@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/dist/state/backend.js

@@ -0,0 +1,406 @@
+/**
+ * Where an initialised root's state is, read from the backend the binary
+ * initialised: `<root>/.terraform/terraform.tfstate` (or
+ * `$TF_DATA_DIR/terraform.tfstate`), which `init` writes with the backend's
+ * type and its whole configuration, whether the root's code, a
+ * `-backend-config` file or the job's flags supplied it. Nothing here reads
+ * a state's contents.
+ *
+ * chant locks and writes four backends: s3 with `use_lockfile`, gcs, azurerm
+ * and local. Every other backend, and a root with a `cloud` block, comes back
+ * as a {@link StateRefusal} naming why, and is never locked.
+ *
+ * This is also the one place that answers which backend a root has and
+ * whether chant can lock it (chant#4478). Before `init` the answer comes
+ * from the root's code with the `-backend-config` pairs over it
+ * ({@link declaredBackend}); after, from what `init` recorded. When both
+ * exist and disagree the root is refused with a reason naming both
+ * ({@link readBackend}, {@link lockRefusal}). The composition's `backend`
+ * fallback and the state refusals both call {@link lockRefusal}, so one root
+ * gets one verdict.
+ *
+ * Lifted from terragucci's `backend.ts` (c493e0e): `initialisedBackend`,
+ * `dataDir`, `workspaceOf`, `s3StateKey`, `stateObject`, `isStored`,
+ * `stateLocation`, and the cloud block check of `migrate.ts`'s `refusal`.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { AZURE_AUTHORITY } from "./azure-blob.js";
+import { GCS_ENDPOINT } from "./gcs.js";
+import { s3FromEnv } from "./s3.js";
+import { isJsonConfigFile, listConfigFilesSafe } from "../hcl/files.js";
+import { blockBody, jsonBlocks, rootTexts } from "../compose/hcl.js";
+import { backendConfigFileKeys, literalAttributes } from "../backend-config.js";
+export const isRefused = (o) => "refused" in o;
+/** Whether the state is in a bucket or a container: s3, gcs or azurerm. */
+export const isStored = (o) => !isRefused(o) && o.backend !== "local";
+/** The backend types whose state chant locks and writes itself, s3 only with `use_lockfile = true` (#4437). The one list (chant#4478). */
+export const LOCKABLE_BACKENDS = ["s3", "gcs", "azurerm", "local"];
+/** What a refusal says chant locks, spelled from {@link LOCKABLE_BACKENDS}. */
+export const LOCKS = (() => {
+    const names = LOCKABLE_BACKENDS.map((b) => (b === "s3" ? "s3 (with use_lockfile = true)" : b));
+    return `chant locks and writes ${names.slice(0, -1).join(", ")} and ${names.at(-1)} states`;
+})();
+const str = (v) => (typeof v === "string" && v !== "" ? v : undefined);
+/** The root's data dir: `TF_DATA_DIR` (relative to the root, as the binary run with `-chdir` reads it), else `.terraform`. */
+export function dataDir(dir, env = process.env) {
+    const d = env.TF_DATA_DIR;
+    if (!d)
+        return join(dir, ".terraform");
+    return isAbsolute(d) ? d : join(dir, d);
+}
+/** The backend `init` recorded for the root, or undefined when it has not been initialised with one. */
+export function initialisedBackend(dir, env = process.env) {
+    const file = join(dataDir(dir, env), "terraform.tfstate");
+    if (!existsSync(file))
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf-8"));
+        const type = str(parsed.backend?.type);
+        if (!type)
+            return undefined;
+        const config = parsed.backend?.config && typeof parsed.backend.config === "object" ? parsed.backend.config : {};
+        return { type, config };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The workspace the binary runs in: `TF_WORKSPACE`, else the one `workspace select` recorded, else `default`. */
+export function workspaceOf(dir, env = process.env) {
+    if (env.TF_WORKSPACE)
+        return env.TF_WORKSPACE;
+    const file = join(dataDir(dir, env), "environment");
+    if (existsSync(file)) {
+        const ws = readFileSync(file, "utf-8").trim();
+        if (ws)
+            return ws;
+    }
+    return "default";
+}
+/** The S3 key of a workspace's state, as the S3 backend names it: the key in `default`, else `<workspace_key_prefix>/<workspace>/<key>`. */
+export function s3StateKey(key, workspace, prefix = "env:") {
+    return workspace === "default" ? key : `${prefix}/${workspace}/${key}`;
+}
+/** Whether a root's JSON code gives a `terraform` block a `cloud` block, as `terraform.cloud` or a list of terraform blocks. */
+function jsonCloud(doc) {
+    const tf = doc && typeof doc === "object" ? doc.terraform : undefined;
+    const blocks = Array.isArray(tf) ? tf : tf ? [tf] : [];
+    return blocks.some((b) => b && typeof b === "object" && "cloud" in b);
+}
+/**
+ * Whether the root's code has a `cloud` block, over the configuration files
+ * `binary` reads: `.tf` and `.tf.json`, plus `.tofu` and `.tofu.json` for a
+ * tofu or choudoufu root, from the lexicon's one lister (chant#4457).
