@intentius/chant-lexicon-terraform 0.124.57 → 0.124.59

package/dist/action-ops.d.ts

@@ -0,0 +1,148 @@
+import type { Capability } from "@intentius/chant/components/capability";
+import { type GatedRequestRules } from "@intentius/chant/lifecycle/gated-request";
+import { type BinaryExec } from "./state/exec.js";
+import { type GatedRequestLedger } from "./state-ops.js";
+/** The op an action's request waits at. */
+export declare const ACTION_OP = "tf-action";
+/** The request kind of an action. */
+export declare const ACTION_KIND = "action";
+/** The oldest Terraform that invokes an action on its own. */
+export declare const ACTION_MIN_TERRAFORM = "1.14.0";
+/** Why an action was refused before it asked for anything. */
+export type ActionRefusal = "action-engine" | "action-address" | "unknown-action";
+/** An action address `-invoke` takes: module steps, then `action.<type>.<label>`, instance keys allowed. */
+export declare const ACTION_ADDRESS: RegExp;
+/** The subject an action's request is asked and approved under: `<root>:<address>`. */
+export declare const actionSubject: (root: string, address: string) => string;
+export interface InvokeActionInput {
+    /** The root's name, as records and messages name it. */
+    root: string;
+    /** The root's directory. */
+    dir: string;
+    /** The binary. Default `terraform`. */
+    binary?: string;
+    /** Its version, when the caller knows it (an image's pin). Absent: read with `version -json` before the plan. */
+    version?: string;
+    /** The action's address: `action.<type>.<label>` or `module.<name>.action.<type>.<label>`. */
+    address: string;
+    /** Who asks. */
+    requester: string;
+    /** Which approvals count. */
+    rules: GatedRequestRules;
+    /** The commit the root is at, bound by the request. */
+    commit?: string;
+    /** The saved plan. Default `<dir>/.chant-action.tfplan`. */
+    planFile?: string;
+    lockTimeout?: string | false;
+    env?: NodeJS.ProcessEnv;
+    exec?: BinaryExec;
+    ledger?: GatedRequestLedger;
+    /** The project's directory, where the ledger is. */
+    cwd?: string;
+    now?: string;
+    runId?: string;
+    expiry?: string;
+    /**
+     * Ask anew even when the same request (same subject, requester and
+     * fields) applied already. Absent, a call that matches an applied request
+     * answers `spent`, so a retried job never runs the action twice.
+     */
+    anew?: boolean;
+}
+/** How an action call ended. `exit` is the code a command that ran it exits with. */
+export type InvokeActionResult = {
+    outcome: "refused";
+    code: ActionRefusal;
+    reason: string;
+    exit: number;
+}
+/** No approval counts yet; nothing ran past the plan. `reason` names an approval that stands and does not count. */
+ | {
+    outcome: "gated";
+    digest: string;
+    subject: string;
+    command: string;
+    reason?: string;
+    exit: number;
+}
+/** The request applied already, and a request applies once; nothing ran past the plan. */
+ | {
+    outcome: "spent";
+    digest: string;
+    subject: string;
+    exit: number;
+} | {
+    outcome: "ok";
+    digest: string;
+    subject: string;
+    approvedBy: string;
+    tail: string;
+    recorded: boolean;
+    exit: number;
+} | {
+    outcome: "failed";
+    digest: string;
+    subject: string;
+    approvedBy: string;
+    error: string;
+    tail: string;
+    recorded: boolean;
+    exit: number;
+};
+/** Whether `version` is at least {@link ACTION_MIN_TERRAFORM}. */
+export declare function invokesActions(version: string): boolean;
+/**
+ * Refuse a binary that cannot invoke an action, before any exec call when
+ * its name or the given version settles it. Undefined: it may run.
+ */
+export declare function actionEngineRefusal(root: string, binary: string, version: string | undefined): string | undefined;
+/** The plan's `action_invocations`, as a request binds them: each entry in canonical form, sorted, hashed. */
+export declare function actionInvocationsDigest(plan: unknown): string;
+/** The addresses the plan's `action_invocations` name. */
+export declare function invokedAddresses(plan: unknown): string[];
+/** An action's plan read back: the saved plan, its JSON, and the request fields it binds. */
+export interface ActionPlanRead {
+    planFile: string;
+    json: unknown;
+    fields: Record<string, string>;
+}
+/**
+ * Check the binary and the address, plan the invocation and read it back.
+ * A refusal comes back as a result; a binary run that fails throws
+ * {@link StateOpError}.
+ */
+export declare function planAction(input: InvokeActionInput): Promise<ActionPlanRead | Extract<InvokeActionResult, {
+    outcome: "refused";
+}>>;
+/**
+ * Invoke one action under a gated request: plan it, ask, and once an
+ * approval by someone other than the requester counts, spend it, apply the
+ * saved plan and record how it ended.
+ */
+export declare function invokeAction(input: InvokeActionInput): Promise<InvokeActionResult>;
+/** `terraform-action`: invoke one action of a root under a gated request. */
+export interface ActionStepInput {
+    root: string;
+    /** The action's address. */
+    address: string;
+    /** The project's directory, where the ledger is and roots are found. Default the process's. */
+    cwd?: string;
+    /** The root's directory. Default `root` under the project. */
+    dir?: string;
+    binary?: string;
+    /** The binary's version, when the step knows it. */
+    version?: string;
+    /** Who asks. Default the CI actor, else the user. */
+    by?: string;
+    /** Which approvals count. Default the ledger's. */
+    approval?: GatedRequestRules["mode"];
+    /** The commit the request binds. Default the CI's commit variable, when set. */
+    commit?: string;
+    lockTimeout?: string | false;
+}
+export declare const terraformActionCapability: Capability<ActionStepInput, {
+    root: string;
+    address: string;
+    digest: string;
+}>;
+//# sourceMappingURL=action-ops.d.ts.map

