@intentius/chant-lexicon-terraform 0.104.1 → 0.104.3

package/dist/components/capability-plugin.d.ts

@@ -25,6 +25,28 @@
  * Run without a wave plan (`chant run --components`, or a fan-out with no
  * wave gate), `run` plans and applies in one go, which is what `terraform
  * apply` with no plan file does too.
+ *
+ * ## choudoufu roots in a gated wave (#3459)
+ *
+ * A live choudoufu root that `live-plan-set` can plan as chant would (no
+ * `vars`, no var files, no backend config; see `choudoufuWaveRoot`) goes
+ * through choudoufu's own set commands (choudoufu#1754), which need
+ * choudoufu v0.22.0 (`MIN_CHOUDOUFU_WAVES_VERSION`):
+ *
+ * - `plan` runs `live-plan-set -json` over the root as a one-root set. The
+ *   wave gate still binds chant's `terraformPlanDigest` of the plan the
+ *   document embeds, the same string a single-root gate binds. choudoufu's
+ *   set digest is kept for the apply, and its root digest is the change-set
+ *   part's `nativeDigest`.
+ * - `run` hands that document and choudoufu's set digest to
+ *   `live-wave-apply`, which plans the root again and applies nothing when
+ *   the plan moved (exit 3).
+ * - choudoufu's resume file is kept in the fan-out's attempt record
+ *   (`DeployContext.carry`) after every apply, landed or not, and written
+ *   back on the next attempt when it was written for the same set digest.
+ *
+ * chant's waves stay the order. Each root is its own one-root set, so
+ * choudoufu's wave over it is always wave 1.
  */
 import type { Capability } from "@intentius/chant/components/capability";
 import { type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,wCAAwC,CAAC;AAExG,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAGzG,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAgCD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CA6BlG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;CACjB,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAWvC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,wCAAwC,CAAC;AAExG,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAWzG,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAmED,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CAwClG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;CACjB,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAWvC,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "0bae71e990e47e95d5f8abf4d52da07e7d626b2758f7cd945d3b9fbb7066a451",
+    "manifest.json": "3ee2ce9ce0166f20d489f1628e86c43499330e1117ea31805b3103d569770d23",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
@@ -56,5 +56,5 @@
     "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "bbad081aac99abd000d25a05a2735ee5306a7f18078e2eb3711b6a9d27b78ef1"
+  "composite": "57d4f388168f72ef71e52530804ecdc19628cf0707ede67c432bde5a0efeb45c"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.104.1",
+  "version": "0.104.3",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/op/activities/terraform.d.ts

