@intentius/chant-lexicon-terraform 0.61.0 → 0.63.0

package/dist/composites/terraform-adopt-op.d.ts

@@ -13,8 +13,18 @@
  * the two values that would claim it. Cloud-to-code here is "claim what the
  * configuration already describes" — a tag write, not a regeneration.
  *
- * Phases: Check, Ledger, Gate, Adopt.
+ * Phases: Init, Check, Ledger, Gate, Adopt.
  *
+ *   - **Init** runs `terraform init`, the same step `TerraformApplyOp` and
+ *     `TerraformWatchOp` open with. The Ledger step's `live-plan` needs the
+ *     provider schema to discover markers on the live resources it reads, and
+ *     a checkout that has never run `init` has no `.terraform` directory to
+ *     read one from — which is every fresh CI checkout, not a GitLab
+ *     peculiarity (#2302). Without this phase `live-plan` fails outright:
+ *     `Error: Provider unavailable for marker discovery`. This composite had
+ *     no Init phase because nothing had ever run `live-adopt` before
+ *     INTENTIUS/choudoufu#1026 did, so the gap survived every guard that only
+ *     read the generated YAML.
  *   - **Check** runs `live-check`, which makes no cloud calls and says whether
  *     this configuration can move under markers at all. It runs first because
  *     a root that `live-check` refuses will produce an adoption ledger that
@@ -103,6 +113,12 @@ export interface TerraformAdoptOpConfig {
     gateTimeout?: string;
     /** Override the gate description shown to the approver. */
     gateDescription?: string;
+    /**
+     * `-upgrade` on the Init step: re-resolve provider and module versions.
+     * Same field, same meaning, as `TerraformApplyOpConfig.upgrade` and
+     * `TerraformWatchOpConfig.upgrade`.
+     */
+    upgrade?: boolean;
     /**
      * Directory each step starts the `chant.config.*` search from, which is what
      * `terraform.roots` and the root's relative `dir` resolve against. Default:
@@ -124,7 +140,7 @@ export interface TerraformAdoptOpConfig {
     };
 }
 export interface TerraformAdoptOpResources {
-    /** Op resource. Generates the Check/Ledger/Gate/Adopt workflow. */
+    /** Op resource. Generates the Init/Check/Ledger/Gate/Adopt workflow. */
     op: InstanceType<typeof OpResource>;
 }
 export declare function TerraformAdoptOp(config: TerraformAdoptOpConfig): TerraformAdoptOpResources;

package/dist/composites/terraform-adopt-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAO5E,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAiE1F"}
+{"version":3,"file":"terraform-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAQ5E,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,wGAAwG;IACxG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,wEAAwE;IACxE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAkE1F"}