package/dist/action-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-ops.d.ts","sourceRoot":"","sources":["../src/action-ops.ts"],"names":[],"mappings":"AA2CA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,wCAAwC,CAAC;AAEzF,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAGrG,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAmD,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvG,2CAA2C;AAC3C,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,qCAAqC;AACrC,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAGlF,4GAA4G;AAC5G,eAAO,MAAM,cAAc,QAAoI,CAAC;AAEhK,uFAAuF;AACvF,eAAO,MAAM,aAAa,SAAU,MAAM,WAAW,MAAM,KAAG,MAA8B,CAAC;AAE7F,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,KAAK,EAAE,iBAAiB,CAAC;IACzB,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,oDAAoD;IACpD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3E,oHAAoH;GAClH;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACvG,0FAA0F;GACxF;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACrH;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAa7I,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAMjH;AAQD,8GAA8G;AAC9G,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAG7D;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAGxD;AASD,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC,CAAC,CAqCxI;AAcD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2DxF;AAID,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,QAAQ,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACrC,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC9B;AAqBD,eAAO,MAAM,yBAAyB,EAAE,UAAU,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAyBpH,CAAC"}

package/dist/action-ops.js

@@ -0,0 +1,270 @@
+/**
+ * A day-2 action (#4653): one Terraform `action` block invoked on its own,
+ * under a gated request on the ledger, the way a state-lock release runs
+ * (./state-ops.ts).
+ *
+ * `invokeAction` runs fixed argument lists only. The caller names the root,
+ * the binary and the action's address, never extra arguments:
+ *
+ * 1. `plan -input=false -no-color -invoke=<address> -out=<file>`, then
+ *    `show -json <file>`. The address must be one of the plan's
+ *    `action_invocations`.
+ * 2. `requestGate` under op `tf-action`, subject `<root>:<address>`. The
+ *    request's fields bind the address, the commit when given, and a digest
+ *    of the plan's `action_invocations`, so a plan whose action input moved
+ *    after the approval asks anew. Without an approval that counts (the
+ *    requester's own never does) it answers `gated`, exit 3, and runs nothing.
+ * 3. With one, `spendGatedRequest`, then `apply <file>`, then
+ *    `finishGatedRequest`. The finished line's `result` stays chant's
+ *    `applied | failed`; `detail.result` carries `ok` or `failed`, with the
+ *    exit code and the last lines of the binary's output.
+ *
+ * The address is checked before anything runs: `action.<type>.<label>`,
+ * after any number of `module.<name>.` steps, each with an optional instance
+ * key (`[0]`, `["a"]`). Terraform 1.14.9 parses a module address for
+ * `-invoke` (`addrs.ParseTargetAction` reads the module prefix first, and its
+ * tests "action invoke in module" and "action invoke in expanded module"
+ * expect success), so a templated app's root, which holds only `module
+ * "app"`, invokes `module.app.action.<type>.<label>` and needs no root-level
+ * action blocks.
+ *
+ * Only Terraform 1.14 or newer invokes an action. An OpenTofu or choudoufu
+ * binary is refused by its engine's name before any exec call (`action-engine`).
+ * A `terraform` binary is refused when its version, passed in or read with
+ * `version -json`, is older than 1.14.
+ *
+ * `-invoke` plans in refresh-only mode and refuses `-target`, so the plan
+ * changes no resource: the apply runs the action and nothing else.
+ *
+ * The exec and the ledger are injectable, so a test runs no binary and
+ * writes no ledger.
+ */
+import { createHash } from "node:crypto";
+import { basename, join } from "node:path";
+import { CHANT_EXIT } from "@intentius/chant/exit-codes";
+import { readGatedRequests } from "@intentius/chant/lifecycle/gated-request";
+import { terraformChangeSetPart } from "./change-set.js";
+import { DEFAULT_LOCK_TIMEOUT, lockTimeoutArgs } from "./lock-timeout.js";
+import { lastLines, runBinary } from "./state/exec.js";
+import { gatedStateOp, StateOpError, StateOpWaitingError } from "./state-ops.js";
+/** The op an action's request waits at. */
+export const ACTION_OP = "tf-action";
+/** The request kind of an action. */
+export const ACTION_KIND = "action";
+/** The oldest Terraform that invokes an action on its own. */
+export const ACTION_MIN_TERRAFORM = "1.14.0";
+const KEY = String.raw `\[(?:[0-9]+|"[A-Za-z0-9_-]+")\]`;
+/** An action address `-invoke` takes: module steps, then `action.<type>.<label>`, instance keys allowed. */
+export const ACTION_ADDRESS = new RegExp(String.raw `^(?:module\.[A-Za-z_][A-Za-z0-9_-]*(?:${KEY})?\.)*action\.[a-z0-9_]+\.[A-Za-z_][A-Za-z0-9_-]*(?:${KEY})?$`);
+/** The subject an action's request is asked and approved under: `<root>:<address>`. */
+export const actionSubject = (root, address) => `${root}:${address}`;
+const refused = (code, reason) => ({ outcome: "refused", code, reason, exit: CHANT_EXIT.failed });
+/** The engine a binary name runs, when it is one that has no `-invoke`. */
+function otherEngine(binary) {
+    const name = basename(binary).toLowerCase().replace(/\.exe$/, "");