+ */
+export function hasCloudBlock(dir, binary) {
+    for (const f of listConfigFilesSafe(dir, binary)) {
+        let text;
+        try {
+            text = readFileSync(join(dir, f), "utf-8");
+        }
+        catch {
+            continue;
+        }
+        if (!isJsonConfigFile(f)) {
+            if (/^\s*cloud\s*\{/m.test(text))
+                return true;
+            continue;
+        }
+        try {
+            if (jsonCloud(JSON.parse(text)))
+                return true;
+        }
+        catch {
+            // Not JSON: the binary reports it.
+        }
+    }
+    return false;
+}
+const CLOUD_REASON = "the root has a cloud block, whose state HCP Terraform keeps and locks";
+/** A `-backend-config` value as init would type it: `true` and `false` are booleans, anything else a string. */
+const typed = (v) => (v === "true" ? true : v === "false" ? false : v);
+/** The `-backend-config` flags in `TF_CLI_ARGS` then `TF_CLI_ARGS_init`, in order: `key=value` pairs, and the paths of backend-config files. */
+export function cliBackendConfig(env = {}) {
+    const pairs = {};
+    const files = [];
+    const ordered = [];
+    const unquote = (t) => t.replace(/^(["'])(.*)\1$/, "$2");
+    for (const line of [env.TF_CLI_ARGS, env.TF_CLI_ARGS_init]) {
+        const tokens = (line ?? "").match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) ?? [];
+        for (let i = 0; i < tokens.length; i++) {
+            const t = unquote(tokens[i]);
+            const flag = /^--?backend-config(?:=(.*))?$/.exec(t);
+            if (!flag)
+                continue;
+            const value = flag[1] !== undefined ? unquote(flag[1]) : tokens[i + 1] !== undefined ? unquote(tokens[++i]) : undefined;
+            if (value === undefined || value === "")
+                continue;
+            const eq = value.indexOf("=");
+            if (eq > 0) {
+                pairs[value.slice(0, eq)] = value.slice(eq + 1);
+                ordered.push({ key: value.slice(0, eq), value: value.slice(eq + 1) });
+            }
+            else {
+                files.push(value);
+                ordered.push({ file: value });
+            }
+        }
+    }
+    return { pairs, files, ordered };
+}
+const plain = (v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean";
+/**
+ * The backend the root's code declares, with the `-backend-config` flags of
+ * `TF_CLI_ARGS`, `TF_CLI_ARGS_init` and then `backendConfig` over it, in the
+ * order init applies them: what `init` would record, as far as chant can read
+ * it before init runs. A `cloud` block is `{ type: "cloud" }`. Undefined when
+ * the code declares neither, which init records as no backend (local).
+ */
+export function declaredBackend(dir, input = {}) {
+    let found;
+    for (const { text, json } of rootTexts(dir, input.binary)) {
+        if (found)
+            break;
+        if (json) {
+            let doc;
+            try {
+                doc = JSON.parse(text);
+            }
+            catch {
+                continue;
+            }
+            for (const t of jsonBlocks(doc, "terraform")) {
+                if (t.cloud !== undefined) {
+                    found = { type: "cloud", config: {} };
+                    break;
+                }
+                const backends = t.backend && typeof t.backend === "object" && !Array.isArray(t.backend) ? t.backend : {};
+                const type = Object.keys(backends)[0];
+                if (!type)
+                    continue;
+                const raw = backends[type];
+                const body = (Array.isArray(raw) ? raw[0] : raw);
+                found = { type, config: Object.fromEntries(Object.entries(body ?? {}).filter(([, v]) => plain(v) && !(typeof v === "string" && /\$\{/.test(v)))) };
+                break;
+            }
+            continue;
+        }
+        const m = text.match(/\bbackend\s+"([^"]+)"\s*\{/);
+        if (m) {
+            found = { type: m[1], config: literalAttributes(blockBody(text, m.index), 1) };
+            break;
+        }
+        if (/^\s*cloud\s*\{/m.test(text))
+            found = { type: "cloud", config: {} };
+    }
+    if (!found || found.type === "cloud")
+        return found;
+    // The order init applies them: the job's TF_CLI_ARGS flags first, then the
+    // flags chant's own init passes, its files before its pairs (chant#4459).
