swallowkit 2.0.0-alpha.1 → 2.0.0-alpha.11

package/dist/core/operations/provision-operations.js

@@ -2,10 +2,10 @@
 /**
  * Plan / Apply Provision — Azure プロビジョニングの事前計画と承認付き実行。
  *
- * - plan provision: ローカルの決定論的プリフライト(Bicep 解析・az CLI 有無)のみ。
- *   ネットワークアクセスや az login を必要とする操作は行わない。
- *   --what-if を明示した場合のみ az deployment group what-if を実行する。
+ * - plan provision: Bicep と Azure の現在の状態を確認する。リソースは変更しない。
  * - apply provision: 常に承認(--approve)必須。承認なしでは requires-human で停止する。
+ * - 対話的な `swallowkit provision` は同じ計画をメモリ上で作成・表示し、確認後に
+ *   executeProvisionPlan で同じ安全確認を経て実行する(計画ファイルは保存しない)。
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -41,17 +41,23 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERACTIVE_PROVISION_RETRY_HINT = void 0;
 exports.planProvisionOperation = planProvisionOperation;
+exports.provisionNextActions = provisionNextActions;
+exports.inspectProvisionOperation = inspectProvisionOperation;
 exports.applyProvisionOperation = applyProvisionOperation;
+exports.executeProvisionPlan = executeProvisionPlan;
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
+const azure_cli_1 = require("../../utils/azure-cli");
+const azure_diagnostics_1 = require("../../utils/azure-diagnostics");
 const path = __importStar(require("path"));
-const child_process_1 = require("child_process");
 const errors_1 = require("../../machine/errors");
 const version_1 = require("../../version");
 const infra_1 = require("../project/infra");
 const state_1 = require("../project/state");
 const file_session_1 = require("./file-session");
+const provision_deployment_1 = require("./provision-deployment");
 const migrations_1 = require("../project/migrations");
 const RESOURCE_GROUP_PATTERN = /^[A-Za-z0-9._()-]{1,90}$/;
 const LOCATION_PATTERN = /^[a-z0-9]{3,30}$/;
@@ -66,36 +72,38 @@ function validateProvisionInputs(options) {
     if (options.subscription && !SUBSCRIPTION_PATTERN.test(options.subscription)) {
         throw new errors_1.MachineCommandError("invalid-arguments", "Subscription must be a GUID.", undefined, "failed");
     }
-}
-function isAzCliAvailable() {
-    try {
-        const result = (0, child_process_1.spawnSync)("az", ["--version"], { shell: false, stdio: "ignore", timeout: 30000 });
-        return result.status === 0;
-    }
-    catch {
-        return false;
+    if (options.resumeDeployment && (!/^[A-Za-z0-9._()-]{1,64}$/.test(options.resumeDeployment) || options.reconcile || options.adoptExisting)) {
+        throw new errors_1.MachineCommandError("invalid-arguments", "--resume-deployment requires a valid deployment name and cannot be combined with adoption or reconcile.", undefined, "blocked");
     }
 }
+function azCliUnavailableWarning(availability) {
+    return availability.reason === "not-found"
+        ? "az-cli-not-found: Azure CLI was not found on PATH. Install it (https://aka.ms/azure-cli) or add it to PATH, then try again."
+        : `az-cli-not-runnable: Azure CLI was found but could not be started. ${availability.detail}`;
+}
 function displayCommand(command) {
     return [command.file, ...command.args.map((arg) => /\s/.test(arg) ? JSON.stringify(arg) : arg)].join(" ");
 }
-function runAz(args, timeout = 300000) {
-    const result = (0, child_process_1.spawnSync)("az", args, { shell: false, encoding: "utf-8", timeout });
-    return {
-        status: result.status,
-        stdout: result.stdout ?? "",
-        stderr: result.stderr ?? "",
-    };
+function runAz(args, timeout = 60000) {
+    return (0, azure_cli_1.runAzCli)(args, { timeout });
+}
+function azQueryError(code, message, result, secretValues = []) {
+    const diagnostic = (0, azure_diagnostics_1.azureCliDiagnostic)(result, "azure-state", secretValues);
+    const output = (diagnostic.stderr || diagnostic.stdout).trim().slice(0, 2000);
+    if (/az login|not logged in|AADSTS|expired/i.test(output)) {
+        return new errors_1.MachineCommandError("az-not-logged-in", `Azure CLI is not signed in (or the session expired). Run "az login", then try again.\n${output.slice(0, 1000)}`, { diagnostic }, "requires-human");
+    }
+    return new errors_1.MachineCommandError(code, `${message}: ${output || result.errorCode || result.failureKind || `exit ${result.status}`}`, { diagnostic }, "blocked");
 }
 function subscriptionArgs(subscription) {
     return subscription ? ["--subscription", subscription] : [];
 }
 function buildBootstrapCommands(options, mainBicepPath, parametersPath) {
     const commands = [];
-    commands.push({ file: "az", args: ["group", "create", "--name", options.resourceGroup, "--location", options.location, ...subscriptionArgs(options.subscription)], kind: "resource-group" });
+    commands.push({ file: "az", args: ["group", "create", "--name", options.resourceGroup, "--location", options.location, ...subscriptionArgs(options.subscription), "--query", "id", "-o", "json"], kind: "resource-group" });
     commands.push({
         file: "az",
-        args: ["deployment", "group", "create", "--name", "swallowkit-baseline", "--resource-group", options.resourceGroup, "--template-file", mainBicepPath, "--parameters", parametersPath, "--parameters", `location=${options.location}`, `swaLocation=${options.swaLocation}`, ...subscriptionArgs(options.subscription)],
+        args: ["deployment", "group", "create", "--name", "swallowkit-baseline", "--resource-group", options.resourceGroup, "--template-file", mainBicepPath, "--parameters", parametersPath, "--parameters", `location=${options.location}`, `swaLocation=${options.swaLocation}`, ...subscriptionArgs(options.subscription), "--no-wait", "--query", provision_deployment_1.DEPLOYMENT_QUERY, "-o", "json"],
         kind: "deployment",
     });
     return commands;
@@ -114,23 +122,32 @@ function readProjectName(parametersPath) {
 }
 function inspectRemoteGroup(options) {
     const existsResult = runAz(["group", "exists", "--name", options.resourceGroup, ...subscriptionArgs(options.subscription)], 60000);
-    if (existsResult.status !== 0) {
-        throw new errors_1.MachineCommandError("azure-state-query-failed", `Could not query resource group: ${(existsResult.stderr || existsResult.stdout || "").trim()}`, undefined, "blocked");
+    if (existsResult.status !== 0 || existsResult.failureKind || !/^(true|false)$/.test(existsResult.stdout.trim())) {
+        throw azQueryError("azure-state-query-failed", "Could not query resource group", existsResult);
     }
     if ((existsResult.stdout || "").trim() !== "true")
         return { exists: false, tags: {} };
     const showResult = runAz(["group", "show", "--name", options.resourceGroup, ...subscriptionArgs(options.subscription), "--query", "{id:id,tags:tags}", "-o", "json"], 60000);
-    if (showResult.status !== 0) {
-        throw new errors_1.MachineCommandError("azure-state-query-failed", `Could not read resource group tags: ${(showResult.stderr || showResult.stdout || "").trim()}`, undefined, "blocked");
+    if (showResult.status !== 0 || showResult.failureKind || showResult.stdoutTruncated) {
+        throw azQueryError("azure-state-query-failed", "Could not read resource group tags", showResult);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(showResult.stdout);
+    }
+    catch {
+        throw azQueryError("azure-state-query-failed", "Invalid resource group response", showResult);
+    }
+    if (!parsed || typeof parsed.id !== "string") {
+        throw azQueryError("azure-state-query-failed", "Invalid resource group identity", showResult);
     }
-    const parsed = JSON.parse(showResult.stdout || "{}");
     return { exists: true, id: parsed.id, tags: parsed.tags ?? {} };
 }