+    if (name === "tofu" || name === "opentofu" || name.startsWith("tofu-") || name.startsWith("opentofu"))
+        return "OpenTofu";
+    if (name.startsWith("choudoufu"))
+        return "choudoufu";
+    if (!/^terraform([-_.]?[0-9][0-9.]*)?$/.test(name))
+        return name;
+    return undefined;
+}
+/** Whether `version` is at least {@link ACTION_MIN_TERRAFORM}. */
+export function invokesActions(version) {
+    const m = /^v?(\d+)\.(\d+)/.exec(version.trim());
+    if (!m)
+        return false;
+    const major = Number(m[1]);
+    const minor = Number(m[2]);
+    return major > 1 || (major === 1 && minor >= 14);
+}
+/**
+ * Refuse a binary that cannot invoke an action, before any exec call when
+ * its name or the given version settles it. Undefined: it may run.
+ */
+export function actionEngineRefusal(root, binary, version) {
+    const engine = otherEngine(binary);
+    const named = `${binary}${version ? ` ${version}` : ""}`;
+    if (engine)
+        return `${root}: an action runs on Terraform ${ACTION_MIN_TERRAFORM.replace(/\.0$/, "")} or newer, and this root runs ${engine} (${named}), which has no action invocation`;
+    if (version !== undefined && !invokesActions(version))
+        return `${root}: an action runs on Terraform ${ACTION_MIN_TERRAFORM.replace(/\.0$/, "")} or newer, and this root runs Terraform ${version} (${binary})`;
+    return undefined;
+}
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/** JSON with every object's keys sorted, so a digest does not follow the emitter's key order. */
+const canonical = (v) => Array.isArray(v) ? `[${v.map(canonical).join(",")}]` : isObject(v) ? `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonical(v[k])}`).join(",")}}` : JSON.stringify(v ?? null);
+/** The plan's `action_invocations`, as a request binds them: each entry in canonical form, sorted, hashed. */
+export function actionInvocationsDigest(plan) {
+    const list = isObject(plan) && Array.isArray(plan.action_invocations) ? plan.action_invocations.map(canonical).sort() : [];
+    return `sha256:${createHash("sha256").update(`[${list.join(",")}]`).digest("hex")}`;
+}
+/** The addresses the plan's `action_invocations` name. */
+export function invokedAddresses(plan) {
+    const list = isObject(plan) && Array.isArray(plan.action_invocations) ? plan.action_invocations : [];
+    return list.flatMap((inv) => (isObject(inv) && typeof inv.address === "string" ? [inv.address] : []));
+}
+async function run(input, binary, args, label) {
+    const exec = input.exec ?? runBinary;
+    const done = await exec(binary, args, input.dir, input.env ?? process.env);
+    if (done.code !== 0)
+        throw new StateOpError(input.root, `${binary} ${label}`, done.code, lastLines(done.out, 10));
+    return done;
+}
+/**
+ * Check the binary and the address, plan the invocation and read it back.
+ * A refusal comes back as a result; a binary run that fails throws
+ * {@link StateOpError}.
+ */
+export async function planAction(input) {
+    const binary = input.binary ?? "terraform";
+    const early = actionEngineRefusal(input.root, binary, input.version);
+    if (early)
+        return refused("action-engine", early);
+    if (!ACTION_ADDRESS.test(input.address)) {
+        return refused("action-address", `${input.root}: "${input.address}" is not an action address; give action.<type>.<label>, after module.<name>. for an action in a module`);
+    }
+    if (input.version === undefined) {
+        const shown = await run(input, binary, ["version", "-json"], "version -json");
+        let version = "";
+        try {
+            const v = JSON.parse(shown.stdout);
+            version = typeof v.terraform_version === "string" ? v.terraform_version : "";
+        }
+        catch {
+            version = "";
+        }
+        const late = actionEngineRefusal(input.root, binary, version || "of no known version");
+        if (late)
+            return refused("action-engine", late);
+    }
+    const planFile = input.planFile ?? join(input.dir, ".chant-action.tfplan");
+    await run(input, binary, ["plan", "-input=false", "-no-color", `-invoke=${input.address}`, `-out=${planFile}`], `plan -invoke=${input.address}`);
+    const show = await run(input, binary, ["show", "-json", planFile], "show -json");
+    let json;
+    try {
+        json = JSON.parse(show.stdout);
+    }
+    catch {
+        throw new StateOpError(input.root, `${binary} show -json`, 0, `printed no plan: ${lastLines(show.out, 10)}`);
+    }
+    const invoked = invokedAddresses(json);
+    if (!invoked.includes(input.address)) {
+        return refused("unknown-action", `${input.root}: the plan invokes ${invoked.length > 0 ? invoked.join(", ") : "no action"}, and not ${input.address}; nothing applied`);
+    }
+    const fields = { address: input.address, invocations: actionInvocationsDigest(json), ...(input.commit ? { commit: input.commit } : {}) };
+    return { planFile, json, fields };
+}
+/** The time of the newest request with these fields that applied already, so asking again answers `spent`. */
+async function appliedAt(input, subject, fields) {
+    const read = input.ledger?.readGatedRequests ?? readGatedRequests;
+    const all = await read(ACTION_OP, input.cwd ? { cwd: input.cwd } : undefined).catch(() => []);
+    const same = JSON.stringify(Object.entries(fields).sort());
+    const last = all
+        .filter((g) => g.request.kind === ACTION_KIND && g.request.subject === subject && g.request.by === input.requester)
