@msn-control/liftoff 0.11.3 → 0.12.0

package/dist/adapters/state/native-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-command.js","sourceRoot":"","sources":["../../../src/adapters/state/native-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAMpE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ;IACvD,eAAe,EAAE,eAAe,EAAE,qBAAqB,EAAE,cAAc;IACvE,gBAAgB,EAAE,0BAA0B,EAAE,aAAa;IAC3D,kBAAkB,EAAE,mBAAmB,EAAE,iBAAiB;IAC1D,aAAa;IACb,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc;CACzE,CAAC,CAAC;AAEH,MAAM,OAAO,8BAA8B;IAIZ,OAAO;IAH3B,cAAc,CAAS;IAChC,UAAU,CAAiC;IAC3C,WAAW,GAAG,CAAC,CAAC;IAChB,YAA6B,OAO5B;uBAP4B,OAAO;QAQlC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACxH,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,8BAA8B,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAA4B;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC9I,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACzH,WAAW,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mFAAmF,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;eACjI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACjI,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;mBAC9E,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrI,CAAC;QACD,WAAW,CAAC,WAAW,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5E,WAAW,CAAC,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ;eAC9E,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC,4BAA4B,EAAE,0BAA0B,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzE,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,0BAA0B,CAAC,CAAC;YAC7F,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;YACjB,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG;YACzE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG;YACxD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC;YACjD,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,sBAAsB,CAAC;YAClE,gBAAgB,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;YAC7D,8BAA8B,EAAE,MAAM,EAAE,mCAAmC,EAAE,MAAM;SACpF,CAAC,CAAC;QACH,WAAW,CAAC,UAAU,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBACvC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG;gBAC3F,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM;gBACzF,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,aAAa,EAAE,KAAK;aACrF,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,CAAC;gBAAS,CAAC;YAAC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QACrE,IAAI,OAAO,EAAE,MAAM,KAAK,UAAU;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC;IAC3D,CAAC;CACF"}

package/dist/adapters/state/native-files.d.ts

@@ -0,0 +1,2 @@
+export declare function writePrivateNativeFile(filename: string, bytes: string | Uint8Array, exclusive?: boolean): Promise<void>;
+export declare function readPrivateNativeFile(filename: string, maximumBytes: number): Promise<Uint8Array>;

package/dist/adapters/state/native-files.js

@@ -0,0 +1,47 @@
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { stateAssert } from '../../domain/repair/stateful-invariants.js';
+async function inspectNativeFile(filename) {
+    stateAssert(path.isAbsolute(filename) && await realpath(path.dirname(filename)) === path.dirname(filename), 'unsafe-path');
+    const existing = await lstat(filename).catch((error) => {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    });
+    stateAssert(!existing || (existing.isFile() && !existing.isSymbolicLink() && existing.nlink === 1), 'unsafe-path');
+    return existing;
+}
+export async function writePrivateNativeFile(filename, bytes, exclusive = false) {
+    const before = await inspectNativeFile(filename);
+    stateAssert(!exclusive || !before, 'unsafe-path');
+    const file = await open(filename, constants.O_WRONLY | constants.O_CREAT | (constants.O_NOFOLLOW ?? 0)
+        | (exclusive ? constants.O_EXCL : 0), 0o600);
+    try {
+        const current = await file.stat();
+        stateAssert(current.isFile() && current.nlink === 1
+            && (!before || (current.ino === before.ino && current.dev === before.dev)), 'unsafe-path');
+        await file.chmod(0o600);
+        await file.truncate(0);
+        await file.writeFile(bytes);
+        await file.sync();
+    }
+    finally {
+        await file.close();
+    }
+}
+export async function readPrivateNativeFile(filename, maximumBytes) {
+    const before = await inspectNativeFile(filename);
+    stateAssert(before && before.size <= maximumBytes, 'storage-limit');
+    const file = await open(filename, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+        const current = await file.stat();
+        stateAssert(current.isFile() && current.nlink === 1 && current.ino === before.ino && current.dev === before.dev
+            && current.size === before.size, 'unsafe-path');
+        return await file.readFile();
+    }
+    finally {
+        await file.close();
+    }
+}
+//# sourceMappingURL=native-files.js.map

package/dist/adapters/state/native-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-files.js","sourceRoot":"","sources":["../../../src/adapters/state/native-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAEzE,KAAK,UAAU,iBAAiB,CAAC,QAAgB;IAC/C,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;IAC3H,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;QAC5E,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACnH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,KAA0B,EAAE,SAAS,GAAG,KAAK;IAC1G,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,WAAW,CAAC,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC;UAClG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC;eAC9C,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC7F,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB,EAAE,YAAoB;IAChF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,WAAW,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE,eAAe,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;eAC1G,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAClD,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACnC,CAAC"}

