@quadnix/octo 0.0.30 → 0.2.0

package/dist/modes/run-action.mode.js

@@ -0,0 +1,140 @@
+import { TransactionError } from '../errors/index.js';
+import { Container } from '../functions/container/container.js';
+import { DiffAction } from '../functions/diff/diff.js';
+import { ResourceDataRepository } from '../resources/resource-data.repository.js';
+import { AResource } from '../resources/resource.abstract.js';
+import { ATerraformResource } from '../resources/terraform-resource.abstract.js';
+import { StateManagementService } from '../services/state-management/state-management.service.js';
+import { TransactionService } from '../services/transaction/transaction.service.js';
+import { StringUtility } from '../utilities/string/string.utility.js';
+/**
+ * Flattens a resource response to the strings terraform's `data "external"` protocol accepts - it
+ * takes a JSON object of strings and nothing else, so an action returning `{ Port: 80 }` fails the
+ * apply. This is the same contract {@link commit} enforces on the way back in, applied here so the
+ * CLI and the commit path cannot disagree.
+ *
+ * A `null`/`undefined` value is rejected rather than emitted as `"null"`: no resource legitimately
+ * emits one, so it signals a broken action, and the string would otherwise land in octo state at
+ * the next commit.
+ */
+function toFlatStringResponse(resourceId, response) {
+    const flatResponse = {};
+    const nullKeys = [];
+    for (const [key, value] of Object.entries(response)) {
+        if (value === null || value === undefined) {
+            nullKeys.push(key);
+        }
+        else {
+            flatResponse[key] = String(value);
+        }
+    }
+    if (nullKeys.length > 0) {
+        throw new TransactionError(`Resource "${resourceId}" returned null response values: ${nullKeys.join(', ')}! ` +
+            'Every response key must carry a value.');
+    }
+    return flatResponse;
+}
+/**
+ * Runs a single resource action, invoked by terraform mid-apply for an external resource.
+ *
+ * Octo-internal: not a step of the user's generate → validate → apply → commit run — terraform
+ * shells back into it from a generated `local-exec` provisioner; users never run it by hand.
+ *
+ * Boots normally, computes the full resource diff, filters to `resourceId` — the diff decides
+ * whether this is an add, update, delete, or noop. Explicit `inputs`
+ * (`<parentResourceId>.<responseKey>` keys) are injected into the parent resources' responses in
+ * memory before the action runs. Rejects a `resourceId` that is not an external resource.
+ *
+ * What the action made of the resource is recorded against it, and a delete clears that record.
+ * Repeating a call for the same inputs and the same desired properties does nothing, because that
+ * record says the work is already done - terraform replaces a `null_resource` by destroying and
+ * recreating it, so it calls back twice for one change, and octo state learns nothing of the first
+ * call until `commit`. Nothing else in octo state is touched.
+ *
+ * @internal
+ */
+export async function runAction(app, { inputs = {}, resourceId }) {
+    const container = Container.getInstance();
+    const [resourceDataRepository, stateManagementService, transactionService] = await Promise.all([
+        container.get(ResourceDataRepository),
+        container.get(StateManagementService),
+        container.get(TransactionService),
+    ]);
+    const recordedState = await stateManagementService.getExternalResourceState(resourceId);
+    const diffs = await app.diff();
+    const transaction = transactionService.beginTransaction(diffs, {
+        filterResourceDiffsByResourceId: resourceId,
+        skipActualResourceUpdate: true,
+        yieldResourceDiffs: true,
+        yieldResourceTransaction: true,
+    });
+    const resourceDiffs = await transaction.next();
+    const allDiffs = resourceDiffs.value.flat();
+    // A terraform resource is managed by terraform and must never be run via run-action.
+    // Guard both paths: a changed resource surfaces in `allDiffs`; an unchanged one has no diff at all,
+    // so we also check the resource in the new graph directly.
+    const targetResource = resourceDataRepository
+        .getNewResourcesByProperties()
+        .find((r) => r.resourceId === resourceId && !r.isMarkedDeleted());
+    if (targetResource instanceof ATerraformResource || allDiffs.some((d) => d.node instanceof ATerraformResource)) {
+        throw new TransactionError(`Resource "${resourceId}" is a terraform resource and cannot be run via run-action!`);
+    }
+    if (allDiffs.length === 0) {
+        // Noop: still report the current response so terraform captures consistent outputs.
