@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/dist/state/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../src/state/s3.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAA8B,KAAK,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAE1F,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAElK;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,QAAQ,CAEtH"}

package/dist/state/s3.js

@@ -0,0 +1,19 @@
+/**
+ * The S3 client a state's lock and write use: chant core's (#4554,
+ * `@intentius/chant/object-store`), which signs with chant's one AWS
+ * signer. Get, put, put only when absent, head and delete one object; with
+ * no static keys, a role is assumed with the job's OIDC token through STS
+ * AssumeRoleWithWebIdentity.
+ */
+import { s3FromEnv as coreS3FromEnv } from "@intentius/chant/object-store";
+export { assumeRoleWithWebIdentity, S3Client, sign } from "@intentius/chant/object-store";
+/**
+ * The target for `bucket` from the AWS environment variables. Credentials,
+ * first match wins: static keys in `AWS_ACCESS_KEY_ID` and
+ * `AWS_SECRET_ACCESS_KEY`; `AWS_ROLE_ARN` assumed with the token in
+ * `AWS_WEB_IDENTITY_TOKEN_FILE`, in a session named `chant-state` unless
+ * AWS_ROLE_SESSION_NAME names one.
+ */
+export function s3FromEnv(where, env = process.env) {
+    return coreS3FromEnv({ ...where, sessionName: "chant-state", setting: "the state bucket" }, env);
+}

package/dist/state/store.d.ts

@@ -0,0 +1,51 @@
+import type { LockableState } from "./backend.js";
+import { type StoreFetch } from "./object-store.js";
+/** The lock a state's backend holds: the ID `force-unlock` takes, and the lock info the binary (or a run) wrote. */
+export interface LockHolder {
+    id: string;
+    /** The lock info as written, JSON. */
+    info: string;
+}
+/** A state where it is, for what locks it and keeps beside it. */
+export interface StateStore {
+    readonly backend: LockableState["backend"];
+    /** Where the state is. */
+    readonly location: string;
+    /** Where its lock is: the lock object, or the blob whose lease is the lock. */
+    readonly lockLocation: string;
+    /** The lock the backend holds now, or undefined. */
+    heldLock(): Promise<LockHolder | undefined>;
+    /** Take the state's lock with `info`, the way the backend takes it: false when it is held. */
+    lock(info: string): Promise<boolean>;
+    /** Release the lock `lock` took, or the one `adopt` took over. */
+    unlock(): Promise<void>;
+    /**
+     * Write a new state under the lock, for a backend whose lock keeps the
+     * binary from writing (azurerm's lease); undefined for a backend the
+     * binary writes with `-lock=false` while the run holds the lock.
+     */
+    write?: (body: string) => Promise<void>;
+    /**
+     * The object beside the state whose key is the state's with `suffix` after
+     * it, in the same bucket, container or directory, under the state's own
+     * access controls: read (undefined when there is none), written, removed.
+     */
+    readBeside(suffix: string): Promise<string | undefined>;
+    writeBeside(suffix: string, body: string): Promise<void>;
+    removeBeside(suffix: string): Promise<void>;
+    /** Where the object beside the state with `suffix` is, for messages. */
+    besideLocation(suffix: string): string;
+    /**
+     * Take over a lock this store finds held, which an earlier run of the same
+     * operation left held on purpose: `unlock` then releases it. A lease
+     * (azurerm) is taken over by its ID, the others need nothing.