package/dist/adapters/state/native-system.d.ts

@@ -0,0 +1,38 @@
+import type { ChildProcessWithoutNullStreams } from 'node:child_process';
+import { type NativeLocalStateTools, type StateRegisteredExecutable } from '../../domain/repair/stateful.js';
+export declare const nativeLocalStateProtocol: Readonly<{
+    version: 'opentofu-1.12.6-posix-fcntl';
+    tofuVersion: '1.12.6';
+    sourceCommit: "b4305e5a5dd2fb79a27897ae30784a181d3a26cb";
+    lockSource: "internal/flock/filesystem_lock_unix.go";
+    lockBlob: "c396e445a0eede26b32b97068216fe3691070d9f";
+    stateSource: "internal/states/statemgr/filesystem.go";
+    stateBlob: "3f01209ea1635c9cad5f499f4f08ce356aef9a4c";
+    lockOperation: "F_SETLK/F_WRLCK/start=0/length=0";
+    writeOperation: "seek/truncate/write/sync on the same open inode";
+}>;
+export declare function nativeStateHostId(): string;
+export declare function captureStateExecutable(filename: string): Promise<StateRegisteredExecutable>;
+export declare function verifyStateExecutable(executable: StateRegisteredExecutable): Promise<void>;
+export declare function isolatedStateEnvironment(cwd: string): NodeJS.ProcessEnv;
+export declare function startPrivateStateProcess(executable: StateRegisteredExecutable, args: readonly string[], cwd: string, environment?: NodeJS.ProcessEnv, role?: 'command' | 'lease'): Promise<ChildProcessWithoutNullStreams>;
+export declare function runPrivateStateProcess(request: {
+    executable: StateRegisteredExecutable;
+    args: readonly string[];
+    cwd: string;
+    stdin?: Uint8Array;
+    timeoutMs?: number;
+    maximumBytes?: number;
+    environment?: NodeJS.ProcessEnv;
+    signal?: AbortSignal;
+}): Promise<{
+    exitCode: number;
+    stdout: Uint8Array;
+    stderr: Uint8Array;
+}>;
+export declare function inspectNativeLocalStateTools(request: {
+    pythonPath: string;
+    tofuPath: string;
+    workingDirectory: string;
+    signal?: AbortSignal;
+}): Promise<NativeLocalStateTools>;