+        return { action: 'noop', resourceId, response: toFlatStringResponse(resourceId, targetResource?.response ?? {}) };
+    }
+    // The work is already done: the record says an action ran for these inputs and left the resource
+    // in the shape being asked for again. The diff cannot tell, because it is computed against the
+    // last commit either way.
+    if (recordedState &&
+        targetResource &&
+        StringUtility.deterministicHash(recordedState.inputs) === StringUtility.deterministicHash(inputs) &&
+        StringUtility.deterministicHash(recordedState.properties) ===
+            StringUtility.deterministicHash(targetResource.properties)) {
+        return { action: 'noop', resourceId, response: recordedState.response };
+    }
+    // Inject explicit inputs into the parent resources the actions will read. An input is keyed
+    // either as "<parentId>.<key>" (one response key, from a native parent) or bare "<parentId>"
+    // (an external parent's entire response map, passed as one JSON object — its keys aren't
+    // enumerable at generation time). Inputs not matching a parent are ignored.
+    for (const diff of allDiffs) {
+        const node = diff.node;
+        for (const parent of node.parents) {
+            const parentResource = parent instanceof AResource ? parent : parent.getActual();
+            for (const [inputKey, inputValue] of Object.entries(inputs)) {
+                const separatorIndex = inputKey.indexOf('.');
+                if (separatorIndex === -1) {
+                    if (inputKey === parentResource.resourceId) {
+                        const wholeResponse = typeof inputValue === 'string' ? JSON.parse(inputValue) : inputValue;
+                        Object.assign(parentResource.response, wholeResponse);
+                    }
+                }
+                else if (inputKey.substring(0, separatorIndex) === parentResource.resourceId) {
+                    parentResource.response[inputKey.substring(separatorIndex + 1)] = inputValue;
+                }
+            }
+        }
+    }
+    // Run the action.
+    await transaction.next();
+    const action = allDiffs.some((d) => d.action === DiffAction.DELETE && d.field === 'resourceId')
+        ? 'delete'
+        : allDiffs.some((d) => d.action === DiffAction.ADD && d.field === 'resourceId')
+            ? 'add'
+            : 'update';
+    if (action === 'delete') {
+        await stateManagementService.deleteExternalResourceState(resourceId);
+        return { action, resourceId, response: {} };
+    }
+    // Record what the action made of the resource, for the next call and for the next plan.
+    const targetContext = allDiffs[0].node.getContext();
+    const resource = resourceDataRepository.getNewResourceByContext(targetContext);
+    const response = toFlatStringResponse(resourceId, resource?.response ?? {});
+    await stateManagementService.saveExternalResourceState(resourceId, {
+        inputs,
+        properties: JSON.parse(JSON.stringify(resource?.properties ?? {})),
+        response,
+    });
+    return { action, resourceId, response };
+}
+//# sourceMappingURL=run-action.mode.js.map

package/dist/modes/run-action.mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-action.mode.js","sourceRoot":"","sources":["../../src/modes/run-action.mode.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAEhE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAClF,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0DAA0D,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAQtE;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,UAAkB,EAAE,QAAiC;IACjF,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CACxB,aAAa,UAAU,oCAAoC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAChF,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAQ,EACR,EAAE,MAAM,GAAG,EAAE,EAAE,UAAU,EAA4D;IAErF,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7F,SAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC;KAClC,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAExF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,KAAK,EAAE;QAC7D,+BAA+B,EAAE,UAAU;QAC3C,wBAAwB,EAAE,IAAI;QAC9B,kBAAkB,EAAE,IAAI;QACxB,wBAAwB,EAAE,IAAI;KAC/B,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAI,aAAa,CAAC,KAA0B,CAAC,IAAI,EAAE,CAAC;IAElE,qFAAqF;IACrF,oGAAoG;IACpG,2DAA2D;IAC3D,MAAM,cAAc,GAAG,sBAAsB;SAC1C,2BAA2B,EAAE;SAC7B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IACpE,IAAI,cAAc,YAAY,kBAAkB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,kBAAkB,CAAC,EAAE,CAAC;QAC/G,MAAM,IAAI,gBAAgB,CAAC,aAAa,UAAU,6DAA6D,CAAC,CAAC;IACnH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,oFAAoF;QACpF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IACpH,CAAC;IAED,iGAAiG;IACjG,+FAA+F;IAC/F,0BAA0B;IAC1B,IACE,aAAa;QACb,cAAc;QACd,aAAa,CAAC,iBAAiB,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACjG,aAAa