@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/README.md

@@ -1,9 +1,12 @@
 # @intentius/chant-lexicon-terraform
 
-Terraform lexicon plugin for [chant](https://github.com/intentius/chant).
+Terraform and OpenTofu lexicon for [chant](https://github.com/intentius/chant).
+It reads your roots as they are, and runs them on terraform, tofu or
+[choudoufu](https://github.com/INTENTIUS/choudoufu), an OpenTofu fork that
+keeps ownership as markers on the resources.
 
-Unlike the lexicons that generate typed resource classes from an upstream
-schema, this one reads the HCL an estate already has. Name your root modules in
+This lexicon reads the HCL an estate already has, where other lexicons
+generate typed resource classes from an upstream schema. Name your root modules in
 `chant.config.ts` and each `.tf` block joins the build as an entity, so the
 post-synth checks and `chant audit` can see the root without anything being
 written back over it.
@@ -16,7 +19,7 @@ import "@intentius/chant-lexicon-terraform";
 export default {
   lexicons: ["terraform"],
   terraform: {
-    binary: "terraform", // or "tofu"
+    binary: "terraform", // or "tofu", or "choudoufu" for ownership markers
     roots: {
       app: { dir: "./terraform", workspace: "prod", varFiles: ["prod.tfvars"] },
     },

package/dist/ci-setup.d.ts

@@ -0,0 +1,11 @@
+/** The choudoufu release the default lines install. A product's images pin their own. */
+export declare const CHOUDOUFU_CI_VERSION = "0.31.0";
+/** choudoufu into /usr/local/bin from its release archive. */
+export declare function choudoufuInstallLine(version?: string): string;
+/** Whether the project's config names choudoufu as a root's binary. */
+export declare function usesChoudoufu(dir: string): boolean;
+/** The lines for the project at `dir`. */
+export declare function terraformCiSetup(ctx: {
+    dir: string;
+}): string[];
+//# sourceMappingURL=ci-setup.d.ts.map

package/dist/ci-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-setup.d.ts","sourceRoot":"","sources":["../src/ci-setup.ts"],"names":[],"mappings":"AAcA,yFAAyF;AACzF,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,8DAA8D;AAC9D,wBAAgB,oBAAoB,CAAC,OAAO,SAAuB,GAAG,MAAM,CAI3E;AAED,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWlD;AAED,0CAA0C;AAC1C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE/D"}

package/dist/ci-setup.js

@@ -0,0 +1,41 @@
+/**
+ * The engine install lines a Terraform project's pull request pipeline runs
+ * in chant's default image (#4550, `LexiconPlugin.ciSetup`): OpenTofu, and
+ * choudoufu when a root runs it. Each line skips the install when the binary
+ * is already on PATH.
+ *
+ * Whether a root runs choudoufu is read from the text of the project's
+ * `chant.config.ts` (`binary: "choudoufu"`), never by running it, as lexicon
+ * detection reads source.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { PR_LOOP_SETUP } from "@intentius/chant/components/pr-pipeline";
+/** The choudoufu release the default lines install. A product's images pin their own. */
+export const CHOUDOUFU_CI_VERSION = "0.31.0";
+/** choudoufu into /usr/local/bin from its release archive. */
+export function choudoufuInstallLine(version = CHOUDOUFU_CI_VERSION) {
+    const arch = `$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')`;
+    const url = `https://github.com/INTENTIUS/choudoufu/releases/download/v${version}/choudoufu_v${version}_linux_${arch}.tar.gz`;
+    return `command -v choudoufu >/dev/null 2>&1 || (mkdir -p /tmp/choudoufu && curl -fsSL "${url}" | tar -xz -C /tmp/choudoufu && install "$(find /tmp/choudoufu -type f -name choudoufu | head -n 1)" /usr/local/bin/choudoufu)`;
+}
+/** Whether the project's config names choudoufu as a root's binary. */
+export function usesChoudoufu(dir) {
+    for (const name of ["chant.config.ts", "chant.config.mts", "chant.config.js"]) {
+        const file = join(dir, name);
+        if (!existsSync(file))
+            continue;
+        try {
+            if (/binary\s*:\s*["']choudoufu["']/.test(readFileSync(file, "utf-8")))
+                return true;
+        }
+        catch {
+            // unreadable: no choudoufu line
+        }
+    }
+    return false;
+}
+/** The lines for the project at `dir`. */
+export function terraformCiSetup(ctx) {
+    return [...PR_LOOP_SETUP, ...(usesChoudoufu(ctx.dir) ? [choudoufuInstallLine()] : [])];
+}

