Blueprint plan and state API

Creates a blueprint definition without provisioning its resources.

Requires blueprints:write, name, and a supported definition. Returns 201 with blueprint ID, definition revision, and empty state mapping. It does not create the defined infrastructure.

A definition revision uses the schema in Blueprints. Unknown resource fields, cyclic required references, and unsupported resource kinds reject validation. Secrets must be referenced by permitted IDs.

Creates a reviewed change plan for a blueprint revision.

Requires the blueprint ETag. Send definition_revision_id and optional mode normal, import, rename, or detach, with default normal.

An import includes logical_name and resource_id. A rename includes old and new logical names. Detach identifies mapped entries that must remain as unmanaged resources. The response returns 201 with a plan, source revisions, changes, blockers, and the state revision used for evaluation.

Planning reads resources through the caller's permissions. It reserves no future capacity and does not silently take ownership from another blueprint.

Applies a reviewed blueprint plan through a parent operation.

Requires blueprints:write, a current plan ETag, and an idempotency key. Each child is also checked against the submitting principal's resource permissions. Accepted work returns 202 with a parent operation.

412 plan_stale means configuration or mapped state changed since planning. 409 blueprint_locked identifies an active apply. Neither error is a reason to recreate the deployment under a different name.

Returns state revision, logical-name-to-resource mapping, resource revisions, current owner, and active operation ID. Requires blueprints:read.

A failed apply can have successful children. Later planning reconciles those mapped IDs instead of assuming that every proposed create is still absent.

Deletes a blueprint definition after its managed mappings and operations are resolved.

Deleting a blueprint definition is blocked by mapped managed resources and unresolved operations. Resolve or explicitly release those mappings first. A CLI process exiting does not release a server apply lock. See operation recovery.