@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/src/composites/terraform-apply-op.test.ts

@@ -1,14 +1,19 @@
 /**
  * TerraformApplyOp composite tests (#2086) — the phase names, the gate, the
- * plan-to-apply reference, and the compensation refusal.
+ * plan-to-apply reference, and the compensation refusal. A live root builds
+ * the same four phases (#2106 follow-up), and what is particular to it is
+ * below, in its own describe block.
  */
 
-import { describe, test, expect } from "vitest";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, test, expect } from "vitest";
 import {
-  findGate,
+  isGated,
   isStepOutputRef,
   runOpLocally,
-  LocalGateUnsupportedError,
+  memoryGateLedgerPort,
   type ActivityStep,
   type GateStep,
   type OpConfig,
@@ -73,20 +78,28 @@ describe("TerraformApplyOp gate (#2086)", () => {
   test("signal name defaults to approve-<name>", () => {
     const op = props({ name: "prod-apply", root: "app" });
     const gate = op.phases.find((p) => p.name === "Gate")!.steps.find(isGate)!;
-    expect(gate.signalName).toBe("approve-prod-apply");
+    expect(gate.gate).toBe("approve-prod-apply");
   });
 
-  test("an explicit signalName, timeout and description win", () => {
+  // #2202: `gate` on this config already means the gate MODE, so the gate's
+  // name is `gateName` here. `signalName` is read through 0.59.0.
+  test("the deprecated `signalName` option still names the gate", () => {
+    const op = props({ name: "prod-apply", root: "app", signalName: "approve-terraform" });
+    const gate = op.phases.find((p) => p.name === "Gate")!.steps.find(isGate)!;
+    expect(gate.gate).toBe("approve-terraform");
+  });
+
+  test("an explicit gateName, timeout and description win", () => {
     const op = props({
       name: "prod-apply",
       root: "app",
-      signalName: "approve-terraform",
+      gateName: "approve-terraform",
       gateTimeout: "72h",
       gateDescription: "Change window only",
     });
     const gate = op.phases.find((p) => p.name === "Gate")!.steps.find(isGate)!;
     expect(gate).toMatchObject({
-      signalName: "approve-terraform",
+      gate: "approve-terraform",
       timeout: "72h",
       description: "Change window only",
     });
@@ -95,7 +108,7 @@ describe("TerraformApplyOp gate (#2086)", () => {
   test("the Gate phase reports the plan's destroy count before it waits", () => {
     // GateStep has no condition field, so "on-destroy" cannot branch at build
     // time. The approver is told instead: a `show` of the saved plan runs
-    // first and surfaces `destroys` as a search attribute.
+    // first and surfaces `destroys` as a run outcome.
     const op = props({ name: "prod-apply", root: "app" });
     const steps = op.phases.find((p) => p.name === "Gate")!.steps;
     const show = steps[0] as ActivityStep;
@@ -168,26 +181,173 @@ describe("TerraformApplyOp compensation — total or refused (#2086)", () => {
   });
 });
 
-describe("TerraformApplyOp on the local executor (#2086)", () => {
-  test("a gated Op is refused up front, naming the signal the local executor cannot wait for", async () => {
+describe("TerraformApplyOp on the local executor (#2086, gate-as-fact #2119)", () => {
+  test("a gated Op stops at the gate and records the pending fact, naming the signal", async () => {
     const op = props({ name: "prod-apply", root: "app" });
-    await expect(runOpLocally(op, new Map(), {})).rejects.toBeInstanceOf(LocalGateUnsupportedError);
+    const ran: string[] = [];
+    const stub = (fn: string) => [fn, async () => { ran.push(fn); return {}; }] as const;
+    const activities = new Map(
+      ["terraformInit", "terraformPlan", "terraformShow", "terraformApply"].map(stub),
+    );
+    const gates = memoryGateLedgerPort();
+    const result = await runOpLocally(op, activities, {}, undefined, { gates, now: "2026-09-05T12:00:00.000Z" });
+
+    expect(result.status).toBe("gated");
+    expect(result.gate?.op).toBe("prod-apply");
+    expect(result.gate?.gate).toBe(op.phases.flatMap((p) => p.steps).find(isGate)?.gate);
+    expect(gates.appended).toHaveLength(1);
+    // Init, Plan and the pre-gate `show` ran; Apply is behind the gate and did not.