package/dist/components/capability-plugin.d.ts

@@ -22,7 +22,7 @@
  * system and refuses with exit 3 when its fresh plan differs (choudoufu
  * #878). Either refusal fails the step. choudoufu's refusal of a plan the
  * wave handed `run` throws {@link TerraformPlanMovedError}, so the command
- * that applied it exits 3 (#3997). terraform's and tofu's stale-plan error
+ * that applied it exits 4, the table's moved code (#3997, #4553). terraform's and tofu's stale-plan error
  * is not classified and exits 1.
  *
  * Run without a wave plan (`chant run --components`, or a fan-out with no
@@ -100,11 +100,34 @@
  * read the way `plan` reads a root's (`terraformPlannedOutputs`). The member
  * is not a `terraform.roots` entry of the reading project; its directory
  * comes from the workspace declaration.
+ *
+ * ## Op waves (#4545)
+ *
+ * The step is what an op wave's `step` names to plan and apply each root
+ * through chant (`chant run wave`), so terragucci's waves and plywood's run
+ * the engine in chant. Three inputs come from terragucci's wave callbacks:
+ *
+ * - `lockTimeout` (default `5m`, `false` for none): `plan` and `apply` wait
+ *   that long for another run's state lock, unless `TF_CLI_ARGS` sets
+ *   `-lock-timeout` already (`../lock-timeout.ts`).
+ * - `cone`: a revision. A live choudoufu root plans the cone of the change
+ *   since it (`plan -cone`, `../cone.ts`), and the cone's targets join the
+ *   plan digest, so an approval of one cone counts for no other. Such a root
+ *   plans with `plan`, never as a one-root set.
+ * - `reads`: vars read from another root's outputs, Atmos's
+ *   `!terraform.state` (`../state-reads.ts`). An upstream with no such output
+ *   yet makes the member a hole naming it, so the root is never planned on a
+ *   stand-in.
+ *
+ * Every plan also writes its `show -json` beside the plan file and names it
+ * as `artifact.planJson`, the document a wave's cost hold prices
+ * (`../cost-hold.ts`).
  */
 import type { Capability, PlannedOutputs } from "@intentius/chant/components/capability";
 import { type PlanShapeArtifact } from "@intentius/chant/components/covered-round";
 import { type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
 import type { EngineOutputSource, EnginePlannedOutputs } from "@intentius/chant/components/verbs/member-outputs";
+import { type TerraformStateRead } from "../state-reads.js";
 /** The `terraform-apply` step's input. */
 export interface TerraformApplyStepInput {
     /** Key into `terraform.roots`. Also the member's name in a wave's set digest. */
@@ -113,6 +136,14 @@ export interface TerraformApplyStepInput {
     vars?: Record<string, unknown>;
     /** Where the `chant.config.*` search starts. Default: the current directory. */
     cwd?: string;
+    /** The root's files from here instead of its entry's `dir` (#4542): a promote under a release sets it to the recorded copy. */
+    dir?: string;
+    /** How long `plan` and `apply` wait for a state lock (#4545). Default `"5m"`; `false` passes no flag. */
+    lockTimeout?: string | false;
+    /** choudoufu live roots (#4545): plan the cone of the change since this revision. */
+    cone?: string;
+    /** Vars read from other roots' outputs (#4545), Atmos's `!terraform.state`. The step's `vars` win over them. */
+    reads?: TerraformStateRead[];
 }
 /** What `terraform-apply` returns. `outputs` is what a dependent's `stackOutput()` reads. */
 export interface TerraformApplyStepOutput {
@@ -155,11 +186,12 @@ export interface TerraformShapeArtifact extends PlanShapeArtifact {
     kind: "terraform-apply-shape";
 }
 /**
- * choudoufu refused the plan `run` was handed by its wave (its exit 3):
- * the live system moved since the plan, or the plan names another estate.
- * Nothing was applied. `planMoved` is core's mark for a moved plan
- * (`isPlanMovedError`), so the command that applied it exits 3, as for the
- * other capabilities that refuse a moved plan (#3997).
+ * choudoufu refused the plan `run` was handed by its wave (its exit 3)
+ * because the live system moved since the plan. Nothing was applied.
+ * `planMoved` is core's mark for a moved plan (`isPlanMovedError`), so the
+ * command that applied it exits `CHANT_EXIT.moved`, 4, as for the other
+ * capabilities that refuse a moved plan (#3997, #4553). A plan made against
+ * another estate is a plain failure (`terraformExitOf` in ../exit-codes).
  */
 export declare class TerraformPlanMovedError extends Error {
     readonly root: string;
@@ -169,6 +201,8 @@ export declare class TerraformPlanMovedError extends Error {
 export declare const terraformApplyCapability: Capability<TerraformApplyStepInput, TerraformApplyStepOutput>;
 export declare const TERRAFORM_VERB_FAMILIES: {
     readonly apply: readonly ["terraform-apply"];
+    readonly state: readonly ["terraform-state-unlock", "terraform-state-push"];
+    readonly copy: readonly ["terraform-copy"];
 };
 export declare const terraformCapabilityPlugin: CapabilityPlugin;
 //# sourceMappingURL=capability-plugin.d.ts.map