@@ -71,6 +71,34 @@ export declare const DEFAULT_LIVE_PLAN_DOCUMENT_FILE = "chant.live-plan.json";
  * shipped the last of the three.
  */
 export declare const MIN_CHOUDOUFU_VERSION = "0.15.0";
+/**
+ * The choudoufu release a gated wave needs for a choudoufu root (#3459):
+ * the set digest on `live-plan-set -json`, and `live-wave-apply` with its
+ * resume file (choudoufu#1754, merged as choudoufu PR 1816 after v0.21.0).
+ * choudoufu's changelog lists both under `v0.22.0 (Unreleased)`, so this is
+ * the version main releases as.
+ *
+ * Only the wave path checks it, so plain `terraform` and `tofu` roots, and a
+ * choudoufu root run any other way, do not wait on it. A dev build prints no
+ * release version. For one, the check is the capability itself: a set plan
+ * document without a top-level `digest` came from a choudoufu older than
+ * choudoufu#1754, and {@link choudoufuPlanSet} refuses it.
+ */
+export declare const MIN_CHOUDOUFU_WAVES_VERSION = "0.22.0";
+/**
+ * Where a choudoufu root's wave files live, relative to the project root:
+ * `<root>/plan-set.json` (the set plan document chant planned and the
+ * approver approved), `<root>/resume-<digest>.json` (choudoufu's resume
+ * file) and `<root>/out/` (plan files and logs).
+ */
+export declare const CHOUDOUFU_WAVES_DIR = ".chant/choudoufu-waves";
+/** `live-wave-apply`'s exit statuses (choudoufu#1754). */
+export declare const CHOUDOUFU_WAVE_EXIT: {
+    readonly landed: 0;
+    readonly error: 1;
+    readonly setMoved: 3;
+    readonly rootFailed: 4;
+};
 /**
  * choudoufu's own refusal summary for `-out` on the `live-plan -estate`
  * surface (`internal/command/live_mode.go`). That is the one surface where a
@@ -550,6 +578,14 @@ export declare function isOlderVersion(version: string, min: string): boolean;
 export declare function parseChoudoufuVersion(versionOutput: string): string | undefined;
 /** Test-only: clear the cached version check so a test can simulate a fresh module load. */
 export declare function __resetChoudoufuVersionCheckForTests(): void;
+/**
+ * Why `choudoufu version`'s output cannot drive a gated wave, or `undefined`
+ * when it can (#3459). A release older than
+ * {@link MIN_CHOUDOUFU_WAVES_VERSION} is refused. A dev build names no
+ * release and passes here; {@link parseChoudoufuPlanSet} then refuses a set
+ * plan document with no digest, which is what an older dev build prints.
+ */
+export declare function choudoufuWavesVersionRefusal(versionOutput: string): string | undefined;
 /**
  * `terraform init` in the named root, with the root's `backendConfig` supplied
  * as `-backend-config` flags. Uses the longInfra profile: init downloads
@@ -605,6 +641,147 @@ export declare function terraformApply(args: TerraformApplyArgs, signal?: AbortS
  * asked for the values to hand them on.
  */
 export declare function terraformOutputs(args: TerraformRootArgs, signal?: AbortSignal): Promise<Record<string, unknown>>;
+/**
+ * `live-plan-set -json` over one root, from the project root, so the
+ * document names the root by its path from there, which is what
+ * `live-wave-apply` resolves it against.
+ */
+export declare function choudoufuPlanSetCommand(opts: {
+    binary: string;
+    root: string;
+    outDir: string;
+}): string;
+/**
+ * `live-wave-apply` over a one-root set. The set chant hands choudoufu is
+ * one root, so choudoufu's waves over it are a single wave and `-wave=1` is
+ * always that root's. chant's waves are the order; choudoufu's command is
+ * the apply, with its set check and its resume file.
+ */
+export declare function choudoufuWaveApplyCommand(opts: {
+    binary: string;
+    planSet: string;
+    digest: string;
+    resume: string;
+    outDir: string;
+}): string;
+/**
+ * The root's directory as a set plan document names it: its path from the
+ * project root, with forward slashes. `undefined` when the root is the
+ * project root itself or outside it, since choudoufu takes only roots inside
+ * the working directory.
+ */
+export declare function choudoufuSetRootPath(projectRoot: string, dir: string): string | undefined;
+/** A root that a gated wave runs through `live-plan-set` and `live-wave-apply`. */
+export interface ChoudoufuWaveRootArgs extends TerraformRootArgs {
+    /** The step's `-var` values. A root given any is not a wave root: see {@link choudoufuWaveRoot}. */
+    vars?: Record<string, unknown>;
+}
+/**
+ * Whether a gated wave runs this root through choudoufu's own set commands
+ * (#3459), and if not, why not. It does for a live choudoufu root that
+ * `live-plan-set` can plan as chant would: those commands run plain `init`
+ * and `plan` in each root, with no `-var-file`, no `-var` and no
+ * `-backend-config`, so a root that needs any of them goes the `plan -out`
+ * and `apply PLANFILE` way instead, where choudoufu's per-root refusal
+ * (choudoufu #878) still stands in front of the apply.
+ */
+export declare function choudoufuWaveRoot(args: ChoudoufuWaveRootArgs, signal?: AbortSignal): Promise<{
+    wave: true;
+    root: string;
+} | {
+    wave: false;
+    reason: string;
+}>;
+/** What {@link parseChoudoufuPlanSet} read out of a one-root set plan document. */
+export interface ChoudoufuPlanSet {
+    /** choudoufu's set digest: what `live-wave-apply -digest` takes. */
+    setDigest: string;
+    /** choudoufu's digest of the one root. */
+    rootDigest: string;
+    /** chant's {@link terraformPlanDigest} over the root's embedded plan: what the wave gate binds. */
+    planDigest: string;
+    changed: boolean;
+    /** The root's `show -json` plan, as the document embeds it. */
+    json: unknown;
+    /** The member's change-set part, with choudoufu's root digest as `nativeDigest`. */
+    changeSet: ChangeSetPart;
+}
+/**
+ * Read `live-plan-set -json`'s document for one root (#3459). Refuses a
+ * document with no set digest: that choudoufu predates choudoufu#1754, and
+ * this is how a dev build, which names no release, is held to
+ * {@link MIN_CHOUDOUFU_WAVES_VERSION}. Refuses a root that did not plan,
+ * with choudoufu's own error.
+ */
+export declare function parseChoudoufuPlanSet(stdout: string, opts: {
+    member: string;
+    root: string;
+}): ChoudoufuPlanSet;
+/** What {@link choudoufuPlanSet} planned. */
+export interface ChoudoufuPlanSetResult extends ChoudoufuPlanSet {
+    /** The set plan document, written as choudoufu printed it. `live-wave-apply -plan-set` reads this file. */
+    planSetFile: string;
+    /** The root's path as the document names it. */
+    root: string;
+}
+/**
+ * Plan one live choudoufu root as a one-root set: `live-plan-set -json` from
+ * the project root (#3459). The document goes to
+ * `<CHOUDOUFU_WAVES_DIR>/<root>/plan-set.json`, the file a later
+ * `live-wave-apply` hands back to choudoufu with the set digest.
+ */
+export declare function choudoufuPlanSet(args: TerraformRootArgs, signal?: AbortSignal): Promise<ChoudoufuPlanSetResult>;
+/**
+ * What a choudoufu root keeps in the fan-out's attempt record (#3459):
+ * choudoufu's resume file, under the set digest it was written for.
+ */
+export interface ChoudoufuCarriedResume {
+    kind: "choudoufu-wave-resume";
+    setDigest: string;
+    resume: unknown;
+}
+/**
+ * The resume file to hand choudoufu for `setDigest`, from what an earlier
+ * attempt carried, or `undefined`. choudoufu refuses a resume file written
+ * for another digest, and a re-planned root with a moved plan has another
+ * digest, so only a file for this same set comes back.
+ */
+export declare function carriedChoudoufuResume(carried: unknown, setDigest: string): unknown;
+export interface ChoudoufuWaveApplyArgs extends TerraformRootArgs {
+    /** {@link ChoudoufuPlanSetResult.planSetFile}: the approved document. */
+    planSetFile: string;
+    /** {@link ChoudoufuPlanSetResult.setDigest}: choudoufu's digest of that document. */
+    setDigest: string;
+    /** What the root carried from an earlier attempt (`DeployContext.carried[root]`). */
+    carried?: unknown;
+}
+export interface ChoudoufuWaveApplyResult {
+    /** `live-wave-apply`'s exit status. See {@link CHOUDOUFU_WAVE_EXIT}. */
+    exitCode: number;
+    /** Exit 0: the root landed. */
+    landed: boolean;
+    /** `-json`'s result document, when it printed one. */
+    result?: unknown;
+    /** choudoufu's resume file after the run, to carry. Absent when choudoufu wrote none. */
+    carry?: ChoudoufuCarriedResume;
+    /** One line for a person: what happened, in choudoufu's words where it gave some. */
+    message: string;
+}
+/** One line for each of `live-wave-apply`'s exit statuses, with choudoufu's own error when it gave one. */
+export declare function describeChoudoufuWaveExit(exitCode: number, result: unknown, stderr: string): string;
+/**
+ * Apply one live choudoufu root through `live-wave-apply` (#3459), with the
+ * set plan document and set digest {@link choudoufuPlanSet} produced. When
+ * the root carried a resume file for this same digest from an earlier
+ * attempt, it is written back first, so choudoufu sees what it already
+ * recorded. Its resume file after the run comes back as `carry`, landed or
+ * not.
+ *
+ * Never throws for a choudoufu answer: exit 3 (the set moved) and exit 4 (the
+ * root failed) come back with `landed: false`, and so does exit 1. An abort
+ * or a spawn failure propagates.
+ */
+export declare function choudoufuWaveApply(args: ChoudoufuWaveApplyArgs, signal?: AbortSignal): Promise<ChoudoufuWaveApplyResult>;
 /**
  * `terraform show` over current state, or over a saved plan when `planFile` is
  * given. Returns the parsed `-json` output and the `-no-color` render, plus

package/dist/op/activities/terraform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../../src/op/activities/terraform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAUH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAWrB,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD,gHAAgH;AAChH,eAAO,MAAM,+BAA+B,yBAAyB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,mEACsB,CAAC;AAEnE,mHAAmH;AACnH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,wGAAwG;AACxG,eAAO,MAAM,mCAAmC,wDAAwD,CAAC;AAEzG,0GAA0G;AAC1G,eAAO,MAAM,8BAA8B,oDAAoD,CAAC;AAIhG,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEvD,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,qGAAqG;IACrG,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7G,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mGAAmG;IACnG,OAAO,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE5E,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB,EAAE,gBAAgB;IACtF,wFAAwF;IACxF,KAAK,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,kGAAkG;IAClG,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yHAAyH;IACzH,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,IAAI,EAAE,OAAO,CAAC;IACd,yHAAyH;IACzH,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,WAAW,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,8FAA8F;IAC9F,OAAO,EAAE,OAAO,CAAC;IACjB,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,kCAAkC;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1G;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAUT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAExF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAcT;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAI7G;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,qBAAqB,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,CAYpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAMxE;AAgBD,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAOpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/E;AA8BD,4FAA4F;AAC5F,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D;AAuGD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAmD9B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAI5F;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAoC/B;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAKlC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CA2B9B;AA6BD;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED;;;;GAIG;AACH,MAAM,WAAW,+BAAgC,SAAQ,qBAAqB;IAC5E,wFAAwF;IACxF,KAAK,EAAE,OAAO,CAAC;IACf,yDAAyD;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,qBAAqB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,+BAA+B,CAAC,CAiD1C;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAiElC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAkBhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CA8C/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAuBnC"}
+{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../../src/op/activities/terraform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAUH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAWrB,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD,gHAAgH;AAChH,eAAO,MAAM,+BAA+B,yBAAyB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,WAAW,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,2BAA2B,CAAC;AAE5D,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB;aAAK,MAAM,EAAE,CAAC;aAAE,KAAK,EAAE,CAAC;aAAE,QAAQ,EAAE,CAAC;aAAE,UAAU,EAAE,CAAC;CAAW,CAAC;AAEhG;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,mEACsB,CAAC;AAEnE,mHAAmH;AACnH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,wGAAwG;AACxG,eAAO,MAAM,mCAAmC,wDAAwD,CAAC;AAEzG,0GAA0G;AAC1G,eAAO,MAAM,8BAA8B,oDAAoD,CAAC;AAIhG,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEvD,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,qGAAqG;IACrG,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE7G,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mGAAmG;IACnG,OAAO,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE5E,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB,EAAE,gBAAgB;IACtF,wFAAwF;IACxF,KAAK,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,kGAAkG;IAClG,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yHAAyH;IACzH,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,IAAI,EAAE,OAAO,CAAC;IACd,yHAAyH;IACzH,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,WAAW,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,8FAA8F;IAC9F,OAAO,EAAE,OAAO,CAAC;IACjB,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,kCAAkC;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1G;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAUT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAExF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAcT;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAI7G;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,qBAAqB,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,CAYpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAMxE;AAgBD,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAOpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/E;AA8BD,4FAA4F;AAC5F,wBAAgB,oCAAoC,IAAI,IAAI,CAG3D;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQtF;AAsHD;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAmD9B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAI5F;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAoC/B;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAKlC;AAID;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEtG;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAWT;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzF;AAED,mFAAmF;AACnF,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,oGAAoG;IACpG,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBzE;AAED,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,IAAI,EAAE,OAAO,CAAC;IACd,oFAAoF;IACpF,SAAS,EAAE,aAAa,CAAC;CAC1B;AAKD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAyC9G;AAYD,6CAA6C;AAC7C,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;IAC9D,2GAA2G;IAC3G,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA6BrH;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAInF;AAED,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,qFAAqF;IACrF,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,MAAM,EAAE,OAAO,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yFAAyF;IACzF,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,2GAA2G;AAC3G,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAoBnG;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA0D9H;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CA2B9B;AA6BD;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED;;;;GAIG;AACH,MAAM,WAAW,+BAAgC,SAAQ,qBAAqB;IAC5E,wFAAwF;IACxF,KAAK,EAAE,OAAO,CAAC;IACf,yDAAyD;IACzD,IAAI,EAAE,OAAO,CAAC;IACd,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,qBAAqB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,+BAA+B,CAAC,CAiD1C;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAiElC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAkBhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CA8C/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAuBnC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.104.1",
+  "version": "0.104.3",
   "type": "module",
   "files": [
     "src/",
@@ -67,7 +67,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.104.1",
+    "@intentius/chant": "^0.104.3",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   },