+     */
+    adopt(held: LockHolder): void;
+}
+/** The ID in a lock info's JSON, or "" when it names none. */
+export declare function lockId(text: string): string;
+/** The metadata an azurerm backend keeps a lock's info in, base64 JSON, on the leased blob. */
+export declare const LOCK_METADATA = "terraformlockid";
+/** The store a state is in, opened with the credentials stateObject chose. `dir` is the root a local path is relative to. */
+export declare function stateStore(o: LockableState, dir: string, fetchFn?: StoreFetch): StateStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/state/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/state/store.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAoC,aAAa,EAAW,MAAM,WAAW,CAAC;AAE1F,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG7D,oHAAoH;AACpH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,0BAA0B;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC5C,8FAA8F;IAC9F,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,kEAAkE;IAClE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC;;;;OAIG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wEAAwE;IACxE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CAC/B;AAED,8DAA8D;AAC9D,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3C;AAiDD,+FAA+F;AAC/F,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAsF/C,6HAA6H;AAC7H,wBAAgB,UAAU,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,UAAU,CAK1F"}

package/dist/state/store.js

@@ -0,0 +1,185 @@
+/**
+ * A state where it is, opened for its lock and for what a run keeps beside
+ * it. Each backend locks its own way:
+ *
+ *   s3       the lock file `use_lockfile` takes, `<key>.tflock`, written only
+ *            when absent
+ *   gcs      the lock object `<prefix>/<workspace>.tflock`, written only when
+ *            absent; the ID `force-unlock` takes is its generation
+ *   azurerm  a lease on the state blob, with the lock info base64 in its
+ *            `terraformlockid` metadata; the binary cannot write the blob
+ *            while chant holds the lease, so the store writes it
+ *   local    a lock file `<path>.tflock` beside the state, created only when
+ *            absent. It keeps another chant run out; the binary's own local
+ *            lock is a file lock it takes per command, so the run writes
+ *            with `-lock=false` while it holds this one. A bare
+ *            `terraform apply` on the same checkout at the same time is not
+ *            kept out. Ruled on #4481 (ruling 4, 2026-10-25): chant's own
+ *            lock file, no Terraform lock-info file, local backends allowed.
+ *
+ * Lifted from terragucci's `backend.ts` (c493e0e): `StateStore`, `s3Store`,
+ * `gcsStore` and `azureStore`, plus a local store and `removeBeside`.
+ */
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join } from "node:path";
+import { AzureBlobClient } from "./azure-blob.js";
+import { GcsClient } from "./gcs.js";
+import { StoreError } from "./object-store.js";
+import { S3Client } from "./s3.js";
+/** The ID in a lock info's JSON, or "" when it names none. */
+export function lockId(text) {
+    try {
+        const v = JSON.parse(text);
+        return typeof v.ID === "string" ? v.ID : "";
+    }
+    catch {
+        return "";
+    }
+}
+const JSON_TYPE = "application/json";
+/** The S3 state, locked by the lock file `use_lockfile` takes. */
+function s3Store(o, fetchFn) {
+    const client = new S3Client(o.target, fetchFn);
+    const lockKey = `${o.key}.tflock`;
+    return {
+        backend: "s3",
+        location: `s3://${o.bucket}/${o.key}`,
+        lockLocation: `s3://${o.bucket}/${lockKey}`,
+        heldLock: async () => {
+            const text = await client.get(lockKey);
+            return text === undefined ? undefined : { id: lockId(text), info: text };
+        },
+        lock: (info) => client.putIfAbsent(lockKey, info, JSON_TYPE),
+        unlock: () => client.remove(lockKey),
+        readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+        writeBeside: async (suffix, body) => void (await client.put(`${o.key}${suffix}`, body, JSON_TYPE)),
+        removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+        besideLocation: (suffix) => `s3://${o.bucket}/${o.key}${suffix}`,
+        adopt: () => { },
+    };
+}
+/** The GCS state, locked by `<prefix>/<workspace>.tflock`, whose generation is the lock's ID. */
+function gcsStore(o, fetchFn) {
+    const client = new GcsClient(o.target, fetchFn);
+    return {
+        backend: "gcs",
+        location: `gs://${o.bucket}/${o.key}`,
+        lockLocation: `gs://${o.bucket}/${o.lock}`,
+        heldLock: async () => {
+            const head = await client.head(o.lock);
+            const info = head.exists ? await client.get(o.lock) : undefined;
+            if (!head.exists || info === undefined)
+                return undefined;
+            return { id: head.generation ?? lockId(info), info };
+        },
+        lock: (info) => client.putIfAbsent(o.lock, info, JSON_TYPE),
+        unlock: () => client.remove(o.lock),
+        readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+        writeBeside: async (suffix, body) => void (await client.put(`${o.key}${suffix}`, body, JSON_TYPE)),
+        removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+        besideLocation: (suffix) => `gs://${o.bucket}/${o.key}${suffix}`,
+        adopt: () => { },
+    };
+}
+/** The metadata an azurerm backend keeps a lock's info in, base64 JSON, on the leased blob. */
+export const LOCK_METADATA = "terraformlockid";
+/** The azurerm state blob, locked by a lease on it with the lock info in its metadata. */
+function azureStore(o, fetchFn) {
+    const client = new AzureBlobClient({ account: o.account, container: o.container, endpoint: o.endpoint, ...o.auth }, fetchFn);
+    let leaseId;
+    const at = `az://${o.account}/${o.container}/${o.key}`;
+    return {
+        backend: "azurerm",
+        location: at,
+        lockLocation: at,
+        heldLock: async () => {
+            const head = await client.head(o.key);
+            if (!head.exists || head.leaseState !== "leased")
+                return undefined;
+            const meta = head.metadata[LOCK_METADATA];
+            const info = meta ? Buffer.from(meta, "base64").toString("utf-8") : "";
+            return { id: lockId(info), info };
+        },
+        lock: async (info) => {
+            const id = lockId(info);
+            // The backend leases a blob that is there: a state with none yet gets an empty one first, as the backend makes it.