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsGG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAiC,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAoBlI,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AA8CD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAerE;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAEhI;AAID;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,kBAInC,CAAC;AA4BF,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,iHAAiH;AACjH,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAqFD;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAEpB,IAAI,EAAE,MAAM;IADxC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YAA4B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxD;CACF;AA+CD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CA8ElG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;CACjB,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAcvC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAiC,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AA0BlI,OAAO,EAA0D,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGjH,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+HAA+H;IAC/H,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gHAAgH;IAChH,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAyGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAerE;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAEhI;AAID;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,kBAInC,CAAC;AA4BF,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,iHAAiH;AACjH,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAsFD;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAEpB,IAAI,EAAE,MAAM;IADxC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YAA4B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxD;CACF;AA6DD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CAmHlG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;aAEzB,KAAK,YAAG,wBAAwB,EAAE,sBAAsB;aACxD,IAAI,YAAG,gBAAgB;CACf,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAcvC,CAAC"}

package/dist/components/capability-plugin.js

@@ -22,7 +22,7 @@
  * system and refuses with exit 3 when its fresh plan differs (choudoufu
  * #878). Either refusal fails the step. choudoufu's refusal of a plan the
  * wave handed `run` throws {@link TerraformPlanMovedError}, so the command
- * that applied it exits 3 (#3997). terraform's and tofu's stale-plan error
+ * that applied it exits 4, the table's moved code (#3997, #4553). terraform's and tofu's stale-plan error
  * is not classified and exits 1.
  *
  * Run without a wave plan (`chant run --components`, or a fan-out with no
@@ -100,21 +100,92 @@
  * read the way `plan` reads a root's (`terraformPlannedOutputs`). The member
  * is not a `terraform.roots` entry of the reading project; its directory
  * comes from the workspace declaration.
+ *
+ * ## Op waves (#4545)
+ *
+ * The step is what an op wave's `step` names to plan and apply each root
+ * through chant (`chant run wave`), so terragucci's waves and plywood's run
+ * the engine in chant. Three inputs come from terragucci's wave callbacks:
+ *
+ * - `lockTimeout` (default `5m`, `false` for none): `plan` and `apply` wait
+ *   that long for another run's state lock, unless `TF_CLI_ARGS` sets
+ *   `-lock-timeout` already (`../lock-timeout.ts`).
+ * - `cone`: a revision. A live choudoufu root plans the cone of the change
+ *   since it (`plan -cone`, `../cone.ts`), and the cone's targets join the
+ *   plan digest, so an approval of one cone counts for no other. Such a root
+ *   plans with `plan`, never as a one-root set.
+ * - `reads`: vars read from another root's outputs, Atmos's
+ *   `!terraform.state` (`../state-reads.ts`). An upstream with no such output
+ *   yet makes the member a hole naming it, so the root is never planned on a
+ *   stand-in.
+ *
+ * Every plan also writes its `show -json` beside the plan file and names it
+ * as `artifact.planJson`, the document a wave's cost hold prices
+ * (`../cost-hold.ts`).
  */
-import { rmSync } from "node:fs";
+import { rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { loadChantConfigUpward } from "@intentius/chant/config";
 import { PlanShapeMovedError, planShapeDifferences, planShapeDigest, } from "@intentius/chant/components/covered-round";
 import { computePlanDigest } from "@intentius/chant/lifecycle/plan-digest";
 import { ownPackageVersion } from "@intentius/chant/components/capability-plugin";