package/src/components/capability-plugin.test.ts

@@ -8,8 +8,31 @@ import { beforeEach, describe, expect, test, vi } from "vitest";
 const calls: string[] = [];
 let applyResult: Record<string, unknown> = { applied: true };
 let changeSet: Record<string, unknown> | undefined;
+// #3459: whether the root goes through choudoufu's set commands, and what they answer.
+let waveRoot: { wave: true; root: string } | { wave: false; reason: string } = { wave: false, reason: "the root runs terraform" };
+let waveApply: Record<string, unknown> = { exitCode: 0, landed: true, message: "landed" };
+const waveApplyArgs: Array<Record<string, unknown>> = [];
 
 vi.mock("../op/activities/terraform", () => ({
+  choudoufuWaveRoot: vi.fn(async () => waveRoot),
+  choudoufuPlanSet: vi.fn(async (args: { root: string }) => {
+    calls.push(`plan-set ${args.root}`);
+    return {
+      setDigest: `sha256:set-${args.root}`,
+      rootDigest: `sha256:root-${args.root}`,
+      planDigest: `jcs1-sha256:${args.root}`,
+      changed: true,
+      json: {},
+      changeSet: { member: { member: args.root, nativeDigest: `sha256:root-${args.root}` }, entries: [] },
+      planSetFile: `/x/.chant/choudoufu-waves/${args.root}/plan-set.json`,
+      root: `estates/${args.root}`,
+    };
+  }),
+  choudoufuWaveApply: vi.fn(async (args: Record<string, unknown>) => {
+    calls.push(`wave-apply ${String(args.root)} ${String(args.setDigest)}`);
+    waveApplyArgs.push(args);
+    return waveApply;
+  }),
   terraformInit: vi.fn(async (args: { root: string }) => {
     calls.push(`init ${args.root}`);
     return { dir: `/x/${args.root}` };
@@ -34,6 +57,73 @@ beforeEach(() => {
   calls.length = 0;
   applyResult = { applied: true };
   changeSet = undefined;
+  waveRoot = { wave: false, reason: "the root runs terraform" };
+  waveApply = { exitCode: 0, landed: true, message: "landed" };
+  waveApplyArgs.length = 0;
+});
+
+describe("terraform-apply on a choudoufu root in a gated wave (#3459)", () => {
+  const resume = { format_version: "1", set_digest: "sha256:set-e01", roots: [{ root: "estates/e01", wave: 1, outcome: "landed" }] };
+  const carry = { kind: "choudoufu-wave-resume", setDigest: "sha256:set-e01", resume };
+  const wavePlan = {
+    planDigest: "jcs1-sha256:e01",
+    choudoufu: { planSetFile: "/x/.chant/choudoufu-waves/e01/plan-set.json", setDigest: "sha256:set-e01" },
+  };
+
+  test("plan runs live-plan-set and binds chant's plan digest, keeping choudoufu's set digest for the apply", async () => {
+    waveRoot = { wave: true, root: "estates/e01" };
+    const planned = await terraformApplyCapability.plan!({ env: "test", component: "e01" }, { root: "e01" });
+    expect(calls).toEqual(["plan-set e01"]);
+    expect(planned.member).toBe("e01");
+    expect(planned.planDigest).toBe("jcs1-sha256:e01");
+    expect(planned.artifact).toEqual(wavePlan);
+    expect(planned.changeSet).toEqual({ member: { member: "e01", nativeDigest: "sha256:root-e01" }, entries: [] });
+  });
+
+  test("a choudoufu root live-plan-set cannot plan as chant would keeps plan -out", async () => {
+    waveRoot = { wave: false, reason: "the step passes -var values, which live-plan-set does not take" };
+    await terraformApplyCapability.plan!({ env: "test", component: "e01" }, { root: "e01", vars: { a: "b" } });
+    expect(calls).toEqual(["init e01", 'plan e01 {"a":"b"}']);
+  });
+
+  test("run hands the approved document and set digest to live-wave-apply and carries the resume file", async () => {
+    waveApply = { exitCode: 0, landed: true, message: "landed", carry };
+    const kept: Array<[string, unknown]> = [];
+    const out = await terraformApplyCapability.run(
+      { env: "test", component: "e01", plans: { e01: wavePlan }, carry: (m, v) => kept.push([m, v]) },
+      { root: "e01" },
+    );
+    expect(calls).toEqual(["wave-apply e01 sha256:set-e01", "output e01"]);
+    expect(waveApplyArgs[0]).toMatchObject({ root: "e01", planSetFile: wavePlan.choudoufu.planSetFile, setDigest: "sha256:set-e01" });
+    expect(kept).toEqual([["e01", carry]]);
+    expect(out).toEqual({ root: "e01", planDigest: "jcs1-sha256:e01", fromWavePlan: true, outputs: { id: "e01-id" } });
+  });
+
+  test("run passes what an earlier attempt carried for the root", async () => {
+    await terraformApplyCapability.run(
+      { env: "test", component: "e01", plans: { e01: wavePlan }, carried: { e01: carry, other: { x: 1 } } },
+      { root: "e01" },
+    );
+    expect(waveApplyArgs[0]!.carried).toEqual(carry);
+  });
+
+  test("a moved set fails the step, applies nothing more, and still carries the resume file", async () => {
+    waveApply = {
+      exitCode: 3,
+      landed: false,
+      message: "choudoufu refused the approved set: the root's plan moved since it was approved, and nothing was applied",
+      carry,
+    };
+    const kept: unknown[] = [];
+    await expect(
+      terraformApplyCapability.run(
+        { env: "test", component: "e01", plans: { e01: wavePlan }, carry: (_m, v) => kept.push(v) },
+        { root: "e01" },
+      ),
+    ).rejects.toThrow(/root "e01": choudoufu refused the approved set/);
+    expect(calls).toEqual(["wave-apply e01 sha256:set-e01"]);
+    expect(kept).toEqual([carry]);
+  });
 });
 