+            if (!(await client.head(o.key)).exists)
+                await client.putBlob(o.key, "", JSON_TYPE, { ifNoneMatch: true });
+            if (!(await client.lease(o.key, "acquire", id)))
+                return false;
+            leaseId = id;
+            await client.setMetadata(o.key, { [LOCK_METADATA]: Buffer.from(info).toString("base64") }, id);
+            return true;
+        },
+        unlock: async () => {
+            if (!leaseId)
+                return;
+            const id = leaseId;
+            await client.setMetadata(o.key, {}, id);
+            await client.lease(o.key, "release", id);
+            leaseId = undefined;
+        },
+        write: async (body) => {
+            if (!leaseId)
+                throw new StoreError(`${at} is written under its lease, and none is held`);
+            // As the backend writes it: a snapshot first when it takes snapshots, and the lock info kept on the blob.
+            if (o.snapshot && (await client.head(o.key)).exists)
+                await client.snapshot(o.key);
+            const meta = (await client.head(o.key)).metadata;
+            await client.putBlob(o.key, body, JSON_TYPE, { leaseId, metadata: meta });
+        },
+        readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+        writeBeside: async (suffix, body) => void (await client.putBlob(`${o.key}${suffix}`, body, JSON_TYPE)),
+        removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+        besideLocation: (suffix) => `${at}${suffix}`,
+        adopt: (held) => {
+            leaseId = held.id;
+        },
+    };
+}
+/** A local state, locked by `<path>.tflock` created only when absent. `dir` is the root the path is relative to. */
+function localStore(o, dir) {
+    const file = isAbsolute(o.path) ? o.path : join(dir, o.path);
+    const lockFile = `${file}.tflock`;
+    const read = (f) => (existsSync(f) ? readFileSync(f, "utf-8") : undefined);
+    return {
+        backend: "local",
+        location: file,
+        lockLocation: lockFile,
+        heldLock: async () => {
+            const text = read(lockFile);
+            return text === undefined ? undefined : { id: lockId(text), info: text };
+        },
+        lock: async (info) => {
+            mkdirSync(dirname(lockFile), { recursive: true });
+            try {
+                writeFileSync(lockFile, info, { flag: "wx" });
+                return true;
+            }
+            catch (e) {
+                if (e.code === "EEXIST")
+                    return false;
+                throw e;
+            }
+        },
+        unlock: async () => rmSync(lockFile, { force: true }),
+        readBeside: async (suffix) => read(`${file}${suffix}`),
+        writeBeside: async (suffix, body) => {
+            mkdirSync(dirname(file), { recursive: true });
+            writeFileSync(`${file}${suffix}`, body);
+        },
+        removeBeside: async (suffix) => rmSync(`${file}${suffix}`, { force: true }),
+        besideLocation: (suffix) => `${file}${suffix}`,
+        adopt: () => { },
+    };
+}
+/** The store a state is in, opened with the credentials stateObject chose. `dir` is the root a local path is relative to. */
+export function stateStore(o, dir, fetchFn) {
+    if (o.backend === "s3")
+        return s3Store(o, fetchFn);
+    if (o.backend === "gcs")
+        return gcsStore(o, fetchFn);
+    if (o.backend === "azurerm")
+        return azureStore(o, fetchFn);
+    return localStore(o, dir);
+}

package/dist/state-ops.d.ts

@@ -0,0 +1,255 @@
+import type { Capability } from "@intentius/chant/components/capability";
+import type { ChangeSetPart } from "@intentius/chant/change-set";