,CAAC,iBAAiB,CAAC,aAAa,CAAC,UAAU,CAAC;YACvD,aAAa,CAAC,iBAAiB,CAAC,cAAc,CAAC,UAAU,CAAC,EAC5D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC;IAC1E,CAAC;IAED,4FAA4F;IAC5F,6FAA6F;IAC7F,yFAAyF;IACzF,4EAA4E;IAC5E,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAuB,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,cAAc,GAAG,MAAM,YAAY,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACjF,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5D,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,cAAc,KAAK,CAAC,CAAC,EAAE,CAAC;oBAC1B,IAAI,QAAQ,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;wBAC3C,MAAM,aAAa,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;wBAC3F,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;qBAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;oBAC/E,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;gBAC/E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;IAEzB,MAAM,MAAM,GAA8B,QAAQ,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,CAClE;QACC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,CAAC;YAC7E,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,QAAQ,CAAC;IAEf,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,sBAAsB,CAAC,2BAA2B,CAAC,UAAU,CAAC,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,wFAAwF;IACxF,MAAM,aAAa,GAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAwB,CAAC,UAAU,EAAE,CAAC;IACzE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,sBAAsB,CAAC,yBAAyB,CAAC,UAAU,EAAE;QACjE,MAAM;QACN,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;QAClE,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC"}

package/dist/modes/validate.mode.d.ts

@@ -0,0 +1,186 @@
+import type { TerraformFolderOutput, TerraformResourceOutput } from '../app.type.js';
+import { type AggregatedResourceAction } from '../functions/diff/aggregate-resource-actions.js';
+import type { ModelTransactionResult } from './apply-transaction.js';
+/**
+ * One argument terraform plans to change on a resource, with the values on either side.
+ *
+ * Values are rendered, truncated strings rather than the raw payload: a report is read, not
+ * replayed, and the raw payload of a real resource is both enormous and a place secrets live.
+ */
+export interface ValidateFieldChange {
+    field: string;
+    /**
+     * The current value. Absent on a create. `(sensitive)` when terraform marked it so.
+     */
+    from?: string;
+    /**
+     * The planned value. `(known after apply)` when terraform cannot say yet.
+     */
+    to?: string;
+}
+/**
+ * One terraform address and the actions terraform plans on it (`create`, `update`, `delete`, …).
+ */
+export interface ValidateTerraformChange {
+    address: string;
+    /**
+     * Which arguments moved, for the changes where that is the whole question: an in-place `update`,
+     * and a `create`+`delete` where the point is *which* argument forced the replacement.
+     *
+     * Left empty on a plain create or delete, where the address and the action already say everything.
+     */
+    changedFields: ValidateFieldChange[];
+    /**
+     * How many further arguments moved that `changedFields` does not list. Absent means none were
+     * left out: a reader of a replace has to be able to tell a complete field list from a capped one.
+     */
+    omittedFieldCount?: number;
+    tfActions: string[];
+}
+/**
+ * What `validate` saw, as a report rather than a verdict.
+ *
+ * Octo's diff and terraform's plan measure different things from different baselines: octo's diff is
+ * `desired graph − last committed graph`, terraform's plan is `desired HCL − real cloud state`. The
+ * report correlates the two and explains what it can. Only being unable to read a plan makes it
+ * unsuccessful — see {@link ValidateReport.failures}.
+ */
+export interface ValidateReport {
+    /**
+     * Terraform changes with no octo diff of their own that octo can explain: the resource references
+     * something whose identity moved, or the resource no longer renders that address.
+     */
+    attributedChanges: {
+        address: string;
+        causeKind: 'address-no-longer-rendered' | 'identity-changed';
+        causeResourceId: string;
+        moduleId: string;
+        tfActions: string[];
+    }[];
+    /**
+     * How far this report can be trusted, decided by whether intent changed.
+     *
+     * - `exact` — octo's diff is empty. Nothing is mocked and no dependency output moves, so every
+     *   folder's plan reflects reality and drift detection is reliable.
+     * - `approximate` — octo's diff is non-empty. Each folder is planned alone against the *last
+     *   applied* outputs of its dependencies, so a cross-folder consequence of this change is invisible
+     *   until apply, and a renamed producer's outputs come from `mock_outputs`. The report may both
+     *   understate what apply will do and overstate drift.