 describe("terraform-apply", () => {

package/src/components/capability-plugin.ts

@@ -25,12 +25,42 @@
  * Run without a wave plan (`chant run --components`, or a fan-out with no
  * wave gate), `run` plans and applies in one go, which is what `terraform
  * apply` with no plan file does too.
+ *
+ * ## choudoufu roots in a gated wave (#3459)
+ *
+ * A live choudoufu root that `live-plan-set` can plan as chant would (no
+ * `vars`, no var files, no backend config; see `choudoufuWaveRoot`) goes
+ * through choudoufu's own set commands (choudoufu#1754), which need
+ * choudoufu v0.22.0 (`MIN_CHOUDOUFU_WAVES_VERSION`):
+ *
+ * - `plan` runs `live-plan-set -json` over the root as a one-root set. The
+ *   wave gate still binds chant's `terraformPlanDigest` of the plan the
+ *   document embeds, the same string a single-root gate binds. choudoufu's
+ *   set digest is kept for the apply, and its root digest is the change-set
+ *   part's `nativeDigest`.
+ * - `run` hands that document and choudoufu's set digest to
+ *   `live-wave-apply`, which plans the root again and applies nothing when
+ *   the plan moved (exit 3).
+ * - choudoufu's resume file is kept in the fan-out's attempt record
+ *   (`DeployContext.carry`) after every apply, landed or not, and written
+ *   back on the next attempt when it was written for the same set digest.
+ *
+ * chant's waves stay the order. Each root is its own one-root set, so
+ * choudoufu's wave over it is always wave 1.
  */
 
 import type { Capability, DeployContext, CapabilityPlan } from "@intentius/chant/components/capability";
 import type { ChangeSetPart } from "@intentius/chant/change-set";
 import { ownPackageVersion, type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
-import { terraformApply, terraformInit, terraformOutputs, terraformPlan } from "../op/activities/terraform";
+import {
+  choudoufuPlanSet,
+  choudoufuWaveApply,
+  choudoufuWaveRoot,
+  terraformApply,
+  terraformInit,
+  terraformOutputs,
+  terraformPlan,
+} from "../op/activities/terraform";
 
 /** The `terraform-apply` step's input. */
 export interface TerraformApplyStepInput {
@@ -82,12 +112,57 @@ function isPlannedRoot(value: unknown): value is PlannedRoot {
   return typeof v?.planFile === "string" && typeof v.planDigest === "string";
 }
 
+/** What `plan` hands `run` for a choudoufu root planned as a one-root set (#3459). */
+interface ChoudoufuWavePlannedRoot {
+  planDigest: string;
+  choudoufu: { planSetFile: string; setDigest: string };
+}
+
+function isChoudoufuWavePlan(value: unknown): value is ChoudoufuWavePlannedRoot {
+  const v = value as Partial<ChoudoufuWavePlannedRoot> | undefined;
+  return (
+    typeof v?.planDigest === "string" &&
+    typeof v.choudoufu?.planSetFile === "string" &&
+    typeof v.choudoufu.setDigest === "string"
+  );
+}
+
+/** Apply a choudoufu root through `live-wave-apply`, carrying its resume file either way. */
+async function runChoudoufuWave(
+  ctx: DeployContext,
+  input: TerraformApplyStepInput,
+  planned: ChoudoufuWavePlannedRoot,
+): Promise<TerraformApplyStepOutput> {
+  const applied = await choudoufuWaveApply({
+    ...rootArgs(input),
+    planSetFile: planned.choudoufu.planSetFile,
+    setDigest: planned.choudoufu.setDigest,
+    ...(ctx.carried?.[input.root] !== undefined ? { carried: ctx.carried[input.root] } : {}),
+  });
+  if (applied.carry) ctx.carry?.(input.root, applied.carry);
+  if (!applied.landed) {
+    throw new Error(`terraform-apply: root "${input.root}": ${applied.message}`);
+  }
+  const outputs = await terraformOutputs(rootArgs(input));
+  return { root: input.root, planDigest: planned.planDigest, fromWavePlan: true, outputs };
+}
+
 export const terraformApplyCapability: Capability<TerraformApplyStepInput, TerraformApplyStepOutput> = {
   kind: "terraform-apply",
   // A root's apply has no undo short of applying the previous configuration,
   // which is a change of its own. COMP003 asks the component to say so.
   rollbackPolicy: "needs-opt-out",
   async plan(_ctx: DeployContext, input: TerraformApplyStepInput): Promise<CapabilityPlan> {
+    requireRoot(input);
+    const wave = await choudoufuWaveRoot({ ...rootArgs(input), ...(input.vars ? { vars: input.vars } : {}) });
+    if (wave.wave) {
+      const set = await choudoufuPlanSet(rootArgs(input));
+      const artifact: ChoudoufuWavePlannedRoot = {
+        planDigest: set.planDigest,
+        choudoufu: { planSetFile: set.planSetFile, setDigest: set.setDigest },
+      };
+      return { member: input.root, planDigest: set.planDigest, artifact, changeSet: set.changeSet };
+    }
     const { changeSet, ...planned } = await planRoot(input);
     return { member: input.root, planDigest: planned.planDigest, artifact: planned, ...(changeSet ? { changeSet } : {}) };
   },
@@ -100,6 +175,7 @@ export const terraformApplyCapability: Capability<TerraformApplyStepInput, Terra
   },
   async run(ctx: DeployContext, input: TerraformApplyStepInput): Promise<TerraformApplyStepOutput> {
     const fromWave = ctx.plans?.[input.root];
+    if (isChoudoufuWavePlan(fromWave)) return runChoudoufuWave(ctx, input, fromWave);
     const planned: PlannedRoot = isPlannedRoot(fromWave) ? fromWave : await planRoot(input);
     const applied = await terraformApply({ ...rootArgs(input), planFile: planned.planFile });
     if (!applied.applied) {

