+ * DRIFT between what each asset passes and the module's CURRENT interface, so the
+ * agent updates exactly the assets that need it (and only those) after a fix —
+ * never weakening an assertion to go green. The parsing is pure + unit-tested;
+ * the collector just reads the conventional locations (no full-repo walk).
+ */
+export type ModuleTestAssetKind = "example" | "native-test" | "go-test";
+export interface ModuleTestAsset {
+    /** repo-relative path: a dir for examples, a file for native/go tests. */
+    path: string;
+    kind: ModuleTestAssetKind;
+    /** variable names the asset passes to the module (best-effort for go tests). */
+    set_variables: string[];
+}
+export interface ModuleTestDrift {
+    path: string;
+    kind: ModuleTestAssetKind;
+    /** required module variables the asset does NOT set (would break plan/test). */
+    missing_required: string[];
+    /** variables the asset sets that are NOT in the module interface — the fix
+     * renamed or removed them, so the reference is now stale/an error. */
+    unknown_set: string[];
+}
+export interface ModuleTestReport {
+    module_dir: string;
+    /** the module's CURRENT interface, the truth the assets must match. */
+    required_variables: string[];
+    variable_names: string[];
+    assets: ModuleTestAsset[];
+    drift: ModuleTestDrift[];
+}
+/**
+ * The TOP-LEVEL attribute names assigned (`name = …`) directly in an HCL block
+ * body — nested-block / object-field keys are excluded by collapsing `{…}` spans
+ * first. Pure. Used for both a `module` block's arguments and a `variables {}`
+ * block's entries. `==`/`>=`/`!=` etc. are excluded via the `=(?!=)` guard and
+ * by requiring the name to start a line.
+ */
+export declare function topLevelAttributeNames(body: string): string[];
+/**
+ * Variables an example sets on the module(s) whose `source` satisfies
+ * `sourceMatches` — the union of the matching `module` blocks' top-level
+ * arguments (minus meta-args like `source`/`version`/`count`). Pure. Returns []
+ * when no module block in the HCL targets the module.
+ */
+export declare function parseExampleModuleVariables(hcl: string, sourceMatches: (source: string) => boolean): string[];
+/**
+ * Variables a Terraform-native test (`*.tftest.hcl`) sets — the union of every
+ * `variables { … }` block's top-level entries (the top-level block plus any
+ * inside `run "…" { … }`). When the test lives in the module's own dir it tests
+ * the module in place, so these are the module's variables. Pure.
+ */
+export declare function parseNativeTestVariables(hcl: string): string[];
+/**
+ * Variable keys a Go Terratest sets — the `"<key>":` entries inside a
+ * `Vars: map[string]interface{}{ … }` (or `map[string]any{ … }`) literal.
+ * Best-effort (Go isn't parsed structurally); advisory only. Pure.
+ */
+export declare function parseGoTestVariables(go: string): string[];
+/**
+ * Drift between what an asset passes and the module's CURRENT interface:
+ * `missing_required` (required vars the asset never sets) and `unknown_set`
+ * (vars the asset sets that the module no longer declares). Pure.
+ */
+export declare function computeInterfaceDrift(input: {
+    setVariables: string[];
+    requiredVariables: string[];
+    variableNames: string[];
+}): {
+    missing_required: string[];
+    unknown_set: string[];
+};
+/**
+ * Find a module's existing test/example assets in the conventional locations and
+ * record which of the module's variables each one passes. Reads only the module's
+ * own `examples/`/`tests/`/`test/` dirs and the repo-root `examples/` (no
+ * full-tree walk). `moduleDir` is repo-relative POSIX. Side-effecting (reads fs).
+ */
+export declare function discoverModuleTestAssets(cwd: string, moduleDir: string): ModuleTestAsset[];
+/**
+ * Build the module's test/example consistency report: its current interface, the
+ * discovered assets, and the per-asset drift against that interface. Side-effecting
+ * (reads fs). The agent reads `drift` to know which assets to update after a fix.
+ */
+export declare function analyzeModuleTests(cwd: string, moduleDir: string): ModuleTestReport;
+export declare const TerraformModuleTestsParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    module_dir: string;
+}, {}>;
+export declare function TerraformModuleTestsTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    module_dir: string;
+}, {
+    module_dir: string;
+}>>;