+    // A file's keys are read from it, relative to the root as init reads it.
+    const config = { ...found.config };
+    for (const flag of cliBackendConfig(input.env).ordered) {
+        if ("file" in flag)
+            Object.assign(config, backendConfigFileKeys(dir, [flag.file]).config);
+        else
+            config[flag.key] = typed(flag.value);
+    }
+    Object.assign(config, backendConfigFileKeys(dir, input.backendConfigFiles).config);
+    for (const [k, v] of Object.entries(input.backendConfig ?? {}))
+        config[k] = typed(v);
+    return { type: found.type, config };
+}
+/** Configuration keys whose values a reason names but never prints. */
+const SECRET_KEYS = /(^|_)(key|secret|token|password|credentials|sas)($|_)/;
+const shown = (k, v) => (SECRET_KEYS.test(k) && k !== "key" ? `${k} (value hidden)` : `${k} = ${JSON.stringify(v)}`);
+/**
+ * A root's backend from its code and flags and from what `init` recorded,
+ * compared (chant#4478). They disagree when both exist and name another type,
+ * or when a key both give a plain value has two values; a key only one side
+ * gives (a default init filled in, a value from a backend-config file chant
+ * did not read) is no disagreement. Code that declares no backend leaves the
+ * record to stand.
+ */
+export function readBackend(dir, input = {}) {
+    const env = input.env ?? process.env;
+    const declared = declaredBackend(dir, input);
+    const recorded = input.recorded === undefined ? initialisedBackend(dir, env) : (input.recorded ?? undefined);
+    const backend = recorded ?? declared ?? { type: "local", config: {} };
+    const out = { ...(declared ? { declared } : {}), ...(recorded ? { recorded } : {}), backend };
+    if (!declared || !recorded)
+        return out;
+    if (declared.type !== recorded.type) {
+        out.disagreement = `the root's code names the ${declared.type} backend and init recorded ${recorded.type}`;
+        return out;
+    }
+    const differ = [];
+    for (const [k, d] of Object.entries(declared.config)) {
+        const r = recorded.config[k];
+        if (!plain(d) || !plain(r) || String(d) === String(r))
+            continue;
+        differ.push(`${shown(k, d)} in the code and flags, ${shown(k, r)} in what init recorded`);
+    }
+    if (differ.length > 0)
+        out.disagreement = `the root's ${declared.type} backend has ${differ.join("; ")}`;
+    return out;
+}
+/**
+ * Whether chant can lock the root's state, from one {@link BackendReading}:
+ * undefined when it can, else the refusal and why. The one verdict the
+ * composition's `backend` fallback (#4438) and the state refusals (#4437)
+ * both give (chant#4478).
+ */
+export function lockRefusal(reading) {
+    const b = reading.backend;
+    if (reading.disagreement)
+        return { backend: b.type, refused: "disagree", reason: `${reading.disagreement}, so chant cannot tell which state to lock; run init again with the configuration the root means; ${LOCKS}` };
+    if (b.type === "cloud")
+        return { backend: b.type, refused: "cloud", reason: `${CLOUD_REASON}; ${LOCKS}` };
+    if (!LOCKABLE_BACKENDS.includes(b.type))
+        return { backend: b.type, refused: "backend", reason: `the root's backend is ${b.type}; ${LOCKS}` };
+    if (b.type === "s3" && b.config.use_lockfile !== true && b.config.use_lockfile !== "true") {
+        return { backend: "s3", refused: "no-lockfile", reason: `the s3 backend takes no lock file (use_lockfile = true is unset), so chant cannot hold its lock; ${LOCKS}` };
+    }
+    return undefined;
+}
+/**
+ * Where the root's state is, or why chant does not lock it, from
+ * {@link readBackend}: what `init` recorded (`backend` stands in for it),
+ * compared with the root's code, `backendConfigFiles` and `backendConfig`. A root neither declares
+ * nor records a backend for reads as a local one.