+        .filter((g) => JSON.stringify(Object.entries(g.request.fields).sort()) === same)
+        .at(-1);
+    return last?.applied ? last.request.at : undefined;
+}
+/**
+ * Invoke one action under a gated request: plan it, ask, and once an
+ * approval by someone other than the requester counts, spend it, apply the
+ * saved plan and record how it ended.
+ */
+export async function invokeAction(input) {
+    const binary = input.binary ?? "terraform";
+    const planned = await planAction(input);
+    if ("outcome" in planned)
+        return planned;
+    const subject = actionSubject(input.root, input.address);
+    const at = input.anew ? undefined : await appliedAt(input, subject, planned.fields);
+    let tail = "";
+    const result = await gatedStateOp({
+        op: ACTION_OP,
+        request: { kind: ACTION_KIND, subject, by: input.requester, fields: planned.fields, ...(at ? { at } : {}) },
+        rules: input.rules,
+        description: `action ${input.address} on ${input.root}, requested by ${input.requester}`,
+        ...(input.expiry ? { expiry: input.expiry } : {}),
+        ...(input.cwd ? { cwd: input.cwd } : {}),
+        ...(input.now ? { now: input.now } : {}),
+        ...(input.runId ? { runId: input.runId } : {}),
+        ...(input.commit ? { commit: input.commit } : {}),
+        ...(input.ledger ? { ledger: input.ledger } : {}),
+        failedDetail: (error) => error instanceof StateOpError ? { result: "failed", exit: error.code, tail: error.tail.slice(-400), address: input.address } : { result: "failed", address: input.address },
+    }, async () => {
+        const done = await run(input, binary, ["apply", "-input=false", "-no-color", ...lockTimeoutArgs("apply", input.lockTimeout ?? DEFAULT_LOCK_TIMEOUT, input.env ?? process.env), planned.planFile], "apply");
+        tail = lastLines(done.out, 10);
+        return { output: tail, detail: { result: "ok", exit: 0, tail: tail.slice(-400), address: input.address } };
+    });
+    switch (result.status) {
+        case "waiting":
+            return { outcome: "gated", digest: result.digest, subject, command: result.command, exit: CHANT_EXIT.waiting };
+        case "refused":
+            return { outcome: "gated", digest: result.digest, subject, command: result.command, reason: result.reason, exit: CHANT_EXIT.waiting };
+        case "spent":
+            return { outcome: "spent", digest: result.digest, subject, exit: CHANT_EXIT.failed };
+        case "held":
+            // No last check is passed, so nothing holds; kept for the union.
+            return { outcome: "gated", digest: result.digest, subject, command: "", reason: result.reason, exit: CHANT_EXIT.waiting };
+        case "done":
+            return { outcome: "ok", digest: result.digest, subject, approvedBy: result.approvedBy, tail: result.output, recorded: result.recorded, exit: CHANT_EXIT.done };
+        case "failed": {
+            const e = result.error;
+            return {
+                outcome: "failed",
+                digest: result.digest,
+                subject,
+                approvedBy: result.approvedBy,
+                error: e.message,
+                tail: e instanceof StateOpError ? e.tail : tail,
+                recorded: result.recorded,
+                exit: CHANT_EXIT.failed,
+            };
+        }
+    }
+}
+const actorOf = (env) => env.GITHUB_ACTOR || env.GITLAB_USER_LOGIN || env.USER || env.USERNAME || "unknown";
+function stepInvoke(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const commit = input.commit ?? (process.env.GITHUB_SHA || process.env.CI_COMMIT_SHA || undefined);
+    return {
+        root: input.root,
+        dir: input.dir ?? join(cwd, input.root),
+        address: input.address,
+        requester: input.by ?? actorOf(process.env),
+        rules: { mode: input.approval ?? "ledger" },
+        cwd,
+        ...(input.binary ? { binary: input.binary } : {}),
+        ...(input.version ? { version: input.version } : {}),
+        ...(commit ? { commit } : {}),
+        ...(input.lockTimeout !== undefined ? { lockTimeout: input.lockTimeout } : {}),
+    };
+}
+export const terraformActionCapability = {
+    kind: "terraform-action",
+    rollbackPolicy: "none-by-design",
+    targets: { refuse: "an action is invoked by its own address" },
+    async plan(_ctx, input) {
+        const planned = await planAction(stepInvoke(input));
+        if ("outcome" in planned)
+            throw new Error(planned.reason);
+        const part = terraformChangeSetPart({ member: input.root, plan: planned.json });
+        return { member: input.root, planDigest: part.member.planDigest ?? "", changeSet: part };
+    },
+    async run(_ctx, input) {
+        const result = await invokeAction(stepInvoke(input));
+        switch (result.outcome) {
+            case "ok":
+                return { root: input.root, address: input.address, digest: result.digest };
+            case "gated":
+                throw new StateOpWaitingError(ACTION_OP, result.subject, result.digest, result.command);
+            case "spent":
+                throw new Error(`${ACTION_OP} ${result.subject}: the request ${result.digest} applied already, and a request applies once`);
+            case "refused":
+                throw new Error(result.reason);
+            case "failed":
+                throw new Error(result.error);
+        }
+    },
+};