package/dist/mcp/modules.d.ts

@@ -0,0 +1,179 @@
+import type { LocalToolContext } from "#app/mcp/localContext";
+/**
+ * Terraform module support (§4.14 + module catalogue). Two related capabilities:
+ *
+ *  - **Module catalogue** — an operator-curated list of approved modules (a
+ *    registry module like `terraform-aws-modules/vpc/aws`, or one of the org's
+ *    own/house modules at a local path) that a fix/generation should PREFER over
+ *    hand-rolling raw resources. Surfaced by `list_modules`.
+ *  - **Module-source-aware fixes** — parse the repo's `module "x" { source = … }`
+ *    blocks into a call-graph so a concern inside a *local* module is fixed at
+ *    its SOURCE once (not patched at every call site), while a concern that would
+ *    require editing a *registry/remote* module is flagged as out-of-repo.
+ *    Surfaced by `terraform_module_graph`.
+ *
+ * The parsing is pure (no subprocess) and unit-tested; the tools just read files.
+ */
+export interface ModuleCatalogueEntry {
+    /** the local name to use in a `module "<name>"` block. */
+    name: string;
+    /** the `source` value, e.g. `terraform-aws-modules/vpc/aws` or `./modules/vpc`. */
+    source: string;
+    /** optional version constraint for a registry module. */
+    version: string | null;
+    /** classification of the source (registry / local / git / remote). */
+    kind: ModuleSourceKind;
+}
+export type ModuleSourceKind = "local" | "registry" | "git" | "remote" | "unknown";
+export interface ParsedModuleSource {
+    /** the full original source string. */
+    raw: string;
+    /** the source with the `//subdir` selector and `?query` stripped. */
+    base: string;
+    /** the `//subdir` path within the module repo/package, or null. */
+    subdir: string | null;
+    /** the `?ref=` revision (git tag/branch/commit), or null. This is how git
+     * modules PIN a version — Terraform has no `version` attribute for them. */
+    ref: string | null;
+    kind: ModuleSourceKind;
+}
+/**
+ * Split a Terraform module `source` into its base, `//subdir` selector, and
+ * `?ref=` revision — the three parts Terraform's go-getter syntax composes
+ * (`git::https://host/repo.git//subdir?ref=v1`,
+ * `terraform-aws-modules/cloudwatch/aws//modules/log-group`). The `//` separator
+ * is the one NOT part of a `://` scheme. Pure; underpins classification + the
+ * version a git module is pinned at.
+ */
+export declare function splitModuleSource(raw: string): ParsedModuleSource;
+/**
+ * Classify a Terraform module `source` string (the full value, including any
+ * `//subdir` / `?ref=`). Mirrors Terraform's own source resolution: a
+ * `./`/`../`/absolute path is LOCAL; a `git::`/`github.com`/`.git`/`bitbucket.org`
+ * source is GIT; an `s3::`/`gcs::`/`http(s)` archive is REMOTE; a bare
+ * `namespace/name/provider` (optionally host-prefixed, optionally with a
+ * `//submodule` path) is a REGISTRY ref.
+ */
+export declare function classifyModuleSource(source: string): ModuleSourceKind;
+/**
+ * Parse the operator's `module_catalogue` input into structured entries. Accepts
+ * newline- and/or comma-separated entries, each:
+ *   `[name=]<source>[ <version>]`
+ * e.g. `vpc=terraform-aws-modules/vpc/aws ~> 5.0`, `terraform-aws-modules/s3-bucket/aws`,
+ * `./modules/networking`. Name is optional (derived from the source when absent);
+ * version applies to registry sources.
+ */
+export declare function parseModuleCatalogue(raw: string | undefined): ModuleCatalogueEntry[];
+export interface ModuleBlock {
+    /** the local name in `module "<name>" { … }`. */
+    name: string;
+    source: string;
+    /** the pinned version — the `version` attribute (registry) or the git `?ref=`
+     * (git), whichever is present; null when unpinned. */
+    version: string | null;
+    /** the `//subdir` selector within the module package, or null. */
+    subdir: string | null;
+    kind: ModuleSourceKind;
+    /** the file the `module` block was declared in (repo-relative). */
+    declaredIn: string;
+}
+/**
+ * Parse every `module "<name>" { … }` block in some HCL into its name, source,
+ * pinned version, and subdir. Brace-matched so nested blocks (e.g. a
+ * `providers = { … }` map inside the module block) don't confuse it. The version
+ * comes from the `version` attribute (registry modules) OR the source's `?ref=`
+ * (git modules), so a git-pinned module isn't reported as unpinned. `declaredIn`
+ * is filled by the caller; here it's "".
+ */
+export declare function parseModuleBlocks(hcl: string): ModuleBlock[];
+export interface ModuleGraph {
+    /** every `module` block found, with its classified source. */
+    modules: ModuleBlock[];