+ */
+export function stateObject(dir, env = process.env, backend = initialisedBackend(dir, env), binary, flags = {}) {
+    const reading = readBackend(dir, {
+        env,
+        recorded: backend ?? null,
+        ...(binary ? { binary } : {}),
+        ...(flags.backendConfig ? { backendConfig: flags.backendConfig } : {}),
+        ...(flags.backendConfigFiles ? { backendConfigFiles: flags.backendConfigFiles } : {}),
+    });
+    const refusal = lockRefusal(reading);
+    if (refusal)
+        return refusal;
+    const chosen = reading.backend;
+    const ws = workspaceOf(dir, env);
+    if (chosen.type === "local") {
+        const c = chosen.config;
+        const path = ws === "default" ? (str(c.path) ?? "terraform.tfstate") : join(str(c.workspace_dir) ?? "terraform.tfstate.d", ws, "terraform.tfstate");
+        return { backend: "local", path };
+    }
+    if (chosen.type === "gcs")
+        return gcsObject(chosen.config, ws, env);
+    if (chosen.type === "azurerm")
+        return azureObject(chosen.config, ws, env);
+    const c = chosen.config;
+    const bucket = str(c.bucket);
+    const key = str(c.key);
+    if (!bucket || !key)
+        return { backend: "s3", refused: "config", reason: "the s3 backend's bucket or key is not in its configuration (the code and flags, or what init recorded)" };
+    const endpoints = c.endpoints && typeof c.endpoints === "object" ? c.endpoints : {};
+    const endpoint = str(endpoints.s3) ?? str(c.endpoint) ?? env.AWS_ENDPOINT_URL_S3 ?? env.AWS_ENDPOINT_URL;
+    const region = str(c.region) ?? env.AWS_REGION ?? env.AWS_DEFAULT_REGION ?? "us-east-1";
+    const access = str(c.access_key);
+    const secret = str(c.secret_key);
+    const jobEnv = { ...env, AWS_REGION: region, ...(access && secret ? { AWS_ACCESS_KEY_ID: access, AWS_SECRET_ACCESS_KEY: secret, AWS_SESSION_TOKEN: str(c.token) ?? "" } : {}) };
+    let target;
+    try {
+        target = s3FromEnv({ bucket, ...(endpoint ? { endpoint } : {}) }, jobEnv);
+    }
+    catch (e) {
+        return { backend: "s3", refused: "credentials", reason: `the job has no credentials to read s3://${bucket}: ${e.message}` };
+    }
+    return {
+        backend: "s3",
+        bucket,
+        key: s3StateKey(key, ws, str(c.workspace_key_prefix)),
+        region,
+        ...(endpoint ? { endpoint: endpoint.replace(/\/+$/, "") } : {}),
+        lockfile: true,
+        target,
+    };
+}
+/** A gcs backend's custom endpoint (`storage_custom_endpoint`, `https://host/storage/v1/`) as the JSON API's address: no path, no trailing slash. */
+const gcsEndpoint = (e) => e.replace(/\/+$/, "").replace(/\/storage\/v1$/, "");
+/**
+ * A gcs backend's state: `<prefix>/<workspace>.tfstate` and its lock beside
+ * it, with the credentials the backend would use, first match wins:
+ * `access_token` (or GOOGLE_OAUTH_ACCESS_TOKEN), `credentials` (a file or its
+ * JSON), GOOGLE_BACKEND_CREDENTIALS, GOOGLE_CREDENTIALS, and
+ * GOOGLE_APPLICATION_CREDENTIALS.