package/dist/composites/terraform-apply-op.d.ts

@@ -56,11 +56,21 @@
  *
  * A gate is a fact on the gate ledger, not a wait (#2119). Reaching one,
  * `chant run` consults the ledger (`packages/core/src/op/gate.ts`): a
- * resolution newer than the gate's newest pending fact lets the run walk
- * through, and anything else records the pending fact and ends the run with
- * status `gated` and exit 3. `chant approve <op> <gate>` writes the
- * resolution, and the next run reads it. `gate: "never"` drops the Gate phase
- * entirely, so a run never stops.
+ * resolution recorded for this run's own plan lets the run walk through, and
+ * anything else records the pending fact and ends the run with status `gated`
+ * and exit 3. `chant approve <op> <gate>` writes the resolution, and the next
+ * run reads it. `gate: "never"` drops the Gate phase entirely, so a run never
+ * stops.
+ *
+ * **The gate binds the plan** (#2300). The Plan step publishes
+ * `planDigest` — its `terraform show -json` change set, hashed — and the Gate
+ * step references it, so the resolution names the plan it approves. That
+ * closes the window the exit-3 refusal above does not: exit 3 compares the
+ * Apply step's fresh plan against the *file* it was handed inside one run,
+ * and this compares a later run's fresh plan against what a human actually
+ * approved. INTENTIUS/choudoufu#1026 measured the gap by approving, renaming
+ * a resource, and re-running: the second run applied without complaint. It
+ * now stops, naming the approved digest and the planned one.
  *
  * @example
  * ```typescript

package/dist/composites/terraform-apply-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform-apply-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-apply-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAW5E;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CA2G1F"}
+{"version":3,"file":"terraform-apply-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-apply-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAEH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAW5E;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAElE,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,mEAAmE;IACnE,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAgH1F"}

package/dist/composites/terraform-watch-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform-watch-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-watch-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AAEH,OAAO,EAAa,UAAU,EAAqB,MAAM,qBAAqB,CAAC;AAS/E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,CAAC;AAEnF,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CA8G1F"}
+{"version":3,"file":"terraform-watch-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-watch-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6GG;AAEH,OAAO,EAAa,UAAU,EAAqB,MAAM,qBAAqB,CAAC;AAS/E;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,cAAc,CAAC;AAEnF,MAAM,WAAW,sBAAsB;IACrC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,+GAA+G;IAC/G,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,4DAA4D;IAC5D,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,yBAAyB,CAwH1F"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "da8f1f7391554299a9dac6411b3d346aac233088d22d080a5c31feb56754ca19",
+    "manifest.json": "795fbe628239306c60d4cf83fb07132d4dd1fef513e9f0e59feee71a5eb1427d",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
@@ -37,5 +37,5 @@
     "rules/tf028.ts": "81ef95659c40ad1774c83e663473ed769143d894a4ba0517c3defa31f00ba723",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "14b513f2e660229ea7f075738074c2cb08fe27e2e42a6ae1fd7e7cd708233ca1"
+  "composite": "9ecb4590f041f9f401794c438d67d6ce20c3f5b21df1796f1d58a6f0a0ee5814"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/op/activities/terraform.d.ts

@@ -203,6 +203,56 @@ export interface PlanChangeCounts {
     /** Resources to destroy. This is the number an approval gate exists for. */
     destroys: number;
 }
+/**
+ * One resource's proposed change, as a plan digest sees it (#2300) — the
+ * projection of a `terraform show -json` `resource_changes` entry that
+ * survives into {@link terraformPlanDigest}.
+ */
+export interface TerraformPlannedChange {
+    address: unknown;
+    mode: unknown;
+    type: unknown;
+    name: unknown;
+    index: unknown;
+    provider_name: unknown;
+    deposed: unknown;
+    actions: unknown;
+    before: unknown;
+    after: unknown;
+    after_unknown: unknown;
+    replace_paths: unknown;
+    importing: unknown;
+}
+/**
+ * The change set a `terraform show -json` plan describes, canonicalised
+ * (#2300): every proposed change, at its address, with the values that would
+ * be written, sorted so two renderings of the same plan project identically.
+ *
+ * Everything else in the document is dropped, and the drops are the point —
+ * see `packages/core/src/lifecycle/plan-digest.ts` for the general rule. Here
+ * that means `timestamp` and `terraform_version` (when the plan was taken and
+ * by which binary), `format_version` (how it was rendered), `prior_state` and
+ * `planned_values` (restatements of the same change set from another angle),
+ * `configuration` (the source that produced it, which can be refactored
+ * without changing a single proposed action) and `checks` / `relevant_
+ * attributes` (diagnostics about the plan, not the plan). What is left is
+ * what applying it would do.
+ */
+export declare function terraformPlanChangeSet(planJson: unknown): {
+    resourceChanges: TerraformPlannedChange[];
+    outputChanges: unknown;
+};
+/**
+ * The identity of a terraform plan (#2300): {@link terraformPlanChangeSet}
+ * hashed. This is what a `TerraformApplyOp` gate binds its approval to, and
+ * what a later run recomputes and compares.
+ *
+ * Taken over the `show -json` rendering rather than the plan file's bytes on
+ * purpose: the file is an opaque, version-stamped archive, and two runs of
+ * `plan -out` over an unchanged root produce different bytes. The rendering
+ * is the same plan both times.
+ */
+export declare function terraformPlanDigest(planJson: unknown): string;
 /** What {@link terraformPlan} resolved. Carries the plan itself, so no later step re-plans. */
 export interface TerraformPlanResult extends PlanChangeCounts {
     /** `true` when terraform reported exit 2 under `-detailed-exitcode`: the plan proposes changes. */
@@ -215,6 +265,13 @@ export interface TerraformPlanResult extends PlanChangeCounts {
     json: unknown;
     /** `terraform show -no-color <planFile>` — the human-readable plan. */
     text: string;
+    /**
+     * This plan's identity (#2300) — {@link terraformPlanDigest} over
+     * {@link TerraformPlanResult.json}. Hand it to a gate step's `plan` so the
+     * approval binds to this plan and not to the next run: `gate(name, { plan:
+     * plan.out.planDigest })`.
+     */
+    planDigest: string;
 }
 /**
  * Why a live apply refused the approval artifact it was handed. Both are

package/dist/op/activities/terraform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../../src/op/activities/terraform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAWrB,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD,gHAAgH;AAChH,eAAO,MAAM,+BAA+B,yBAAyB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,mEACsB,CAAC;AAEnE,mHAAmH;AACnH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,wGAAwG;AACxG,eAAO,MAAM,mCAAmC,wDAAwD,CAAC;AAEzG,0GAA0G;AAC1G,eAAO,MAAM,8BAA8B,oDAAoD,CAAC;AAIhG,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEvD,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,qGAAqG;IACrG,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mGAAmG;IACnG,OAAO,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE5E,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB,EAAE,gBAAgB;IACtF,wFAAwF;IACxF,KAAK,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,kGAAkG;IAClG,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yHAAyH;IACzH,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,IAAI,EAAE,OAAO,CAAC;IACd,yHAAyH;IACzH,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,WAAW,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,8FAA8F;IAC9F,OAAO,EAAE,OAAO,CAAC;IACjB,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,kCAAkC;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1G;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAExF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAcT;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAI7G;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,qBAAqB,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,CAYpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAMxE;AAgBD,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAOpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/E;AA8BD,4FAA4F;AAC5F,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D;AAwED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAoC9B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAI5F;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAoC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CA2B9B;AAmBD;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,uBAAuB,CAAC,CA0GlC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CA8C/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAuBnC"}