 function tagCommand(resourceId, key, state, expectedState) {
-    return { file: "az", args: ["tag", "update", "--resource-id", resourceId, "--operation", "Merge", "--tags", `${key}=${(0, migrations_1.encodeMigrationState)(state)}`], kind: "tag", expectedState };
+    return { file: "az", args: ["tag", "update", "--resource-id", resourceId, "--operation", "Merge", "--tags", `${key}=${(0, migrations_1.encodeMigrationState)(state)}`, "-o", "none"], kind: "tag", expectedState };
 }
 function bootstrapTagCommand(options, key, state) {
-    return { file: "az", args: ["group", "update", "--name", options.resourceGroup, "--set", `tags.${key}=${(0, migrations_1.encodeMigrationState)(state)}`, ...subscriptionArgs(options.subscription)], kind: "tag", expectedState: null };
+    return { file: "az", args: ["group", "update", "--name", options.resourceGroup, "--set", `tags.${key}=${(0, migrations_1.encodeMigrationState)(state)}`, ...subscriptionArgs(options.subscription), "-o", "none"], kind: "tag", expectedState: null };
 }
 function runBaseWhatIf(options, mainBicepPath, parametersPath) {
     const result = runAz([
@@ -145,7 +162,7 @@ function runBaseWhatIf(options, mainBicepPath, parametersPath) {
         "-o", "json",
     ]);
     if (result.status !== 0) {
-        throw new errors_1.MachineCommandError("what-if-failed", `az deployment group what-if failed: ${(result.stderr || result.stdout).trim().slice(0, 2000)}`, undefined, "blocked");
+        throw azQueryError("what-if-failed", "az deployment group what-if failed", result);
     }
     return result.stdout.trim();
 }
@@ -163,7 +180,93 @@ function assertAdoptionWhatIfIsSafe(whatIfResult) {
         throw new errors_1.MachineCommandError("what-if-invalid", "Azure what-if did not return valid JSON for legacy adoption.", undefined, "blocked");
     }
 }
-async function planProvisionOperation(options) {
+function resolveSubscription(options) {
+    if (options.subscription)
+        return options.subscription;
+    const result = runAz(["account", "show", "--query", "id", "-o", "tsv"]);
+    const subscription = result.stdout.trim();
+    if (result.status !== 0 || !SUBSCRIPTION_PATTERN.test(subscription)) {
+        throw azQueryError("azure-subscription-query-failed", "Could not identify the Azure subscription for this provision run", result);
+    }
+    return subscription;
+}
+function canonicalTemplate(value) {
+    const normalize = (item) => {
+        if (Array.isArray(item))
+            return item.map(normalize);
+        if (item && typeof item === "object") {
+            return Object.fromEntries(Object.entries(item).filter(([key]) => key !== "_generator")
+                .sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, normalize(entry)]));
+        }
+        return item;
+    };
+    return JSON.stringify(normalize(value));
+}
+async function verifyExistingBaseline(options, mainBicepPath, parametersPath) {
+    const projectRoot = path.dirname(path.dirname(mainBicepPath));
+    const secretValues = provisionSecretValues({
+        fingerprints: Object.fromEntries((0, migrations_1.collectLegacyBaselineFiles)(projectRoot).map(file => [file.path, file.checksum])),
+    }, projectRoot);
+    const reference = {
+        subscription: options.subscription, resourceGroup: options.resourceGroup, name: options.resumeDeployment,
+    };
+    const observation = await (0, provision_deployment_1.queryAzureDeployment)(reference, { secretValues });
+    if (observation.state === "unknown") {
+        throw new errors_1.MachineCommandError("recovery-deployment-unknown", "The existing deployment could not be identified. No Bicep will be submitted.", { deployment: observation }, "blocked");
+    }
+    const compiled = await (0, azure_cli_1.runAzCliAsync)(["bicep", "build", "--file", mainBicepPath, "--stdout"], { timeout: 60000, captureBytes: 16777216 });
+    const exported = await (0, azure_cli_1.runAzCliAsync)([
+        "deployment", "group", "export", "--name", reference.name,
+        "--resource-group", reference.resourceGroup, "--subscription", reference.subscription,
+    ], { timeout: 60000, captureBytes: 16777216 });
+    const parameters = await (0, azure_cli_1.runAzCliAsync)([
+        "deployment", "group", "show", "--name", reference.name, "--resource-group", reference.resourceGroup,
+        "--subscription", reference.subscription, "--query", "properties.parameters", "-o", "json",
+    ], { timeout: 30000 });
+    if ([compiled, exported, parameters].some((result) => result.status !== 0 || result.failureKind || result.stdoutTruncated)) {
+        throw new errors_1.MachineCommandError("recovery-evidence-unavailable", "Recovery requires the existing deployment template and parameters to match the local baseline. Evidence could not be read; nothing will be redeployed.", {
+            diagnostics: [compiled, exported, parameters].map((result, index) => ({
+                ...(0, azure_diagnostics_1.azureCliDiagnostic)(result, ["local-bicep-build", "recovery-template", "recovery-parameters"][index], secretValues),
+                stdout: "[template/parameter payload omitted]", stderr: "[template/parameter payload omitted]", outputTruncated: true,
+            })),
+        }, "blocked");
+    }
+    let template;
+    let remoteParameters;
+    let localParameters;
+    try {
+        template = JSON.parse(compiled.stdout);
+        if (canonicalTemplate(template) !== canonicalTemplate(JSON.parse(exported.stdout))) {
+            throw new errors_1.MachineCommandError("recovery-template-mismatch", "The deployed ARM template differs from the local Bicep. Restore the matching reviewed files before recovery; do not redeploy to repair migration bookkeeping.", undefined, "blocked");
+        }
+        remoteParameters = JSON.parse(parameters.stdout);
+        localParameters = JSON.parse(fs.readFileSync(parametersPath, "utf-8")).parameters;
+        if (!remoteParameters || !localParameters || typeof remoteParameters !== "object" || typeof localParameters !== "object")
+            throw new Error("Invalid parameters");
+    }
+    catch (error) {
+        if (error instanceof errors_1.MachineCommandError)
+            throw error;
+        throw new errors_1.MachineCommandError("recovery-invalid-evidence", "Recovery template/parameter evidence is not valid JSON.", undefined, "blocked");
+    }
+    const declarations = template.parameters;
+    if (Object.values(declarations ?? {}).some((parameter) => /^secure/i.test(parameter.type ?? ""))) {
+        throw new errors_1.MachineCommandError("recovery-secure-parameters", "This untracked deployment has secure parameters that cannot be verified. Recovery requires the original execution checkpoint; no secret values will be requested or printed.", undefined, "blocked");
+    }
+    const expected = { ...localParameters, location: { value: options.location }, swaLocation: { value: options.swaLocation } };
+    for (const [name, parameter] of Object.entries(expected)) {
+        if (!parameter || !Object.prototype.hasOwnProperty.call(parameter, "value")
+            || canonicalTemplate(parameter.value) !== canonicalTemplate(remoteParameters[name]?.value)) {
+            throw new errors_1.MachineCommandError("recovery-parameters-mismatch", "The deployed parameters differ from the local reviewed parameters/regions. No tag or ledger will be changed.", undefined, "blocked");
+        }
+    }
+    return observation.reference;
+}
+/**
+ * Builds the provision plan. Machine/MCP callers persist it for a later `apply provision --plan`;
+ * the interactive `swallowkit provision` command keeps it in memory and executes it after confirmation.