package/dist/adapters/state/native-system.js

@@ -0,0 +1,86 @@
+import { lstat, readFile, realpath } from 'node:fs/promises';
+import { hostname } from 'node:os';
+import path from 'node:path';
+import { stateAssert, stateDigest, stateObjectDigest } from '../../domain/repair/stateful-invariants.js';
+import { OwnedPrivateStateProcessRunner, spawnOwnedStateProcess } from './owned-process.js';
+export const nativeLocalStateProtocol = Object.freeze({
+    version: 'opentofu-1.12.6-posix-fcntl',
+    tofuVersion: '1.12.6',
+    sourceCommit: 'b4305e5a5dd2fb79a27897ae30784a181d3a26cb',
+    lockSource: 'internal/flock/filesystem_lock_unix.go',
+    lockBlob: 'c396e445a0eede26b32b97068216fe3691070d9f',
+    stateSource: 'internal/states/statemgr/filesystem.go',
+    stateBlob: '3f01209ea1635c9cad5f499f4f08ce356aef9a4c',
+    lockOperation: 'F_SETLK/F_WRLCK/start=0/length=0',
+    writeOperation: 'seek/truncate/write/sync on the same open inode'
+});
+export function nativeStateHostId() {
+    return `native-host:${stateObjectDigest({ platform: process.platform, host: hostname(), uid: process.getuid?.() })}`;
+}
+export async function captureStateExecutable(filename) {
+    stateAssert(path.isAbsolute(filename), 'tool-unavailable');
+    const resolved = await realpath(filename);
+    const info = await lstat(resolved);
+    stateAssert(info.isFile() && (info.mode & 0o022) === 0 && (info.mode & 0o111) !== 0, 'tool-unavailable');
+    return { path: resolved, sha256: stateDigest(await readFile(resolved)) };
+}
+export async function verifyStateExecutable(executable) {
+    stateAssert((await captureStateExecutable(executable.path)).sha256 === executable.sha256, 'tool-unavailable');
+}
+export function isolatedStateEnvironment(cwd) {
+    return {
+        PATH: '/usr/bin:/bin:/usr/sbin:/sbin', HOME: cwd, USERPROFILE: cwd,
+        XDG_CONFIG_HOME: cwd, TMPDIR: cwd, TMP: cwd, TEMP: cwd,
+        CHECKPOINT_DISABLE: '1', TF_IN_AUTOMATION: '1', TF_LOG: 'OFF',
+        TF_CLI_CONFIG_FILE: path.join(cwd, 'liftoff.private.tfrc'),
+        TF_DATA_DIR: path.join(cwd, '.terraform'), LC_ALL: 'C'
+    };
+}
+export async function startPrivateStateProcess(executable, args, cwd, environment = isolatedStateEnvironment(cwd), role = 'command') {
+    await verifyStateExecutable(executable);
+    stateAssert(path.isAbsolute(cwd) && args.every((arg) => !arg.includes('\0')), 'unsafe-path');
+    return spawnOwnedStateProcess({ executable: executable.path, args, cwd, environment, role });
+}
+export async function runPrivateStateProcess(request) {
+    const timeout = request.timeoutMs ?? 20_000;
+    stateAssert(timeout > 0 && timeout <= 300_000, 'invalid-binding');
+    await verifyStateExecutable(request.executable);
+    return new OwnedPrivateStateProcessRunner().run({
+        executable: request.executable.path, args: request.args, cwd: request.cwd,
+        environment: request.environment ?? isolatedStateEnvironment(request.cwd), stdin: request.stdin,
+        signal: request.signal, timeoutMs: timeout, maximumBytes: request.maximumBytes ?? 2 * 1024 * 1024
+    });
+}
+export async function inspectNativeLocalStateTools(request) {
+    stateAssert(process.platform === 'darwin', 'unsupported-native-platform');
+    const python = await captureStateExecutable(request.pythonPath);
+    const tofu = await captureStateExecutable(request.tofuPath);
+    const py = await runPrivateStateProcess({
+        executable: python, args: ['-I', '-S', '-B', '-c', 'import json,platform,sys; print(json.dumps({"implementation":platform.python_implementation(),"version":".".join(map(str,sys.version_info[:3]))}))'],
+        cwd: request.workingDirectory, signal: request.signal
+    });
+    let pythonVersion;
+    try {
+        const info = JSON.parse(Buffer.from(py.stdout).toString('utf8'));
+        stateAssert(py.exitCode === 0 && info.implementation === 'CPython' && /^3\.14\.\d+$/.test(info.version), 'native-lock-provider-required');
+        pythonVersion = info.version;
+    }
+    finally {
+        py.stdout.fill(0);
+        py.stderr.fill(0);
+    }
+    const tf = await runPrivateStateProcess({
+        executable: tofu, args: ['version', '-json'], cwd: request.workingDirectory, signal: request.signal
+    });
+    try {
+        const info = JSON.parse(Buffer.from(tf.stdout).toString('utf8'));
+        stateAssert(tf.exitCode === 0 && info.terraform_version === nativeLocalStateProtocol.tofuVersion
+            && info.platform === `darwin_${process.arch === 'arm64' ? 'arm64' : 'amd64'}`, 'unqualified-combination');
+    }
+    finally {
+        tf.stdout.fill(0);
+        tf.stderr.fill(0);
+    }
+    return { python, tofu, pythonVersion, tofuVersion: '1.12.6', hostId: nativeStateHostId() };
+}
+//# sourceMappingURL=native-system.js.map

package/dist/adapters/state/native-system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-system.js","sourceRoot":"","sources":["../../../src/adapters/state/native-system.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AACzG,OAAO,EAAE,8BAA8B,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5F,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,6BAAsC;IAC/C,WAAW,EAAE,QAAiB;IAC9B,YAAY,EAAE,0CAA0C;IACxD,UAAU,EAAE,wCAAwC;IACpD,QAAQ,EAAE,0CAA0C;IACpD,WAAW,EAAE,wCAAwC;IACrD,SAAS,EAAE,0CAA0C;IACrD,aAAa,EAAE,kCAAkC;IACjD,cAAc,EAAE,iDAAiD;CAClE,CAAC,CAAC;AAEH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,eAAe,iBAAiB,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACvH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB;IAC3D,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAqC;IAC/E,WAAW,CAAC,CAAC,MAAM,sBAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO;QACL,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG;QAClE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG;QACtD,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK;QAC7D,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC;QAC1D,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAqC,EACrC,IAAuB,EACvB,GAAW,EACX,WAAW,GAAsB,wBAAwB,CAAC,GAAG,CAAC,EAC9D,IAAI,GAAwB,SAAS;IAErC,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACxC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7F,OAAO,sBAAsB,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAS5C;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC5C,WAAW,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAClE,MAAM,qBAAqB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO,IAAI,8BAA8B,EAAE,CAAC,GAAG,CAAC;QAC9C,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;QACzE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;QAC/F,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;KAClG,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAKlD;IACC,WAAW,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,6BAA6B,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC;QACtC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oJAAoJ,CAAC;QACxM,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;KACtD,CAAC,CAAC;IACH,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,WAAW,CAAC,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC1I,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;IAC/B,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACnD,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC;QACtC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;KACpG,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,WAAW,CAAC,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,iBAAiB,KAAK,wBAAwB,CAAC,WAAW;eAC3F,IAAI,CAAC,QAAQ,KAAK,UAAU,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAC9G,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACnD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC;AAC7F,CAAC"}