+    expect(ran).toEqual(["terraformInit", "terraformPlan", "terraformShow"]);
   });
 
-  test('gate: "never" clears that refusal, which is what makes `chant run` viable', () => {
-    expect(findGate(props({ name: "prod-apply", root: "app", gate: "never" }))).toBeUndefined();
+  test('gate: "never" means there is no gate to stop at', () => {
+    expect(isGated(props({ name: "prod-apply", root: "app", gate: "never" }))).toBe(false);
+    expect(isGated(props({ name: "prod-apply", root: "app" }))).toBe(true);
   });
 });
 
 describe("TerraformApplyOp Op metadata (#2086)", () => {
-  test("task queue defaults to the name and search attributes name the root", () => {
+  test("labels name the root, and no task queue rides on the Op (#2118)", () => {
     const op = props({ name: "app-apply", root: "app" });
     expect(op.name).toBe("app-apply");
-    expect(op.taskQueue).toBe("app-apply");
-    expect(op.searchAttributes).toEqual({ Apply: "true", TerraformRoot: "app" });
+    expect(op.labels).toEqual({ Apply: "true", TerraformRoot: "app" });
+    expect(op).not.toHaveProperty("taskQueue");
   });
+});
+
+// ── Live root (#2106) ────────────────────────────────────────────────────────
+
+const dirs: string[] = [];
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+});
+
+/** A throwaway project whose one root is live, stock, or live with a policy block, per `policy`. */
+function project(policy?: string): string {
+  const dir = mkdtempSync(join(tmpdir(), "chant-tf-apply-op-live-"));
+  dirs.push(dir);
+  mkdirSync(join(dir, "root"), { recursive: true });
+  writeFileSync(
+    join(dir, "root", "main.tf"),
+    [
+      "terraform {",
+      "  live {",
+      '    estate = "fixture-estate"',
+      ...(policy ? ["    policy {", `      ${policy}`, "    }"] : []),
+      "  }",
+      "}",
+      "",
+      'resource "null_resource" "x" {}',
+      "",
+    ].join("\n"),
+  );
+  writeFileSync(
+    join(dir, "chant.config.json"),
+    JSON.stringify({ terraform: { binary: "choudoufu", roots: { estate: { dir: "./root" } } } }),
+  );
+  return dir;
+}
+
+describe("TerraformApplyOp on a live root (#2106 follow-up)", () => {
+  test("the same Init, Plan, Gate, Apply as a stock root, with the plan file paired through", () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    expect(phaseNames(op)).toEqual(["Init", "Plan", "Gate", "Apply"]);
 
-  test("an explicit taskQueue wins", () => {
-    expect(props({ name: "app-apply", root: "app", taskQueue: "infra" }).taskQueue).toBe("infra");
+    const activitySteps = op.phases.flatMap((p) => p.steps.filter(isActivity));
+    expect(activitySteps.map((s) => s.fn)).toEqual([
+      "terraformInit",
+      "terraformPlan",
+      "terraformShow",
+      "terraformApply",
+    ]);
+
+    const plan = op.phases.find((p) => p.name === "Plan")!.steps[0] as ActivityStep;
+    expect(plan.args?.planFile).toBe("chant.tfplan");
+
+    // The Apply step names the Plan step's own output, never a literal path:
+    // on a live root that reference is the approval artifact itself.