package/src/op/activities/choudoufu-waves.test.ts

@@ -0,0 +1,176 @@
+/**
+ * choudoufu roots in a gated wave (#3459): the version floor, the one-root
+ * set plan document, the commands, and which resume file comes back.
+ */
+
+import { describe, expect, test } from "vitest";
+import { join } from "node:path";
+import {
+  MIN_CHOUDOUFU_WAVES_VERSION,
+  carriedChoudoufuResume,
+  choudoufuPlanSetCommand,
+  choudoufuSetRootPath,
+  choudoufuWaveApplyCommand,
+  choudoufuWavesVersionRefusal,
+  describeChoudoufuWaveExit,
+  parseChoudoufuPlanSet,
+  terraformPlanDigest,
+} from "./terraform";
+
+const plan = {
+  format_version: "1.2",
+  resource_changes: [
+    {
+      address: "aws_sqs_queue.q",
+      mode: "managed",
+      type: "aws_sqs_queue",
+      name: "q",
+      change: { actions: ["create"], before: null, after: { name: "q" } },
+    },
+  ],
+};
+
+function setDocument(overrides: Record<string, unknown> = {}, root: Record<string, unknown> = {}): string {
+  return JSON.stringify({
+    format_version: "1",
+    roots: [
+      {
+        root: "estates/e01",
+        estate: "e01",
+        status: "planned",
+        error: "",
+        changes: true,
+        plan_file: ".chant/choudoufu-waves/e01/out/estates/e01.tfplan",
+        log_file: ".chant/choudoufu-waves/e01/out/estates/e01.log",
+        duration_ms: 10,
+        plan,
+        digest: "sha256:root",
+        ...root,
+      },
+    ],
+    summary: { roots: 1, planned: 1, changed: 1, failed: 0 },
+    digest: "sha256:set",
+    exit_code: 2,
+    ...overrides,
+  });
+}
+
+describe("the version floor", () => {
+  test("is the release choudoufu#1754 ships in", () => {
+    expect(MIN_CHOUDOUFU_WAVES_VERSION).toBe("0.22.0");
+  });
+
+  test("refuses a release older than it", () => {
+    const refusal = choudoufuWavesVersionRefusal("choudoufu v0.21.0 (based on OpenTofu v1.13.0)\non darwin_arm64");
+    expect(refusal).toMatch(/choudoufu 0\.21\.0 is older than v0\.22\.0/);
+  });
+
+  test("passes that release and later ones", () => {
+    expect(choudoufuWavesVersionRefusal("choudoufu v0.22.0 (based on OpenTofu v1.13.0)")).toBeUndefined();
+    expect(choudoufuWavesVersionRefusal("choudoufu v1.0.0 (based on OpenTofu v1.13.0)")).toBeUndefined();
+  });
+
+  test("passes a dev build, which names no release; the document's digest is the check there", () => {
+    expect(choudoufuWavesVersionRefusal("OpenTofu v1.13.0-dev\non darwin_arm64")).toBeUndefined();
+  });
+});
+
+describe("parseChoudoufuPlanSet", () => {
+  test("binds chant's digest of the embedded plan and keeps choudoufu's set and root digests", () => {
+    const parsed = parseChoudoufuPlanSet(setDocument(), { member: "e01", root: "estates/e01" });
+    expect(parsed.setDigest).toBe("sha256:set");
+    expect(parsed.rootDigest).toBe("sha256:root");
+    expect(parsed.planDigest).toBe(terraformPlanDigest(plan));
+    expect(parsed.changed).toBe(true);
+    expect(parsed.changeSet.member.member).toBe("e01");
+    expect(parsed.changeSet.member.nativeDigest).toBe("sha256:root");
+  });
+
+  test("refuses a document with no set digest: that choudoufu predates choudoufu#1754", () => {
+    expect(() => parseChoudoufuPlanSet(setDocument({ digest: undefined }), { member: "e01", root: "estates/e01" })).toThrow(
+      /carries no set digest.*v0\.22\.0/,
+    );
+  });
+
+  test("refuses a root that did not plan, with choudoufu's error", () => {
+    const doc = setDocument({}, { status: "failed", stage: "init", error: "provider not found", plan: null });
+    expect(() => parseChoudoufuPlanSet(doc, { member: "e01", root: "estates/e01" })).toThrow(
+      'choudoufu could not plan root "e01" at init: provider not found',
+    );
+  });
+
+  test("refuses a document that is not about this root alone", () => {
+    expect(() => parseChoudoufuPlanSet(setDocument(), { member: "e01", root: "estates/e02" })).toThrow(/not only "estates\/e02"/);
+  });
+
+  test("refuses output that is not JSON", () => {
+    expect(() => parseChoudoufuPlanSet("Error: something", { member: "e01", root: "estates/e01" })).toThrow(/no JSON document/);
+  });
+});
+
+describe("commands", () => {
+  test("live-plan-set plans the one root, as a document", () => {
+    expect(choudoufuPlanSetCommand({ binary: "choudoufu", root: "estates/e01", outDir: ".chant/choudoufu-waves/e01/out" })).toBe(
+      "choudoufu live-plan-set -json -out-dir=.chant/choudoufu-waves/e01/out estates/e01",
+    );
+  });
+
+  test("live-wave-apply takes the approved document, its set digest, wave 1 and the resume file", () => {
+    expect(
+      choudoufuWaveApplyCommand({
+        binary: "choudoufu",
+        planSet: ".chant/choudoufu-waves/e01/plan-set.json",
+        digest: "sha256:set",
+        resume: ".chant/choudoufu-waves/e01/resume-set.json",
+        outDir: ".chant/choudoufu-waves/e01/out",
+      }),
+    ).toBe(
+      "choudoufu live-wave-apply -plan-set=.chant/choudoufu-waves/e01/plan-set.json -digest=sha256:set -wave=1 " +
+        "-resume=.chant/choudoufu-waves/e01/resume-set.json -out-dir=.chant/choudoufu-waves/e01/out -json",
+    );
+  });
+
+  test("a root is named by its path from the project root, and only inside it", () => {
+    expect(choudoufuSetRootPath("/p", join("/p", "estates", "e01"))).toBe("estates/e01");
+    expect(choudoufuSetRootPath("/p", "/p")).toBeUndefined();
+    expect(choudoufuSetRootPath("/p", "/elsewhere/e01")).toBeUndefined();
+  });
+});
+
+describe("the carried resume file", () => {
+  const resume = { format_version: "1", set_digest: "sha256:set", roots: [{ root: "estates/e01", wave: 1, outcome: "failed" }] };
+
+  test("comes back for the same set digest", () => {
+    expect(carriedChoudoufuResume({ kind: "choudoufu-wave-resume", setDigest: "sha256:set", resume }, "sha256:set")).toEqual(resume);
+  });
+
+  test("does not come back for another set digest, which choudoufu would refuse", () => {
+    expect(carriedChoudoufuResume({ kind: "choudoufu-wave-resume", setDigest: "sha256:set", resume }, "sha256:other")).toBeUndefined();
+  });
+
+  test("does not come back when the file inside names another digest, or for something else carried", () => {
+    const wrong = { ...resume, set_digest: "sha256:other" };
+    expect(carriedChoudoufuResume({ kind: "choudoufu-wave-resume", setDigest: "sha256:set", resume: wrong }, "sha256:set")).toBeUndefined();
+    expect(carriedChoudoufuResume({ kind: "something-else" }, "sha256:set")).toBeUndefined();
+    expect(carriedChoudoufuResume(undefined, "sha256:set")).toBeUndefined();
+  });
+});
+
+describe("describeChoudoufuWaveExit", () => {
+  test("exit 3 names the moved root and both digests", () => {
+    const message = describeChoudoufuWaveExit(
+      3,
+      { exit_code: 3, moved: [{ root: "estates/e01", approved_digest: "sha256:a", fresh_digest: "sha256:b" }] },
+      "",
+    );
+    expect(message).toMatch(/nothing was applied/);
+    expect(message).toMatch(/estates\/e01 moved: approved sha256:a, now sha256:b/);
+  });
+
+  test("exit 4 points at the resume file, and exit 1 says the command could not run", () => {
+    expect(describeChoudoufuWaveExit(4, { exit_code: 4 }, "")).toMatch(/resume file records why/);
+    expect(describeChoudoufuWaveExit(1, undefined, "Error: Missing options\n")).toBe(
+      "choudoufu live-wave-apply could not run (exit 1) (Error: Missing options)",
+    );
+  });
+});

package/src/op/activities/terraform.ts

@@ -40,13 +40,13 @@
  */
 
 import { exec } from "node:child_process";
-import { writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { promisify } from "node:util";
-import { resolve, dirname, join } from "node:path";
+import { resolve, dirname, join, relative, sep } from "node:path";
 import { loadChantConfigUpward } from "@intentius/chant/config";
 import { liveReadKey, memoLiveRead } from "@intentius/chant/live-read-session";
 import { terraformPlanDigest } from "../../plan-digest";
-import { plannerForBinary, terraformChangeSetPart } from "../../change-set";
+import { choudoufuSetPlanParts, plannerForBinary, terraformChangeSetPart } from "../../change-set";
 import type { ChangeSetPart } from "@intentius/chant/change-set";
 import type { TerraformConfig, TerraformRootConfig } from "../../config";
 import { detectLiveEstate } from "./live-detect";
@@ -100,6 +100,32 @@ export const DEFAULT_LIVE_PLAN_DOCUMENT_FILE = "chant.live-plan.json";
  */
 export const MIN_CHOUDOUFU_VERSION = "0.15.0";
 