package/dist/components/capability-plugin.d.ts

@@ -203,6 +203,7 @@ export declare const TERRAFORM_VERB_FAMILIES: {
     readonly apply: readonly ["terraform-apply"];
     readonly state: readonly ["terraform-state-unlock", "terraform-state-push"];
     readonly copy: readonly ["terraform-copy"];
+    readonly action: readonly ["terraform-action"];
 };
 export declare const terraformCapabilityPlugin: CapabilityPlugin;
 //# sourceMappingURL=capability-plugin.d.ts.map

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAiC,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AA0BlI,OAAO,EAA0D,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGjH,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+HAA+H;IAC/H,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gHAAgH;IAChH,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAyGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAerE;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAEhI;AAID;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,kBAInC,CAAC;AA4BF,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,iHAAiH;AACjH,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAsFD;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAEpB,IAAI,EAAE,MAAM;IADxC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YAA4B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxD;CACF;AA6DD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CAwHlG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;aAEzB,KAAK,YAAG,wBAAwB,EAAE,sBAAsB;aACxD,IAAI,YAAG,gBAAgB;CACf,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAcvC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAiC,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AA0BlI,OAAO,EAA0D,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIjH,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+HAA+H;IAC/H,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gHAAgH;IAChH,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAyGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAerE;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAEhI;AAID;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,kBAInC,CAAC;AA4BF,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,iHAAiH;AACjH,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAsFD;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAEpB,IAAI,EAAE,MAAM;IADxC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YAA4B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxD;CACF;AA6DD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CAwHlG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;aAEzB,KAAK,YAAG,wBAAwB,EAAE,sBAAsB;aACxD,IAAI,YAAG,gBAAgB;aAEvB,MAAM,YAAG,kBAAkB;CACnB,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAcvC,CAAC"}

package/dist/components/capability-plugin.js

@@ -145,6 +145,7 @@ import { DEFAULT_LOCK_TIMEOUT, isLockTimeout } from "../lock-timeout.js";
 import { conePlanDigest } from "../cone.js";
 import { fillStateReads, stateReadsProblems, waitingReadsReason } from "../state-reads.js";
 import { terraformStateOpCapabilities } from "../state-ops.js";
+import { terraformActionCapability } from "../action-ops.js";
 /** The lock timeout a step's plan and apply pass (#4545). */
 function lockTimeoutOf(input) {
     if (input.lockTimeout === false)
@@ -587,6 +588,8 @@ export const TERRAFORM_VERB_FAMILIES = {
     // #4618: the binary runs outside waves, each a fixed operation; the two that change state on their own run under a gated request.
     state: ["terraform-state-unlock", "terraform-state-push"],
     copy: ["terraform-copy"],
+    // #4653: one action block invoked on its own, under a gated request.
+    action: ["terraform-action"],
 };
 export const terraformCapabilityPlugin = {
     name: "terraform",
@@ -594,7 +597,7 @@ export const terraformCapabilityPlugin = {
         return ownPackageVersion(import.meta.url);
     },
     capabilities() {
-        return [terraformApplyCapability, ...terraformStateOpCapabilities.map((c) => c)];
+        return [terraformApplyCapability, ...terraformStateOpCapabilities.map((c) => c), terraformActionCapability];
     },
     families() {
         return TERRAFORM_VERB_FAMILIES;

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "fd96faaa2af8305a7195930eb1df376fa5a0ffe710227048d672d31630c5c344",
+    "manifest.json": "9d0b2a34e8ab7ef946ff820f524b61023dcbfde27bb6c087f18536fab7356b53",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "7c10245b2c3335253b48ee7d8b075d89f43116bde20313a5d1031b343fef1282",
@@ -59,5 +59,5 @@
     "rules/tf047.ts": "bfa86f85c4c5efff297280fc2f15104d6319fa96dfc444a31829fb7353224092",
     "skills/chant-terraform.md": "53dd11c7b289652f92fdaf2c03766abda46d8964e31fe709e8b142ced4f19c50"
   },
-  "composite": "da933455020d701804e48e82031f7a8cc1479bc7985240575245eef3216c34c4"
+  "composite": "2c430036fefe238c43a24320fc630c35a3430dd1cdaf4e6a54c9fac464699b0a"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.57",
+  "version": "0.124.59",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/pin/scan.d.ts

@@ -49,6 +49,11 @@ export declare class HclScanError extends Error {
 export declare function scanBlocks(text: string, file: string): ScannedBlock[];
 /** Undo HCL's string escapes, so a literal's raw text compares to the value the reader returned. */
 export declare function unescapeHcl(raw: string): string;
-/** Write a value as the content of an HCL string literal. */
+/**
+ * Write a value as the content of an HCL string literal: `\` and `"`
+ * escaped, a control character as `\n`, `\r`, `\t` or `\uNNNN`, and `${`
+ * and `%{` doubled so nothing in it is a template. The replacements are
+ * functions because a replacement string reads `$$` as one `$`.
+ */
 export declare function escapeHcl(value: string): string;
 //# sourceMappingURL=scan.d.ts.map

package/dist/pin/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/pin/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,+GAA+G;AAC/G,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAYD,0EAA0E;AAC1E,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxC;CACF;AAmID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAgCrE;AAkDD,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyB/C;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/pin/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,+GAA+G;AAC/G,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAYD,0EAA0E;AAC1E,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxC;CACF;AAmID,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAgCrE;AAkDD,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyB/C;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/C"}