+ */
+async function planProvisionOperation(options, planOptions = {}) {
     const projectRoot = process.cwd();
     validateProvisionInputs(options);
     const infra = (0, infra_1.inspectInfra)(projectRoot);
@@ -174,9 +277,10 @@ async function planProvisionOperation(options) {
     if (!infra.parametersFile.exists) {
         warnings.push("infra/main.parameters.json not found; deployment will fail until it is created.");
     }
-    const azCliAvailable = isAzCliAvailable();
-    if (!azCliAvailable) {
-        warnings.push("az-cli-not-found: Azure CLI is not installed. Install it before applying: https://aka.ms/azure-cli");
+    const azCli = (0, azure_cli_1.checkAzCliAvailability)();
+    const azCliAvailable = azCli.available;
+    if (!azCli.available) {
+        warnings.push(azCliUnavailableWarning(azCli));
     }
     const mainBicepPath = path.join(projectRoot, "infra", "main.bicep");
     const parametersPath = path.join(projectRoot, "infra", "main.parameters.json");
@@ -188,6 +292,7 @@ async function planProvisionOperation(options) {
     let whatIfResult;
     let manifestAfterApply;
     let baselineDrift = [];
+    let recoveryDeployment;
     const manifestPath = path.join(projectRoot, migrations_1.MIGRATION_MANIFEST_PATH);
     const manifest = fs.existsSync(manifestPath) ? (0, migrations_1.loadMigrationManifest)(projectRoot) : null;
     if (manifest) {
@@ -202,6 +307,12 @@ async function planProvisionOperation(options) {
         baselineDrift = (0, migrations_1.findBaselineDrift)(manifest, projectRoot);
     }
     if (azCliAvailable) {
+        options = { ...options, subscription: resolveSubscription(options) };
+        const unfinished = readRuns(projectRoot).find((run) => run.outcome !== "succeeded" && run.outcome !== "failed" && run.plan.resourceGroup === options.resourceGroup
+            && run.plan.subscription === options.subscription);
+        if (unfinished) {
+            throw new errors_1.MachineCommandError("provision-run-pending", `Provision run ${unfinished.runId} is unfinished. Inspect or resume that run instead of submitting Bicep again.`, { runId: unfinished.runId, outcome: unfinished.outcome }, "blocked", provisionNextActions(unfinished.runId));
+        }
         const remoteGroup = inspectRemoteGroup(options);
         if (!manifest) {
             if (remoteGroup.exists) {
@@ -210,7 +321,33 @@ async function planProvisionOperation(options) {
             throw new errors_1.MachineCommandError("migration-manifest-not-found", "Initialize a migration manifest before the first provision.", undefined, "blocked");
         }
         migrationTagKey = (0, migrations_1.getMigrationTagKey)(manifest.projectId);
-        if (!remoteGroup.exists) {
+        if (options.resumeDeployment) {
+            if (!remoteGroup.exists || manifest.baseline.legacy) {
+                throw new errors_1.MachineCommandError("recovery-baseline-required", "--resume-deployment requires an existing resource group and the original non-legacy baseline manifest.", undefined, "blocked");
+            }
+            const tagValue = remoteGroup.tags[migrationTagKey];
+            remoteState = tagValue ? (0, migrations_1.decodeMigrationState)(tagValue) : null;
+            if (remoteState && remoteState.version !== 0) {
+                throw new errors_1.MachineCommandError("recovery-baseline-only", "Untracked-deployment recovery supports baseline 0 only. Use the original checkpoint to resume migrations.", undefined, "blocked");
+            }
+            recoveryDeployment = await verifyExistingBaseline(options, mainBicepPath, parametersPath);
+            const baselineFiles = (0, migrations_1.collectLegacyBaselineFiles)(projectRoot);
+            manifestAfterApply = {
+                ...manifest,
+                baseline: { ...manifest.baseline, files: baselineFiles, checksum: (0, migrations_1.computeBaselineChecksum)(baselineFiles) },
+            };
+            if (remoteState && remoteState.checksum !== manifestAfterApply.baseline.checksum) {
+                throw new errors_1.MachineCommandError("recovery-checksum-mismatch", "The existing baseline tag does not match this project. Nothing will be overwritten.", undefined, "blocked");
+            }
+            mode = "recover";
+            warnings.push("Recovery only observes the matching existing deployment, then records migration state after Azure Succeeded. It never submits Bicep.");
+            commandSpecs = [{
+                    file: "az",
+                    args: ["deployment", "group", "show", "--name", recoveryDeployment.name, "--resource-group", options.resourceGroup, ...subscriptionArgs(options.subscription), "--query", provision_deployment_1.DEPLOYMENT_QUERY, "-o", "json"],
+                    kind: "deployment",
+                }, tagCommand(remoteGroup.id, migrationTagKey, { schemaVersion: 1, version: 0, checksum: manifestAfterApply.baseline.checksum }, remoteState)];
+        }
+        else if (!remoteGroup.exists) {
             mode = "bootstrap";
             const baselineFiles = (0, migrations_1.collectLegacyBaselineFiles)(projectRoot);
             manifestAfterApply = {
@@ -233,7 +370,7 @@ async function planProvisionOperation(options) {
                 commandSpecs = [];
                 if (options.reconcile && !manifest.baseline.legacy) {
                     whatIfResult = runBaseWhatIf(options, mainBicepPath, parametersPath);
-                    warnings.push("Recovering an interrupted bootstrap by reconciling the baseline before recording migration state.");
+                    warnings.push("Explicit reconcile redeploys the untagged baseline. For an interrupted wait/tag/ledger update use --resume-deployment instead.");
                     mode = "reconcile";
                     const baselineFiles = (0, migrations_1.collectLegacyBaselineFiles)(projectRoot);
                     manifestAfterApply = {
@@ -289,12 +426,13 @@ async function planProvisionOperation(options) {
                         file: "az",
                         args: [
                             "deployment", "group", "create",
-                            "--name", "swallowkit-migration",
+                            "--name", `swallowkit-migration-${migration.version}-${migration.checksum.slice(0, 12)}`,
                             "--resource-group", options.resourceGroup,
                             "--template-file", path.join(projectRoot, migration.template),
                             ...(migration.parameters ? ["--parameters", path.join(projectRoot, migration.parameters)] : []),
                             "--parameters", `projectName=${projectName}`, `location=${options.location}`,
                             ...subscriptionArgs(options.subscription),
+                            "--no-wait", "--query", provision_deployment_1.DEPLOYMENT_QUERY, "-o", "json",
                         ],
                         kind: "migration",
                         expectedState,
@@ -306,8 +444,9 @@ async function planProvisionOperation(options) {
             }
         }
     }
-    else if (options.whatIf || options.adoptExisting || options.reconcile) {
-        throw new errors_1.MachineCommandError("az-cli-not-found", "Azure CLI is required for --what-if, --adopt-existing, and --reconcile.", undefined, "blocked");
+    else if (options.whatIf || options.adoptExisting || options.reconcile || options.resumeDeployment) {
+        const detail = azCli.available ? "" : ` ${azCliUnavailableWarning(azCli)}`;
+        throw new errors_1.MachineCommandError(!azCli.available && azCli.reason === "not-runnable" ? "az-cli-not-runnable" : "az-cli-not-found", `Azure CLI is required for --what-if, --adopt-existing, --reconcile, and --resume-deployment.${detail}`, undefined, "blocked");
     }
     const fingerprints = {
         "infra/main.bicep": (0, file_session_1.hashFileIfExists)(mainBicepPath),
@@ -337,6 +476,8 @@ async function planProvisionOperation(options) {
         mode,
         remoteState,
         pendingMigrations: pendingMigrations.map((migration) => ({ version: migration.version, checksum: migration.checksum })),
+        recoveryDeployment,
+        nonce: crypto.randomUUID(),
         baselineSnapshotChecksum,
         fingerprints,
     }))
