@staticforge/iac 0.0.0-stage → 0.1.1

package/dist/operations.d.ts

@@ -0,0 +1,78 @@
+import { type Logger } from '@staticforge/core';
+import type { Engine } from './engine.js';
+/** A workspace and the engine that runs it. */
+export interface Workspace {
+    engine: Engine;
+    dir: string;
+    env: NodeJS.ProcessEnv;
+    logger: Logger;
+}
+export type ChangeAction = 'create' | 'update' | 'delete' | 'replace' | 'read' | 'noop' | 'move';
+export interface ResourceChange {
+    address: string;
+    action: ChangeAction;
+}
+export interface PlanSummary {
+    /** True when applying the plan would change something. */
+    changes: boolean;
+    add: number;
+    change: number;
+    remove: number;
+    import: number;
+    resources: ResourceChange[];
+    /** Changes made outside OpenTofu/Terraform, detected while refreshing. */
+    drift: ResourceChange[];
+    /** Saved plan file (absent for refresh-only and failed plans). */
+    planFile?: string;
+}
+export interface ApplySummary {
+    add: number;
+    change: number;
+    remove: number;
+}
+export interface OutputValue {
+    value: unknown;
+    sensitive: boolean;
+    type?: unknown;
+}
+/** Platforms recorded in `.terraform.lock.hcl`, so a lock made on a laptop also works in CI. */
+export declare const LOCK_PLATFORMS: string[];
+export interface InitOptions {
+    /** `-migrate-state -force-copy`: move existing state into the configured backend. */
+    migrateState?: boolean;
+    /** `-reconfigure`: use the configured backend, ignoring the previous one. */
+    reconfigure?: boolean;
+    /** `-backend=false`: install modules and providers only (for validate). */
+    noBackend?: boolean;
+}
+/**
+ * `init`. The first init also records provider checksums for the common
+ * platforms in `.terraform.lock.hcl`.
+ */
+export declare function init(ws: Workspace, options?: InitOptions): Promise<void>;
+export interface PlanOptions {
+    /** Only compare the state with the real infrastructure (drift detection). */
+    refreshOnly?: boolean;
+    destroy?: boolean;
+    /** Plan file to write (relative to the workspace). Defaults to `tfplan`. */
+    out?: string;
+    /** Only these resource addresses (`-target`). */
+    targets?: string[];
+}
+/** `plan -detailed-exitcode`: 0 no changes, 2 changes, anything else failed. */
+export declare function plan(ws: Workspace, options?: PlanOptions): Promise<PlanSummary>;
+/** Apply a saved plan. */
+export declare function apply(ws: Workspace, planFile: string): Promise<ApplySummary>;
+/**
+ * `apply -refresh-only`: record attributes the provider only reports after
+ * creation (a function's status, a bucket's policy, empty lists). Run right
+ * after an apply, so `sforge status` reports only real drift.