+import { finishGatedRequest, readGatedRequests, requestGate, spendGatedRequest, type GatedRequest, type GatedRequestRules, type RequestGateInput, type RequestGateResult } from "@intentius/chant/lifecycle/gated-request";
+import { type BinaryExec } from "./state/exec.js";
+/** The ops the gated requests of this module wait at, one per kind, as terragucci named them. */
+export declare const STATE_OPS: {
+    readonly unlock: "tf-unlock";
+    readonly migrate: "tf-migrate";
+    readonly export: "tf-state-export";
+};
+/** The request kinds of #4551's design. */
+export declare const STATE_OP_KINDS: {
+    readonly unlock: "unlock";
+    readonly migrate: "migrate";
+    readonly export: "state-export";
+};
+/** A binary run that exited non-zero, with the tail of its output. */
+export declare class StateOpError extends Error {
+    readonly root: string;
+    readonly command: string;
+    readonly code: number;
+    readonly tail: string;
+    constructor(root: string, command: string, code: number, tail: string);
+}
+/** A gated operation stopped for a person: its request waits for an approval. The command that ran it exits 3. */
+export declare class StateOpWaitingError extends Error {
+    readonly op: string;
+    readonly subject: string;
+    readonly digest: string;
+    readonly command: string;
+    readonly exitCode: 3;
+    constructor(op: string, subject: string, digest: string, command: string);
+}
+/** Where and how the binary runs for one root. */
+export interface RootRun {
+    /** The root's name, as messages and records name it. */
+    root: string;
+    binary: string;
+    /** The root's directory. */
+    dir: string;
+    env?: NodeJS.ProcessEnv;
+    exec?: BinaryExec;
+}
+/** `init -input=false -no-color`, with `-reconfigure` and `-backend-config` pairs when given. */
+export declare function initRoot(r: RootRun & {
+    backendConfig?: Record<string, string>;
+    reconfigure?: boolean;
+}): Promise<void>;
+/**
+ * Release the state lock with this ID: `force-unlock -force -no-color <id>`.
+ * Run it under {@link gatedStateOp}; the binary releases whichever lock has
+ * the ID, so the approval binds the ID and the lock's location.
+ */
+export declare function forceUnlockState(r: RootRun & {
+    id: string;
+}): Promise<void>;
+/**
+ * Write a state file with `state push`. `lock: false` passes `-lock=false`,
+ * for a caller that holds the state's lock itself; `force` passes `-force`,
+ * for a push over an empty state of another lineage the caller checked.
+ */
+export declare function pushStateFile(r: RootRun & {
+    file: string;
+    lock?: boolean;
+    force?: boolean;
+}): Promise<void>;
+/** A plan read back: its JSON, and the binary's summary line. */
+export interface PlanRead {
+    planFile: string;
+    json: unknown;
+    summary: string;
+}
+/**
+ * Plan a root against its state and read the plan: the check a migration
+ * makes before and after it writes. `lock: false` passes `-lock=false`, for a
+ * caller that holds the lock itself.
+ */
+export declare function planStateCheck(r: RootRun & {
+    planFile: string;
+    lock?: boolean;
+}): Promise<PlanRead>;
+/** A copy's plan: the plan read back, and its change-set part with the member's plan digest. */
+export interface CopyPlanRead extends PlanRead {
+    part: ChangeSetPart;
+    planDigest: string;
+}
+/**
+ * Initialise a root under its copy's backend settings and plan it, a destroy
+ * with `destroy`. `backendConfig` is what makes it the copy (a state key with
+ * the copy's suffix), so it is required and never empty: without it the plan
+ * would be of the root's own state. Pass `init: false` for a root another
+ * tool initialised (a Terragrunt unit prepared with the suffix set).