@@ -365,116 +506,513 @@ async function planProvisionOperation(options) {
         requiresApproval: true,
         fingerprints,
         ...(baselineSnapshotChecksum ? { baselineSnapshotChecksum } : {}),
+        ...(recoveryDeployment ? { recoveryDeployment } : {}),
     };
-    (0, state_1.savePlanState)(plan, projectRoot);
+    if (planOptions.persist !== false)
+        (0, state_1.savePlanState)(plan, projectRoot);
     return plan;
 }
 function statesEqual(left, right) {
     return left?.version === right?.version && left?.checksum === right?.checksum;
 }
-function readRemoteMigrationState(plan) {
-    const group = inspectRemoteGroup(plan);
-    if (!group.exists || !plan.migrationTagKey)
-        return { group, state: null };
-    const tagValue = group.tags[plan.migrationTagKey];
-    return { group, state: tagValue ? (0, migrations_1.decodeMigrationState)(tagValue) : null };
+const MACHINE_RETRY_HINT = "Re-run plan provision.";
+exports.INTERACTIVE_PROVISION_RETRY_HINT = 'Run "swallowkit provision" again to review the current state.';
+function provisionNextActions(runId) {
+    return [
+        { command: `swallowkit machine inspect provision --plan ${runId}`, description: "Read the original Azure deployment state without creating, cancelling, deleting, tagging, or updating the ledger." },
+        { command: `swallowkit machine apply provision --plan ${runId} --approve`, description: "After explicit human approval, resume this checkpoint: observe the original deployment and finish tags/ledger; never resubmit an attempted deployment." },
+    ];
+}
+function resultForRun(run, outcome = run.outcome, interrupted) {
+    run.warnings = run.warnings.slice(-20);
+    run.diagnostics = run.diagnostics.slice(-20);
+    return {
+        status: outcome === "succeeded" ? "complete" : outcome === "in-progress" ? "in-progress" : outcome === "failed" ? "failed" : "blocked",
+        outcome, runId: run.runId, planId: run.plan.planId,
+        resourceGroup: run.plan.resourceGroup, location: run.plan.location, swaLocation: run.plan.swaLocation,
+        executedCommands: run.executedCommands, warnings: run.warnings, diagnostics: run.diagnostics,
+        ...(run.observation ? { deployment: run.observation } : {}),
+        nextActions: outcome === "succeeded"
+            ? [{ command: "swallowkit machine inspect infra", description: "Inspect local infrastructure assets after deployment and migration bookkeeping completed." }]
+            : provisionNextActions(run.runId),
+        ...(interrupted ? { interrupted } : {}),
+    };
+}
+function readRun(runId, projectRoot) {
+    let run;
+    try {
+        run = (0, state_1.loadProvisionRun)(runId, projectRoot);
+    }
+    catch {
+        throw new errors_1.MachineCommandError("invalid-provision-checkpoint", "The execution checkpoint cannot be read. Do not re-submit Bicep; inspect the original deployment first.", { runId }, "blocked");
+    }
+    if (run && (run.schemaVersion !== 1 || run.runId !== runId || run.plan?.planId !== runId
+        || run.projectRoot !== path.resolve(projectRoot) || !Number.isInteger(run.cursor)
+        || !Array.isArray(run.plan.commandSpecs) || !run.plan.fingerprints
+        || !Array.isArray(run.warnings) || !Array.isArray(run.diagnostics) || !Array.isArray(run.executedCommands)
+        || !["succeeded", "in-progress", "unknown", "partial", "failed"].includes(run.outcome)
+        || run.cursor < 0 || run.cursor > run.plan.commandSpecs.length)) {
+        throw new errors_1.MachineCommandError("invalid-provision-checkpoint", "The execution checkpoint is invalid or belongs to another checkout. Nothing will be re-submitted.", { runId }, "blocked");
+    }
+    return run;
+}
+function readRuns(projectRoot) {
+    try {
+        return (0, state_1.listProvisionRuns)(projectRoot).map(record => {
+            if (!record || typeof record.runId !== "string")
+                throw new Error("Invalid checkpoint identity.");
+            const run = readRun(record.runId, projectRoot);
+            if (!run)
+                throw new Error("Missing execution checkpoint.");
+            return run;
+        });
+    }
+    catch (error) {
+        if (error instanceof errors_1.MachineCommandError)
+            throw error;
+        throw new errors_1.MachineCommandError("invalid-provision-checkpoint", "An execution checkpoint is corrupt. Preserve it and inspect the original deployment; nothing will be re-submitted.", undefined, "blocked");
+    }
+}
+function validateWaitSeconds(value = provision_deployment_1.DEFAULT_PROVISION_WAIT_SECONDS) {
+    if (!Number.isInteger(value) || value < 0 || value > provision_deployment_1.MAX_PROVISION_WAIT_SECONDS) {
+        throw new errors_1.MachineCommandError("invalid-arguments", `--wait-seconds must be an integer from 0 to ${provision_deployment_1.MAX_PROVISION_WAIT_SECONDS}.`, undefined, "blocked");
+    }
+    return value;
+}
+function assertLocalFiles(plan, projectRoot, retryHint, allowRecordedManifest = false) {
+    const changedFiles = Object.entries(plan.fingerprints).filter(([relativePath, expectedHash]) => {
+        const file = path.join(projectRoot, relativePath);
+        if (allowRecordedManifest && relativePath === migrations_1.MIGRATION_MANIFEST_PATH && plan.manifestAfterApply && fs.existsSync(file)
+            && fs.readFileSync(file, "utf-8") === `${JSON.stringify(plan.manifestAfterApply, null, 2)}\n`)
+            return false;
+        return (0, file_session_1.hashFileIfExists)(file) !== expectedHash;
+    }).map(([file]) => file);
+    if (changedFiles.length || (plan.baselineSnapshotChecksum
+        && (0, migrations_1.computeBaselineChecksum)((0, migrations_1.collectLegacyBaselineFiles)(projectRoot)) !== plan.baselineSnapshotChecksum)) {
+        throw new errors_1.MachineCommandError("stale-plan", `${changedFiles.join(", ") || "Baseline infrastructure files"} changed after the preview was computed. ${retryHint}`, { planId: plan.planId, changedFiles }, "blocked");
+    }
+}
+async function readMigrationState(plan, signal, secretValues = []) {
+    const exists = await (0, azure_cli_1.runAzCliAsync)(["group", "exists", "--name", plan.resourceGroup, ...subscriptionArgs(plan.subscription)], { timeout: 30000, signal });
+    if (exists.status !== 0 || exists.failureKind || !/^(true|false)$/.test(exists.stdout.trim())) {
+        throw azQueryError("azure-state-query-failed", "Could not query resource group", exists, secretValues);
+    }
+    if (exists.stdout.trim() === "false")
+        return { group: { exists: false, tags: {} }, state: null };
+    const show = await (0, azure_cli_1.runAzCliAsync)(["group", "show", "--name", plan.resourceGroup, ...subscriptionArgs(plan.subscription), "--query", "{id:id,tags:tags}", "-o", "json"], { timeout: 30000, signal });
+    if (show.status !== 0 || show.failureKind || show.stdoutTruncated)
+        throw azQueryError("azure-state-query-failed", "Could not read resource group tags", show, secretValues);
+    let parsed;
+    try {
+        parsed = JSON.parse(show.stdout);
+    }
+    catch {
+        throw azQueryError("azure-state-query-failed", "Invalid resource group response", show, secretValues);
+    }
+    const expectedId = `/subscriptions/${plan.subscription}/resourceGroups/${plan.resourceGroup}`;
+    if (typeof parsed.id !== "string" || parsed.id.toLowerCase() !== expectedId.toLowerCase()) {
+        throw new errors_1.MachineCommandError("azure-resource-group-mismatch", "Azure returned a different resource group/subscription. Nothing will be updated.", undefined, "blocked");
+    }
+    const group = { exists: true, id: parsed.id, tags: parsed.tags ?? {} };
+    const tag = plan.migrationTagKey ? group.tags[plan.migrationTagKey] : undefined;
+    return { group, state: tag ? (0, migrations_1.decodeMigrationState)(tag) : null };
+}
+function desiredTagState(command, key) {
+    const value = command.args.find((arg) => arg.startsWith(`${key}=`) || arg.startsWith(`tags.${key}=`));
+    if (!value)
+        throw new errors_1.MachineCommandError("incompatible-plan", "The reviewed migration tag is missing.", undefined, "blocked");
+    return (0, migrations_1.decodeMigrationState)(value.slice(value.indexOf("=") + 1));
 }
-function assertPlanRemoteState(plan, expected) {
-    if (plan.mode === "offline")