+{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../../src/op/activities/terraform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAQH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAWrB,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD,gHAAgH;AAChH,eAAO,MAAM,+BAA+B,yBAAyB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,mEACsB,CAAC;AAEnE,mHAAmH;AACnH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,wGAAwG;AACxG,eAAO,MAAM,mCAAmC,wDAAwD,CAAC;AAEzG,0GAA0G;AAC1G,eAAO,MAAM,8BAA8B,oDAAoD,CAAC;AAIhG,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,iBAAiB;IAC1D,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,MAAM,sBAAsB,GAAG,iBAAiB,CAAC;AAEvD,MAAM,WAAW,kBAAmB,SAAQ,iBAAiB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;;;OAIG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,qGAAqG;IACrG,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG;IACzD,eAAe,EAAE,sBAAsB,EAAE,CAAC;IAC1C,aAAa,EAAE,OAAO,CAAC;CACxB,CA+BA;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAE7D;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,mGAAmG;IACnG,OAAO,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE5E,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB,EAAE,gBAAgB;IACtF,wFAAwF;IACxF,KAAK,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,iHAAiH;IACjH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,kGAAkG;IAClG,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yHAAyH;IACzH,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,IAAI,EAAE,OAAO,CAAC;IACd,yHAAyH;IACzH,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,SAAS,EAAE,WAAW,CAAC;IACvB,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,wFAAwF;IACxF,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACvC,8FAA8F;IAC9F,OAAO,EAAE,OAAO,CAAC;IACjB,4FAA4F;IAC5F,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,kEAAkE;IAClE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,kCAAkC;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,MAAM,CAEhE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK1G;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAMT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAExF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,MAAM,CAcT;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAI7G;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,qBAAqB,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAIvG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,CAYpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAMxE;AAgBD,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAOpE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/E;AA8BD,4FAA4F;AAC5F,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D;AAwED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CA4C9B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAI5F;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CAoC/B;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,iBAAiB,EACvB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,mBAAmB,CAAC,CA2B9B;AAmBD;;;;;;;;;;;;;;GAcG;AACH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,GAAG;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,uBAAuB,CAAC,CA0GlC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAWhC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,oBAAoB,CAAC,CA8C/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAuBnC"}

package/dist/op/activity-contracts.d.ts

@@ -49,6 +49,7 @@ export declare const terraformPlanContract: import("@intentius/chant/op").Activi
     dir: string;
     json: unknown;
     text: string;
+    planDigest: string;
     adds: number;
     changes: number;
     destroys: number;

package/dist/op/activity-contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA+BH,eAAO,MAAM,qBAAqB;;;;;;;;EASjC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;EAgBjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;EAWlC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;EAYjC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;EASnC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;EAKtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;EAgBlC,CAAC"}
+{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA+BH,eAAO,MAAM,qBAAqB;;;;;;;;EASjC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;EAiBjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;EAWlC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;EAYjC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;EASnC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;EAKtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;EAgBlC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "type": "module",
   "files": [
     "src/",
@@ -56,7 +56,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.61.0",
+    "@intentius/chant": "^0.63.0",
     "typescript": "^5.9.3"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/__fixtures__/ACCEPTANCE.md

@@ -1,6 +1,6 @@
 # What the gated acceptance suites have actually run against
 
-Four `describe` blocks across three files run this lexicon against a real
+Five `describe` blocks across three files run this lexicon against a real
 binary rather than a fixture, and every one of them skips rather than fails
 when its dependency is absent. A skip is silent by design, so without this
 file nothing in the tree says which of them has ever passed, against what, or
@@ -170,6 +170,47 @@ The fixture was deliberately left as an `aws_vpc`. A log group would make the
 block pass off `unowned[]` alone and would stop it proving the content-matcher
 path, which is the only thing it exists to prove.
 
+### 5. `TerraformAdoptOp reaches its gate on a checkout that has never run init`
+
+Same file, third block (#2302). One test: build `TerraformAdoptOp` and drive
+it through `runOpLocally`, exactly as the apply Op's own acceptance suite
+does, over a project this test creates fresh and never initializes by hand —
+no `terraformInit` call anywhere in the block. The Op's own Init phase is what
+has to download the provider, or the Ledger step fails the way it failed in
+INTENTIUS/choudoufu#1026. `TerraformAdoptOp` gates unconditionally, so a
+passing run ends `status: "gated"` right after the Ledger phase — reaching the
+gate is the pass, not a completed adoption.
+
+Gated on a `choudoufu` on PATH and `CHOUDOUFU_EMULATOR_ENDPOINT`. No `aws` CLI:
+this block creates no live resource of its own.
+
+```
+npx vitest run lexicons/terraform/src/composites/terraform-adopt-op.acceptance.test.ts
+```
+
+Last passed: 2026-09-09, choudoufu v0.15.0 with the pinned floci emulator up.
+Removing the Init phase this block exists to guard reproduces
+INTENTIUS/choudoufu#1026 verbatim:
+
+```
+choudoufu live-plan failed in <dir> (exit 1)
+Error: Provider unavailable for marker discovery
+
+Finding the live resources of this estate needs provider
+provider["registry.opentofu.org/hashicorp/aws"], which could not be used:
+cannot read the schema of provider registry.opentofu.org/hashicorp/aws:
+failed to instantiate provider "registry.opentofu.org/hashicorp/aws" to
+obtain schema: unavailable provider "registry.opentofu.org/hashicorp/aws".
+```
+
+With the Init phase back, the same run reaches its gate:
+
+```
+ ✓ TerraformAdoptOp reaches its gate on a checkout that has never run init >
+   Init downloads the provider the Ledger step needs, and the run reaches
+   its gate
+```
+
 ## Running everything that can run on a machine with no choudoufu
 