package/dist/adapters/state/opentofu.d.ts

@@ -0,0 +1,35 @@
+import { type InspectedState, type PreparedStateMigration, type PrivateStateCommandRunner, type ProtectedStateWorkspace, type StateBackendKind, type StateConfigurationProvider, type StateMigrationPlan, type StateNativeDriver, type StateNativeReview, type StateRecipe, type StateRecipeQualification } from '../../domain/repair/stateful.js';
+export declare const implementedStateRecipeCombinations: readonly {
+    recipe: StateRecipe;
+    source: StateBackendKind;
+    destinations: readonly StateBackendKind[];
+    liveQualificationRequired: true;
+}[];
+export type { StateConfigurationAttestation, StateConfigurationProvider, StateRecipeQualification } from '../../domain/repair/stateful.js';
+export declare class OpenTofuStateDriver implements StateNativeDriver {
+    private readonly options;
+    constructor(options: {
+        workspace: ProtectedStateWorkspace;
+        runner: PrivateStateCommandRunner;
+        configurations: StateConfigurationProvider;
+        qualification: StateRecipeQualification;
+        now?: () => number;
+    });
+    quiesce(): Promise<void>;
+    private withScratch;
+    private qualify;
+    private run;
+    private runQuiet;
+    private backendConfiguration;
+    private minimalRoot;
+    private materialize;
+    private copyState;
+    private verifyPlannedIdentities;
+    private rootPlan;
+    review(request: Parameters<StateNativeDriver['review']>[0]): Promise<StateNativeReview>;
+    private privateState;
+    prepare(plan: StateMigrationPlan, signal?: AbortSignal): Promise<PreparedStateMigration>;
+    verify(plan: StateMigrationPlan, current: Readonly<Record<string, InspectedState>>, signal?: AbortSignal): Promise<string>;
+    verifyDestinations(plan: StateMigrationPlan, current: Readonly<Record<string, InspectedState>>, signal?: AbortSignal): Promise<string>;
+    private verifyRoots;
+}