+ */
+export declare function refreshState(ws: Workspace): Promise<void>;
+/** `output -json`: every root output, sensitive ones included (callers must filter). */
+export declare function outputs(ws: Workspace): Promise<Record<string, OutputValue>>;
+/** Non-sensitive output values, keyed by name. */
+export declare function publicOutputs(values: Record<string, OutputValue>): Record<string, unknown>;
+/** Whether a workspace holds local state (only with --local-state or a pending bootstrap). */
+export declare function hasLocalState(dir: string): boolean;
+//# sourceMappingURL=operations.d.ts.map

package/dist/operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../src/operations.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,MAAM,EAAe,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,0DAA0D;IAC1D,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,0EAA0E;IAC1E,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,gGAAgG;AAChG,eAAO,MAAM,cAAc,UAM1B,CAAC;AAiCF,MAAM,WAAW,WAAW;IAC1B,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BlF;AAgCD,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,gFAAgF;AAChF,wBAAsB,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAczF;AAED,0BAA0B;AAC1B,wBAAsB,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAKlF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/D;AAED,wFAAwF;AACxF,wBAAsB,OAAO,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAYjF;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAM1F;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CASlD"}

package/dist/operations.js

@@ -0,0 +1,185 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ErrorCode, SforgeError } from '@staticforge/core';
+import { assertSucceeded, runEngine } from './runner.js';
+/** Platforms recorded in `.terraform.lock.hcl`, so a lock made on a laptop also works in CI. */
+export const LOCK_PLATFORMS = [
+    'linux_amd64',
+    'linux_arm64',
+    'darwin_amd64',
+    'darwin_arm64',
+    'windows_amd64',
+];
+/** Log engine progress: resource operations at info, the rest at debug. */
+function progressLogger(logger) {
+    return (event) => {
+        if (event.message === '')
+            return;
+        switch (event.type) {
+            case 'apply_start':
+            case 'apply_complete':
+            case 'apply_errored':
+            case 'resource_drift':
+                logger.info(event.message);
+                break;
+            case 'diagnostic':
+                if (event.level === 'warn')
+                    logger.warn(event.message);
+                else
+                    logger.debug(event.message);
+                break;
+            default:
+                logger.debug(event.message);
+        }
+    };
+}
+function run(ws, args, json = true) {
+    ws.logger.debug(`${ws.engine.name} ${args.join(' ')}`);
+    return runEngine(ws.engine, args, {
+        cwd: ws.dir,
+        env: ws.env,
+        json,
+        onEvent: progressLogger(ws.logger),
+    });
+}
+/**
+ * `init`. The first init also records provider checksums for the common
+ * platforms in `.terraform.lock.hcl`.
+ */
+export async function init(ws, options = {}) {
+    const lockFile = join(ws.dir, '.terraform.lock.hcl');
+    const hadLock = existsSync(lockFile);
+    const args = ['init', '-input=false', '-no-color'];
+    if (options.migrateState)
+        args.push('-migrate-state', '-force-copy');
+    if (options.reconfigure)
+        args.push('-reconfigure');
+    if (options.noBackend)
+        args.push('-backend=false');
+    const result = await run(ws, args, false);
+    if (result.exitCode !== 0 &&
+        /backend configuration (has )?changed/i.test(result.stdout + result.stderr)) {
+        throw new SforgeError(ErrorCode.IacFailed, 'The state backend configuration changed', {
+            details: { diagnostics: result.diagnostics },
+            hint: 'Move the state with `sforge iac init <target> -- -migrate-state`, ' +
+                'or start over in the new backend with `-- -reconfigure`.',
+        });
+    }
+    assertSucceeded(result, `${ws.engine.name} init`);
+    if (!hadLock && existsSync(lockFile)) {
+        const lock = await run(ws, ['providers', 'lock', ...LOCK_PLATFORMS.map((p) => `-platform=${p}`)], false);
+        // Not fatal: the lock still covers the current platform.