+    /** local module source dirs (repo-relative), each with the caller files that
+     * reference it — fix a concern in one of these dirs ONCE at the source. */
+    localModuleDirs: {
+        dir: string;
+        callers: string[];
+    }[];
+    /** count of registry/git/remote module references — concerns that live inside
+     * one of these are NOT editable in this repo (open an issue instead). */
+    externalCount: number;
+}
+/**
+ * Recursively list `*.tf` files under `cwd`, repo-relative (POSIX), skipping
+ * cache/VCS/dep dirs. Bounded by depth and a file cap so a huge monorepo can't
+ * stall the walk. Real Terraform repos (e.g. hepcare) keep their root config in
+ * a subdir (`terraform/`) with house modules in `terraform/modules/` and even a
+ * second root (`terraform/core/`) — a single-level read misses all of that, so
+ * we walk the tree.
+ */
+export declare function walkTfFiles(cwd: string, maxDepth?: number, cap?: number): string[];
+/**
+ * Walk `cwd` recursively and build the module call-graph across every Terraform
+ * file (root + subdir roots + nested modules). A local module's dir is resolved
+ * RELATIVE TO THE DECLARING FILE (`./modules/x` in `core/main.tf` → `core/modules/x`),
+ * not to `cwd`, so the graph is correct for multi-root repos.
+ */
+export declare function collectModuleGraph(cwd: string): ModuleGraph;
+/**
+ * §24 dependency-aware fix ordering. Order the repo's LOCAL module dirs so a
+ * module that others depend on is fixed BEFORE its dependents — sequencing
+ * remediation PRs so they don't conflict (a fix at a shared module source
+ * propagates to callers; fixing the caller first would be redundant or clash).
+ *
+ * Builds edges among local module dirs: a `module` block declared inside local
+ * dir A whose source resolves to local dir B means "A depends on B", so B must
+ * come first. Returns a stable topological order (Kahn's algorithm, ties broken
+ * by path) of the local module dirs; cycle-safe (any leftover nodes are appended
+ * in sorted order). Pure. The remaining non-module (root) files are fixed after
+ * every local module they call — the caller dirs are in each entry's `callers`.
+ */
+export declare function dependencyOrderedModuleDirs(graph: ModuleGraph): string[];
+/** true when `file` sits under one of the graph's local module dirs — i.e. a
+ * concern there should be fixed at the module SOURCE (it propagates to callers). */
+export declare function isInLocalModule(file: string, graph: ModuleGraph): {
+    dir: string;
+    callers: string[];
+} | null;
+export interface ModuleVariable {
+    name: string;
+    /** the `type` expression as written (`string`, `list(string)`, …), or null. */
+    type: string | null;
+    description: string | null;
+    /** true when the variable has NO `default` (the caller must set it). */
+    required: boolean;
+}
+export interface ModuleOutput {
+    name: string;
+    description: string | null;
+}
+export interface ModuleInterface {
+    variables: ModuleVariable[];
+    outputs: ModuleOutput[];
+}
+/**
+ * Parse a module's `variable`/`output` blocks into its public interface — the
+ * real names, types, descriptions, and which variables are REQUIRED (no
+ * `default`). Used so a generated `module` block (or a Terratest/example
+ * fixture) sets the module's ACTUAL variables instead of guessed ones. Pure;
+ * brace-matched so a nested `type = object({…})` or `validation {…}` doesn't
+ * confuse it.
+ */
+export declare function parseModuleInterface(hcl: string): ModuleInterface;
+/** read a module DIR's `*.tf` (non-recursive — a module is a single dir) and
+ * parse its interface. */
+export declare function collectModuleInterface(cwd: string, moduleDir: string): ModuleInterface;
+export declare const ListModulesParams: import("arktype/internal/variants/object.ts").ObjectType<object, {}>;
+export declare function ListModulesTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<object, object>>;
+export declare const TerraformModuleGraphParams: import("arktype/internal/variants/object.ts").ObjectType<object, {}>;
+export declare function TerraformModuleGraphTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<object, object>>;
+export declare const TerraformModuleInterfaceParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    module_dir: string;
+}, {}>;
+export declare function TerraformModuleInterfaceTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    module_dir: string;
+}, {
+    module_dir: string;
+}>>;
+/** best-effort existence check used by tests/tools — exported for reuse. */
+export declare function moduleDirExists(cwd: string, dir: string): boolean;