-        return;
-    const current = readRemoteMigrationState(plan);
-    if (plan.mode === "bootstrap") {
-        if (current.group.exists) {
-            throw new errors_1.MachineCommandError("stale-azure-state", "The resource group was created after this plan. Re-run plan provision.", undefined, "blocked");
+function provisionSecretValues(plan, projectRoot) {
+    const files = Object.keys(plan.fingerprints);
+    const secureBicep = files.filter(file => file.endsWith(".bicep")).some(file => /@secure\s*\(/.test(fs.readFileSync(path.join(projectRoot, file), "utf-8")));
+    const values = [];
+    const collect = (value) => {
+        if (typeof value === "string" && value)
+            values.push(value);
+        else if (Array.isArray(value))
+            value.forEach(collect);
+        else if (value && typeof value === "object")
+            Object.values(value).forEach(collect);
+    };
+    for (const file of files.filter(file => file.endsWith(".json") && file !== migrations_1.MIGRATION_MANIFEST_PATH)) {
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(path.join(projectRoot, file), "utf-8"));
+        }
+        catch {
+            throw new errors_1.MachineCommandError("invalid-infra-parameters", "Infrastructure JSON is invalid. Correct it before provision; unstructured Azure output cannot safely redact unknown parameter secrets.", undefined, "blocked");
+        }
+        for (const [name, parameter] of Object.entries(parsed.parameters ?? {})) {
+            if (secureBicep || /secret|password|token|key|connection.?string/i.test(name))
+                collect(parameter?.value);
         }
-        return;
     }
-    if (!current.group.exists || !statesEqual(current.state, expected)) {
-        throw new errors_1.MachineCommandError("stale-azure-state", "Azure migration state changed after this plan was created. Re-run plan provision.", { expected, actual: current.state, resourceGroupExists: current.group.exists }, "blocked");
+    return [...new Set(values)].sort((left, right) => right.length - left.length);
+}
+function rememberDiagnostic(run, result, phase, secretValues) {
+    run.diagnostics.push((0, azure_diagnostics_1.azureCliDiagnostic)(result, phase, secretValues));
+    run.diagnostics = run.diagnostics.slice(-20);
+    if (result.stderr.trim()) {
+        run.warnings.push(result.stderrTruncated ? "Azure CLI stderr exceeded the capture limit; output omitted." : (0, azure_diagnostics_1.redactAzureText)(result.stderr, secretValues).slice(0, 4000));
+        run.warnings = run.warnings.slice(-20);
     }
 }
-function assertTagExpectedState(plan, expected) {
-    const current = readRemoteMigrationState(plan);
-    if (!current.group.exists || !statesEqual(current.state, expected)) {
-        throw new errors_1.MachineCommandError("stale-azure-state", "Azure migration state changed before its tag could be updated. Re-run plan provision.", { expected, actual: current.state, resourceGroupExists: current.group.exists }, "blocked");
+async function inspectProvisionOperation(options) {
+    const run = readRun(options.planId, process.cwd());
+    if (!run)
+        throw new errors_1.MachineCommandError("provision-run-not-found", "No execution checkpoint exists for this ID. For an older interrupted bootstrap use plan provision --resume-deployment <name> with the original resource group/subscription/regions.", { runId: options.planId }, "blocked");
+    const waitSeconds = validateWaitSeconds(options.waitSeconds ?? 0);
+    if (run.deployment) {
+        let secretValues = [];
+        let omitOutput = false;
+        try {
+            assertLocalFiles(run.plan, process.cwd(), "Reviewed files no longer match.", true);
+            secretValues = provisionSecretValues(run.plan, process.cwd());
+        }
+        catch {
+            omitOutput = true;
+            run.warnings.push("Reviewed files are unavailable or changed; deployment state is still read, but diagnostic output/causes are omitted to avoid exposing unknown secrets.");
+        }
+        run.observation = await (0, provision_deployment_1.waitForAzureDeployment)(run.deployment, { deadline: Date.now() + waitSeconds * 1000, secretValues });
+        if (omitOutput) {
+            run.observation.errors = [];
+            run.observation.diagnostic = { ...run.observation.diagnostic, stdout: "[output omitted: reviewed parameters unavailable]", stderr: "", outputTruncated: true };
+        }
+        run.diagnostics = [...run.diagnostics, run.observation.diagnostic].slice(-20);
+        let outcome = run.observation.state === "Failed" || run.observation.state === "Canceled" ? "failed"
+            : run.observation.state === "Succeeded" ? run.outcome === "succeeded" ? "succeeded" : "partial"
+                : run.observation.state === "unknown" ? "unknown" : "in-progress";
+        if (outcome === "succeeded") {
+            try {
+                assertLocalFiles(run.plan, process.cwd(), "The original reviewed files no longer match.", true);
+                const tag = [...run.plan.commandSpecs].reverse().find(command => command.kind === "tag");
+                if (tag && !statesEqual((await readMigrationState(run.plan, undefined, secretValues)).state, desiredTagState(tag, run.plan.migrationTagKey))) {
+                    outcome = "partial";
+                    run.warnings.push("Azure Succeeded, but the completed run's migration tag no longer matches. No bookkeeping or deployment write was performed.");
+                }
+            }
+            catch {
+                outcome = "partial";
+                run.warnings.push("Azure Succeeded, but current local files or migration bookkeeping could not be verified. No writes were performed.");
+            }
+        }
+        return resultForRun(run, outcome);
     }
+    return resultForRun(run);
 }
 async function applyProvisionOperation(options) {
     const projectRoot = process.cwd();
-    const plan = (0, state_1.loadPlanState)(options.planId, projectRoot);
+    const run = /^[a-f0-9]{12}$/.test(options.planId) ? readRun(options.planId, projectRoot) : null;
+    const plan = run?.plan ?? (0, state_1.loadPlanState)(options.planId, projectRoot);
     if (!plan) {
         throw new errors_1.MachineCommandError("plan-not-found", `Plan "${options.planId}" was not found. Run "plan provision" to create a new plan.`, { planId: options.planId }, "blocked");
     }
-    // Bicep が plan 後に変更されていないか確認
-    const changedFiles = [];
-    for (const [relativePath, expectedHash] of Object.entries(plan.fingerprints)) {
-        const currentHash = (0, file_session_1.hashFileIfExists)(path.join(projectRoot, relativePath));
-        if (currentHash !== expectedHash)
-            changedFiles.push(relativePath);
-    }
-    if (changedFiles.length > 0) {
-        throw new errors_1.MachineCommandError("stale-plan", `Plan "${options.planId}" is stale: ${changedFiles.join(", ")} changed after the plan was created. Re-run "plan provision".`, { planId: options.planId, changedFiles }, "blocked");
-    }
-    if (plan.baselineSnapshotChecksum) {
-        const currentBaselineChecksum = (0, migrations_1.computeBaselineChecksum)((0, migrations_1.collectLegacyBaselineFiles)(projectRoot));
-        if (currentBaselineChecksum !== plan.baselineSnapshotChecksum) {
-            throw new errors_1.MachineCommandError("stale-plan", `Plan "${options.planId}" is stale: baseline infrastructure inventory changed after the plan was created.`, { planId: options.planId }, "blocked");
+    const result = await executeProvisionPlan(plan, {
+        approve: options.approve, waitSeconds: options.waitSeconds, waitUntilComplete: options.waitUntilComplete,
+        retryHint: MACHINE_RETRY_HINT, projectRoot,
+    });
+    if (result.status === "complete") {
+        try {
+            (0, state_1.deletePlanState)(plan.planId, projectRoot);
+        }
+        catch {
+            result.warnings.push("Azure and migration bookkeeping completed, but the old preview could not be removed. The completed execution checkpoint prevents replay.");
         }
     }
+    return result;
+}
+/**
+ * Runs an approved provision plan with every safety check: local files and Azure state must still
+ * match the reviewed preview, and each migration/tag step re-checks Azure state before it runs.