package/dist/pin/scan.js

@@ -281,7 +281,17 @@ export function unescapeHcl(raw) {
     }
     return out;
 }
-/** Write a value as the content of an HCL string literal. */
+const CONTROL_ESCAPES = { "\n": "\\n", "\r": "\\r", "\t": "\\t" };
+/**
+ * Write a value as the content of an HCL string literal: `\` and `"`
+ * escaped, a control character as `\n`, `\r`, `\t` or `\uNNNN`, and `${`
+ * and `%{` doubled so nothing in it is a template. The replacements are
+ * functions because a replacement string reads `$$` as one `$`.
+ */
 export function escapeHcl(value) {
-    return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\$\{/g, "$${").replace(/%\{/g, "%%{");
+    return value
+        .replace(/[\\"]/g, (c) => `\\${c}`)
+        .replace(/[\u0000-\u001f\u007f]/g, (c) => CONTROL_ESCAPES[c] ?? `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`)
+        .replace(/\$\{/g, () => "$${")
+        .replace(/%\{/g, () => "%%{");
 }

package/dist/state-ops.d.ts

@@ -148,6 +148,11 @@ export interface GatedStateOpInput {
      * the operation with that reason, and the approval is not spent.
      */
     beforeSpend?: () => Promise<string | undefined>;
+    /**
+     * The flat facts of a failed act's finished line, beside its `error`, such
+     * as the binary's exit code and last lines (#4653). Default none.
+     */
+    failedDetail?: (error: Error) => Record<string, string | number | boolean>;
 }
 /** How a gated operation ended. */
 export type GatedStateOpResult<T> = Exclude<RequestGateResult, {

package/dist/state-ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state-ops.d.ts","sourceRoot":"","sources":["../src/state-ops.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,wCAAwC,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAErE,iGAAiG;AACjG,eAAO,MAAM,SAAS;aACpB,MAAM,EAAE,WAAW;aACnB,OAAO,EAAE,YAAY;aACrB,MAAM,EAAE,iBAAiB;CACjB,CAAC;AAEX,2CAA2C;AAC3C,eAAO,MAAM,cAAc;aACzB,MAAM,EAAE,QAAQ;aAChB,OAAO,EAAE,SAAS;aAClB,MAAM,EAAE,cAAc;CACd,CAAC;AAEX,sEAAsE;AACtE,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJvB,YACW,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAItB;CACF;AAED,kHAAkH;AAClH,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,EAAE,EAAE,MAAM;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM;IAL1B,QAAQ,CAAC,QAAQ,IAAsB;IACvC,YACW,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAIzB;CACF;AAED,kDAAkD;AAClD,MAAM,WAAW,OAAO;IACtB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAWD,iGAAiG;AACjG,wBAAsB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5H;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjF;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjH;AAED,iEAAiE;AACjE,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEnG;AAED,gGAAgG;AAChG,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,CAAC,EAAE,OAAO,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACxI,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAElH;AAID,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,OAAO,WAAW,CAAC;IAChC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;CAC7C;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EACjC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAA;CAAO,GACnG,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MAA2E,CAAC;AAElI,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACjD;AAED,mCAAmC;AACnC,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAC5B,OAAO,CAAC,iBAAiB,EAAE;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC,GAClD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAC3G;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAErH;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,CAAC,QAAQ,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;CAAE,CAAC,GAC3J,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAgDhC;AAED,8EAA8E;AAC9E,eAAO,MAAM,aAAa,OAAQ,MAAM,WAAW,YAAY,KAAG,MAAyC,CAAC;AAI5G,qFAAqF;AACrF,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,QAAQ,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sHAAsH;AACtH,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC9B;AAsBD,eAAO,MAAM,8BAA8B,EAAE,UAAU,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAgBzG,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,UAAU,CAAC,kBAAkB,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAqB5F,CAAC;AAQF,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiBnG,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,4BAA4B;UAnE6C,MAAM;QAAM,MAAM;;WAkBrB,MAAM,EAAE;;UA6BnB,MAAM;gBAAc,MAAM;GAoB0C,CAAC"}