 ```
@@ -179,15 +220,15 @@ npx vitest run \
   lexicons/terraform/src/op/activities/choudoufu.acceptance.test.ts
 ```
 
-With `terraform` on PATH and the registry reachable, that is 1 passed and 5
+With `terraform` on PATH and the registry reachable, that is 1 passed and 6
 skipped, and each skip names its own reason in the block title. With
-choudoufu v0.15.0, the `aws` CLI and the emulator all present, it is 6 passed
-and 0 skipped: no block in this file skips any more. On 2026-09-08 that is
-exactly what it printed.
+choudoufu v0.15.0 and the emulator present (the `aws` CLI besides, for block
+4), it is 7 passed and 0 skipped: no block in this file skips any more. On
+2026-09-09 that is exactly what it printed.
 
 ```
  Test Files  3 passed (3)
-      Tests  6 passed (6)
+      Tests  7 passed (7)
 ```
 
 Bring the emulator up on a fixed port from choudoufu's own compose file rather

package/src/composites/terraform-adopt-op.acceptance.test.ts

@@ -69,6 +69,8 @@ import { cpSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, describe, expect, it } from "vitest";
+import { loadActivities, loadProfiles, runOpLocally, type OpConfig } from "@intentius/chant/op";
+import { TerraformAdoptOp } from "./terraform-adopt-op";
 import { choudoufuAdopt, choudoufuLivePlan, terraformInit } from "../op/activities/terraform";
 
 function onPath(cmd: string): boolean {
@@ -177,3 +179,66 @@ describe.skipIf(skipReason !== "")(
     );
   },
 );
+
+/**
+ * #2302: `TerraformAdoptOp` built with no Init phase reached its Ledger step
+ * with an empty `.terraform` on every checkout that had never run `init` —
+ * every fresh CI checkout, not a GitLab peculiarity. This drives the built Op
+ * itself through `runOpLocally`, the way `terraform-apply-op.acceptance.test.ts`
+ * does, over a project this test creates fresh and never initializes by hand:
+ * no `terraformInit` call anywhere in this block, unlike the suite above. The
+ * Op's own Init phase is what has to do that work, or the Ledger step fails
+ * the same way it failed in INTENTIUS/choudoufu#1026.
+ *
+ * `TerraformAdoptOp` gates unconditionally (no `gate: "never"`, unlike
+ * `TerraformApplyOp`), so a passing run here ends with `status: "gated"`
+ * right after the Ledger phase — "reaching its gate" is the pass, not a
+ * completed adoption. That is proof enough: the Ledger step needs the
+ * provider schema, and a run that reaches the gate is a run whose Ledger step
+ * already read it.
+ *
+ * Needs only a `choudoufu` on PATH and the emulator, not the `aws` CLI: this
+ * block creates no live resource and never reads `ledger.adoptions`, so a
+ * narrower gate than the suite above is correct instead of borrowed.
+ */
+const gateSkipReason = !onPath("choudoufu")
+  ? "no choudoufu binary on PATH"
+  : !emulatorEndpoint
+    ? "CHOUDOUFU_EMULATOR_ENDPOINT is not set (bring up choudoufu's `just smoke` emulator stack and export it)"
+    : "";
+
+describe.skipIf(gateSkipReason !== "")(
+  `TerraformAdoptOp reaches its gate on a checkout that has never run init${gateSkipReason ? ` (skipped: ${gateSkipReason})` : ""}`,
+  () => {
+    it(
+      "Init downloads the provider the Ledger step needs, and the run reaches its gate",
+      { timeout: 300_000 },
+      async () => {
+        const dir = project();
+
+        process.env.AWS_ENDPOINT_URL ??= emulatorEndpoint;
+        process.env.AWS_ACCESS_KEY_ID ??= "choudoufu-emulator";
+        process.env.AWS_SECRET_ACCESS_KEY ??= "choudoufu-emulator";
+        process.env.AWS_DEFAULT_REGION ??= "us-east-1";
+
+        // No `terraformInit` call here. `dir/root` is a fresh checkout: no
+        // `.terraform`, only the fixture's own `main.tf` and
+        // `estate.chdf.hcl` — exactly what `git clone` leaves behind, since
+        // `.terraform` is what every `.gitignore` in this ecosystem excludes.
+        const { op } = TerraformAdoptOp({ name: "gate-check-adopt", root: "estate", cwd: dir });
+
+        const activities = await loadActivities(["terraform"]);
+        const result = await runOpLocally((op as unknown as { props: OpConfig }).props, activities, await loadProfiles());
+
+        expect(result.status).toBe("gated");
+        expect(result.records.map((r) => `${r.phase}:${r.status}`)).toEqual([
+          "Init:ok",
+          "Check:ok",
+          "Ledger:ok",
+          "Gate:skipped",
+          "Adopt:skipped",
+        ]);
+      },
+    );
+  },
+);

package/src/composites/terraform-adopt-op.test.ts

@@ -26,15 +26,37 @@ const isActivity = (s: StepDefinition): s is ActivityStep => s.kind === "activit
 const steps = (op: OpConfig): ActivityStep[] => op.phases.flatMap((p) => p.steps.filter(isActivity));
 const base = { name: "estate-adopt", root: "estate" };
 
-describe("TerraformAdoptOp phases (#2105)", () => {
-  test("Check, Ledger, Gate, Adopt, in that order", () => {
+describe("TerraformAdoptOp phases (#2105, #2302)", () => {
+  test("Init, Check, Ledger, Gate, Adopt, in that order", () => {
     const op = props(base);
-    expect(phaseNames(op)).toEqual(["Check", "Ledger", "Gate", "Adopt"]);
-    expect(steps(op).map((s) => s.fn)).toEqual(["choudoufuLiveCheck", "choudoufuLivePlan", "choudoufuAdopt"]);
+    expect(phaseNames(op)).toEqual(["Init", "Check", "Ledger", "Gate", "Adopt"]);
+    expect(steps(op).map((s) => s.fn)).toEqual([
+      "terraformInit",
+      "choudoufuLiveCheck",
+      "choudoufuLivePlan",
+      "choudoufuAdopt",
+    ]);
+  });
+
+  // #2302: the Ledger step's `live-plan` needs the provider schema to
+  // discover markers, which a checkout that has never run `init` does not
+  // have — every fresh CI checkout, not a GitLab peculiarity. Without this
+  // phase `live-plan` fails outright: "Error: Provider unavailable for
+  // marker discovery".
+  test("Init runs terraform init first, the same shape TerraformApplyOp and TerraformWatchOp use", () => {
+    const init = props(base).phases[0].steps[0] as ActivityStep;
+    expect(init.fn).toBe("terraformInit");
+    expect(init.args?.root).toBe("estate");
+    expect(init.args && "upgrade" in init.args).toBe(false);
+  });
+
+  test("upgrade rides the Init step only, the same option name as the other two Ops", () => {
+    const init = props({ ...base, upgrade: true }).phases[0].steps[0] as ActivityStep;
+    expect(init.args?.upgrade).toBe(true);
   });
 
-  test("Check runs live-check first, and reports whether the root was refused", () => {
-    const check = props(base).phases[0].steps[0] as ActivityStep;
+  test("Check runs live-check second, and reports whether the root was refused", () => {
+    const check = props(base).phases[1].steps[0] as ActivityStep;
     expect(check.fn).toBe("choudoufuLiveCheck");
     expect(check.outcomeAttribute).toEqual({ name: "Refused", from: "refused" });
     // No cloud calls, so this is the cheapest place to learn the root cannot
@@ -43,7 +65,7 @@ describe("TerraformAdoptOp phases (#2105)", () => {
   });
 
   test("Ledger is the -adoption-only live plan, and publishes both counts", () => {
-    const ledger = props(base).phases[1].steps[0] as ActivityStep;
+    const ledger = props(base).phases[2].steps[0] as ActivityStep;
     expect(ledger.fn).toBe("choudoufuLivePlan");
     expect(ledger.id).toBe("ledger");
     expect(ledger.args?.adoptionOnly).toBe(true);
@@ -64,14 +86,14 @@ describe("TerraformAdoptOp phases (#2105)", () => {
 
   test("an explicit estate rides the Ledger step only", () => {
     const op = props({ ...base, estate: "prod-networking" });
-    expect((op.phases[1].steps[0] as ActivityStep).args?.estate).toBe("prod-networking");
-    expect((op.phases[0].steps[0] as ActivityStep).args?.estate).toBeUndefined();
+    expect((op.phases[2].steps[0] as ActivityStep).args?.estate).toBe("prod-networking");
