wfctlhelpers

func ApplyPlanWithHooks ¶ added in v0.51.3

func ApplyPlanWithHooks(ctx context.Context, p interfaces.IaCProvider, plan *interfaces.IaCPlan, hooks ApplyPlanHooks) (*interfaces.ApplyResult, error)

ApplyPlanWithHooks is ApplyPlan plus action-boundary hooks for callers that need durable side effects as each cloud mutation succeeds.

func DefaultReplace ¶ added in v0.23.0

func DefaultReplace(ctx context.Context, d interfaces.ResourceDriver, action interfaces.PlanAction, result *interfaces.ApplyResult) error

DefaultReplace is the engine's default Replace dispatcher: Delete the resource at action.Current, then Create from action.Resource. Public so drivers that opt into ResourceReplacer can delegate a particular spec to engine-default behavior without a sentinel-error round-trip.

Decomposes a Replace action into Delete-then-Create on the driver and propagates the new ProviderID through result.ReplaceIDMap[action.Resource.Name] so the JIT substitution wired into ApplyPlan's loop (T5.2) can patch dependent resources whose configs reference the replaced resource by name.

Cascade contract (T5.3) ¶

When a plan has [Replace parent, X dependent] where dependent's Config carries ${parent.id}, the cascade lands automatically: DefaultReplace's post-Create write to result.ReplaceIDMap completes BEFORE the dispatch loop's next iteration calls jitsubst.ResolveSpec on the dependent's spec, so the dependent's driver call (Create or Replace's post-Delete Create) sees the freshly-resolved parent ProviderID. Delete continues to use action.Current.ProviderID via refFromAction — JIT substitution does NOT alter action.Current, so Replace's Delete still targets the pre-Replace cloud resource.

Verified by apply_replace_cascade_test.go.

Failure semantics:

• Delete fails → return wrapped "replace: delete: <err>"; Create does NOT run; ReplaceIDMap is NOT populated for this resource.
• Delete succeeds, ctx canceled before Create → return wrapped "replace: canceled after delete: <err>"; Create does NOT run; ReplaceIDMap is NOT populated. The half-replaced state is the operator's recovery surface (same as the Create-fails case).
• Delete succeeds, Create fails → return wrapped "replace: create: <err>"; ReplaceIDMap stays empty for this resource. Operators inspect the apply log + the empty-for-this- name slot in ReplaceIDMap to know which resources are in a half-replaced state and need manual cloud restoration.
• Both succeed → result.Resources gets the new output appended, result.ReplaceIDMap[action.Resource.Name] = new ProviderID. Map is lazily-initialized on first successful Replace so plans with no Replace actions don't carry an empty map through serialisation.

The "replace: ..." prefix is essential because Replace decomposes into two driver calls — without it, an operator reading result.Errors couldn't tell whether the Delete or the Create failed. Other sub-functions (doCreate non-recovery path, doUpdate, doDelete) pass driver errors through unchanged.

func ValidateAllowReplaceProtected ¶

func ValidateAllowReplaceProtected(plan interfaces.IaCPlan, allow map[string]struct{}) error

ValidateAllowReplaceProtected gates dispatch on the per-resource `protected: true` annotation. It walks every replace or delete action in plan and aggregates ALL blockers (resources protected and not in `allow`) into a single error before returning, so the operator sees the full set of names in one apply attempt and can authorize them with one round-trip via the pre-formatted --allow-replace=<csv> value.

Format (W-6/T6.2):

plan would require destructive action on N protected resource(s):
  <name1> (replace)
  <name2> (delete)
  ...
to authorize, re-run with:
  --allow-replace=<name1>,<name2>,...

Both names and the csv preserve plan-action declaration order so the output is deterministic across runs.

`protected: true` is sourced from PlanAction.Resource.Config for replace actions (where Resource carries the desired spec) and from PlanAction.Current.AppliedConfig for delete actions (where platform.differ leaves Resource.Config empty and the protected status is preserved on the previously-applied state).

Promoted from cmd/wfctl in W-7/T7.9 so the iac/conformance suite can exercise the gate contract without importing package main. The cmd/wfctl validateAllowReplaceProtected wrapper now delegates here; behavior and error format are byte-identical with the pre-W-7 implementation, so all existing tests in cmd/wfctl continue to pass without modification.