+        if (lock.exitCode !== 0)
+            ws.logger.warn('Could not add other platforms to .terraform.lock.hcl');
+    }
+}
+function change(raw) {
+    const c = raw.change;
+    if (c?.resource?.addr === undefined || c.action === undefined)
+        return undefined;
+    return { address: c.resource.addr, action: c.action };
+}
+function summarize(result) {
+    const resources = [];
+    const drift = [];
+    let counts = { add: 0, change: 0, remove: 0, import: 0 };
+    for (const event of result.events) {
+        if (event.type === 'planned_change') {
+            const c = change(event.raw);
+            if (c !== undefined)
+                resources.push(c);
+        }
+        else if (event.type === 'resource_drift') {
+            const c = change(event.raw);
+            if (c !== undefined)
+                drift.push(c);
+        }
+        else if (event.type === 'change_summary') {
+            const c = event.raw.changes;
+            counts = {
+                add: c?.add ?? 0,
+                change: c?.change ?? 0,
+                remove: c?.remove ?? 0,
+                import: c?.import ?? 0,
+            };
+        }
+    }
+    return { ...counts, resources, drift };
+}
+/** `plan -detailed-exitcode`: 0 no changes, 2 changes, anything else failed. */
+export async function plan(ws, options = {}) {
+    const out = options.out ?? 'tfplan';
+    const args = ['plan', '-input=false', '-json', '-detailed-exitcode', `-out=${out}`];
+    if (options.refreshOnly)
+        args.push('-refresh-only');
+    if (options.destroy)
+        args.push('-destroy');
+    for (const target of options.targets ?? [])
+        args.push(`-target=${target}`);
+    const result = await run(ws, args);
+    assertSucceeded(result, `${ws.engine.name} plan`, [0, 2]);
+    const summary = summarize(result);
+    return {
+        ...summary,
+        changes: result.exitCode === 2,
+        ...(result.exitCode === 2 && { planFile: out }),
+    };
+}
+/** Apply a saved plan. */
+export async function apply(ws, planFile) {
+    const result = await run(ws, ['apply', '-input=false', '-json', planFile]);
+    assertSucceeded(result, `${ws.engine.name} apply`);
+    const summary = summarize(result);
+    return { add: summary.add, change: summary.change, remove: summary.remove };
+}
+/**
+ * `apply -refresh-only`: record attributes the provider only reports after
+ * creation (a function's status, a bucket's policy, empty lists). Run right
+ * after an apply, so `sforge status` reports only real drift.
+ */
+export async function refreshState(ws) {
+    const result = await run(ws, [
+        'apply',
+        '-refresh-only',
+        '-auto-approve',
+        '-input=false',
+        '-json',
+    ]);
+    assertSucceeded(result, `${ws.engine.name} apply -refresh-only`);
+}
+/** `output -json`: every root output, sensitive ones included (callers must filter). */
+export async function outputs(ws) {
+    const result = await run(ws, ['output', '-json', '-no-color'], false);
+    assertSucceeded(result, `${ws.engine.name} output`);
+    const text = result.stdout.trim();
+    if (text === '')
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw new SforgeError(ErrorCode.IacFailed, `Could not parse ${ws.engine.name} output -json`, {
+            cause: error,
+        });
+    }
+}
+/** Non-sensitive output values, keyed by name. */
+export function publicOutputs(values) {
+    return Object.fromEntries(Object.entries(values)
+        .filter(([, output]) => !output.sensitive)
+        .map(([name, output]) => [name, output.value]));
+}
+/** Whether a workspace holds local state (only with --local-state or a pending bootstrap). */
+export function hasLocalState(dir) {
+    const path = join(dir, 'terraform.tfstate');
+    if (!existsSync(path))
+        return false;
+    try {
+        const state = JSON.parse(readFileSync(path, 'utf8'));
+        return (state.resources?.length ?? 0) > 0;
+    }
+    catch {
+        return true;
+    }
+}
+//# sourceMappingURL=operations.js.map

package/dist/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../src/operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAe,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAoC,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA2C3F,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,aAAa;IACb,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,2EAA2E;AAC3E,SAAS,cAAc,CAAC,MAAc;IACpC,OAAO,CAAC,KAAkB,EAAE,EAAE;QAC5B,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE;YAAE,OAAO;QACjC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,aAAa,CAAC;YACnB,KAAK,gBAAgB,CAAC;YACtB,KAAK,eAAe,CAAC;YACrB,KAAK,gBAAgB;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,YAAY;gBACf,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;oBAClD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM;YACR;gBACE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,GAAG,CAAC,EAAa,EAAE,IAAc,EAAE,IAAI,GAAG,IAAI;IACrD,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE;QAChC,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,IAAI;QACJ,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC;KACnC,CAAC,CAAC;AACL,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAa,EAAE,UAAuB,EAAE;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,IACE,MAAM,CAAC,QAAQ,KAAK,CAAC;QACrB,uCAAuC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,yCAAyC,EAAE;YACpF,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;YAC5