package/dist/mcp/output.d.ts

@@ -0,0 +1,12 @@
+import type { StandardSchemaV1 } from "@standard-schema/spec";
+import type { ToolContext } from "#app/mcp/server";
+export declare const SetOutputParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    value: string;
+}, {}>;
+type JsonSchema = Record<string, unknown>;
+export declare function SetOutputTool(ctx: ToolContext, outputSchema?: JsonSchema): import("fastmcp").Tool<any, StandardSchemaV1<any, any>> | import("fastmcp").Tool<any, StandardSchemaV1<{
+    value: string;
+}, {
+    value: string;
+}>>;
+export {};

package/dist/mcp/pathSafety.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolve an agent-supplied path against `cwd` and confine it to that workspace.
+ *
+ * Returns the absolute path when it stays inside `cwd`; throws otherwise. Blocks
+ * both `..` traversal and absolute paths that point outside `cwd` (including a
+ * different drive on Windows, where `relative` returns an absolute path).
+ *
+ * Terramend treats the agent as semi-trusted (attacker-controlled PR content can
+ * prompt-inject it), so any tool that reads or writes a file path the agent
+ * controls — read_findings, terraform_emit_sarif, terraform_module_interface —
+ * must confine that path to the workspace. Without it the agent has an arbitrary
+ * file read (findings) or write (SARIF) primitive on the runner.
+ */
+export declare function resolveWithinCwd(cwd: string, userPath: string): string;

package/dist/mcp/policy.d.ts

@@ -0,0 +1,48 @@
+import type { ToolContext } from "#app/mcp/server";
+/**
+ * Policy-as-code gate (§3.5 OPA/Conftest). An optional, opt-in tool that runs
+ * the operator's own Rego policies against the Terraform plan JSON (or the HCL),
+ * so an org's policy-as-code can gate a remediation/generation the same way the
+ * deterministic scanners do — pairs with §21 (prevent recurrence). Terramend is
+ * an ORCHESTRATOR here, never a redistributor: it invokes the external
+ * `conftest` (OPA) binary as a separate process and consumes its normalized
+ * output. Degrades green — when conftest isn't installed or no policy dir
+ * exists, it returns `ok: false` with a `code` and never fails the run.
+ *
+ * The parsing is pure + unit-tested; the tool just shells out and parses.
+ */
+export interface PolicyFailure {
+    /** the policy rule message (the human-readable violation). */
+    msg: string;
+    /** the file conftest evaluated (repo-relative when conftest reported it). */
+    file: string;
+    /** "failure" (a deny) or "warning" (a warn). */
+    level: "failure" | "warning";
+}
+export interface PolicyResult {
+    /** true when there were zero failures (warnings don't fail the gate). */
+    passed: boolean;
+    failures: PolicyFailure[];
+    warnings: PolicyFailure[];
+    /** total tests conftest ran (across files), for a confidence signal. */
+    tested: number;
+}
+/**
+ * Parse `conftest test --output json` output into a normalized PolicyResult.
+ * Conftest emits an array of per-file result objects, each with `failures` /
+ * `warnings` / `successes`. Pure; tolerant of malformed/empty input (returns a
+ * clean pass). A non-empty `failures` anywhere means the gate did NOT pass;
+ * warnings are surfaced but don't fail it.
+ */
+export declare function parseConftestOutput(stdout: string): PolicyResult;
+export declare const PolicyCheckParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    target?: string;
+    policy_dir?: string;
+}, {}>;
+export declare function PolicyCheckTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    target?: string;
+    policy_dir?: string;
+}, {
+    target?: string;
+    policy_dir?: string;
+}>>;