+/**
+ * The choudoufu release a gated wave needs for a choudoufu root (#3459):
+ * the set digest on `live-plan-set -json`, and `live-wave-apply` with its
+ * resume file (choudoufu#1754, merged as choudoufu PR 1816 after v0.21.0).
+ * choudoufu's changelog lists both under `v0.22.0 (Unreleased)`, so this is
+ * the version main releases as.
+ *
+ * Only the wave path checks it, so plain `terraform` and `tofu` roots, and a
+ * choudoufu root run any other way, do not wait on it. A dev build prints no
+ * release version. For one, the check is the capability itself: a set plan
+ * document without a top-level `digest` came from a choudoufu older than
+ * choudoufu#1754, and {@link choudoufuPlanSet} refuses it.
+ */
+export const MIN_CHOUDOUFU_WAVES_VERSION = "0.22.0";
+
+/**
+ * Where a choudoufu root's wave files live, relative to the project root:
+ * `<root>/plan-set.json` (the set plan document chant planned and the
+ * approver approved), `<root>/resume-<digest>.json` (choudoufu's resume
+ * file) and `<root>/out/` (plan files and logs).
+ */
+export const CHOUDOUFU_WAVES_DIR = ".chant/choudoufu-waves";
+
+/** `live-wave-apply`'s exit statuses (choudoufu#1754). */
+export const CHOUDOUFU_WAVE_EXIT = { landed: 0, error: 1, setMoved: 3, rootFailed: 4 } as const;
+
 /**
  * choudoufu's own refusal summary for `-out` on the `live-plan -estate`
  * surface (`internal/command/live_mode.go`). That is the one surface where a
@@ -745,6 +771,36 @@ async function ensureChoudoufuVersion(binary: string, signal?: AbortSignal): Pro
 /** Test-only: clear the cached version check so a test can simulate a fresh module load. */
 export function __resetChoudoufuVersionCheckForTests(): void {
   choudoufuVersionCheck = undefined;
+  choudoufuWavesVersionCheck = undefined;
+}
+
+/**
+ * Why `choudoufu version`'s output cannot drive a gated wave, or `undefined`
+ * when it can (#3459). A release older than
+ * {@link MIN_CHOUDOUFU_WAVES_VERSION} is refused. A dev build names no
+ * release and passes here; {@link parseChoudoufuPlanSet} then refuses a set
+ * plan document with no digest, which is what an older dev build prints.
+ */
+export function choudoufuWavesVersionRefusal(versionOutput: string): string | undefined {
+  const version = parseChoudoufuVersion(versionOutput);
+  if (version === undefined || !isOlderVersion(version, MIN_CHOUDOUFU_WAVES_VERSION)) return undefined;
+  return (
+    `choudoufu ${version} is older than v${MIN_CHOUDOUFU_WAVES_VERSION}, the first release with the set digest and ` +
+    "live-wave-apply (choudoufu#1754) that a gated wave uses for a choudoufu root. Upgrade choudoufu, or run the " +
+    "fan-out without --wave-gate."
+  );
+}
+
+/** Cached like {@link choudoufuVersionCheck}, and only ever run on the wave path. */
+let choudoufuWavesVersionCheck: Promise<void> | undefined;
+
+async function ensureChoudoufuWavesVersion(binary: string, signal?: AbortSignal): Promise<void> {
+  choudoufuWavesVersionCheck ??= (async () => {
+    const { stdout } = await execAsync(`${binary} version`, { env: process.env, signal });
+    const refusal = choudoufuWavesVersionRefusal(stdout);
+    if (refusal) throw new Error(refusal);
+  })();
+  return choudoufuWavesVersionCheck;
 }
 
 // ── Root resolution ─────────────────────────────────────────────────────────
@@ -759,6 +815,8 @@ interface ResolvedRoot {
   estate?: string;
   /** `true` exactly when this root is live: `binary` is `"choudoufu"` and `estate` is set. */
   live: boolean;
+  /** The directory the project's `chant.config.*` lives in, which `root.dir` resolves against. */
+  projectRoot: string;
 }
 
 /**
@@ -802,6 +860,7 @@ async function resolveRoot(args: TerraformRootArgs, signal?: AbortSignal): Promi
     dir,
     ...(estate !== undefined ? { estate } : {}),
     live: estate !== undefined || configEstate !== undefined,
+    projectRoot,
   };
 }
 
@@ -1029,6 +1088,352 @@ export async function terraformOutputs(
   return Object.fromEntries(Object.entries(parsed).map(([name, entry]) => [name, entry?.value]));
 }
 