+     */
+    confidence: 'approximate' | 'exact';
+    /**
+     * Destroys terraform plans of a resource whose class declares that destroying it loses data, whatever
+     * the cause.
+     */
+    dataLoss: {
+        address: string;
+        message: string;
+        moduleId: string;
+        resourceId: string;
+    }[];
+    /**
+     * Terraform changes nothing in octo explains: the infrastructure moved out from under intent.
+     */
+    drift: {
+        address: string;
+        moduleId: string;
+        tfActions: string[];
+    }[];
+    /**
+     * Folders terraform could not plan. The only unsuccessful outcome, because validate cannot report
+     * on a folder it was unable to read.
+     */
+    failures: {
+        message: string;
+        moduleId?: string;
+    }[];
+    /**
+     * Octo resources that changed, each with the terraform changes correlated to it. An empty
+     * `terraformChanges` means the intent change carries no infrastructure cost.
+     */
+    intentChanges: {
+        moduleId?: string;
+        octoAction: AggregatedResourceAction['action'];
+        reason?: string;
+        resourceContext: string;
+        resourceId: string;
+        terraformChanges: ValidateTerraformChange[];
+    }[];
+    /**
+     * Resources rendered into another module folder than the one holding their terraform state. The state
+     * moves with them before terraform runs, so terraform updates them in place.
+     */
+    moves: {
+        fromModuleId: string;
+        moduleId: string;
+        resourceId: string;
+    }[];
+    /**
+     * Observations that judge nothing: a folder octo does not track, a delete it cannot correlate.
+     */
+    notes: {
+        message: string;
+        moduleId?: string;
+    }[];
+    /**
+     * Terraform changes planned against a value that may be a `mock_outputs` placeholder. Reported
+     * apart from {@link ValidateReport.drift}, and never as drift.
+     */
+    uncertain: {
+        address: string;
+        moduleId: string;
+        reason: string;
+        tfActions: string[];
+    }[];
+}
+/**
+ * One module's parsed terraform plan, i.e. the JSON produced by `terraform show -json <plan-file>`
+ * (run via terragrunt by the caller, so it is backend-agnostic). Only `resource_changes` is read.
+ */
+export interface TerraformPlan {
+    resource_changes?: {
+        address: string;
+        change?: {
+            actions?: string[];
+            after?: Record<string, unknown> | null;
+            after_sensitive?: Record<string, unknown> | boolean | null;
+            after_unknown?: Record<string, unknown> | boolean | null;
+            before?: Record<string, unknown> | null;
+            before_sensitive?: Record<string, unknown> | boolean | null;
+        };
+        mode?: string;
+    }[];
+}
+/**
+ * Read-only correlation of `terraform plan` against intent. Never writes state or folders.
+ *
+ * `plans` maps each module folder's id to its parsed terraform plan, and `planErrors` maps a folder
+ * terraform *failed* to plan to the reason why. The two are disjoint, and a folder in neither was
+ * never inspected.
+ *
+ * `persistedMappings` is the octo→terraform mapping captured by the last commit. It supplies the
+ * addresses of resources deleted since (absent from this boot's generated files), and identifies
+ * producers that have never been applied, whose outputs terragrunt can only supply as a mock.
+ *
+ * Plans are partitioned by the tracked set (intent ∪ the committed folder record,
+ * `previousFolders`): a plan for a module the sweep filled is demanded and correlated; a plan for a
+ * committed-then-deleted (emptied) folder is read when supplied; a plan for a folder octo does
+ * **not** track is noted and excluded from all correlation, and re-declaring its module in intent
+ * re-adopts it.
+ *
+ * `externalResourceStateIds` names every external resource a `run-action` published and no commit
+ * has recorded yet, from `StateManagementService.listExternalResourceStateIds()`. Each one is
+ * reported as a note.
+ *
+ * By-design limit: correlation is resource-level, not field-level.
+ *
+ * @internal
+ */
+export declare function validate({ externalResourceStateIds, persistedMappings, planErrors, plans, previousFolders, transaction, }: {
+    externalResourceStateIds?: string[];
+    persistedMappings: Map<string, TerraformResourceOutput>;
+    planErrors?: Map<string, string>;
+    plans: Map<string, TerraformPlan>;
+    previousFolders?: TerraformFolderOutput[];
+    transaction: ModelTransactionResult;
+}): Promise<ValidateReport>;