package/dist/adapters/state/opentofu.js

@@ -0,0 +1,350 @@
+import { lstat, mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import { statefulRecipeVersion } from '../../domain/repair/stateful.js';
+import { assertNoResourceChanges, inspectStateBytes, isStateDigest, stateAssert, stateDigest, stateObjectDigest, validateStateMappings, validateStatePlanBindings, verifyStateAccounting } from '../../domain/repair/stateful-invariants.js';
+import { protectedStateScope } from './protected-workspace.js';
+import { readPrivateNativeFile, writePrivateNativeFile } from './native-files.js';
+export const implementedStateRecipeCombinations = ['local', 'azurerm'].flatMap((source) => [
+    { recipe: 'address-refactor', source, destinations: [source], liveQualificationRequired: true },
+    ...['local', 'azurerm'].map((destination) => ({
+        recipe: 'backend-relocation', source, destinations: [destination], liveQualificationRequired: true
+    })),
+    { recipe: 'state-partition', source, destinations: ['local', 'azurerm'], liveQualificationRequired: true }
+]);
+export class OpenTofuStateDriver {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async quiesce() {
+        stateAssert(this.options.runner.quiesce, 'process-tree-termination-unproven');
+        await this.options.runner.quiesce();
+    }
+    async withScratch(context, action) {
+        return this.options.workspace.withScratch(context, async (directory) => {
+            try {
+                return await action(directory);
+            }
+            finally {
+                await this.quiesce();
+            }
+        });
+    }
+    async qualify(plan) {
+        stateAssert(plan.inspection.live, 'live-scope-required');
+        validateStateMappings(plan.intent, plan.inspection.states);
+        validateStatePlanBindings(plan.intent, plan.inspection.bindings);
+        const source = plan.inspection.bindings.find((binding) => binding.id === plan.intent.sourceBackendId);
+        stateAssert(source, 'mapping-incomplete');
+        stateAssert(this.options.qualification, 'unqualified-combination');
+        await this.options.qualification.assertQualified({
+            recipeVersion: statefulRecipeVersion, recipe: plan.intent.recipe, source: source.kind,
+            destinations: plan.intent.destinationBackendIds.map((id) => {
+                const target = plan.inspection.bindings.find((binding) => binding.id === id);
+                stateAssert(target, 'mapping-incomplete');
+                return target.kind;
+            }),
+            executableDigest: this.options.runner.identityDigest, hostId: plan.context.hostId
+        });
+    }
+    async run(cwd, args, operation, signal, stdin, allowed = [0]) {
+        const result = await this.options.runner.run({ cwd, args, operation, signal, ...(stdin ? { stdin } : {}) });
+        if (!allowed.includes(result.exitCode)) {
+            result.stdout.fill(0);
+            stateAssert(false, 'native-command-failed');
+        }
+        return result;
+    }
+    async runQuiet(cwd, args, operation, signal, stdin) {
+        const result = await this.run(cwd, args, operation, signal, stdin);
+        result.stdout.fill(0);
+    }
+    async backendConfiguration(directory, statePath) {
+        await writePrivateNativeFile(path.join(directory, 'liftoff-state-backend.tf.json'), JSON.stringify({
+            terraform: { backend: { local: { path: statePath } } }
+        }));
+    }
+    async minimalRoot(directory, statePath, signal) {
+        await mkdir(directory, { mode: 0o700 });
+        const mirror = path.join(directory, 'provider-mirror');
+        await mkdir(mirror, { mode: 0o700 });
+        await writePrivateNativeFile(path.join(directory, 'liftoff.private.tfrc'), `disable_checkpoint = true\nprovider_installation {\n  filesystem_mirror {\n    path = ${JSON.stringify(mirror)}\n  }\n}\n`);
+        await this.backendConfiguration(directory, statePath);
+        await this.runQuiet(directory, ['init', '-input=false', '-no-color', '-get=false'], 'inspect', signal);
+    }
+    async materialize(reference, directory, context, signal) {
+        await mkdir(directory, { mode: 0o700 });
+        const proof = await this.options.configurations.materialize(reference, directory, context, signal);
+        stateAssert(proof?.stateFormat === 'opentofu-v4-json', 'unsupported-encryption');
+        stateAssert(proof.configurationRef === reference && isStateDigest(proof.configurationDigest)
+            && proof.artifactDigest === context.artifactDigest && proof.backendNeutral
+            && proof.providerRegistration === 'disabled' && proof.provisioners.length === 0
+            && proof.externalPrograms.length === 0 && proof.uninspectedDataSources.length === 0
+            && proof.unresolvedModules.length === 0 && proof.moduleDigests.every(isStateDigest)
+            && typeof proof.providerMirrorDirectory === 'string' && path.isAbsolute(proof.providerMirrorDirectory)
+            && !/[\x00-\x1f]/.test(proof.providerMirrorDirectory)
+            && proof.providers.length > 0 && proof.providers.every((provider) => /^registry\.(?:opentofu|terraform)\.org\/hashicorp\/azurerm$/.test(provider.source)
+            && /^\d+\.\d+\.\d+$/.test(provider.version) && isStateDigest(provider.binaryDigest)), 'unsafe-planning-contract');
+        stateAssert(new Set(proof.providers.map((provider) => provider.source)).size === proof.providers.length, 'unsafe-planning-contract');