+ */
+export declare function planCopy(r: RootRun & {
+    backendConfig: Record<string, string>;
+    planFile: string;
+    destroy?: boolean;
+    lockTimeout?: string | false;
+    init?: boolean;
+}): Promise<CopyPlanRead>;
+/** Apply a saved plan, and nothing else: `apply -input=false -no-color <plan>`. */
+export declare function applyPlanFile(r: RootRun & {
+    planFile: string;
+    lockTimeout?: string | false;
+}): Promise<void>;
+/** The gated-request ledger, injectable for tests. Default chant's on `chant/lifecycle`. */
+export interface GatedRequestLedger {
+    requestGate: typeof requestGate;
+    spendGatedRequest: typeof spendGatedRequest;
+    finishGatedRequest: typeof finishGatedRequest;
+    readGatedRequests: typeof readGatedRequests;
+}
+/**
+ * The time a request was first asked, so asking again binds the same
+ * digest: chant's digest covers `at`, and a run that asked anew each time
+ * would never meet the approval of the last one. The newest standing,
+ * unspent request with the same kind, subject, requester and fields gives
+ * its `at`; with none, `now`.
+ */
+export declare function requestedAt(op: string, request: Omit<GatedRequest, "at">, options?: {
+    now?: string;
+    cwd?: string;
+    ledger?: Pick<GatedRequestLedger, "readGatedRequests">;
+}): Promise<string>;
+/** The digest `requestGate` puts in `fields.proof` for an attachment. */
+export declare const attachmentDigest: (attachment: string) => string;
+export interface GatedStateOpInput {
+    op: string;
+    /** The request, less `at`, which {@link requestedAt} fills. */
+    request: Omit<GatedRequest, "at"> & {
+        at?: string;
+    };
+    rules: GatedRequestRules;
+    description?: string;
+    expiry?: string;
+    base?: string;
+    /** A document the request carries, such as a migration's proof; its digest joins the request. */
+    attachment?: string;
+    cwd?: string;
+    now?: string;
+    runId?: string;
+    commit?: string;
+    ledger?: GatedRequestLedger;
+    gates?: RequestGateInput["gates"];
+    /**
+     * A last check just before the spend, for a fact that can change while the
+     * request waited (a run that may hold the lock came back). A string refuses
+     * the operation with that reason, and the approval is not spent.
+     */
+    beforeSpend?: () => Promise<string | undefined>;
+}
+/** How a gated operation ended. */
+export type GatedStateOpResult<T> = Exclude<RequestGateResult, {
+    status: "approved";
+}> | {
+    status: "held";
+    digest: string;
+    request: GatedRequest;
+    reason: string;
+} | {
+    status: "done";
+    digest: string;
+    request: GatedRequest;
+    approvedBy: string;
+    output: T;
+    recorded: boolean;
+} | {
+    status: "failed";
+    digest: string;
+    request: GatedRequest;
+    approvedBy: string;
+    error: Error;
+    recorded: boolean;
+};
+/**
+ * Run `act` once its request is approved: ask (or read) the request, spend
+ * the approval, act, and record how it ended. `act` returns its output and
+ * the flat facts that go on the finished line. A spend that cannot be pushed
+ * throws before `act` runs, so no approval acts twice. A finished line that
+ * cannot be written is reported as `recorded: false`; the act already ran.