+    const apply = op.phases.find((p) => p.name === "Apply")!.steps[0] as ActivityStep;
+    expect(isStepOutputRef(apply.args?.planFile)).toBe(true);
+    expect(apply.args?.planFile).toMatchObject({ step: "plan", path: "planFile" });
+  });
+
+  test("no choudoufuLivePlan step anywhere: the watch and adopt Ops still use it, this one does not", () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    const fns = op.phases.flatMap((p) => p.steps.filter(isActivity)).map((s) => s.fn);
+    expect(fns).not.toContain("choudoufuLivePlan");
+  });
+
+  test('gate: "never" drops the Gate phase, leaving Init, Plan, Apply', () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir, gate: "never" });
+    expect(phaseNames(op)).toEqual(["Init", "Plan", "Apply"]);
+    expect(op.phases.flatMap((p) => p.steps).some(isGate)).toBe(false);
+  });
+
+  test("Plan reports Changed; the Gate's show step reports Destroys off the saved plan", () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    const plan = op.phases.find((p) => p.name === "Plan")!.steps[0] as ActivityStep;
+    expect(plan.outcomeAttribute).toEqual({ name: "Changed", from: "changed" });
+
+    const gateSteps = op.phases.find((p) => p.name === "Gate")!.steps;
+    const show = gateSteps[0] as ActivityStep;
+    expect(show.fn).toBe("terraformShow");
+    expect(show.outcomeAttribute).toEqual({ name: "Destroys", from: "destroys" });
+    expect(gateSteps[1].kind).toBe("gate");
+  });
+
+  test("the gate description tells the approver what the exit-3 refusal does", () => {
+    const dir = project();
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    const gateStep = op.phases.find((p) => p.name === "Gate")!.steps.find(isGate)!;
+    expect(gateStep.description).toContain("live root");
+    expect(gateStep.description).toContain("exit status 3");
+    expect(gateStep.description).toContain("choudoufu #878");
+  });
+
+  test("a stock root's gate description says nothing about a live re-plan", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-tf-apply-op-live-"));
+    dirs.push(dir);
+    mkdirSync(join(dir, "root"), { recursive: true });
+    writeFileSync(join(dir, "root", "main.tf"), 'resource "null_resource" "x" {}\n');
+    writeFileSync(
+      join(dir, "chant.config.json"),
+      JSON.stringify({ terraform: { binary: "terraform", roots: { estate: { dir: "./root" } } } }),
+    );
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir });
+    const gateStep = op.phases.find((p) => p.name === "Gate")!.steps.find(isGate)!;
+    expect(gateStep.description).not.toContain("exit status 3");
+    expect(gateStep.description).not.toContain("live root");
+  });
+
+  test("refuses to build when the root's policy sets undeclared_untagged = \"delete\"", () => {
+    const dir = project('undeclared_untagged = "delete"');
+    expect(() => TerraformApplyOp({ name: "estate-apply", root: "estate", cwd: dir })).toThrow(
+      /TerraformApplyOp "estate-apply".*undeclared_untagged = "delete"/s,
+    );
+  });
+
+  test("builds fine when the root's policy sets undeclared_untagged to something else", () => {
+    const dir = project('undeclared_untagged = "report"');
+    expect(() => TerraformApplyOp({ name: "estate-apply", root: "estate", cwd: dir })).not.toThrow();
+  });
+
+  test("a choudoufu root with no declared estate builds the same phases and skips the policy read", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-tf-apply-op-live-"));
+    dirs.push(dir);
+    mkdirSync(join(dir, "root"), { recursive: true });
+    writeFileSync(join(dir, "root", "main.tf"), 'resource "null_resource" "x" {}\n');
+    writeFileSync(
+      join(dir, "chant.config.json"),
+      JSON.stringify({ terraform: { binary: "choudoufu", roots: { estate: { dir: "./root" } } } }),
+    );
+
+    const op = props({ name: "estate-apply", root: "estate", cwd: dir, gate: "never" });
+    const fns = op.phases.flatMap((p) => p.steps.filter(isActivity)).map((s) => s.fn);
+    expect(fns).toEqual(["terraformInit", "terraformPlan", "terraformApply"]);
   });
 });

package/src/composites/terraform-apply-op.ts

@@ -1,17 +1,66 @@
 /**
- * TerraformApplyOp composite (#2086) — init, plan, approve, apply for one root
+ * TerraformApplyOp composite (#2086), init, plan, approve, apply for one root
  * module named in `terraform.roots`.
  *
  * Authority stays with terraform: chant runs the binary, reads its plan, and
- * hands the same saved plan to apply. The Apply step never re-plans, because
- * it takes the Plan step's own `planFile` as a `StepOutputRef` — whatever was
- * approved is what runs.