+ */
+function gcsObject(c, ws, env) {
+    const bucket = str(c.bucket);
+    if (!bucket)
+        return { backend: "gcs", refused: "config", reason: "the gcs backend's bucket is not in the configuration init recorded" };
+    const raw = str(c.prefix) ?? "";
+    const prefix = raw === "" || raw.endsWith("/") ? raw : `${raw}/`;
+    const endpoint = gcsEndpoint(str(c.storage_custom_endpoint) ?? env.GOOGLE_BACKEND_STORAGE_CUSTOM_ENDPOINT ?? env.GOOGLE_STORAGE_CUSTOM_ENDPOINT ?? GCS_ENDPOINT);
+    const impersonate = str(c.impersonate_service_account) ?? env.GOOGLE_BACKEND_IMPERSONATE_SERVICE_ACCOUNT ?? env.GOOGLE_IMPERSONATE_SERVICE_ACCOUNT;
+    const where = { bucket, endpoint, ...(impersonate ? { impersonate } : {}) };
+    const token = str(c.access_token) ?? env.GOOGLE_OAUTH_ACCESS_TOKEN;
+    const creds = str(c.credentials) ?? env.GOOGLE_BACKEND_CREDENTIALS ?? env.GOOGLE_CREDENTIALS;
+    let target;
+    if (token)
+        target = { ...where, accessToken: token };
+    else if (creds)
+        target = creds.trim().startsWith("{") ? { ...where, credentialsJson: creds } : { ...where, credentialsFile: creds };
+    else if (env.GOOGLE_APPLICATION_CREDENTIALS)
+        target = { ...where, credentialsFile: env.GOOGLE_APPLICATION_CREDENTIALS };
+    else
+        return { backend: "gcs", refused: "credentials", reason: `the job has no credentials to read gs://${bucket}: set GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_CREDENTIALS or GOOGLE_OAUTH_ACCESS_TOKEN` };
+    return { backend: "gcs", bucket, key: `${prefix}${ws}.tfstate`, lock: `${prefix}${ws}.tflock`, target };
+}
+/** Each Azure cloud's storage suffix and Entra ID, by the azurerm backend's `environment`. */
+const CLOUD_ENDPOINTS = {
+    public: { storage: "core.windows.net", authority: AZURE_AUTHORITY },
+    china: { storage: "core.chinacloudapi.cn", authority: "https://login.chinacloudapi.cn" },
+    usgovernment: { storage: "core.usgovcloudapi.net", authority: "https://login.microsoftonline.us" },
+};
+/**
+ * An azurerm backend's state: the blob `key` in `container_name` of
+ * `storage_account_name`, `<key>env:<workspace>` in another workspace, with
+ * the credentials the backend would use: `access_key` (ARM_ACCESS_KEY),
+ * `sas_token` (ARM_SAS_TOKEN), else the job's OIDC identity. An
+ * `environment` other than public, china or usgovernment is refused: its
+ * storage suffix would need the metadata lookup terragucci makes and chant
+ * does not.
+ */
+function azureObject(c, ws, env) {
+    const account = str(c.storage_account_name);
+    const container = str(c.container_name);
+    const base = str(c.key);
+    if (!account || !container || !base)
+        return { backend: "azurerm", refused: "config", reason: "the azurerm backend's storage_account_name, container_name or key is not in the configuration init recorded" };
+    const key = ws === "default" ? base : `${base}env:${ws}`;
+    const cloud = CLOUD_ENDPOINTS[str(c.environment) ?? env.ARM_ENVIRONMENT ?? "public"];
+    if (!cloud)
+        return { backend: "azurerm", refused: "config", reason: `the azurerm backend's environment ${str(c.environment) ?? env.ARM_ENVIRONMENT} is not public, china or usgovernment` };
+    const accessKey = str(c.access_key) ?? env.ARM_ACCESS_KEY;
+    const sas = str(c.sas_token) ?? env.ARM_SAS_TOKEN;
+    const tenantId = str(c.tenant_id) ?? env.ARM_TENANT_ID;
+    const clientId = str(c.client_id) ?? env.ARM_CLIENT_ID;
+    const tokenFile = str(c.oidc_token_file_path) ?? env.ARM_OIDC_TOKEN_FILE_PATH;
+    let auth;
+    if (accessKey)
+        auth = { accountKey: accessKey };
+    else if (sas)
+        auth = { sas };
+    else if (tenantId && clientId && tokenFile)
+        auth = { oidc: { tenantId, clientId, tokenFile, authority: (env.AZURE_AUTHORITY_HOST || cloud.authority).replace(/\/+$/, "") } };
+    else
+        return { backend: "azurerm", refused: "credentials", reason: `the job has no credentials to read the container ${container} of ${account}: set ARM_ACCESS_KEY, ARM_SAS_TOKEN, or ARM_TENANT_ID, ARM_CLIENT_ID and ARM_OIDC_TOKEN_FILE_PATH` };