+// ── choudoufu gated waves (#3459) ───────────────────────────────────────────
+
+/**
+ * `live-plan-set -json` over one root, from the project root, so the
+ * document names the root by its path from there, which is what
+ * `live-wave-apply` resolves it against.
+ */
+export function choudoufuPlanSetCommand(opts: { binary: string; root: string; outDir: string }): string {
+  return [opts.binary, "live-plan-set", "-json", `-out-dir=${quoteArg(opts.outDir)}`, quoteArg(opts.root)].join(" ");
+}
+
+/**
+ * `live-wave-apply` over a one-root set. The set chant hands choudoufu is
+ * one root, so choudoufu's waves over it are a single wave and `-wave=1` is
+ * always that root's. chant's waves are the order; choudoufu's command is
+ * the apply, with its set check and its resume file.
+ */
+export function choudoufuWaveApplyCommand(opts: {
+  binary: string;
+  planSet: string;
+  digest: string;
+  resume: string;
+  outDir: string;
+}): string {
+  return [
+    opts.binary,
+    "live-wave-apply",
+    `-plan-set=${quoteArg(opts.planSet)}`,
+    `-digest=${quoteArg(opts.digest)}`,
+    "-wave=1",
+    `-resume=${quoteArg(opts.resume)}`,
+    `-out-dir=${quoteArg(opts.outDir)}`,
+    "-json",
+  ].join(" ");
+}
+
+/**
+ * The root's directory as a set plan document names it: its path from the
+ * project root, with forward slashes. `undefined` when the root is the
+ * project root itself or outside it, since choudoufu takes only roots inside
+ * the working directory.
+ */
+export function choudoufuSetRootPath(projectRoot: string, dir: string): string | undefined {
+  const rel = relative(projectRoot, dir);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || resolve(projectRoot, rel) !== resolve(dir)) return undefined;
+  return rel.split(sep).join("/");
+}
+
+/** A root that a gated wave runs through `live-plan-set` and `live-wave-apply`. */
+export interface ChoudoufuWaveRootArgs extends TerraformRootArgs {
+  /** The step's `-var` values. A root given any is not a wave root: see {@link choudoufuWaveRoot}. */
+  vars?: Record<string, unknown>;
+}
+
+/**
+ * Whether a gated wave runs this root through choudoufu's own set commands
+ * (#3459), and if not, why not. It does for a live choudoufu root that
+ * `live-plan-set` can plan as chant would: those commands run plain `init`
+ * and `plan` in each root, with no `-var-file`, no `-var` and no
+ * `-backend-config`, so a root that needs any of them goes the `plan -out`
+ * and `apply PLANFILE` way instead, where choudoufu's per-root refusal
+ * (choudoufu #878) still stands in front of the apply.
+ */
+export async function choudoufuWaveRoot(
+  args: ChoudoufuWaveRootArgs,
+  signal?: AbortSignal,
+): Promise<{ wave: true; root: string } | { wave: false; reason: string }> {
+  const resolved = await resolveRoot(args, signal);
+  if (resolved.binary !== "choudoufu") return { wave: false, reason: `the root runs ${resolved.binary}` };
+  if (!resolved.live) return { wave: false, reason: "the root declares no live estate" };
+  if (args.vars && Object.values(args.vars).some((v) => v !== undefined)) {
+    return { wave: false, reason: "the step passes -var values, which live-plan-set does not take" };
+  }
+  if (resolved.root.varFiles && resolved.root.varFiles.length > 0) {
+    return { wave: false, reason: "the root has var files, which live-plan-set does not take" };
+  }
+  if (resolved.root.backendConfig && Object.keys(resolved.root.backendConfig).length > 0) {
+    return { wave: false, reason: "the root has backend config, which live-plan-set does not take" };
+  }
+  const root = choudoufuSetRootPath(resolved.projectRoot, resolved.dir);
+  if (root === undefined) return { wave: false, reason: "the root's directory is not inside the project" };
+  return { wave: true, root };
+}
+
+/** What {@link parseChoudoufuPlanSet} read out of a one-root set plan document. */
+export interface ChoudoufuPlanSet {
+  /** choudoufu's set digest: what `live-wave-apply -digest` takes. */
+  setDigest: string;
+  /** choudoufu's digest of the one root. */
+  rootDigest: string;
+  /** chant's {@link terraformPlanDigest} over the root's embedded plan: what the wave gate binds. */
+  planDigest: string;
+  changed: boolean;
+  /** The root's `show -json` plan, as the document embeds it. */
+  json: unknown;
+  /** The member's change-set part, with choudoufu's root digest as `nativeDigest`. */
+  changeSet: ChangeSetPart;
+}
+
+const isObjectValue = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null && !Array.isArray(value);
+
+/**
+ * Read `live-plan-set -json`'s document for one root (#3459). Refuses a
+ * document with no set digest: that choudoufu predates choudoufu#1754, and
+ * this is how a dev build, which names no release, is held to
+ * {@link MIN_CHOUDOUFU_WAVES_VERSION}. Refuses a root that did not plan,
+ * with choudoufu's own error.
+ */
+export function parseChoudoufuPlanSet(stdout: string, opts: { member: string; root: string }): ChoudoufuPlanSet {
+  let doc: unknown;
+  try {
+    doc = JSON.parse(stdout);
+  } catch {
+    throw new Error(`choudoufu live-plan-set printed no JSON document for root "${opts.member}"`);
+  }
+  if (!isObjectValue(doc) || !Array.isArray(doc.roots)) {
+    throw new Error(`choudoufu live-plan-set printed no set plan document for root "${opts.member}"`);
+  }
+  if (typeof doc.digest !== "string" || doc.digest === "") {
+    throw new Error(
+      `choudoufu's set plan document for root "${opts.member}" carries no set digest, so this choudoufu predates ` +
+        `choudoufu#1754. A gated wave over a choudoufu root needs v${MIN_CHOUDOUFU_WAVES_VERSION} or later.`,
+    );
+  }
+  const roots = doc.roots.filter(isObjectValue);
+  const entry = roots.find((r) => r.root === opts.root);
+  if (roots.length !== 1 || !entry) {
+    throw new Error(
+      `choudoufu's set plan document for root "${opts.member}" names ${roots.map((r) => String(r.root)).join(", ") || "no root"}, ` +
+        `not only "${opts.root}"`,
+    );
+  }
+  if (entry.status !== "planned" || !isObjectValue(entry.plan)) {
+    const stage = typeof entry.stage === "string" && entry.stage ? ` at ${entry.stage}` : "";
+    const error = typeof entry.error === "string" && entry.error ? `: ${entry.error}` : "";
+    throw new Error(`choudoufu could not plan root "${opts.member}"${stage}${error}`);
+  }
+  if (typeof entry.digest !== "string" || entry.digest === "") {
+    throw new Error(`choudoufu's set plan document gives root "${opts.member}" no digest`);
+  }
+  const [changeSet] = choudoufuSetPlanParts({ document: doc, memberFor: () => opts.member });
+  return {
+    setDigest: doc.digest,
+    rootDigest: entry.digest,
+    planDigest: terraformPlanDigest(entry.plan),
+    changed: entry.changes === true,
+    json: entry.plan,
+    changeSet: changeSet!,
+  };
+}
+
+/** The directory a root's wave files go in, absolute. */
+function choudoufuWavesDir(projectRoot: string, root: string): string {
+  return join(projectRoot, CHOUDOUFU_WAVES_DIR, root.replace(/[^A-Za-z0-9._-]/g, "_"));
+}
+
+/** A path under the project root as choudoufu, run from there, should be given it. */
+function fromProject(projectRoot: string, path: string): string {
+  return relative(projectRoot, path).split(sep).join("/");
+}
+
+/** What {@link choudoufuPlanSet} planned. */
+export interface ChoudoufuPlanSetResult extends ChoudoufuPlanSet {
+  /** The set plan document, written as choudoufu printed it. `live-wave-apply -plan-set` reads this file. */
+  planSetFile: string;
+  /** The root's path as the document names it. */
+  root: string;
+}
+
+/**
+ * Plan one live choudoufu root as a one-root set: `live-plan-set -json` from
+ * the project root (#3459). The document goes to
+ * `<CHOUDOUFU_WAVES_DIR>/<root>/plan-set.json`, the file a later