 import { choudoufuMemberOutputs, choudoufuMemberPlanSet, choudoufuPlanSet, choudoufuWaveApply, choudoufuWaveRoot, terraformApply, terraformInit, terraformOutputs, terraformPlan, } from "../op/activities/terraform.js";
+import { terraformPlanMoved } from "../exit-codes.js";
 import { terraformPlanShape } from "../plan-shape.js";
-import { terraformChangeSetPart } from "../change-set.js";
+import { plannerForBinary, terraformChangeSetPart } from "../change-set.js";
+import { terraformDefaultLockGrain, terraformLockGrainRefusal, terraformLockRows, terraformLockRowsFromPart } from "../lock-rows.js";
 import { rootTexts } from "../compose/hcl.js";
 import { declaredVariables } from "../compose/root.js";
 import { terraformComposeGroup } from "./compose-group.js";
 import { markPlaceholderDriven, placeholderVars, waitingHole } from "./placeholder-preview.js";
-const rootArgs = (input) => ({ root: input.root, ...(input.cwd ? { cwd: input.cwd } : {}) });
+import { terraformReleaseInputs } from "./release-inputs.js";
+import { terraformTraceFacts } from "./trace-facts.js";
+import { DEFAULT_LOCK_TIMEOUT, isLockTimeout } from "../lock-timeout.js";
+import { conePlanDigest } from "../cone.js";
+import { fillStateReads, stateReadsProblems, waitingReadsReason } from "../state-reads.js";
+import { terraformStateOpCapabilities } from "../state-ops.js";
+/** The lock timeout a step's plan and apply pass (#4545). */
+function lockTimeoutOf(input) {
+    if (input.lockTimeout === false)
+        return {};
+    const value = input.lockTimeout ?? DEFAULT_LOCK_TIMEOUT;
+    if (!isLockTimeout(value))
+        throw new Error(`terraform-apply: root "${input.root}": lockTimeout "${String(value)}" is not a duration such as "5m"`);
+    return { lockTimeout: value };
+}
+/**
+ * The step's input with its `reads` filled (#4545): each upstream's outputs
+ * read once, the values under the step's own `vars`. `waiting` when an
+ * upstream has no such output yet. Throws when a state cannot be read.
+ */
+async function withReads(input) {
+    const reads = input.reads ?? [];
+    if (reads.length === 0)
+        return { input };
+    const problems = stateReadsProblems(reads);
+    if (problems.length > 0)
+        throw new Error(`terraform-apply: root "${input.root}": ${problems.join("; ")}`);
+    const filled = await fillStateReads(reads, async (root) => {
+        const at = { root, ...(input.cwd ? { cwd: input.cwd } : {}) };
+        await terraformInit(at);
+        return terraformOutputs(at);
+    });
+    if (filled.errors.length > 0)
+        throw new Error(`terraform-apply: root "${input.root}": ${filled.errors.join("; ")}`);
+    if (filled.waiting.length > 0)
+        return { waiting: waitingReadsReason(filled.waiting), upstreams: [...new Set(filled.waiting.map((w) => w.read.root))].sort() };
+    return { input: { ...input, vars: { ...filled.vars, ...(input.vars ?? {}) } } };
+}
+/** A root whose reads wait on an upstream (#4545): a hole naming it, and a digest over the root and those upstreams. */
+function waitingOnReads(ctx, input, waiting) {
+    const planDigest = computePlanDigest("terraform-apply-reads-waiting", { env: ctx.env, root: input.root, upstreams: waiting.upstreams });
+    const changeSet = {
+        member: { member: input.root, lexicon: "terraform", planner: "chant", status: "planned", planDigest, holes: [{ address: input.root, type: "terraform_root", reason: waiting.waiting }] },
+        entries: [],
+    };
+    return { member: input.root, planDigest, changeSet };
+}
+const rootArgs = (input) => ({ root: input.root, ...(input.cwd ? { cwd: input.cwd } : {}), ...(input.dir ? { dir: input.dir } : {}) });
 function requireRoot(input) {
     if (typeof input.root !== "string" || input.root === "") {
         throw new Error('terraform-apply: "root" is required and names an entry in terraform.roots');
@@ -130,12 +201,28 @@ async function planRoot(input, targets) {
         ...rootArgs(input),
         ...(input.vars ? { vars: input.vars } : {}),
         ...(targets && targets.length > 0 ? { targets } : {}),
+        ...lockTimeoutOf(input),
+        ...(input.cone && !(targets && targets.length > 0) ? { cone: input.cone } : {}),
         text: false,
     });
+    // #4545: the cone's targets join the digest, so an approval of this cone counts for no other.
+    const planDigest = conePlanDigest(planned.planDigest, planned.cone);