+    expect((op.phases[1].steps[0] as ActivityStep).args?.estate).toBeUndefined();
   });
 });
 
 describe("TerraformAdoptOp gates on the ledger (#2105)", () => {
   const gateOf = (op: OpConfig): GateStep => {
-    const step = op.phases[2].steps[0];
+    const step = op.phases[3].steps[0];
     expect(step.kind).toBe("gate");
     return step as GateStep;
   };
@@ -107,7 +129,7 @@ describe("TerraformAdoptOp gates on the ledger (#2105)", () => {
 });
 
 describe("TerraformAdoptOp adopts the ledger's matches and nothing else (#2105)", () => {
-  const adoptStep = (op: OpConfig): ActivityStep => op.phases[3].steps[0] as ActivityStep;
+  const adoptStep = (op: OpConfig): ActivityStep => op.phases[4].steps[0] as ActivityStep;
 
   test("the Adopt step takes the ledger's adoptable set by reference", () => {
     const adopt = adoptStep(props(base));

package/src/composites/terraform-adopt-op.ts

@@ -13,8 +13,18 @@
  * the two values that would claim it. Cloud-to-code here is "claim what the
  * configuration already describes" — a tag write, not a regeneration.
  *
- * Phases: Check, Ledger, Gate, Adopt.
+ * Phases: Init, Check, Ledger, Gate, Adopt.
  *
+ *   - **Init** runs `terraform init`, the same step `TerraformApplyOp` and
+ *     `TerraformWatchOp` open with. The Ledger step's `live-plan` needs the
+ *     provider schema to discover markers on the live resources it reads, and
+ *     a checkout that has never run `init` has no `.terraform` directory to
+ *     read one from — which is every fresh CI checkout, not a GitLab
+ *     peculiarity (#2302). Without this phase `live-plan` fails outright:
+ *     `Error: Provider unavailable for marker discovery`. This composite had
+ *     no Init phase because nothing had ever run `live-adopt` before
+ *     INTENTIUS/choudoufu#1026 did, so the gap survived every guard that only
+ *     read the generated YAML.
  *   - **Check** runs `live-check`, which makes no cloud calls and says whether
  *     this configuration can move under markers at all. It runs first because
  *     a root that `live-check` refuses will produce an adoption ledger that
@@ -83,6 +93,7 @@
 
 import { Op, phase, gate, activity, OpResource } from "@intentius/chant/op";
 import {
+  terraformInit as initStep,
   choudoufuLiveCheck as checkStep,
   choudoufuLivePlan as ledgerStep,
   choudoufuAdopt as adoptStep,
@@ -110,6 +121,12 @@ export interface TerraformAdoptOpConfig {
   gateTimeout?: string;
   /** Override the gate description shown to the approver. */
   gateDescription?: string;
+  /**
+   * `-upgrade` on the Init step: re-resolve provider and module versions.
+   * Same field, same meaning, as `TerraformApplyOpConfig.upgrade` and
+   * `TerraformWatchOpConfig.upgrade`.
+   */
+  upgrade?: boolean;
   /**
    * Directory each step starts the `chant.config.*` search from, which is what
    * `terraform.roots` and the root's relative `dir` resolve against. Default:
@@ -130,7 +147,7 @@ export interface TerraformAdoptOpConfig {
 }
 
 export interface TerraformAdoptOpResources {
-  /** Op resource. Generates the Check/Ledger/Gate/Adopt workflow. */
+  /** Op resource. Generates the Init/Check/Ledger/Gate/Adopt workflow. */
   op: InstanceType<typeof OpResource>;
 }
 
@@ -178,6 +195,7 @@ export function TerraformAdoptOp(config: TerraformAdoptOpConfig): TerraformAdopt
       TerraformMode: "live",
     },
     phases: [
+      phase("Init", [initStep(config.root, { ...where, ...(config.upgrade ? { upgrade: true } : {}) })]),
       phase("Check", [check]),
       phase("Ledger", [ledger]),
       phase("Gate", [

package/src/composites/terraform-apply-op.test.ts

@@ -351,3 +351,35 @@ describe("TerraformApplyOp on a live root (#2106 follow-up)", () => {
     expect(fns).toEqual(["terraformInit", "terraformPlan", "terraformApply"]);
   });
 });
+
+/**
+ * #2300 — the gate binds the plan. The Plan step publishes `planDigest` and
+ * the Gate step references it, so the resolution `chant approve` writes names
+ * the plan it approves. Before this, INTENTIUS/choudoufu#1026 approved,
+ * renamed a resource in the root, re-ran, and watched the apply proceed.
+ */
+describe("TerraformApplyOp binds the gate to the plan (#2300)", () => {
+  test("the gate step references the Plan step's own digest", () => {
+    const op = props({ name: "app-apply", root: "app" });
+    const gate = op.phases.find((p) => p.name === "Gate")!.steps.find(isGate)!;
+    expect(isStepOutputRef(gate.plan)).toBe(true);
+    expect(gate.plan).toMatchObject({ step: "plan", path: "planDigest" });
+  });
+
+  test("a run records the plan on the pending fact it leaves behind", async () => {
+    const op = props({ name: "prod-apply", root: "app" });
+    const digest = `sha256:${"c".repeat(64)}`;
+    const activities = new Map<string, (args: Record<string, unknown>) => Promise<unknown>>([
+      ["terraformInit", async () => ({})],
+      ["terraformPlan", async () => ({ planFile: "chant.tfplan", planDigest: digest })],
+      ["terraformShow", async () => ({})],
+      ["terraformApply", async () => ({})],
+    ]);
+    const gates = memoryGateLedgerPort();
+    const result = await runOpLocally(op, activities, {}, undefined, { gates, now: "2026-09-09T12:00:00.000Z" });
+
+    expect(result.status).toBe("gated");
+    expect(result.gate?.planDigest).toBe(digest);
+    expect(gates.appended[0].planDigest).toBe(digest);
+  });
+});

package/src/composites/terraform-apply-op.ts

@@ -56,11 +56,21 @@
  *
  * A gate is a fact on the gate ledger, not a wait (#2119). Reaching one,
  * `chant run` consults the ledger (`packages/core/src/op/gate.ts`): a
- * resolution newer than the gate's newest pending fact lets the run walk
- * through, and anything else records the pending fact and ends the run with
- * status `gated` and exit 3. `chant approve <op> <gate>` writes the
- * resolution, and the next run reads it. `gate: "never"` drops the Gate phase
- * entirely, so a run never stops.
+ * resolution recorded for this run's own plan lets the run walk through, and
+ * anything else records the pending fact and ends the run with status `gated`
+ * and exit 3. `chant approve <op> <gate>` writes the resolution, and the next
+ * run reads it. `gate: "never"` drops the Gate phase entirely, so a run never
+ * stops.
+ *
+ * **The gate binds the plan** (#2300). The Plan step publishes
+ * `planDigest` — its `terraform show -json` change set, hashed — and the Gate
+ * step references it, so the resolution names the plan it approves. That
+ * closes the window the exit-3 refusal above does not: exit 3 compares the
+ * Apply step's fresh plan against the *file* it was handed inside one run,
+ * and this compares a later run's fresh plan against what a human actually
+ * approved. INTENTIUS/choudoufu#1026 measured the gap by approving, renaming
+ * a resource, and re-running: the second run applied without complaint. It
+ * now stops, naming the approved digest and the planned one.
  *
  * @example
  * ```typescript
@@ -226,6 +236,11 @@ export function TerraformApplyOp(config: TerraformApplyOpConfig): TerraformApply
         show,
         gate(config.gateName ?? config.signalName ?? `approve-${config.name}`, {
           ...(config.gateTimeout ? { timeout: config.gateTimeout } : {}),
+          // #2300: the approval is for this plan, not for the next run. The
+          // Plan step's digest rides onto the pending fact, `chant approve`
+          // copies it onto the resolution, and a later run whose fresh plan
+          // digests differently is refused with both digests named.
+          plan: plan.out.planDigest,
           description:
             config.gateDescription ??
             `Approve terraform apply of ${live ? "live " : ""}root "${config.root}" (gate: ${gateMode}). ` +