+ */
+async function executeProvisionPlan(plan, options = {}) {
+    const projectRoot = options.projectRoot ?? process.cwd();
+    const retryHint = options.retryHint ?? MACHINE_RETRY_HINT;
+    const waitUntilComplete = options.waitUntilComplete === true && options.waitSeconds === undefined;
+    const waitSeconds = waitUntilComplete ? 0 : validateWaitSeconds(options.waitSeconds);
     if (!options.approve) {
-        throw new errors_1.MachineCommandError("approval-required", "Provisioning creates billable Azure resources and always requires human approval. Review plan.commands and re-run with --approve.", { planId: plan.planId, commands: plan.commands }, "requires-human");
+        throw new errors_1.MachineCommandError("approval-required", "Provisioning creates billable Azure resources and always requires human approval. Review plan.commands and re-run with --approve.", { planId: plan.planId, commands: plan.commands }, "requires-human", [{ command: `swallowkit machine apply provision --plan ${plan.planId} --approve`, description: "Review the commands and obtain explicit human consent before applying or resuming." }]);
     }
     if (!plan.mode || !plan.commandSpecs) {
-        throw new errors_1.MachineCommandError("incompatible-plan", "This provision plan was created by an older SwallowKit version. Re-run plan provision.", undefined, "blocked");
+        throw new errors_1.MachineCommandError("incompatible-plan", `This provision plan was created by an older SwallowKit version. ${retryHint}`, undefined, "blocked");
     }
     if (plan.mode === "offline") {
-        throw new errors_1.MachineCommandError("online-plan-required", "Provision apply requires a fresh plan created while Azure CLI is available and authenticated.", undefined, "blocked");
+        throw new errors_1.MachineCommandError("online-plan-required", `Azure state was not read because Azure CLI was unavailable, so nothing can be applied. Make az available and signed in (az login). ${retryHint}`, { planId: plan.planId, warnings: plan.warnings }, "blocked");
     }
     if (plan.mode === "adoption-required") {
-        throw new errors_1.MachineCommandError("adoption-required", 'This existing resource group has no SwallowKit migration state. Re-plan with --adopt-existing --baseline 0 --what-if.', { planId: plan.planId }, "requires-human");
-    }
-    if (!isAzCliAvailable()) {
-        throw new errors_1.MachineCommandError("az-cli-not-found", "Azure CLI is not installed. Install it first: https://aka.ms/azure-cli", undefined, "blocked");
-    }
-    const executedCommands = [];
-    const warnings = [...plan.warnings];
-    let deploymentOutputs;
-    assertPlanRemoteState(plan, plan.remoteState);
-    for (const command of plan.commandSpecs) {
-        if (command.kind === "migration") {
-            assertPlanRemoteState(plan, command.expectedState);
-        }
-        if (command.kind === "tag") {
-            assertTagExpectedState(plan, command.expectedState);
+        throw new errors_1.MachineCommandError("adoption-required", 'This resource group has no migration tag. Recover a matching existing baseline with --resume-deployment <name>; adoption applies only to a legacy manifest. Do not reconcile just to repair bookkeeping.', { planId: plan.planId }, "requires-human");
+    }
+    let run = readRun(plan.planId, projectRoot);
+    const resuming = run !== null;
+    if (run)
+        plan = run.plan;
+    try {
+        assertLocalFiles(plan, projectRoot, run ? "Restore the original reviewed files before resuming this checkpoint; do not resubmit Bicep." : retryHint, run?.cursor === plan.commandSpecs.length);
+    }
+    catch (error) {
+        if (run && error instanceof errors_1.MachineCommandError) {
+            throw new errors_1.MachineCommandError(error.code, error.message, { ...resultForRun(run), cause: error.details }, error.status, provisionNextActions(run.runId));
         }
-        const result = runAz(command.args);
-        const commandText = displayCommand(command);
-        executedCommands.push(commandText);
-        if (result.status !== 0) {
-            throw new errors_1.MachineCommandError("provision-failed", `Command failed: ${commandText}\n${(result.stderr || result.stdout).trim().slice(0, 4000)}`, { executedCommands }, "failed");
+        throw error;
+    }
+    const secretValues = provisionSecretValues(plan, projectRoot);
+    if (!plan.subscription || plan.commandSpecs.some((command) => (command.kind === "deployment" || command.kind === "migration")
+        && !plan.recoveryDeployment && !command.args.includes("--no-wait"))) {
+        throw new errors_1.MachineCommandError("incompatible-plan", `Create a fresh preview with bounded deployment tracking. For an older interrupted deployment use --resume-deployment instead of resubmitting Bicep. ${retryHint}`, undefined, "blocked");
+    }
+    const azCli = (0, azure_cli_1.checkAzCliAvailability)();
+    if (!azCli.available) {
+        throw new errors_1.MachineCommandError(azCli.reason === "not-found" ? "az-cli-not-found" : "az-cli-not-runnable", azCliUnavailableWarning(azCli), undefined, "blocked");
+    }
+    const targetKey = crypto.createHash("sha256").update(`${plan.subscription}/${plan.resourceGroup.toLowerCase()}`).digest("hex");
+    let unlock;
+    try {
+        unlock = (0, state_1.lockProvisionTarget)(targetKey, projectRoot);
+    }
+    catch (error) {
+        throw new errors_1.MachineCommandError("provision-target-locked", error instanceof Error ? error.message : "Provision target is locked.", { runId: plan.planId }, "blocked", provisionNextActions(plan.planId));
+    }
+    const controller = new AbortController();
+    let interrupted;
+    const interrupt = (signal) => {
+        interrupted = signal;
+        controller.abort();
+    };
+    const sigint = () => interrupt("SIGINT");
+    const sigterm = () => interrupt("SIGTERM");
+    const externalAbort = () => controller.abort();
+    process.on("SIGINT", sigint);
+    process.on("SIGTERM", sigterm);
+    options.signal?.addEventListener("abort", externalAbort, { once: true });
+    if (options.signal?.aborted)
+        controller.abort();
+    const signal = controller.signal;
+    const deadline = waitUntilComplete ? Number.POSITIVE_INFINITY : Date.now() + waitSeconds * 1000;
+    const persist = () => {
+        if (!run)
+            return;
+        run.warnings = run.warnings.slice(-20);
+        run.diagnostics = run.diagnostics.slice(-20);
+        run.updatedAt = new Date().toISOString();
+        (0, state_1.saveProvisionRun)(run, projectRoot);
+    };
+    const pause = (outcome, warning) => {
+        run.outcome = outcome;
+        run.warnings.push(warning);
+        persist();
+        return resultForRun(run, outcome, interrupted);
+    };
+    const observe = async () => {
+        const observation = await (0, provision_deployment_1.waitForAzureDeployment)(run.deployment, {
+            deadline: signal.aborted ? Date.now() : deadline,
+            // A final short read after Ctrl+C must not inherit the aborted wait signal.