+    const changeSet = planned.changeSet && planDigest !== planned.planDigest ? { ...planned.changeSet, member: { ...planned.changeSet.member, planDigest } } : planned.changeSet;
+    // #4545: the plan document beside the plan file, which a wave's cost hold prices.
+    const planJson = join(planned.dir, `${planned.planFile}.json`);
+    let wrote = true;
+    try {
+        writeFileSync(planJson, JSON.stringify(planned.json));
+    }
+    catch {
+        wrote = false;
+    }
     return {
         planFile: planned.planFile,
-        planDigest: planned.planDigest,
-        ...(planned.changeSet ? { changeSet: planned.changeSet } : {}),
+        planDigest,
+        ...(wrote ? { planJson } : {}),
+        ...(planned.cone ? { cone: planned.cone } : {}),
+        ...(changeSet ? { changeSet } : {}),
         json: planned.json,
     };
 }
@@ -231,9 +318,10 @@ async function rootDir(input) {
     const start = resolve(input.cwd ?? process.cwd());
     const { config, configPath } = await loadChantConfigUpward(start);
     const terraform = config.terraform;
-    const dir = terraform?.roots?.[input.root]?.dir;
-    if (dir === undefined)
+    const declared = terraform?.roots?.[input.root]?.dir;
+    if (declared === undefined)
         return undefined;
+    const dir = input.dir ?? declared;
     return { dir: resolve(configPath ? dirname(configPath) : start, dir), ...(terraform?.binary ? { binary: terraform.binary } : {}) };
 }
 const firstLines = (err) => {
@@ -308,11 +396,12 @@ async function previewRoot(ctx, input, unresolved, targets) {
     };
 }
 /**
- * choudoufu refused the plan `run` was handed by its wave (its exit 3):
- * the live system moved since the plan, or the plan names another estate.
- * Nothing was applied. `planMoved` is core's mark for a moved plan
- * (`isPlanMovedError`), so the command that applied it exits 3, as for the
- * other capabilities that refuse a moved plan (#3997).
+ * choudoufu refused the plan `run` was handed by its wave (its exit 3)
+ * because the live system moved since the plan. Nothing was applied.
+ * `planMoved` is core's mark for a moved plan (`isPlanMovedError`), so the
+ * command that applied it exits `CHANT_EXIT.moved`, 4, as for the other
+ * capabilities that refuse a moved plan (#3997, #4553). A plan made against
+ * another estate is a plain failure (`terraformExitOf` in ../exit-codes).
  */
 export class TerraformPlanMovedError extends Error {
     constructor(root, message) {
@@ -322,8 +411,6 @@ export class TerraformPlanMovedError extends Error {
         this.name = "TerraformPlanMovedError";
     }
 }
-/** `live-wave-apply`'s exit status for a set whose plan moved (`CHOUDOUFU_WAVE_EXIT.setMoved`). */
-const CHOUDOUFU_SET_MOVED_EXIT = 3;
 function isPlannedRoot(value) {
     const v = value;
     return typeof v?.planFile === "string" && typeof v.planDigest === "string";
@@ -346,13 +433,28 @@ async function runChoudoufuWave(ctx, input, planned) {
         ctx.carry?.(input.root, applied.carry);
     if (!applied.landed) {
         const message = `terraform-apply: root "${input.root}": ${applied.message}`;
-        if (applied.exitCode === CHOUDOUFU_SET_MOVED_EXIT)
+        if (terraformPlanMoved({ command: "live-wave-apply", code: applied.exitCode }))
             throw new TerraformPlanMovedError(input.root, message);
         throw new Error(message);
     }
     const outputs = await terraformOutputs(rootArgs(input));
     return { root: input.root, planDigest: planned.planDigest, fromWavePlan: true, outputs };
 }
+/** The input a `run` that plans for itself plans with (#4545): its reads filled, or an error naming the upstream to apply first. */
+async function readsForRun(input) {
+    const read = await withReads(input);
+    if ("waiting" in read)
+        throw new Error(`terraform-apply: root "${input.root}": ${read.waiting}`);
+    return read.input;
+}
+/** The engine a root plans with (#4552): the configured binary's, else the plan's planner. */
+async function plannerOf(input, plan) {
+    const binary = (await rootDir(input).catch(() => undefined))?.binary;
+    if (binary !== undefined)
+        return plannerForBinary(binary);
+    const planner = plan?.changeSet?.member.planner;
+    return planner === "terraform" || planner === "tofu" || planner === "choudoufu" ? planner : "terraform";
+}
 export const terraformApplyCapability = {
     kind: "terraform-apply",
     // A root's apply has no undo short of applying the previous configuration,