package/src/composites/terraform-watch-op.test.ts

@@ -103,6 +103,20 @@ describe("TerraformWatchOp finding modes (#2087)", () => {
     expect(step.outcomeAttribute).toEqual({ name: "Comment", from: "commentUrl" });
   });
 
+  test("the finding step names its Op, so two watches over one root cannot collide (#2319)", () => {
+    // The pairing #2319 names: a stock drift watch and a `live: true` one over
+    // the same root is what this composite is built for, and both pass the
+    // root as `env`. Before #2319 that was the whole marker, so each nightly
+    // run PATCHed the title and body of the other Op's issue.
+    expect(findingStep("issue").args?.op).toBe("app-watch");
+    const stock = props({ name: "app-drift", root: "app", findingMode: "issue" });
+    const paired = props({ name: "app-drift-nightly", root: "app", findingMode: "issue" });
+    const a = stock.phases[2].steps[0] as ActivityStep;
+    const b = paired.phases[2].steps[0] as ActivityStep;
+    expect(a.args?.env).toBe(b.args?.env);
+    expect(a.args?.op).not.toBe(b.args?.op);
+  });
+
   test("the finding step derives no plan of its own", () => {
     // `entries: []` is what stops reconcilePr shelling to `chant lifecycle
     // plan --json`: the finding is already written by the time it runs.

package/src/composites/terraform-watch-op.ts

@@ -269,11 +269,21 @@ export function TerraformWatchOp(config: TerraformWatchOpConfig): TerraformWatch
     // terraform that is the root, which with its workspace is the deployment
     // target. `entries: []` and `body` together mean the activity opens what
     // it is given rather than running `chant lifecycle plan` to find out.
+    //
+    // `op` is what keeps the sticky issue this Op's own (#2319). The root
+    // alone does not: a stock drift watch and a `live: true` watch over one
+    // root is the pairing this composite is built for, and before #2319 both
+    // resolved to one env-keyed marker, so each nightly run rewrote the
+    // other's issue title and body. Two Ops in a project do not share a raw
+    // name — it names the Op's output directory — though the marker carries
+    // the slug rather than the raw name, and the slug is not injective; see
+    // `issueMarker` for what that leaves and why it is accepted.
     const report: ActivityStep = {
       kind: "activity",
       fn: "reconcilePr",
       args: {
         env: config.root,
+        op: config.name,
         mode: findingMode,
         entries: [],
         title: config.title ?? `Terraform drift in root "${config.root}"`,

package/src/op/activities/terraform.test.ts

@@ -29,6 +29,8 @@ import {
   terraformEnvironment,
   terraformBinary,
   countPlanChanges,
+  terraformPlanChangeSet,
+  terraformPlanDigest,
   quoteArg,
   DEFAULT_PLAN_FILE,
 } from "./terraform";
@@ -253,6 +255,79 @@ describe("countPlanChanges (#2086)", () => {
   });
 });
 