+    return { backend: "azurerm", account, container, key, snapshot: c.snapshot === true || env.ARM_SNAPSHOT === "true", endpoint: `https://${account}.blob.${cloud.storage}`, auth };
+}
+/** `s3://<bucket>/<key>`, `gs://<bucket>/<key>`, `az://<account>/<container>/<key>`, or the local file's path; undefined for a refusal. */
+export function stateLocation(o) {
+    if (isRefused(o))
+        return undefined;
+    if (o.backend === "local")
+        return o.path;
+    if (o.backend === "gcs")
+        return `gs://${o.bucket}/${o.key}`;
+    if (o.backend === "azurerm")
+        return `az://${o.account}/${o.container}/${o.key}`;
+    return `s3://${o.bucket}/${o.key}`;
+}

package/dist/state/exec.d.ts

@@ -0,0 +1,39 @@
+export interface Ran {
+    code: number;
+    stdout: string;
+    /** stdout and stderr together, as they came. */
+    out: string;
+}
+/** What a run of the binary hands back while it runs: `stderr` sees each line of stderr as it arrives, and a line it takes (true) is left out of `out`. */
+export interface BinaryIo {
+    stderr?: (line: string) => boolean;
+}
+/** How the binary runs: in `dir`, with `env`. Injectable for tests. */
+export type BinaryExec = (binary: string, args: string[], dir: string, env: NodeJS.ProcessEnv, io?: BinaryIo) => Promise<Ran>;
+/** The binary run with `-chdir=<dir>` and `TF_IN_AUTOMATION=1`. */
+export declare const runBinary: BinaryExec;
+/** A state file as `state pull` prints it (format version 4); only what a run touches is named. */
+export interface StateFile {
+    version: number;
+    terraform_version?: string;
+    serial: number;
+    lineage: string;
+    outputs?: Record<string, unknown>;
+    resources: StateResource[];
+    check_results?: unknown;
+    [k: string]: unknown;
+}
+export interface StateResource {
+    module?: string;
+    mode: string;
+    type: string;
+    name: string;
+    provider?: string;
+    instances?: unknown[];
+    [k: string]: unknown;
+}
+/** The last lines of the binary's output, on one line, for an error. */
+export declare const lastLines: (s: string, n?: number) => string;
+/** A root's state as `state pull` gives it, or null when it has none. */
+export declare function pullState(exec: BinaryExec, binary: string, root: string, dir: string, env: NodeJS.ProcessEnv): Promise<StateFile | null>;
+//# sourceMappingURL=exec.d.ts.map

package/dist/state/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/state/exec.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2JAA2J;AAC3J,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACpC;AAED,uEAAuE;AACvE,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;AAE9H,mEAAmE;AACnE,eAAO,MAAM,SAAS,EAAE,UA2CpB,CAAC;AAEL,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAED,wEAAwE;AACxE,eAAO,MAAM,SAAS,MAAO,MAAM,iBAAU,MAAgE,CAAC;AAE9G,yEAAyE;AACzE,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAc9I"}

package/dist/state/exec.js

@@ -0,0 +1,80 @@
+/**
+ * The binary a state is read and written through: `state pull` and
+ * `state push`. The exec is injectable, so a test runs none.
+ *
+ * Lifted from terragucci's `migrate.ts` (c493e0e): `Ran`, `BinaryIo`,
+ * `BinaryExec`, `runBinary`, `StateFile`, `StateResource` and `pullState`.
+ */
+import { spawn } from "node:child_process";
+/** The binary run with `-chdir=<dir>` and `TF_IN_AUTOMATION=1`. */
+export const runBinary = (binary, args, dir, env, io) => new Promise((done) => {
+    const child = spawn(binary, [`-chdir=${dir}`, ...args], { env: { ...env, TF_IN_AUTOMATION: "1" }, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let out = "";
+    let partial = "";
+    const stderrLine = (line) => {
+        let taken = false;
+        try {
+            taken = io.stderr(line);
+        }
+        catch {
+            taken = false;
+        }
+        if (!taken)
+            out += `${line}\n`;
+    };
+    child.stdout.on("data", (d) => {
+        stdout += d;
+        out += d;
+    });
+    // A line split across two chunks, a character too, is put back together before it is read.