@@ -360,27 +462,42 @@ export const terraformApplyCapability = {
     rollbackPolicy: "needs-opt-out",
     // #4300: `--target` passes through as `-target`, and the saved plan holds those addresses alone.
     targets: "accept",
-    async plan(ctx, input) {
-        requireRoot(input);
+    // #4627: `plan` refreshes the root's state before it plans unless told `-refresh=false`, which chant never passes,
+    // so `--refresh` asks for what every plan does and the digest still binds it. `-target` plans a resource with what it
+    // depends on and never what depends on it, so `--target-dependents` has nothing to map onto.
+    planFlags: {
+        refresh: "accept",
+        targetDependents: { refuse: "terraform and tofu plan a -target with what it depends on, never what depends on it, so there is no flag to widen it to its dependents; name each dependent with --target" },
+    },
+    async plan(ctx, given) {
+        requireRoot(given);
+        // #4545: a root reading an upstream's output that is not there yet is a hole naming the upstream.
+        const read = await withReads(given);
+        if ("waiting" in read)
+            return waitingOnReads(ctx, given, read);
+        const { input } = read;
         const unresolved = [...(ctx.unresolvedInputs ?? [])].sort();
         const targets = ctx.targets && ctx.targets.length > 0 ? ctx.targets : undefined;
         if (unresolved.length > 0)
             return previewRoot(ctx, input, unresolved, targets);
-        // A targeted root plans with `plan -target`, never as a choudoufu one-root set.
-        const wave = targets ? { wave: false } : await choudoufuWaveRoot({ ...rootArgs(input), ...(input.vars ? { vars: input.vars } : {}) });
+        // A targeted root plans with `plan -target`, and a cone plan with `plan -cone` (#4545), never as a choudoufu one-root set.
+        const wave = targets || input.cone ? { wave: false } : await choudoufuWaveRoot({ ...rootArgs(input), ...(input.vars ? { vars: input.vars } : {}) });
         if (wave.wave) {
             const set = await choudoufuPlanSet(rootArgs(input));
             const artifact = {
                 planDigest: set.planDigest,
                 choudoufu: { planSetFile: set.planSetFile, setDigest: set.setDigest },
+                lockRows: terraformLockRows(input.root, set.changeSet.member.scope, set.json),
             };
             return { member: input.root, planDigest: set.planDigest, artifact, changeSet: set.changeSet, outputs: terraformPlannedOutputs(set.json), shape: terraformPlanShape(set.json, input.root) };
         }
         const { changeSet, json, ...planned } = await planRoot(input, targets);
+        // #4552: a choudoufu root's rows, keyed from the plan document while it is at hand.
+        const lockRows = changeSet?.member.planner === "choudoufu" ? terraformLockRows(input.root, changeSet.member.scope, json) : undefined;
         return {
             member: input.root,
             planDigest: planned.planDigest,
-            artifact: planned,
+            artifact: { ...planned, ...(lockRows ? { lockRows } : {}) },
             ...(changeSet ? { changeSet } : {}),
             outputs: terraformPlannedOutputs(json),
             shape: terraformPlanShape(json, input.root),
@@ -397,7 +514,30 @@ export const terraformApplyCapability = {
     // #4447 (ws-107): a group core forms of components that read each other plans and applies as one composed run
     // when `terraform.compose.enabled` is set (./compose-group.ts). Delegates, so the methods are read when called.
     groupReads: (ctx, members) => terraformComposeGroup.groupReads(ctx, members),
-    groupFallback: (ctx, members) => terraformComposeGroup.groupFallback(ctx, members),
+    // #4542: a member pointed at a release's recorded copy plans alone, since a composition reads the declared roots.
+    groupFallback: async (ctx, members) => members.some((m) => typeof m.step.dir === "string")
+        ? { kind: "release-copy", reason: "a member deploys a release's recorded copy of its root, which a composition does not read" }
+        : terraformComposeGroup.groupFallback(ctx, members),
+    // #4542: the root's files, which a release cut records and a promote under it plans.
+    releaseInputs: (input, ctx) => terraformReleaseInputs(input, ctx),
+    // #4552: resource under choudoufu, the root under Terraform, tofu and Terragrunt, which refuse resource by name.