+        await this.options.configurations.verifyMaterialized(reference, directory, proof, signal);
+        await writePrivateNativeFile(path.join(directory, 'liftoff.private.tfrc'), `disable_checkpoint = true\nprovider_installation {\n  filesystem_mirror {\n    path = ${JSON.stringify(proof.providerMirrorDirectory)}\n    include = ${JSON.stringify(proof.providers.map((provider) => provider.source))}\n  }\n}\n`);
+        return proof;
+    }
+    async copyState(state, destination, context) {
+        stateAssert(state.stateRef && state.snapshot.digest, 'artifact-integrity');
+        const bytes = await this.options.workspace.get(state.stateRef, 'state', protectedStateScope(context));
+        try {
+            stateAssert(stateDigest(bytes) === state.snapshot.digest, 'artifact-integrity');
+            await writePrivateNativeFile(destination, bytes, true);
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+    verifyPlannedIdentities(plan, expected) {
+        const plannedValues = plan.planned_values;
+        stateAssert(plannedValues && typeof plannedValues === 'object', 'verification-incomplete');
+        const found = new Map();
+        const visit = (value) => {
+            stateAssert(value && typeof value === 'object', 'verification-incomplete');
+            const module = value;
+            stateAssert(module.resources === undefined || Array.isArray(module.resources), 'verification-incomplete');
+            for (const resource of module.resources ?? []) {
+                stateAssert(typeof resource.address === 'string' && typeof resource.values?.id === 'string' && !found.has(resource.address), 'verification-incomplete');
+                found.set(resource.address, stateDigest(resource.values.id));
+            }
+            stateAssert(module.child_modules === undefined || Array.isArray(module.child_modules), 'verification-incomplete');
+            for (const child of module.child_modules ?? [])
+                visit(child);
+        };
+        visit(plannedValues.root_module ?? {});
+        stateAssert(found.size === expected.length && expected.every((instance) => found.get(instance.address) === instance.identityDigest), 'resource-identity-changed');
+    }
+    async rootPlan(request) {
+        const attestation = await this.materialize(request.reference, request.directory, request.context, request.signal);
+        stateAssert(request.expectedConfigurationDigest === undefined || request.expectedConfigurationDigest === attestation.configurationDigest, 'configuration-changed');
+        await this.backendConfiguration(request.directory, request.statePath);
+        await this.runQuiet(request.directory, ['init', '-input=false', '-no-color', '-get=false', '-lockfile=readonly'], 'inspect', request.signal);
+        const saved = path.join(request.directory, 'reviewed.tfplan');
+        const result = await this.run(request.directory, [
+            'plan', '-input=false', '-no-color', '-refresh=true', '-lock=true', '-lock-timeout=10s',
+            '-detailed-exitcode', `-out=${saved}`
+        ], request.operation, request.signal, undefined, [0, 2]);
+        result.stdout.fill(0);
+        const shown = await this.run(request.directory, ['show', '-json', saved], 'inspect', request.signal);
+        let parsed;
+        try {
+            parsed = JSON.parse(Buffer.from(shown.stdout).toString('utf8'));
+        }
+        catch {
+            stateAssert(false, 'verification-incomplete');
+        }
+        finally {
+            shown.stdout.fill(0);
+        }
+        stateAssert(typeof parsed.format_version === 'string' && /^1\.\d+$/.test(parsed.format_version), 'verification-incomplete');
+        assertNoResourceChanges(parsed, request.strict);
+        this.verifyPlannedIdentities(parsed, request.instances);
+        if (request.strict)
+            stateAssert(result.exitCode === 0, 'verification-incomplete');
+        await this.options.configurations.verifyMaterialized(request.reference, request.directory, attestation, request.signal);
+        const bytes = await readPrivateNativeFile(saved, 64 * 1024 * 1024);
+        let savedRef;
+        let savedDigest;
+        try {
+            const artifact = await this.options.workspace.put('plan', protectedStateScope(request.context), bytes);
+            savedRef = artifact.ref;
+            savedDigest = artifact.digest;
+        }
+        finally {
+            bytes.fill(0);
+        }
+        if (request.applyPrivateStateOnly) {
+            stateAssert(request.operation === 'transform', 'unsafe-planning-contract');
+            await this.runQuiet(request.directory, ['apply', '-input=false', '-no-color', saved], 'transform', request.signal);
+        }
+        return {
+            proofDigest: stateObjectDigest({
+                config: attestation.configurationDigest, plan: stateObjectDigest(parsed),
+                binary: this.options.runner.identityDigest, refresh: true
+            }),
+            savedRef, savedDigest, exitCode: result.exitCode, configurationDigest: attestation.configurationDigest
+        };
+    }
+    async review(request) {
+        await this.qualify(request);
+        return this.withScratch(request.context, async (directory) => {
+            const source = request.inspection.states.find((state) => state.snapshot.backendId === request.intent.sourceBackendId);
+            const sourcePath = path.join(directory, 'source.tfstate');