+{"version":3,"file":"state-ops.d.ts","sourceRoot":"","sources":["../src/state-ops.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,wCAAwC,CAAC;AACzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAErE,iGAAiG;AACjG,eAAO,MAAM,SAAS;aACpB,MAAM,EAAE,WAAW;aACnB,OAAO,EAAE,YAAY;aACrB,MAAM,EAAE,iBAAiB;CACjB,CAAC;AAEX,2CAA2C;AAC3C,eAAO,MAAM,cAAc;aACzB,MAAM,EAAE,QAAQ;aAChB,OAAO,EAAE,SAAS;aAClB,MAAM,EAAE,cAAc;CACd,CAAC;AAEX,sEAAsE;AACtE,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM;IAJvB,YACW,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAItB;CACF;AAED,kHAAkH;AAClH,qBAAa,mBAAoB,SAAQ,KAAK;IAG1C,QAAQ,CAAC,EAAE,EAAE,MAAM;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM;IAL1B,QAAQ,CAAC,QAAQ,IAAsB;IACvC,YACW,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EAIzB;CACF;AAED,kDAAkD;AAClD,MAAM,WAAW,OAAO;IACtB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAWD,iGAAiG;AACjG,wBAAsB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5H;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjF;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjH;AAED,iEAAiE;AACjE,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAcD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEnG;AAED,gGAAgG;AAChG,MAAM,WAAW,YAAa,SAAQ,QAAQ;IAC5C,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAC5B,CAAC,EAAE,OAAO,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GACxI,OAAO,CAAC,YAAY,CAAC,CAQvB;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,CAAC,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAElH;AAID,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,OAAO,WAAW,CAAC;IAChC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;CAC7C;AAID;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,EACjC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAA;CAAO,GACnG,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,eAAgB,MAAM,KAAG,MAA2E,CAAC;AAElI,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,+DAA+D;IAC/D,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,KAAK,EAAE,iBAAiB,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,KAAK,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAChD;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC5E;AAED,mCAAmC;AACnC,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAC5B,OAAO,CAAC,iBAAiB,EAAE;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC,GAClD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GAC3G;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAErH;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,KAAK,EAAE,iBAAiB,EACxB,GAAG,EAAE,CAAC,QAAQ,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAA;CAAE,CAAC,GAC3J,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAgDhC;AAED,8EAA8E;AAC9E,eAAO,MAAM,aAAa,OAAQ,MAAM,WAAW,YAAY,KAAG,MAAyC,CAAC;AAI5G,qFAAqF;AACrF,UAAU,cAAc;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,QAAQ,CAAC,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sHAAsH;AACtH,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;CAC9B;AAsBD,eAAO,MAAM,8BAA8B,EAAE,UAAU,CAAC,oBAAoB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAgBzG,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,UAAU,CAAC,kBAAkB,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAqB5F,CAAC;AAQF,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAiBnG,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,4BAA4B;UAnE6C,MAAM;QAAM,MAAM;;WAkBrB,MAAM,EAAE;;UA6BnB,MAAM;gBAAc,MAAM;GAoB0C,CAAC"}