+    async defaultLockGrain(input, plan) {
+        return terraformDefaultLockGrain(await plannerOf(input, plan));
+    },
+    async lockGrainRefusal(input, grain, plan) {
+        if (grain !== "resource")
+            return undefined;
+        const binary = (await rootDir(input).catch(() => undefined))?.binary;
+        return terraformLockGrainRefusal(grain, await plannerOf(input, plan), binary);
+    },
+    lockRows(input, plan) {
+        const kept = plan.artifact?.lockRows;
+        if (Array.isArray(kept))
+            return kept;
+        return plan.changeSet ? terraformLockRowsFromPart(input.root, plan.changeSet) : [];
+    },
+    // #4555: the root and the binary, for the step's span and run record.
+    traceFacts: async (input, outcome) => terraformTraceFacts(input, outcome, (await rootDir(input).catch(() => undefined))?.binary),
     planGroup: (ctx, members) => terraformComposeGroup.planGroup(ctx, members),
     runGroup: (ctx, run, members) => terraformComposeGroup.runGroup(ctx, run, members),
     async run(ctx, input) {
@@ -407,11 +547,11 @@ export const terraformApplyCapability = {
         if (isShapeArtifact(fromWave)) {
             // A root previewed with stand-ins (#4463): plan it now with the real
             // values, and apply that plan only when it is within the preview's shape.
-            const fresh = await planRoot(input, ctx.targets);
+            const fresh = await planRoot(await readsForRun(input), ctx.targets);
             const differences = planShapeDifferences(fromWave.shape, terraformPlanShape(fresh.json, input.root));
             if (differences.length > 0)
                 throw new PlanShapeMovedError(input.root, differences);
-            const applied = await terraformApply({ ...rootArgs(input), planFile: fresh.planFile });
+            const applied = await terraformApply({ ...rootArgs(input), planFile: fresh.planFile, ...lockTimeoutOf(input) });
             if (!applied.applied) {
                 throw new Error(`terraform-apply: root "${input.root}" refused the plan it was given (${applied.refused ?? "refused"}). ${applied.refusal ?? ""}`);
             }
@@ -420,14 +560,15 @@ export const terraformApplyCapability = {
         }
         const planned = isPlannedRoot(fromWave)
             ? fromWave
-            : await planRoot(input, ctx.targets).then(({ planFile, planDigest }) => ({ planFile, planDigest }));
-        const applied = await terraformApply({ ...rootArgs(input), planFile: planned.planFile });
+            : await planRoot(await readsForRun(input), ctx.targets).then(({ planFile, planDigest }) => ({ planFile, planDigest }));
+        const applied = await terraformApply({ ...rootArgs(input), planFile: planned.planFile, ...lockTimeoutOf(input) });
         if (!applied.applied) {
             const message = `terraform-apply: root "${input.root}" refused the plan it was given (${applied.refused ?? "refused"}). ` +
                 (applied.refusal ?? "");
-            // A plan the wave approved that choudoufu refuses moved since the
-            // approval. One this run made itself is planned afresh by the next run.
-            if (applied.refused !== undefined && isPlannedRoot(fromWave))
+            // A plan the wave approved that choudoufu refuses as no longer matching
+            // moved since the approval (#4553: one made against another estate is a
+            // failure). One this run made itself is planned afresh by the next run.
+            if (applied.refused === "approval-mismatch" && isPlannedRoot(fromWave))
                 throw new TerraformPlanMovedError(input.root, message);
             throw new Error(message);
         }
@@ -437,6 +578,9 @@ export const terraformApplyCapability = {
 };
 export const TERRAFORM_VERB_FAMILIES = {
     apply: ["terraform-apply"],
+    // #4618: the binary runs outside waves, each a fixed operation; the two that change state on their own run under a gated request.
+    state: ["terraform-state-unlock", "terraform-state-push"],
+    copy: ["terraform-copy"],
 };
 export const terraformCapabilityPlugin = {
     name: "terraform",
@@ -444,7 +588,7 @@ export const terraformCapabilityPlugin = {
         return ownPackageVersion(import.meta.url);
     },
     capabilities() {
-        return [terraformApplyCapability];
+        return [terraformApplyCapability, ...terraformStateOpCapabilities.map((c) => c)];
     },
     families() {
         return TERRAFORM_VERB_FAMILIES;