+            ...(signal.aborted ? {} : { signal }),
+            ...(signal.aborted ? { queryTimeoutMs: 5000 } : {}),
+            pollIntervalMs: options.pollIntervalMs,
+            ...(waitUntilComplete ? { transientRetries: provision_deployment_1.UNBOUNDED_WAIT_TRANSIENT_RETRIES } : {}),
+            secretValues,
+            onObservation: (value) => {
+                run.observation = value;
+                if (value.state !== "unknown")
+                    run.deployment = value.reference;
+                persist();
+            },
+        });
+        run.observation = observation;
+        run.diagnostics.push(observation.diagnostic);
+        run.diagnostics = run.diagnostics.slice(-20);
+        return observation;
+    };
+    try {
+        if (!run) {
+            const unfinished = readRuns(projectRoot).find((other) => other.outcome !== "succeeded" && other.outcome !== "failed"
+                && other.plan.resourceGroup === plan.resourceGroup && other.plan.subscription === plan.subscription);
+            if (unfinished)
+                throw new errors_1.MachineCommandError("provision-run-pending", "Resume the existing execution checkpoint instead of creating another deployment.", { runId: unfinished.runId }, "blocked", provisionNextActions(unfinished.runId));
+            const current = await readMigrationState(plan, signal, secretValues);
+            if (plan.mode === "bootstrap" ? current.group.exists : !current.group.exists || !statesEqual(current.state, plan.remoteState)) {
+                throw new errors_1.MachineCommandError("stale-azure-state", plan.mode === "bootstrap"
+                    ? `The resource group was created after the preview was computed. ${retryHint}`
+                    : `Azure migration state changed after the preview was computed. ${retryHint}`, { expected: plan.remoteState, actual: current.state }, "blocked");
+            }
+            const checkpointPlan = { ...plan };
+            delete checkpointPlan.whatIfResult;
+            run = {
+                schemaVersion: 1, runId: plan.planId, projectRoot: path.resolve(projectRoot), plan: checkpointPlan,
+                cursor: 0, outcome: "in-progress", executedCommands: [], warnings: [...plan.warnings], diagnostics: [],
+                updatedAt: new Date().toISOString(),
+            };
+            persist();
         }
-        if (command.kind === "deployment" || command.kind === "migration") {
-            try {
-                const deployment = JSON.parse(result.stdout || "{}");
-                deploymentOutputs = deployment.properties?.outputs;
+        for (; run.cursor < plan.commandSpecs.length;) {
+            if (signal.aborted)
+                return pause(run.observation?.state === "Succeeded" ? "partial" : "unknown", "Local provisioning was interrupted. Azure may continue; use status/resume. No Azure cancel/delete was requested and the ledger is not marked successful.");
+            assertLocalFiles(plan, projectRoot, "Restore the original reviewed files before resuming; do not resubmit Bicep.");
+            const command = plan.commandSpecs[run.cursor];
+            if (command.kind === "deployment" || command.kind === "migration") {
+                if (command.kind === "migration" && run.attemptedIndex !== run.cursor && run.observation?.state === "Succeeded" && Date.now() >= deadline) {
+                    return pause("partial", "The bounded wait budget ended before the next reviewed migration. Resume this checkpoint after approval; completed deployments will not be re-submitted.");
+                }
+                if (run.attemptedIndex !== run.cursor) {
+                    let observationOnly = Boolean(plan.recoveryDeployment);
+                    if (plan.recoveryDeployment) {
+                        run.deployment = plan.recoveryDeployment;
+                    }
+                    else {
+                        const current = await readMigrationState(plan, signal, secretValues);
+                        if (!current.group.exists || !statesEqual(current.state, command.expectedState ?? plan.remoteState)) {
+                            throw new errors_1.MachineCommandError("stale-azure-state", `Azure migration state changed before deployment. ${retryHint}`, { expected: command.expectedState ?? plan.remoteState, actual: current.state }, "blocked");
+                        }
+                        const name = command.args[command.args.indexOf("--name") + 1];
+                        const reference = { name, resourceGroup: plan.resourceGroup, subscription: plan.subscription };
+                        const previous = await (0, provision_deployment_1.queryAzureDeployment)(reference, { signal, secretValues });
+                        if (previous.state === "unknown" && previous.reason !== "not-found") {
+                            run.deployment = reference;
+                            run.observation = previous;
+                            return pause("unknown", "The deployment name could not be checked before submission. No create request was sent; inspect the original deployment before proceeding.");
+                        }
+                        if (previous.state !== "unknown" && (plan.mode !== "reconcile" || previous.state === "Running" || previous.state === "Accepted")) {
+                            run.deployment = previous.reference;
+                            run.observation = previous;
+                            if (!resuming || command.kind !== "deployment") {
+                                return pause("unknown", "A deployment already exists under the reviewed name. No create request was sent. Resume only after matching its template/parameters; do not overwrite or re-submit it.");
+                            }
+                            run.deployment = await verifyExistingBaseline({ ...plan, resumeDeployment: name }, path.join(projectRoot, "infra", "main.bicep"), path.join(projectRoot, "infra", "main.parameters.json"));
+                            observationOnly = true;
+                        }
+                        else {
+                            run.deployment = {
+                                ...reference,
+                                ...(previous.state !== "unknown" ? { previousCorrelationId: previous.reference.correlationId } : {}),
+                            };
+                        }
+                    }
+                    // Persist intent before spawn: even a hard process termination must never replay this create.