package/dist/state-ops.js

@@ -228,7 +228,7 @@ export async function gatedStateOp(input, act) {
     }
     catch (e) {
         const error = e instanceof Error ? e : new Error(String(e));
-        return { status: "failed", digest, request: asked.request, approvedBy, error, recorded: await finish("failed", { error: error.message.slice(0, 400) }) };
+        return { status: "failed", digest, request: asked.request, approvedBy, error, recorded: await finish("failed", { ...(input.failedDetail?.(error) ?? {}), error: error.message.slice(0, 400) }) };
     }
 }
 /** The digest a request binds, for a caller that prints it before it asks. */

package/dist/template/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `@intentius/chant-lexicon-terraform/template` (#4652): a template request
+ * (`@intentius/chant/template-request`) as Terraform files, an app's new
+ * root or an add-on's module call in it. Nothing here reads the disk.
+ */
+export { renderAppRoot, renderAddonCall, terraformInputType, addonFile, TemplateRenderError, APP_MODULE_NAME, APP_OUTPUT_PREFIX, APP_ROOT_FILE, } from "./render.js";
+export type { RenderAppRootOptions, RenderAddonCallOptions, RenderedFile, TemplateOutput, TemplateRenderErrorCode } from "./render.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/template/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/template/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,SAAS,EACT,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC"}

package/dist/template/index.js

@@ -0,0 +1,6 @@
+/**
+ * `@intentius/chant-lexicon-terraform/template` (#4652): a template request
+ * (`@intentius/chant/template-request`) as Terraform files, an app's new
+ * root or an add-on's module call in it. Nothing here reads the disk.
+ */
+export { renderAppRoot, renderAddonCall, terraformInputType, addonFile, TemplateRenderError, APP_MODULE_NAME, APP_OUTPUT_PREFIX, APP_ROOT_FILE, } from "./render.js";