+ * `live-wave-apply` hands back to choudoufu with the set digest.
+ */
+export async function choudoufuPlanSet(args: TerraformRootArgs, signal?: AbortSignal): Promise<ChoudoufuPlanSetResult> {
+  const resolved = await resolveRoot(args, signal);
+  const { binary, root, dir, projectRoot } = resolved;
+  if (binary !== "choudoufu") throw new Error(`choudoufuPlanSet: root "${args.root}" runs ${binary}, not choudoufu`);
+  await ensureChoudoufuWavesVersion(binary, signal);
+  const rootPath = choudoufuSetRootPath(projectRoot, dir);
+  if (rootPath === undefined) throw new Error(`choudoufuPlanSet: root "${args.root}" (${dir}) is not inside ${projectRoot}`);
+  const wavesDir = choudoufuWavesDir(projectRoot, args.root);
+  mkdirSync(wavesDir, { recursive: true });
+  const cmd = choudoufuPlanSetCommand({ binary, root: rootPath, outDir: fromProject(projectRoot, join(wavesDir, "out")) });
+
+  let stdout: string;
+  try {
+    const out = await run(cmd, projectRoot, terraformEnvironment(root), signal);
+    report("", out.stderr);
+    stdout = out.stdout;
+  } catch (err) {
+    // 2 is "planned, with changes" and 4 is "a root failed", which the
+    // document itself explains. Anything else is the command not running.
+    const failure = err as ExecFailure;
+    if (failure.code !== 2 && failure.code !== 4) throw err;
+    report("", failure.stderr ?? "");
+    stdout = failure.stdout ?? "";
+  }
+
+  const parsed = parseChoudoufuPlanSet(stdout, { member: args.root, root: rootPath });
+  const planSetFile = join(wavesDir, "plan-set.json");
+  writeFileSync(planSetFile, stdout);
+  return { ...parsed, planSetFile, root: rootPath };
+}
+
+/**
+ * What a choudoufu root keeps in the fan-out's attempt record (#3459):
+ * choudoufu's resume file, under the set digest it was written for.
+ */
+export interface ChoudoufuCarriedResume {
+  kind: "choudoufu-wave-resume";
+  setDigest: string;
+  resume: unknown;
+}
+
+/**
+ * The resume file to hand choudoufu for `setDigest`, from what an earlier
+ * attempt carried, or `undefined`. choudoufu refuses a resume file written
+ * for another digest, and a re-planned root with a moved plan has another
+ * digest, so only a file for this same set comes back.
+ */
+export function carriedChoudoufuResume(carried: unknown, setDigest: string): unknown {
+  if (!isObjectValue(carried) || carried.kind !== "choudoufu-wave-resume") return undefined;
+  if (carried.setDigest !== setDigest || !isObjectValue(carried.resume)) return undefined;
+  return carried.resume.set_digest === setDigest ? carried.resume : undefined;
+}
+
+export interface ChoudoufuWaveApplyArgs extends TerraformRootArgs {
+  /** {@link ChoudoufuPlanSetResult.planSetFile}: the approved document. */
+  planSetFile: string;
+  /** {@link ChoudoufuPlanSetResult.setDigest}: choudoufu's digest of that document. */
+  setDigest: string;
+  /** What the root carried from an earlier attempt (`DeployContext.carried[root]`). */
+  carried?: unknown;
+}
+
+export interface ChoudoufuWaveApplyResult {
+  /** `live-wave-apply`'s exit status. See {@link CHOUDOUFU_WAVE_EXIT}. */
+  exitCode: number;
+  /** Exit 0: the root landed. */
+  landed: boolean;
+  /** `-json`'s result document, when it printed one. */
+  result?: unknown;
+  /** choudoufu's resume file after the run, to carry. Absent when choudoufu wrote none. */
+  carry?: ChoudoufuCarriedResume;
+  /** One line for a person: what happened, in choudoufu's words where it gave some. */
+  message: string;
+}
+
+/** One line for each of `live-wave-apply`'s exit statuses, with choudoufu's own error when it gave one. */
+export function describeChoudoufuWaveExit(exitCode: number, result: unknown, stderr: string): string {
+  const error = isObjectValue(result) && typeof result.error === "string" && result.error ? result.error : "";
+  const moved =
+    isObjectValue(result) && Array.isArray(result.moved)
+      ? result.moved
+          .filter(isObjectValue)
+          .map((m) => `${String(m.root)} moved: approved ${String(m.approved_digest)}, now ${String(m.fresh_digest)}`)
+      : [];
+  const detail = error || moved.join("; ") || stderr.trim().split("\n").find((l) => l.trim() !== "")?.trim() || "";
+  const suffix = detail ? ` (${detail})` : "";
+  switch (exitCode) {
+    case CHOUDOUFU_WAVE_EXIT.landed:
+      return "landed";
+    case CHOUDOUFU_WAVE_EXIT.setMoved:
+      return `choudoufu refused the approved set: the root's plan moved since it was approved, and nothing was applied${suffix}`;
+    case CHOUDOUFU_WAVE_EXIT.rootFailed:
+      return `choudoufu could not land the root; its resume file records why${suffix}`;
+    default:
+      return `choudoufu live-wave-apply could not run (exit ${exitCode})${suffix}`;
+  }
+}
+
+/**
+ * Apply one live choudoufu root through `live-wave-apply` (#3459), with the
+ * set plan document and set digest {@link choudoufuPlanSet} produced. When
+ * the root carried a resume file for this same digest from an earlier
+ * attempt, it is written back first, so choudoufu sees what it already
+ * recorded. Its resume file after the run comes back as `carry`, landed or
+ * not.
+ *
+ * Never throws for a choudoufu answer: exit 3 (the set moved) and exit 4 (the
+ * root failed) come back with `landed: false`, and so does exit 1. An abort
+ * or a spawn failure propagates.
+ */
+export async function choudoufuWaveApply(args: ChoudoufuWaveApplyArgs, signal?: AbortSignal): Promise<ChoudoufuWaveApplyResult> {
+  const resolved = await resolveRoot(args, signal);
+  const { binary, root, projectRoot } = resolved;
+  if (binary !== "choudoufu") throw new Error(`choudoufuWaveApply: root "${args.root}" runs ${binary}, not choudoufu`);
+  await ensureChoudoufuWavesVersion(binary, signal);
+  const wavesDir = choudoufuWavesDir(projectRoot, args.root);
+  mkdirSync(wavesDir, { recursive: true });
+  // One file per digest: choudoufu refuses a resume file written for
+  // another, and a file left by an earlier set must not block this one.
+  const resumeFile = join(wavesDir, `resume-${args.setDigest.replace(/^sha256:/, "").slice(0, 16)}.json`);
+  const carried = carriedChoudoufuResume(args.carried, args.setDigest);
+  if (carried !== undefined) writeFileSync(resumeFile, JSON.stringify(carried, null, 2) + "\n");
+
+  const cmd = choudoufuWaveApplyCommand({
+    binary,
+    planSet: fromProject(projectRoot, args.planSetFile),
+    digest: args.setDigest,
+    resume: fromProject(projectRoot, resumeFile),
+    outDir: fromProject(projectRoot, join(wavesDir, "out")),
+  });
+
+  let exitCode = 0;
+  let stdout = "";
+  let stderr = "";
+  try {
+    const out = await run(cmd, projectRoot, terraformEnvironment(root), signal);
+    stdout = out.stdout;
+    stderr = out.stderr;
+  } catch (err) {
+    const failure = err as ExecFailure;
+    if (typeof failure.code !== "number") throw err;
+    exitCode = failure.code;
+    stdout = failure.stdout ?? "";
+    stderr = failure.stderr ?? "";
+  }
+  report(stdout, stderr);
+
+  let result: unknown;
+  try {
+    result = stdout.trim() ? JSON.parse(stdout) : undefined;
+  } catch {
+    result = undefined;
+  }
+  let carry: ChoudoufuCarriedResume | undefined;
+  if (existsSync(resumeFile)) {
+    try {
+      carry = { kind: "choudoufu-wave-resume", setDigest: args.setDigest, resume: JSON.parse(readFileSync(resumeFile, "utf8")) };
+    } catch {
+      carry = undefined;
+    }
+  }
+  return {
+    exitCode,
+    landed: exitCode === CHOUDOUFU_WAVE_EXIT.landed,
+    ...(result !== undefined ? { result } : {}),
+    ...(carry ? { carry } : {}),
+    message: describeChoudoufuWaveExit(exitCode, result, stderr),
+  };
+}
+
 /**
  * `terraform show` over current state, or over a saved plan when `planFile` is
  * given. Returns the parsed `-json` output and the `-no-color` render, plus