C,IAAI,EACF,oEAAoE;gBACpE,0DAA0D;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,EAAE,EACF,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,EACrE,KAAK,CACN,CAAC;QACF,yDAAyD;QACzD,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;YAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAA4B;IAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAuE,CAAC;IACtF,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChF,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAsB,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,SAAS,CAAC,MAAiB;IAClC,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,IAAI,MAAM,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,OAA6C,CAAC;YAClE,MAAM,GAAG;gBACP,GAAG,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC;gBAChB,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC;gBACtB,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC;gBACtB,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAYD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,EAAa,EAAE,UAAuB,EAAE;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,QAAQ,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,OAAO,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnC,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,0BAA0B;AAC1B,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,EAAa,EAAE,QAAgB;IACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3E,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa;IAC9C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE;QAC3B,OAAO;QACP,eAAe;QACf,eAAe;QACf,cAAc;QACd,OAAO;KACR,CAAC,CAAC;IACH,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,CAAC;AACnE,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAa;IACzC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IACtE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,EAAE;YAC3F,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,aAAa,CAAC,MAAmC;IAC/D,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA8B,CAAC;QAClF,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/provision.d.ts

@@ -0,0 +1,128 @@
+import { type Logger } from '@staticforge/core';
+import type { SforgeConfig } from '@staticforge/core';
+import { type Engine, type EngineName } from './engine.js';
+import { type ApplySummary, type PlanSummary, type Workspace } from './operations.js';
+import { type RunResult } from './runner.js';
+import type { IacProfile, PreparedTarget, StateBackend } from './spec.js';
+/** `.sforge/state/<target>.json`: the non-secret outputs of the last apply. */
+export declare function stateCachePath(rootDir: string, targetName: string): string;
+export interface CachedOutputs {
+    target: string;
+    provider: string;
+    engine: EngineName;
+    updatedAt: string;
+    outputs: Record<string, unknown>;
+}
+export declare function readCachedOutputs(rootDir: string, targetName: string): CachedOutputs | undefined;
+/** Asked before applying; resolves false to abort. */
+export type Confirm = (question: string, plan: PlanSummary) => Promise<boolean>;
+export interface IacRunOptions {
+    rootDir: string;
+    config: SforgeConfig;
+    targetName: string;
+    profile: IacProfile;
+    env?: NodeJS.ProcessEnv;
+    logger: Logger;
+    /** Keep state in the workspace instead of the remote backend. */
+    localState?: boolean;
+    /** Extra module inputs for this run. */
+    inputs?: Record<string, unknown>;
+    /** Engine to use instead of resolving one (tests). */
+    engine?: Engine;
+    purpose?: 'provision' | 'outputs';
+}
+interface Opened {
+    engine: Engine;
+    prepared: PreparedTarget;
+    ws: Workspace;
+}
+export interface BootstrapResult {
+    backend: string;
+    description: string;
+    created: boolean;
+}
+/**
+ * Create the remote state backend: apply the bootstrap module with local
+ * state, then migrate that state into the backend it created. An existing
+ * backend is left alone, so bootstrapping is safe to repeat.
+ */
+export declare function bootstrapState(options: Omit<IacRunOptions, 'profile' | 'localState'> & {
+    engine: Engine;
+    state: StateBackend;
+    confirm?: Confirm;
+}): Promise<BootstrapResult>;
+export interface ProvisionResult {
+    target: string;
+    provider: string;
+    engine: {
+        name: EngineName;
+        version: string;
+    };
+    workspace: string;
+    bootstrap?: BootstrapResult;
+    plan: PlanSummary;
+    /** False for --diff, when nothing changed, or when declined. */
+    applied: boolean;
+    apply?: ApplySummary;
+    outputs?: Record<string, unknown>;
+    /** Instructions for the user, e.g. DNS records to create. */
+    notices: string[];
+    /** True when provisioning stopped after the pre-phase (`noWait`). */
+    pending?: boolean;
+}
+export interface ProvisionOptions extends IacRunOptions {
+    /** Only plan (`provision --diff`). */
+    diff?: boolean;
+    /** Create the remote state backend first. */
+    bootstrapState?: boolean;
+    /** Asked before applying; omit to apply without asking (--yes). */
+    confirm?: Confirm;
+    /** Stop after the pre-phase instead of waiting for it (e.g. for DNS validation). */
+    noWait?: boolean;
+}
+/** `sforge provision`: plan, and unless `diff`, apply after confirmation. */
+export declare function provision(options: ProvisionOptions): Promise<ProvisionResult>;
+/**
+ * The target's non-secret outputs: from `.sforge/state/<target>.json`, or
+ * (e.g. in CI, where that cache is not committed) read from the state.