+/**
+ * #2300. The digest is what a `TerraformApplyOp` gate binds its approval to,
+ * so what it covers and what it ignores is the contract an approver is
+ * relying on. Taken over the `show -json` rendering rather than the plan
+ * file's bytes: two `plan -out` runs over an unchanged root write different
+ * bytes and the same plan.
+ */
+describe("terraformPlanDigest (#2300)", () => {
+  test("the same change set digests the same across renderings that differ only in noise", () => {
+    const a = JSON.parse(PLAN_JSON) as Record<string, unknown>;
+    const b = {
+      ...JSON.parse(PLAN_JSON) as Record<string, unknown>,
+      format_version: "1.3",
+      terraform_version: "1.9.0",
+      timestamp: "2026-09-09T12:00:00Z",
+      prior_state: { anything: true },
+      configuration: { root_module: { resources: ["moved around"] } },
+      checks: [],
+    };
+    expect(terraformPlanDigest(b)).toBe(terraformPlanDigest(a));
+  });
+
+  test("a renamed resource changes it — the exact edit choudoufu#1026 made between approve and re-run", () => {
+    const before = JSON.parse(PLAN_JSON) as { resource_changes: { address: string }[] };
+    const after = JSON.parse(PLAN_JSON) as { resource_changes: { address: string }[] };
+    after.resource_changes[0].address = "null_resource.renamed";
+    expect(terraformPlanDigest(after)).not.toBe(terraformPlanDigest(before));
+  });
+
+  test("a changed planned value changes it, even at the same addresses and actions", () => {
+    const before = { resource_changes: [{ address: "null_resource.a", change: { actions: ["create"], after: { triggers: { v: "1" } } } }] };
+    const after = { resource_changes: [{ address: "null_resource.a", change: { actions: ["create"], after: { triggers: { v: "2" } } } }] };
+    expect(terraformPlanDigest(after)).not.toBe(terraformPlanDigest(before));
+  });
+
+  test("a changed action changes it — create is not destroy", () => {
+    const create = { resource_changes: [{ address: "null_resource.a", change: { actions: ["create"] } }] };
+    const destroy = { resource_changes: [{ address: "null_resource.a", change: { actions: ["delete"] } }] };
+    expect(terraformPlanDigest(destroy)).not.toBe(terraformPlanDigest(create));
+  });
+
+  test("output changes are part of the plan", () => {
+    const withOutput = { resource_changes: [], output_changes: { url: { actions: ["create"], after: "https://a" } } };
+    const withOther = { resource_changes: [], output_changes: { url: { actions: ["create"], after: "https://b" } } };
+    expect(terraformPlanDigest(withOther)).not.toBe(terraformPlanDigest(withOutput));
+  });
+
+  test("the emitter's iteration order does not change the answer", () => {
+    const one = { resource_changes: [{ address: "b", change: { actions: ["create"] } }, { address: "a", change: { actions: ["create"] } }] };
+    const two = { resource_changes: [{ address: "a", change: { actions: ["create"] } }, { address: "b", change: { actions: ["create"] } }] };
+    expect(terraformPlanDigest(one)).toBe(terraformPlanDigest(two));
+  });
+
+  test("a plan with no resource_changes still digests, rather than throwing", () => {
+    expect(terraformPlanDigest({ format_version: "1.2" })).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(terraformPlanDigest(null)).toMatch(/^sha256:[0-9a-f]{64}$/);
+  });
+
+  test("the change set keeps the fields an approver reads and drops the rest", () => {
+    const { resourceChanges } = terraformPlanChangeSet({
+      timestamp: "2026-09-09T12:00:00Z",
+      resource_changes: [{
+        address: "null_resource.a", mode: "managed", type: "null_resource", name: "a",
+        provider_name: "registry.terraform.io/hashicorp/null",
+        change: { actions: ["create"], before: null, after: { x: 1 }, after_unknown: {}, before_sensitive: false },
+      }],
+    });
+    expect(resourceChanges[0]).toMatchObject({ address: "null_resource.a", actions: ["create"], after: { x: 1 } });
+    expect(resourceChanges[0]).not.toHaveProperty("before_sensitive");
+    expect(resourceChanges[0]).not.toHaveProperty("change");
+  });
+});
+
 // ── Root resolution ─────────────────────────────────────────────────────────
 
 describe("root resolution against terraform.roots (#2086)", () => {
@@ -323,6 +398,16 @@ describe("terraformPlan — the -detailed-exitcode mapping (#2086)", () => {
     ]);
   });
 