+            await this.copyState(source, sourcePath, request.context);
+            const contracts = [];
+            let index = 0;
+            for (const reference of Object.values(request.intent.targetConfigurationRefs)) {
+                contracts.push(await this.materialize(reference, path.join(directory, `inspect-target-${index++}`), request.context, request.signal));
+            }
+            stateAssert(stateObjectDigest(contracts.map((entry) => [entry.configurationRef, entry.configurationDigest]).sort()) === request.intent.targetConfigurationDigest, 'configuration-changed');
+            const sourceRoot = path.join(directory, 'source-plan');
+            const proof = await this.rootPlan({
+                reference: request.intent.sourceConfigurationRef, directory: sourceRoot, statePath: sourcePath,
+                context: request.context, instances: source.instances, strict: true, operation: 'inspect', signal: request.signal
+            });
+            // Preview validates native address syntax without moving even private state.
+            for (const mapping of request.intent.mappings) {
+                if (mapping.sourceAddress === mapping.destinationAddress || mapping.disposition === 'preserve')
+                    continue;
+                await this.runQuiet(sourceRoot, [
+                    'state', 'mv', '-dry-run', '-lock=true', '-lock-timeout=10s', `-state=${sourcePath}`,
+                    mapping.sourceAddress, mapping.destinationAddress
+                ], 'inspect', request.signal);
+            }
+            return {
+                configurationDigest: request.context.configurationDigest,
+                configurationDigests: Object.fromEntries([
+                    ...contracts.map((contract) => [contract.configurationRef, contract.configurationDigest]),
+                    [request.intent.sourceConfigurationRef, proof.configurationDigest]
+                ]),
+                contractDigest: stateObjectDigest({ contracts, binary: this.options.runner.identityDigest }),
+                savedPlanRefs: [proof.savedRef], savedPlanDigests: [proof.savedDigest]
+            };
+        });
+    }
+    async privateState(backendId, filename, original, context, purpose) {
+        const info = await lstat(filename).catch((error) => {
+            stateAssert(error.code === 'ENOENT', 'unsafe-path');
+            return null;
+        });
+        if (!info) {
+            const empty = inspectStateBytes({
+                ...original.snapshot, backendId, exists: false, version: null, etag: null, size: 0
+            }, null);
+            return { ...empty, stateRef: null };
+        }
+        stateAssert(info.isFile() && !info.isSymbolicLink() && info.nlink === 1, 'unsafe-path');
+        stateAssert(info.size > 0 && info.size <= 32 * 1024 * 1024, 'invalid-state');
+        const bytes = await readPrivateNativeFile(filename, 32 * 1024 * 1024);
+        try {
+            const inspected = inspectStateBytes({
+                ...original.snapshot, backendId, exists: true, size: bytes.byteLength,
+                observedAt: this.options.now?.() ?? Date.now()
+            }, bytes);
+            const saved = await this.options.workspace.put(purpose, protectedStateScope(context), bytes);
+            return { ...inspected, stateRef: saved.ref };
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+    async prepare(plan, signal) {
+        await this.qualify({ context: plan.context, inspection: plan.inspection, intent: plan.intent, signal });
+        return this.withScratch(plan.context, async (directory) => {
+            const contracts = [];
+            let contractIndex = 0;
+            for (const reference of Object.values(plan.intent.targetConfigurationRefs)) {
+                contracts.push(await this.materialize(reference, path.join(directory, `recheck-target-${contractIndex++}`), plan.context, signal));
+            }
+            stateAssert(stateObjectDigest(contracts.map((entry) => [entry.configurationRef, entry.configurationDigest]).sort()) === plan.intent.targetConfigurationDigest
+                && stateObjectDigest({ contracts, binary: this.options.runner.identityDigest }) === plan.review.contractDigest, 'configuration-changed');
+            for (let index = 0; index < plan.review.savedPlanRefs.length; index++) {
+                const bytes = await this.options.workspace.get(plan.review.savedPlanRefs[index], 'plan', protectedStateScope(plan.context));
+                try {
+                    stateAssert(stateDigest(bytes) === plan.review.savedPlanDigests[index], 'artifact-integrity');
+                }
+                finally {
+                    bytes.fill(0);
+                }
+            }
+            const source = plan.inspection.states.find((state) => state.snapshot.backendId === plan.intent.sourceBackendId);
+            const filenames = Object.fromEntries(plan.inspection.states.map((state, index) => [state.snapshot.backendId, path.join(directory, `state-${index}.tfstate`)]));
+            const sourcePath = filenames[plan.intent.sourceBackendId];
+            await this.copyState(source, sourcePath, plan.context);
+            const nativeRoot = path.join(directory, 'native');
+            await this.minimalRoot(nativeRoot, sourcePath, signal);
+            if (plan.intent.recipe === 'backend-relocation') {
+                const destinationPath = filenames[plan.intent.destinationBackendIds[0]];
+                await this.backendConfiguration(nativeRoot, destinationPath);