+ */
+export declare function targetOutputs(options: IacRunOptions): Promise<Record<string, unknown>>;
+export interface DriftResult {
+    target: string;
+    provider: string;
+    engine: {
+        name: EngineName;
+        version: string;
+    };
+    /** Resources changed outside OpenTofu/Terraform since the last apply. */
+    drift: PlanSummary['drift'];
+    drifted: boolean;
+    outputs: Record<string, unknown>;
+}
+/** `sforge status`: a refresh-only plan, reporting drift and the current outputs. */
+export declare function detectDrift(options: IacRunOptions): Promise<DriftResult>;
+export interface DestroyResult {
+    target: string;
+    provider: string;
+    plan: PlanSummary;
+    destroyed: boolean;
+}
+/** `sforge destroy`: remove every resource of the target (the state backend stays). */
+export declare function destroy(options: IacRunOptions & {
+    confirm?: Confirm;
+}): Promise<DestroyResult>;
+export type PassthroughCommand = 'init' | 'plan' | 'apply' | 'output' | 'validate' | 'state' | 'import' | 'show' | 'console';
+/** Generate the workspace and return it, for `sforge iac path` and the passthrough commands. */
+export declare function prepareWorkspace(options: IacRunOptions): Promise<Opened>;
+/** `sforge iac <command> <target> [-- args]`: run the engine directly in the workspace. */
+export declare function passthrough(options: IacRunOptions & {
+    command: PassthroughCommand;
+    args: string[];
+    onStdout: (chunk: string) => void;
+    onStderr: (chunk: string) => void;
+    interactive: boolean;
+}): Promise<RunResult & {
+    workspace: string;
+}>;
+export {};
+//# sourceMappingURL=provision.d.ts.map

package/dist/provision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../src/provision.ts"],"names":[],"mappings":"AAEA,OAAO,EAAa,KAAK,MAAM,EAA0B,MAAM,mBAAmB,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,UAAU,EAAiB,MAAM,aAAa,CAAC;AAC1E,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EAQf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,KAAK,SAAS,EAAa,MAAM,aAAa,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAW,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGnF,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAQhG;AAUD,sDAAsD;AACtD,MAAM,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhF,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,UAAU,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CACnC;AAED,UAAU,MAAM;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,cAAc,CAAC;IACzB,EAAE,EAAE,SAAS,CAAC;CACf;AAoED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,YAAY,CAAC,GAAG;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,eAAe,CAAC,CA0C1B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,6DAA6D;IAC7D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qEAAqE;IACrE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,sCAAsC;IACtC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oFAAoF;IACpF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,6EAA6E;AAC7E,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6EnF;AAYD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAiB5F;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,yEAAyE;IACzE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,qFAAqF;AACrF,wBAAsB,WAAW,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAmB9E;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,uFAAuF;AACvF,wBAAsB,OAAO,CAC3B,OAAO,EAAE,aAAa,GAAG;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,aAAa,CAAC,CAkCxB;AAED,MAAM,MAAM,kBAAkB,GAC5B,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE9F,gGAAgG;AAChG,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAI9E;AAED,2FAA2F;AAC3F,wBAAsB,WAAW,CAC/B,OAAO,EAAE,aAAa,GAAG;IACvB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,WAAW,EAAE,OAAO,CAAC;CACtB,GACA,OAAO,CAAC,SAAS,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAa5C"}