+ * hands the same saved plan to apply. The Apply step never applies something
+ * no gate saw, because it takes the Plan step's own `planFile` as a
+ * `StepOutputRef`.
  *
- * Phases: Init, Plan, Gate, Apply.
+ * Phases: Init, Plan, Gate, Apply. One shape, both kinds of root. A live root
+ * (#2103, `terraform.binary: "choudoufu"` plus a declared estate) ran a
+ * different shape for one release, because choudoufu refused `-out` and
+ * `apply <planfile>`; choudoufu v0.13.0 admits both under a `live` block
+ * ([choudoufu #878](https://github.com/INTENTIUS/choudoufu/issues/878),
+ * PR 889), so the plan-file discipline is back and the two shapes are one
+ * again.
  *
- * The gate is durable-runtime work, so an Op that emits one needs Temporal;
- * `packages/core/src/op/local-executor.ts` refuses any Op containing a gate.
- * `gate: "never"` is what makes the Op runnable with `chant run` locally.
+ * **What the approval covers on a live root.** `plan -out=<planFile>` writes
+ * stock's own plan file, and that file is what the approver reads and what
+ * the Apply step names. `apply <planFile>` does not replay it: prior state on
+ * a live root is a projection rebuilt from the live system every run, so the
+ * apply re-plans against the live system the way every live-markers run does,
+ * then compares its fresh plan with the file's. Same addresses, same actions,
+ * same live objects, and the same planned values, or it refuses before
+ * anything changes:
+ *
+ *   - `The approved plan no longer matches the live system`, and
+ *   - `The approved plan belongs to a different estate`,
+ *
+ * both with exit status **3**, which is neither 1 (any ordinary failure) nor
+ * `-detailed-exitcode`'s 2. `terraformApply` maps that status to a named
+ * result rather than a thrown error (`refused: "approval-mismatch" |
+ * "wrong-estate"`, with choudoufu's message in `refusal`), so a workflow
+ * reading the Apply step's output can route the run back to review instead of
+ * treating it as a broken step. The seam #2106 left named and unused on the
+ * apply args is now the plan file itself.
+ *
+ * TF101 therefore fires on a live root's `terraformApply` call again: there
+ * is a plan file to pair once more, and pairing it is what the refusal above
+ * has to compare against.
+ *
+ * **Delete modes.** chant's `delete: "never" | "owned-only" | "gated"`
+ * (`terraform.roots.<name>.delete`, `../config.ts`) maps onto choudoufu's
+ * `policy` block. `"owned-only"` is choudoufu's own default verb for the
+ * `undeclared_tagged` quadrant (an orphaned marked resource) and needs
+ * nothing; `"gated"` needs nothing beyond this composite's own approval gate;
+ * `"never"` requires the root's `policy` block to set `undeclared_tagged` to
+ * `"keep"`, `"untag"` or `"report"`, and TF026 (`../lint/post-synth/tf026.ts`)
+ * enforces that at build time, naming the setting to add. Separately, and
+ * regardless of `delete`, this composite refuses outright to build against a
+ * root whose `policy` sets `undeclared_untagged = "delete"` (account-scoped
+ * reconciliation, which needs a `scope` block): that quadrant deletes
+ * resources the estate never claimed, anywhere the scope reaches, and chant
+ * never proposes deleting a resource it does not own, not for a root, and not
+ * for an Op it generated.
+ *
+ * A gate is a fact on the gate ledger, not a wait (#2119). Reaching one,
+ * `chant run` consults the ledger (`packages/core/src/op/gate.ts`): a
+ * resolution newer than the gate's newest pending fact lets the run walk
+ * through, and anything else records the pending fact and ends the run with
+ * status `gated` and exit 3. `chant approve <op> <gate>` writes the
+ * resolution, and the next run reads it. `gate: "never"` drops the Gate phase
+ * entirely, so a run never stops.