+                await this.runQuiet(nativeRoot, [
+                    'init', '-migrate-state', '-input=true', '-no-color', '-get=false', '-lock-timeout=10s'
+                ], 'transform', signal, Buffer.from('yes\n'));
+            }
+            else {
+                for (const mapping of plan.intent.mappings) {
+                    if (mapping.disposition === 'preserve'
+                        || (mapping.destinationBackendId === plan.intent.sourceBackendId && mapping.sourceAddress === mapping.destinationAddress))
+                        continue;
+                    await this.runQuiet(nativeRoot, [
+                        'state', 'mv', '-lock=true', '-lock-timeout=10s', `-state=${sourcePath}`,
+                        ...(mapping.destinationBackendId === plan.intent.sourceBackendId ? [] : [`-state-out=${filenames[mapping.destinationBackendId]}`]),
+                        mapping.sourceAddress, mapping.destinationAddress
+                    ], 'transform', signal);
+                }
+            }
+            const preliminary = {};
+            for (const state of plan.inspection.states) {
+                const id = state.snapshot.backendId;
+                if (plan.intent.recipe === 'backend-relocation' && id === plan.intent.sourceBackendId)
+                    continue;
+                preliminary[id] = await this.privateState(id, filenames[id], state, plan.context, 'candidate');
+            }
+            verifyStateAccounting(plan.intent, source, preliminary, true);
+            const candidates = {};
+            const proofs = [];
+            let index = 0;
+            for (const [id, candidate] of Object.entries(preliminary)) {
+                if (candidate.instances.length === 0)
+                    continue;
+                const reference = plan.intent.targetConfigurationRefs[id];
+                stateAssert(reference, 'mapping-incomplete');
+                await this.rootPlan({
+                    reference, directory: path.join(directory, `target-prepare-${index}`), statePath: filenames[id],
+                    context: plan.context, instances: candidate.instances, strict: false, operation: 'transform',
+                    applyPrivateStateOnly: true, signal, expectedConfigurationDigest: plan.review.configurationDigests[reference]
+                });
+                const prepared = await this.privateState(id, filenames[id], candidate, plan.context, 'candidate');
+                const verified = await this.rootPlan({
+                    reference, directory: path.join(directory, `target-verify-${index++}`), statePath: filenames[id],
+                    context: plan.context, instances: prepared.instances, strict: true, operation: 'inspect', signal,
+                    expectedConfigurationDigest: plan.review.configurationDigests[reference]
+                });
+                candidates[id] = prepared;
+                proofs.push(verified.proofDigest);
+            }
+            verifyStateAccounting(plan.intent, source, candidates, false);
+            return { candidates, verificationDigest: stateObjectDigest(proofs) };
+        });
+    }
+    async verify(plan, current, signal) {
+        await this.qualify({ context: plan.context, inspection: plan.inspection, intent: plan.intent, signal });
+        const source = plan.inspection.states.find((state) => state.snapshot.backendId === plan.intent.sourceBackendId);
+        verifyStateAccounting(plan.intent, source, current, false);
+        return this.verifyRoots(plan, current, signal);
+    }
+    async verifyDestinations(plan, current, signal) {
+        await this.qualify({ context: plan.context, inspection: plan.inspection, intent: plan.intent, signal });
+        const ids = new Set(plan.intent.destinationBackendIds);
+        stateAssert(Object.keys(current).length === ids.size && Object.keys(current).every((id) => ids.has(id)), 'mapping-incomplete');
+        const source = plan.inspection.states.find((state) => state.snapshot.backendId === plan.intent.sourceBackendId);
+        const mappings = plan.intent.mappings.filter((mapping) => ids.has(mapping.destinationBackendId));
+        verifyStateAccounting({ ...plan.intent, mappings }, source, current, false);
+        return this.verifyRoots(plan, current, signal);
+    }
+    async verifyRoots(plan, current, signal) {
+        return this.withScratch(plan.context, async (directory) => {
+            const proofs = [];
+            let index = 0;
+            for (const [id, state] of Object.entries(current)) {
+                if (!state.snapshot.exists || state.instances.length === 0)
+                    continue;
+                const filename = path.join(directory, `verify-${index}.tfstate`);
+                await this.copyState(state, filename, plan.context);
+                const proof = await this.rootPlan({
+                    reference: plan.intent.targetConfigurationRefs[id], directory: path.join(directory, `verify-root-${index++}`),
+                    statePath: filename, context: plan.context, instances: state.instances, strict: true, operation: 'inspect', signal,
+                    expectedConfigurationDigest: plan.review.configurationDigests[plan.intent.targetConfigurationRefs[id]]
+                });
+                proofs.push(proof.proofDigest);
+            }
+            return stateObjectDigest(proofs);
+        });
+    }
+}
+//# sourceMappingURL=opentofu.js.map