+ */
+export declare function gatedStateOp<T>(input: GatedStateOpInput, act: (approved: {
+    digest: string;
+    request: GatedRequest;
+    approvedBy: string;
+}) => Promise<{
+    output: T;
+    detail?: Record<string, string | number | boolean>;
+}>): Promise<GatedStateOpResult<T>>;
+/** The digest a request binds, for a caller that prints it before it asks. */
+export declare const stateOpDigest: (op: string, request: GatedRequest) => string;
+/** The step input the gated capabilities share: the root and the request's rules. */
+interface GatedRootInput {
+    root: string;
+    /** The project's directory, where the ledger is and roots are found. Default the process's. */
+    cwd?: string;
+    /** The root's directory. Default `root` under the project. */
+    dir?: string;
+    binary?: string;
+    /** Who asks. Default the CI actor, else the user. */
+    by?: string;
+    /** Which approvals count. Default the ledger's. */
+    approval?: GatedRequestRules["mode"];
+}
+/** `terraform-state-unlock`: release one lock, by ID, under a gated request. */
+export interface StateUnlockStepInput extends GatedRootInput {
+    id: string;
+    /** Where the lock is, as the record names it: the lock file, the lock object, the lease's blob. */
+    location: string;
+}
+/** `terraform-state-push`: write state files to their roots under one gated request whose attachment is the proof. */
+export interface StatePushStepInput extends GatedRootInput {
+    files: Array<{
+        root: string;
+        dir?: string;
+        file: string;
+        lock?: boolean;
+        force?: boolean;
+    }>;
+    /** The proof the approval binds: what the push writes and why it is safe. */
+    proof: string;
+}
+/** `terraform-copy`: plan and apply a root's copy under its own backend settings. */
+export interface CopyStepInput {
+    root: string;
+    cwd?: string;
+    dir?: string;
+    binary?: string;
+    backendConfig: Record<string, string>;
+    destroy?: boolean;
+    lockTimeout?: string | false;
+}
+export declare const terraformStateUnlockCapability: Capability<StateUnlockStepInput, {
+    root: string;
+    id: string;
+}>;
+export declare const terraformStatePushCapability: Capability<StatePushStepInput, {
+    roots: string[];
+}>;
+export declare const terraformCopyCapability: Capability<CopyStepInput, {
+    root: string;
+    planDigest: string;
+}>;
+/** The state operations' capabilities, for the plugin's registry. */
+export declare const terraformStateOpCapabilities: readonly [Capability<StateUnlockStepInput, {
+    root: string;
+    id: string;
+}>, Capability<StatePushStepInput, {
+    roots: string[];
+}>, Capability<CopyStepInput, {
+    root: string;
+    planDigest: string;
+}>];
+export {};
+//# sourceMappingURL=state-ops.d.ts.map

package/dist/state-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-ops.d.ts","sourceRoot":"","sources":["../src/state-ops.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,wCAAwC,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAErE,iGAAiG;AACjG,eAAO,MAAM,SAAS;aACpB,MAAM,EAAE,WAAW;aACnB,OAAO,EAAE,YAAY;aACrB,MAAM,EAAE,iBAAiB;CACjB,CAAC;AAEX,2CAA2C;AAC3C,eAAO,MAAM,cAAc;aACzB,MAAM,EAAE,QAAQ;aAChB,OAAO,EAAE,SAAS;aAClB,MAAM,EAAE,cAAc;CACd,CAAC;AAEX,sEAAsE;AACtE,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJvB,YACW,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAItB;CACF;AAED,kHAAkH;AAClH,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,EAAE,EAAE,MAAM;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM;IAL1B,QAAQ,CAAC,QAAQ,IAAsB;IACvC,YACW,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAIzB;CACF;AAED,kDAAkD;AAClD,MAAM,WAAW,OAAO;IACtB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAWD,iGAAiG;AACjG,wBAAsB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5H;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjF;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjH;AAED,iEAAiE;AACjE,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEnG;AAED,gGAAgG;AAChG,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,CAAC,EAAE,OAAO,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACxI,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAElH;AAID,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,OAAO,WAAW,CAAC;IAChC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;CAC7C;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EACjC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAA;CAAO,GACnG,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MAA2E,CAAC;AAElI,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACjD;AAED,mCAAmC;AACnC,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAC5B,OAAO,CAAC,iBAAiB,EAAE;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC,GAClD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAC3G;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAErH;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,CAAC,QAAQ,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;CAAE,CAAC,GAC3J,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAgDhC;AAED,8EAA8E;AAC9E,eAAO,MAAM,aAAa,OAAQ,MAAM,WAAW,YAAY,KAAG,MAAyC,CAAC;AAI5G,qFAAqF;AACrF,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,QAAQ,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sHAAsH;AACtH,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC9B;AAsBD,eAAO,MAAM,8BAA8B,EAAE,UAAU,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAgBzG,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,UAAU,CAAC,kBAAkB,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAqB5F,CAAC;AAQF,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiBnG,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,4BAA4B;UAnE6C,MAAM;QAAM,MAAM;;WAkBrB,MAAM,EAAE;;UA6BnB,MAAM;gBAAc,MAAM;GAoB0C,CAAC"}