  *
  * @example
  * ```typescript
@@ -23,6 +72,8 @@
 
 import { Op, phase, gate, activity, OpResource } from "@intentius/chant/op";
 import { DEFAULT_PLAN_FILE } from "../op/activities/terraform";
+import { detectLivePolicyVerbs } from "../op/activities/live-detect";
+import { resolveRootModeSync } from "../op/resolve-root-mode";
 import {
   terraformInit as initStep,
   terraformPlan as planStep,
@@ -38,14 +89,14 @@ import {
  * cannot branch at build time on a count the plan only produces at run time.
  * The workable v1 is that `"on-destroy"` and `"always"` emit the same Gate
  * phase, and the approver is told what is at stake instead: the phase reports
- * the plan's `destroys` count as the `Destroys` search attribute before it
- * waits, and the gate description says so. A gate that skips itself when the
- * plan turns out additive is a new step kind, out of scope here.
+ * the plan's `destroys` count as the `Destroys` run outcome before the
+ * gate is reached, and the gate description says so. A gate that skips itself
+ * when the plan turns out additive is a new step kind, out of scope here.
  */
 export type TerraformGateMode = "on-destroy" | "always" | "never";
 
 export interface TerraformApplyOpConfig {
-  /** Op name (kebab-case). Also the default task queue and gate signal suffix. */
+  /** Op name (kebab-case). `gateName` defaults to `approve-<name>`. */
   name: string;
   /** Key into the project's `terraform.roots`. The root carries dir, workspace, var files and backend config. */
   root: string;
@@ -57,9 +108,15 @@ export interface TerraformApplyOpConfig {
    * same phase.
    */
   gate?: TerraformGateMode;
-  /** Gate signal name. Default: `approve-<name>`, as `ApplyOp` does. */
+  /** The gate's name. Default: `approve-<name>`, as `ApplyOp` does. */
+  gateName?: string;
+  /**
+   * @deprecated The gate's name was `signalName` through 0.58.0 and is
+   * `gateName` since #2202 (`gate` is taken here by {@link TerraformGateMode}).
+   * Still read; removed in 0.60.0.
+   */
   signalName?: string;
-  /** Temporal duration the gate waits before timing out. Default: core's own (48h). */
+  /** How long a recorded pending gate stays valid, as a duration string. Default: core's own (48h). */
   gateTimeout?: string;
   /** Override the gate description shown to the approver. */
   gateDescription?: string;
@@ -78,15 +135,13 @@ export interface TerraformApplyOpConfig {
    * Terraform has no automatic rollback: a half-applied plan is undone by
    * planning and applying the inverse, which is a decision about the estate
    * rather than something chant can synthesize. So compensation here is
-   * total or refused, the same stance `ApplyOp` takes (`lexicons/temporal/src/
+   * total or refused, the same stance `ApplyOp` takes (`packages/core/src/op/
    * composites/apply-op.ts`) — `true`, or an object with no `command`, throws
    * when the Op is built, naming the Op, rather than warning at the moment a
    * rollback is already needed. Supply `compensate: { command: "..." }` with a
    * rollback of your own, or leave it unset.
    */
   compensate?: boolean | { command?: string };
-  /** Override the task queue. Defaults to `name`. */
-  taskQueue?: string;
 }
 
 export interface TerraformApplyOpResources {
@@ -95,7 +150,6 @@ export interface TerraformApplyOpResources {
 }
 
 export function TerraformApplyOp(config: TerraformApplyOpConfig): TerraformApplyOpResources {
-  const taskQueue = config.taskQueue ?? config.name;
   const planFile = config.planFile ?? DEFAULT_PLAN_FILE;
   const gateMode: TerraformGateMode = config.gate ?? "on-destroy";
 
@@ -116,31 +170,71 @@ export function TerraformApplyOp(config: TerraformApplyOpConfig): TerraformApply
   // travels with each of them rather than being read off the process once.
   const where = config.cwd ? { cwd: config.cwd } : {};
 
-  // `id` is what makes `plan.out` legal, and `plan.out.planFile` is how the
-  // Apply step below names this step's saved plan.