package/dist/mcp/pr.d.ts

@@ -0,0 +1,49 @@
+import type { ToolContext } from "#app/mcp/server";
+export declare const PullRequest: import("arktype/internal/variants/object.ts").ObjectType<{
+    title: string;
+    body: string;
+    base?: string;
+    draft?: boolean;
+}, {}>;
+/**
+ * Pure base-branch picker. Precedence: an explicit `base_branch` declaration
+ * always wins; otherwise the repository's default branch (GitHub reports it —
+ * normally `main`, sometimes `master`); otherwise prefer `main`, then `master`;
+ * final fallback `main`. Split out from git/ctx so it's exhaustively testable.
+ */
+export declare function pickBaseBranch(opts: {
+    declared?: string | undefined;
+    defaultBranch?: string | undefined;
+    mainExists: boolean;
+    masterExists: boolean;
+}): string;
+/**
+ * Deterministically resolve the branch a PR targets, so the base is never left
+ * to the agent's guess. Resolves to the repository's default branch (`main`, or
+ * `master`), overridable by the `base_branch` input. Git is only probed for
+ * main/master in the last-resort case where neither an explicit declaration nor
+ * a GitHub default branch is available (essentially never).
+ */
+export declare function resolveBaseBranch(ctx: ToolContext): string;
+export declare const UpdatePullRequestBody: import("arktype/internal/variants/object.ts").ObjectType<{
+    pull_number: number;
+    body: string;
+}, {}>;
+export declare function UpdatePullRequestBodyTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    pull_number: number;
+    body: string;
+}, {
+    pull_number: number;
+    body: string;
+}>>;
+export declare function CreatePullRequestTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    title: string;
+    body: string;
+    base?: string;
+    draft?: boolean;
+}, {
+    title: string;
+    body: string;
+    base?: string;
+    draft?: boolean;
+}>>;

package/dist/mcp/prInfo.d.ts

@@ -0,0 +1,9 @@
+import type { ToolContext } from "#app/mcp/server";
+export declare const PullRequestInfo: import("arktype/internal/variants/object.ts").ObjectType<{
+    pull_number: number;
+}, {}>;
+export declare function PullRequestInfoTool(ctx: ToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    pull_number: number;
+}, {
+    pull_number: number;
+}>>;

package/dist/mcp/providerSchema.d.ts

@@ -0,0 +1,50 @@
+import type { LocalToolContext } from "#app/mcp/localContext";
+/**
+ * Provider-schema awareness (§4.15 next). A "correct" fix for the wrong provider
+ * major just breaks `plan` — argument names and nested blocks differ across
+ * majors. After `terraform init`, the installed provider's exact schema is
+ * available via `terraform providers schema -json`; this parses it so a fix can
+ * be checked against the REAL attributes/blocks for the version in use, not the
+ * model's memory of the provider.
+ *
+ * The schema fetch is cached per `cwd` for the process (schemas don't change
+ * within a run) and degrades green (returns `ok: false`) when terraform isn't
+ * installed or the dir isn't initialised.
+ */
+export interface ResourceSchema {
+    attributes: Set<string>;
+    blocks: Set<string>;
+}
+/** resourceType → its attribute + nested-block names, across all providers. */
+export type ProvidersSchema = Map<string, ResourceSchema>;
+/**
+ * Parse `terraform providers schema -json` into a resource-type → {attributes,
+ * blocks} map. Merges every provider's `resource_schemas`. Pure; tolerant of a
+ * missing/empty schema.
+ */
+export declare function parseProvidersSchema(json: string): ProvidersSchema;
+/**
+ * Given a resource type and the argument names a fix introduces, return the ones
+ * that are NOT valid attributes or nested blocks for that resource in the
+ * installed provider — i.e. names that would break `plan`. Returns `null` for
+ * `unknownResourceType` when the schema has no entry for the type (can't judge).
+ */
+export declare function unknownArgsForResource(schema: ProvidersSchema, resourceType: string, args: string[]): {
+    unknownResourceType: boolean;
+    unknown: string[];
+};
+/** fetch + cache the providers schema for `cwd`. null when unavailable. */
+export declare function loadProvidersSchema(cwd: string): ProvidersSchema | null;
+/** test-only: clear the per-process schema cache. */
+export declare function _clearProviderSchemaCache(): void;
+export declare const TerraformProviderSchemaParams: import("arktype/internal/variants/object.ts").ObjectType<{
+    resource_type: string;
+    args?: string[];
+}, {}>;
+export declare function TerraformProviderSchemaTool(ctx: LocalToolContext): import("fastmcp").Tool<any, import("@standard-schema/spec").StandardSchemaV1<{
+    resource_type: string;
+    args?: string[];
+}, {
+    resource_type: string;
+    args?: string[];
+}>>;