+    if (io?.stderr)
+        child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (d) => {
+        if (!io?.stderr) {
+            out += d;
+            return;
+        }
+        partial += d;
+        const lines = partial.split("\n");
+        partial = lines.pop();
+        for (const l of lines)
+            stderrLine(l);
+    });
+    const rest = () => {
+        if (io?.stderr && partial)
+            stderrLine(partial);
+        partial = "";
+    };
+    child.on("error", (e) => {
+        rest();
+        done({ code: 127, stdout, out: `${out}${e.message}` });
+    });
+    child.on("close", (code) => {
+        rest();
+        done({ code: code ?? 1, stdout, out });
+    });
+});
+/** The last lines of the binary's output, on one line, for an error. */
+export const lastLines = (s, n = 4) => s.trim().split("\n").slice(-n).join(" ").slice(0, 400);
+/** A root's state as `state pull` gives it, or null when it has none. */
+export async function pullState(exec, binary, root, dir, env) {
+    const pulled = await exec(binary, ["state", "pull"], dir, env);
+    if (pulled.code !== 0)
+        throw new Error(`state pull in ${root} failed: ${lastLines(pulled.out)}`);
+    if (!pulled.stdout.trim())
+        return null;
+    let s;
+    try {
+        s = JSON.parse(pulled.stdout);
+    }
+    catch {
+        throw new Error(`state pull in ${root} printed something that is not a state`);
+    }
+    if (!Array.isArray(s.resources))
+        s.resources = [];
+    // A backend with no state object yet prints an empty state with no lineage: that is no state.
+    if (!s.lineage && !s.serial && s.resources.length === 0)
+        return null;
+    return s;
+}

package/dist/state/gcs.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The Google Cloud Storage client a gcs backend's state uses: chant core's
+ * (#4554, `@intentius/chant/object-store`), over the JSON API with `fetch`
+ * and `node:crypto`. Writes are conditional on a generation
+ * (`ifGenerationMatch`); a lost write is a 412, a StoreConflict.
+ */
+export { GCS_ENDPOINT, GcsClient, IAM_CREDENTIALS, selfSignedJwt, type GcsTarget } from "@intentius/chant/object-store";
+//# sourceMappingURL=gcs.d.ts.map

package/dist/state/gcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcs.d.ts","sourceRoot":"","sources":["../../src/state/gcs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/state/gcs.js

@@ -0,0 +1,7 @@
+/**
+ * The Google Cloud Storage client a gcs backend's state uses: chant core's
+ * (#4554, `@intentius/chant/object-store`), over the JSON API with `fetch`
+ * and `node:crypto`. Writes are conditional on a generation
+ * (`ifGenerationMatch`); a lost write is a 412, a StoreConflict.
+ */
+export { GCS_ENDPOINT, GcsClient, IAM_CREDENTIALS, selfSignedJwt } from "@intentius/chant/object-store";

package/dist/state/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A root's state for a composed run (#4437): where it is, its lock, its pull
+ * and its write, and the unwritten keep. Plain lexicon code, lifted from
+ * terragucci at c493e0e.
+ */
+export * from "./object-store.js";
+export * from "./backend.js";
+export * from "./store.js";
+export * from "./exec.js";
+export * from "./locks.js";
+export * from "./root-states.js";
+export { S3Client, s3FromEnv, type S3Target } from "./s3.js";
+export { GcsClient, type GcsTarget } from "./gcs.js";
+export { AzureBlobClient, type AzureTarget } from "./azure-blob.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/state/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,SAAS,CAAC;AACxB,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,MAAM,MAAM,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/state/index.js

@@ -0,0 +1,14 @@
+/**
+ * A root's state for a composed run (#4437): where it is, its lock, its pull
+ * and its write, and the unwritten keep. Plain lexicon code, lifted from
+ * terragucci at c493e0e.
+ */
+export * from "./object-store.js";
+export * from "./backend.js";
+export * from "./store.js";
+export * from "./exec.js";
+export * from "./locks.js";
+export * from "./root-states.js";
+export { S3Client, s3FromEnv } from "./s3.js";
+export { GcsClient } from "./gcs.js";
+export { AzureBlobClient } from "./azure-blob.js";