-  const plan = planStep(config.root, { planFile, ...where, id: "plan" });
-  plan.outcomeAttribute = { name: "Changed", from: "changed" };
+  // Best-effort, synchronous (chant.config.json only, see resolveRootModeSync's
+  // own doc comment). The mode no longer changes which steps are emitted; it
+  // words the gate below, and it decides whether the policy refusal is even
+  // asked. "Unknown" reads as stock, which for the gate wording is harmless
+  // and for the refusal is the permissive direction, so the refusal is not
+  // this function's to guarantee: on a chant.config.ts project, which is
+  // every project in this repository, the mode never resolves and the
+  // refusal below never runs (#2216).
+  const resolved = resolveRootModeSync(config.root, config.cwd);
+  const live = resolved?.mode === "live";
+
+  if (live) {
+    // Regardless of `delete`: an account-scoped purge is never something
+    // chant proposes on an Op's own initiative. TF026 handles the narrower,
+    // config-driven `delete: "never"` requirement; this is unconditional.
+    //
+    // TF027 (`../lint/post-synth/tf027.ts`) makes the same refusal off the
+    // parsed HCL, whatever the config file is written in, and is the check
+    // that guarantees it. This throw is kept for the projects whose mode does
+    // resolve here, where failing at the moment the Op is built names the Op
+    // as well as the root.
+    const verbs = detectLivePolicyVerbs(resolved!.dir);
+    if (verbs?.undeclaredUntagged === "delete") {
+      throw new Error(
+        `TerraformApplyOp "${config.name}": root "${config.root}"'s policy block sets ` +
+          `undeclared_untagged = "delete" (account-scoped reconciliation, scoped by a \`scope\` block). ` +
+          "chant never proposes deleting a resource it does not own, and neither does an Op it " +
+          "generates. Remove that setting from the policy block, or narrow the estate's ownership " +
+          "answer instead of the account's.",
+      );
+    }
+  }
 
   const phases = [
     phase("Init", [initStep(config.root, { ...where, ...(config.upgrade ? { upgrade: true } : {}) })]),
-    phase("Plan", [plan]),
   ];
 
+  // `id` is what makes `plan.out` legal, and `plan.out.planFile` is how the
+  // Apply step below names this step's saved plan. On a live root that file
+  // is also the approval artifact the apply re-plans against, so the same
+  // reference carries the approval as well as the path.
+  const plan = planStep(config.root, { planFile, ...where, id: "plan" });
+  plan.outcomeAttribute = { name: "Changed", from: "changed" };
+  phases.push(phase("Plan", [plan]));
+
   if (gateMode !== "never") {
-    // Re-render the saved plan just before the wait, so the approver's
+    // Re-render the saved plan just before the gate, so the approver's
     // `Destroys` attribute comes off the plan that will actually apply.
-    // `show` against a plan file calls no provider.
+    // `show` against a plan file calls no provider, on either kind of root.
     const show = showStep(config.root, { ...where, planFile: plan.out.planFile });
     show.outcomeAttribute = { name: "Destroys", from: "destroys" };
     phases.push(
       phase("Gate", [
         show,
-        gate(config.signalName ?? `approve-${config.name}`, {
+        gate(config.gateName ?? config.signalName ?? `approve-${config.name}`, {
           ...(config.gateTimeout ? { timeout: config.gateTimeout } : {}),
           description:
             config.gateDescription ??
-            `Approve terraform apply of root "${config.root}" (gate: ${gateMode}). ` +
-              `The Destroys search attribute on this phase is the plan's destroy count.`,
+            `Approve terraform apply of ${live ? "live " : ""}root "${config.root}" (gate: ${gateMode}). ` +
+              `The Destroys run outcome from this phase is the plan's destroy count.` +
+              (live
+                ? " The apply that follows re-plans against the live system and applies this plan file only" +
+                  " if its own fresh plan agrees; otherwise it refuses with exit status 3 and the Apply" +
+                  " step reports a named refusal for review (choudoufu #878)."
+                : ""),
         }),
       ]),
     );
@@ -151,8 +245,7 @@ export function TerraformApplyOp(config: TerraformApplyOpConfig): TerraformApply
   const op = Op({
     name: config.name,
     overview: `Init, plan and apply the "${config.root}" terraform root`,
-    taskQueue,
-    searchAttributes: {
+    labels: {
       Apply: "true",
       TerraformRoot: config.root,
     },