package/dist/components/compose-group.d.ts

@@ -132,7 +132,7 @@ export declare function groupFallbackOf(c: Composition, members: readonly string
  * them: `writeComposedRoot` turns those reads into literals.
  */
 export declare function outsideOutputs(members: readonly GroupMember<StepInput>[]): Record<string, Record<string, unknown>>;
-/** A composed plan that no longer matches the one approved. Core's moved-plan mark, so nothing applies and the command exits 3. */
+/** A composed plan that no longer matches the one approved. Core's moved-plan mark, so nothing applies and the command exits `CHANT_EXIT.moved`, 4 (#4553). */
 export declare class ComposedPlanMovedError extends Error {
     readonly planMoved = true;
     constructor(message: string);

package/dist/components/compose-group.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose-group.d.ts","sourceRoot":"","sources":["../../src/components/compose-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EAEnB,YAAY,EAEZ,aAAa,EACb,WAAW,EAEX,QAAQ,EACR,iBAAiB,EAClB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAG1E,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AAC3H,OAAO,EAAkF,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9H,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAI1F,wGAAwG;AACxG,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,yGAAyG;IACzG,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,eAAe,CAAC;CAC5B;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,WAAW,EAAE,WAAW,CAAC;IACzB,qEAAqE;IACrE,IAAI,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1D,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AASD,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,gGAAgG;IAChG,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,cAAc,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAC;IAChG,yDAAyD;IACzD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,6IAA6I;IAC7I,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxG,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACjH,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvG,QAAQ,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACzH;AA+BD,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,eAAe,EAAE,CAM9F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,EAC1C,MAAM,EAAE,yBAAyB,GAAG,SAAS,GAC5C,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAStD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,EAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAChD,WAAW,GAAG,SAAS,CAWzB;AAeD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAgBtH;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAYrG;AAuBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAWlH;AAiCD,mIAAmI;AACnI,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,GAAE,gBAAqB,GAAG,mBAAmB,CAoI7E;AAED,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,EAAE,mBAAoC,CAAC"}
+{"version":3,"file":"compose-group.d.ts","sourceRoot":"","sources":["../../src/components/compose-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,OAAO,KAAK,EACV,sBAAsB,EACtB,mBAAmB,EAEnB,YAAY,EAEZ,aAAa,EACb,WAAW,EAEX,QAAQ,EACR,iBAAiB,EAClB,MAAM,wCAAwC,CAAC;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAG1E,OAAO,EAA+B,KAAK,yBAAyB,EAAE,MAAM,8CAA8C,CAAC;AAC3H,OAAO,EAAkF,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9H,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAI1F,wGAAwG;AACxG,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B,yGAAyG;IACzG,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,eAAe,CAAC;CAC5B;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,WAAW,EAAE,WAAW,CAAC;IACzB,qEAAqE;IACrE,IAAI,EAAE,OAAO,CAAC;IACd,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1D,+EAA+E;IAC/E,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AASD,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IACxC,gGAAgG;IAChG,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,cAAc,CAAC;IACnD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAAC;IAChG,yDAAyD;IACzD,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,6IAA6I;IAC7I,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxG,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACjH,SAAS,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvG,QAAQ,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACzH;AA+BD,0FAA0F;AAC1F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,eAAe,EAAE,CAM9F;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,EAC1C,MAAM,EAAE,yBAAyB,GAAG,SAAS,GAC5C,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAStD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,EAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAChD,WAAW,GAAG,SAAS,CAWzB;AAeD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAgBtH;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAYrG;AAuBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAWlH;AAiCD,+JAA+J;AAC/J,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,GAAE,gBAAqB,GAAG,mBAAmB,CAoI7E;AAED,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,EAAE,mBAAoC,CAAC"}

package/dist/components/compose-group.js

@@ -251,7 +251,7 @@ function waitingGroup(ctx, members, unresolved) {
     }
     return { members: plans, digest: computePlanDigest("terraform-apply-group-unresolved", { components: ctx.components, unresolved: waits }) };
 }
-/** A composed plan that no longer matches the one approved. Core's moved-plan mark, so nothing applies and the command exits 3. */
+/** A composed plan that no longer matches the one approved. Core's moved-plan mark, so nothing applies and the command exits `CHANT_EXIT.moved`, 4 (#4553). */
 export class ComposedPlanMovedError extends Error {
     constructor(message) {
         super(message);

package/dist/components/release-inputs.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The files a release records for a `terraform-apply` step (chant#4542).
+ *
+ * The step names its root by key, so core can't see which files it deploys.
+ * `terraformReleaseInputs` answers core's `releaseInputs` with the set a
+ * pull request's plan treats as the root's change (`rootWatchPaths`): the
+ * root's directory, each local module it reaches, and its var files, plus
+ * its backend-config files. A release cut records them for the component,
+ * and a promote or rollback under the release writes them under
+ * `.chant/release-templates/<digest>/` and sets the step's `dir` to the copy
+ * of the root, so `terraform-apply` plans the release's configuration against
+ * the environment's state.
+ *
+ * A root whose state is a file in its own directory (the `local` backend) is
+ * unbound: a plan run in a copy elsewhere would read no state and propose
+ * creating everything. Such a root rolls back through `chant lifecycle
+ * rollback --to`. A live choudoufu root has no state file and is recorded.
+ */
+import type { ReleaseInputs, ReleaseInputsContext, ReleaseInputsUnbound } from "@intentius/chant/components/capability";
+/** The parts of the `terraform-apply` input this reads. */
+interface StepInput {
+    root: string;
+    cwd?: string;
+    dir?: string;
+}
+/** What a release records for one `terraform-apply` step, relative to the member's directory. Null when the root is not declared. */
+export declare function terraformReleaseInputs(input: StepInput, ctx: ReleaseInputsContext): Promise<ReleaseInputs | ReleaseInputsUnbound | null>;
+export {};
+//# sourceMappingURL=release-inputs.d.ts.map

package/dist/components/release-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-inputs.d.ts","sourceRoot":"","sources":["../../src/components/release-inputs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAOxH,2DAA2D;AAC3D,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAID,qIAAqI;AACrI,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,GAAG,oBAAoB,GAAG,IAAI,CAAC,CA+B9I"}