+  // #2300 — the Plan phase is where the plan gets its identity, so the
+  // activity's own result carries it and the Gate step references it from
+  // there rather than re-reading the file.
+  test("the result carries the plan's digest, taken off the show -json rendering", async () => {
+    const dir = project({ roots: { app: { dir: "./infra" } } });
+    showReplies();
+    const result = await terraformPlan({ root: "app", cwd: dir });
+    expect(result.planDigest).toBe(terraformPlanDigest(JSON.parse(PLAN_JSON)));
+  });
+
   test("exit 2: changed, and the plan is still shown", async () => {
     const dir = project({ roots: { app: { dir: "./infra" } } });
     replies.push({ match: "plan ", reply: execError(2, "", "Plan: 2 to add...\n") });

package/src/op/activities/terraform.ts

@@ -44,6 +44,7 @@ import { writeFileSync } from "node:fs";
 import { promisify } from "node:util";
 import { resolve, dirname, join } from "node:path";
 import { loadChantConfigUpward } from "@intentius/chant/config";
+import { computePlanDigest } from "@intentius/chant/op";
 import type { TerraformConfig, TerraformRootConfig } from "../../config";
 import { detectLiveEstate } from "./live-detect";
 import {
@@ -247,6 +248,92 @@ export interface PlanChangeCounts {
   destroys: number;
 }
 
+/**
+ * One resource's proposed change, as a plan digest sees it (#2300) — the
+ * projection of a `terraform show -json` `resource_changes` entry that
+ * survives into {@link terraformPlanDigest}.
+ */
+export interface TerraformPlannedChange {
+  address: unknown;
+  mode: unknown;
+  type: unknown;
+  name: unknown;
+  index: unknown;
+  provider_name: unknown;
+  deposed: unknown;
+  actions: unknown;
+  before: unknown;
+  after: unknown;
+  after_unknown: unknown;
+  replace_paths: unknown;
+  importing: unknown;
+}
+
+/**
+ * The change set a `terraform show -json` plan describes, canonicalised
+ * (#2300): every proposed change, at its address, with the values that would
+ * be written, sorted so two renderings of the same plan project identically.
+ *
+ * Everything else in the document is dropped, and the drops are the point —
+ * see `packages/core/src/lifecycle/plan-digest.ts` for the general rule. Here
+ * that means `timestamp` and `terraform_version` (when the plan was taken and
+ * by which binary), `format_version` (how it was rendered), `prior_state` and
+ * `planned_values` (restatements of the same change set from another angle),
+ * `configuration` (the source that produced it, which can be refactored
+ * without changing a single proposed action) and `checks` / `relevant_
+ * attributes` (diagnostics about the plan, not the plan). What is left is
+ * what applying it would do.
+ */
+export function terraformPlanChangeSet(planJson: unknown): {
+  resourceChanges: TerraformPlannedChange[];
+  outputChanges: unknown;
+} {
+  const doc = planJson as { resource_changes?: unknown; output_changes?: unknown } | null | undefined;
+  const raw = Array.isArray(doc?.resource_changes) ? doc.resource_changes : [];
+  const resourceChanges = raw.map((entry): TerraformPlannedChange => {
+    const e = (entry ?? {}) as Record<string, unknown>;
+    const change = (e.change ?? {}) as Record<string, unknown>;
+    return {
+      address: e.address,
+      mode: e.mode,
+      type: e.type,
+      name: e.name,
+      index: e.index,
+      provider_name: e.provider_name,
+      deposed: e.deposed,
+      actions: change.actions,
+      before: change.before,
+      after: change.after,
+      after_unknown: change.after_unknown,
+      replace_paths: change.replace_paths,
+      importing: change.importing,
+    };
+  });
+  // terraform already emits these in address order, but nothing in the format
+  // promises it, and a digest that depends on the emitter's iteration order
+  // would refuse a plan that is identical in every way that matters.
+  resourceChanges.sort((a, b) =>
+    `${String(a.address)}\u0000${String(a.deposed ?? "")}`.localeCompare(
+      `${String(b.address)}\u0000${String(b.deposed ?? "")}`,
+    ),
+  );
+  return { resourceChanges, outputChanges: doc?.output_changes ?? {} };
+}
+
+/**
+ * The identity of a terraform plan (#2300): {@link terraformPlanChangeSet}
+ * hashed. This is what a `TerraformApplyOp` gate binds its approval to, and
+ * what a later run recomputes and compares.
+ *
+ * Taken over the `show -json` rendering rather than the plan file's bytes on
+ * purpose: the file is an opaque, version-stamped archive, and two runs of
+ * `plan -out` over an unchanged root produce different bytes. The rendering
+ * is the same plan both times.
+ */
+export function terraformPlanDigest(planJson: unknown): string {
+  return computePlanDigest("terraform-plan", terraformPlanChangeSet(planJson));
+}
+
 /** What {@link terraformPlan} resolved. Carries the plan itself, so no later step re-plans. */
 export interface TerraformPlanResult extends PlanChangeCounts {
   /** `true` when terraform reported exit 2 under `-detailed-exitcode`: the plan proposes changes. */
@@ -259,6 +346,13 @@ export interface TerraformPlanResult extends PlanChangeCounts {
   json: unknown;
   /** `terraform show -no-color <planFile>` — the human-readable plan. */
   text: string;
+  /**
+   * This plan's identity (#2300) — {@link terraformPlanDigest} over
+   * {@link TerraformPlanResult.json}. Hand it to a gate step's `plan` so the
+   * approval binds to this plan and not to the next run: `gate(name, { plan:
+   * plan.out.planDigest })`.
+   */
+  planDigest: string;
 }
 
 /**
@@ -858,7 +952,15 @@ export async function terraformPlan(
   const textRun = await run(terraformShowCommand({ binary, json: false, planFile }), dir, env, signal);
   const json: unknown = JSON.parse(jsonRun.stdout);
 
-  return { changed, planFile, dir, json, text: textRun.stdout, ...countPlanChanges(json) };
+  return {
+    changed,
+    planFile,
+    dir,
+    json,
+    text: textRun.stdout,
+    planDigest: terraformPlanDigest(json),
+    ...countPlanChanges(json),
+  };
 }
 
 /**

package/src/op/activity-contracts.ts

@@ -84,6 +84,7 @@ export const terraformPlanContract = activityContract(
     dir: z.string(),
     json: z.unknown(),
     text: z.string(),
+    planDigest: z.string(),
   }),
   rootEntity,
 );