+                    run.attemptedIndex = run.cursor;
+                    persist();
+                    if (!observationOnly) {
+                        const result = await (0, azure_cli_1.runAzCliAsync)(command.args, { timeout: 60000, signal });
+                        run.executedCommands.push(displayCommand(command));
+                        rememberDiagnostic(run, result, command.kind === "migration" ? "migration-submit" : "baseline-submit", secretValues);
+                        persist();
+                    }
+                }
+                const observation = await observe();
+                if (signal.aborted)
+                    return pause(observation.state === "Succeeded" ? "partial" : observation.state === "Running" || observation.state === "Accepted" ? "in-progress" : "unknown", "Local provisioning was interrupted. Azure may continue. The original deployment is tracked; no cancellation or successful ledger update was performed.");
+                if (observation.state === "Failed" || observation.state === "Canceled") {
+                    const operations = await (0, provision_deployment_1.queryDeploymentOperationErrors)(observation.reference, secretValues, signal);
+                    observation.errors.push(...operations.errors);
+                    run.diagnostics.push(operations.diagnostic);
+                    run.outcome = "failed";
+                    persist();
+                    throw new errors_1.MachineCommandError("azure-deployment-failed", `Azure deployment ${observation.reference.name} is ${observation.state}.${observation.errors.length ? `\n${observation.errors.map((error) => `${error.code}: ${error.message}`).join("\n")}` : " Azure did not return a structured cause; inspect deployment operations."}`, resultForRun(run), "failed", provisionNextActions(run.runId));
+                }
+                if (observation.state !== "Succeeded") {
+                    return pause(observation.state === "unknown" ? "unknown" : "in-progress", observation.state === "unknown" ? `Azure deployment result is unknown (${observation.reason}); a local az error is not proof that Azure failed. No create will be automatically retried.`
+                        : `Azure deployment is ${observation.state}. The bounded local wait ended; status/resume tracks the same deployment without submitting Bicep again.`);
+                }
             }
-            catch {
-                warnings.push("Could not parse deployment output JSON.");
+            else if (command.kind === "tag") {
+                if (run.deployment) {
+                    const observation = await (0, provision_deployment_1.queryAzureDeployment)(run.deployment, { signal, secretValues });
+                    run.observation = observation;
+                    if (observation.state !== "Succeeded")
+                        return pause("partial", "Azure Succeeded was previously observed, but its identity/terminal state could not be confirmed before migration tagging. No tag or ledger update was performed.");
+                }
+                const current = await readMigrationState(plan, signal, secretValues);
+                const desired = desiredTagState(command, plan.migrationTagKey);
+                if (!current.group.exists)
+                    throw new errors_1.MachineCommandError("stale-azure-state", "The resource group disappeared before tagging.", undefined, "blocked");
+                if (!statesEqual(current.state, desired)) {
+                    if (!statesEqual(current.state, command.expectedState)) {
+                        throw new errors_1.MachineCommandError("stale-azure-state", `Azure migration state changed before its tag could be updated. ${retryHint}`, { expected: command.expectedState, actual: current.state }, "blocked");
+                    }
+                    run.attemptedIndex = run.cursor;
+                    persist();
+                    const result = await (0, azure_cli_1.runAzCliAsync)(command.args, { timeout: 60000, signal });
+                    run.executedCommands.push(displayCommand(command));
+                    rememberDiagnostic(run, result, "migration-tag", secretValues);
+                    if (result.status !== 0 || result.failureKind || signal.aborted) {
+                        return pause("partial", "Azure deployment succeeded, but migration tagging did not complete locally. Resume this checkpoint to verify/finish tagging; do not redeploy the baseline.");
+                    }
+                    const after = await readMigrationState(plan, signal, secretValues);
+                    if (!statesEqual(after.state, desired))
+                        return pause("partial", "The tag update returned successfully but its version/checksum could not be confirmed. Resume bookkeeping without redeploying Bicep.");
+                }
             }
+            else {
+                const current = await readMigrationState(plan, signal, secretValues);
+                if (run.attemptedIndex === run.cursor) {
+                    if (!current.group.exists)
+                        return pause("unknown", "Resource group creation was attempted, but its result is unknown. Inspect the target before resuming; nothing will be re-created automatically.");
+                }
+                else {
+                    if (current.group.exists)
+                        throw new errors_1.MachineCommandError("stale-azure-state", `The resource group was created after the preview was computed. ${retryHint}`, undefined, "blocked");
+                    run.attemptedIndex = run.cursor;
+                    persist();
+                    const result = await (0, azure_cli_1.runAzCliAsync)(command.args, { timeout: 60000, signal });
+                    run.executedCommands.push(displayCommand(command));
+                    rememberDiagnostic(run, result, "resource-group-create", secretValues);
+                    if (result.status !== 0 || result.failureKind || signal.aborted)
+                        return pause("unknown", "Local resource-group creation did not complete. Azure may have accepted it; inspect/resume this checkpoint, not a new bootstrap.");
+                }
+            }
+            run.cursor++;
+            delete run.attemptedIndex;
+            persist();
+        }
+        if (signal.aborted)
+            return pause("partial", "Local provisioning was interrupted before ledger completion. Resume bookkeeping; no deployment will be submitted again.");
+        assertLocalFiles(plan, projectRoot, "Restore the reviewed files before completing the local ledger.", true);
+        const finalTag = [...plan.commandSpecs].reverse().find((command) => command.kind === "tag");
+        if (finalTag) {
+            const current = await readMigrationState(plan, signal, secretValues);
+            if (!statesEqual(current.state, desiredTagState(finalTag, plan.migrationTagKey)))
+                return pause("partial", "The final remote migration version/checksum changed before local ledger completion. No ledger success was recorded.");
         }
+        if (run.deployment) {
+            run.observation = await (0, provision_deployment_1.queryAzureDeployment)(run.deployment, { signal, secretValues });
+            if (run.observation.state !== "Succeeded")
+                return pause("partial", "The original deployment identity/terminal state could not be confirmed before local ledger completion. No successful ledger update was performed.");
+        }
+        if (plan.manifestAfterApply && run.outcome !== "succeeded")
+            (0, migrations_1.replaceMigrationManifest)(plan.manifestAfterApply, projectRoot);
+        run.outcome = "succeeded";
+        persist();
+        return resultForRun(run);
     }
-    if (plan.manifestAfterApply) {
-        (0, migrations_1.replaceMigrationManifest)(plan.manifestAfterApply, projectRoot);
+    catch (error) {
+        if (!run)
+            throw error;
+        if (error instanceof errors_1.MachineCommandError && error.code === "azure-deployment-failed")
+            throw error;
+        run.outcome = run.observation?.state === "Succeeded" ? "partial" : "unknown";
+        run.warnings.push(`Provisioning stopped: ${(0, azure_diagnostics_1.redactAzureText)(error instanceof Error ? error.message : "Unknown local error", secretValues)}. Azure deployment and local bookkeeping are separate; inspect/resume this checkpoint.`);
+        try {
+            persist();
+        }
+        catch {
+            run.warnings.push("The checkpoint could not be updated. Preserve the existing checkpoint; inspect the original Azure deployment before any further write.");
+        }
+        if (error instanceof errors_1.MachineCommandError) {
+            throw new errors_1.MachineCommandError(error.code, error.message, { ...resultForRun(run), cause: error.details }, error.status ?? "blocked", provisionNextActions(run.runId));
+        }
+        return resultForRun(run, run.outcome, interrupted);
+    }
+    finally {
+        process.removeListener("SIGINT", sigint);
+        process.removeListener("SIGTERM", sigterm);
+        options.signal?.removeEventListener("abort", externalAbort);
+        try {
+            unlock();
+        }
+        catch {
+            run?.warnings.push("The local execution lock could not be removed. Inspect its owner before retrying; Azure deployment/ledger results are unchanged.");
+            console.warn("Provision lock cleanup failed; inspect the checkpoint before another apply.");
+        }
     }
-    (0, state_1.deletePlanState)(plan.planId, projectRoot);
-    return {
-        planId: plan.planId,
-        resourceGroup: plan.resourceGroup,
-        location: plan.location,
-        swaLocation: plan.swaLocation,
-        executedCommands,
-        ...(deploymentOutputs ? { deploymentOutputs } : {}),
-        warnings,
-    };
 }
 //# sourceMappingURL=provision-operations.js.map