> ## Documentation Index > Fetch the complete documentation index at: https://docs.reasonos.com/llms.txt > Use this file to discover all available pages before exploring further. # Infra commands > Every rbs infra subcommand: planning, applying, inspecting state, verifying against real providers, and generating typed resource catalogs. All `rbs infra` commands share these flags: | Flag | Meaning | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `-e, --env ` | Environment to operate on (`dev`, `staging`, `prod`, ...). Alias for `-w/--workspace`; default `default`. Once environments are declared, an undeclared name is an error. | | `-p, --parallelism ` | Maximum parallel operations (default 10). | ## Safety at a glance | Command | Cloud resources | State file | Notes | | -------------------------------- | -------------------------------- | ------------------------ | ------------------------------------------------------------------- | | `plan` | never changed | read only | Writes a plan file under `.rbs/` | | `apply` | **created / updated / deleted** | updated | Interactive confirmation by default | | `destroy` | **all deleted** | updated | Requires typed confirmation | | `refresh` | read only | updated to match reality | | | `import` | read only | one resource added | | | `show`, `output`, `env`, `graph` | untouched | read only | No cloud calls | | `verify` | untouched, no credentials needed | read only | Downloads provider plugins | | `schema`, `generate`, `scaffold` | untouched | untouched | Download provider plugins; `generate`/`scaffold` write `.rbs` files | ## rbs infra plan Compute what would change: resources to create, update, delete, replace, or leave unchanged. Nothing is modified. ```bash theme={null} rbs infra plan # whole workspace rbs infra plan //backend:* # scoped to a package rbs infra plan -e prod rbs infra plan -o release.plan.json # save to an explicit file ``` The plan is saved (default: under `.rbs/infra/plans/`) so a later `rbs infra apply` executes exactly what you reviewed. Sensitive values appear as `(sensitive)` in the diff. A targeted plan (`plan //pkg:*`) is a **partial plan**: it never proposes deleting resources outside its scope. Only a full-workspace plan detects true orphans — resources in state that no declaration mentions anymore. ## rbs infra apply Execute the plan: create, update, or delete cloud resources to match your declarations, then record the results in `.reasonos/infra/state/`. ```bash theme={null} rbs infra apply # uses the saved plan if one exists, else plans fresh rbs infra apply release.plan.json # apply a specific saved plan rbs infra apply -y # --auto-approve: skip the confirmation prompt rbs infra apply --dry-run # walk the plan without touching anything ``` Apply shows the plan and asks for confirmation unless `-y` is passed. A saved plan older than an hour triggers a staleness warning; a consumed plan file is removed after a successful apply. Set `RBS_INFRA_PASSPHRASE` before applying resources with secrets. State is committed to git — without the passphrase, sensitive values are stored in plaintext (rbs warns loudly when this happens). ## rbs infra destroy Delete **every** resource in the selected environment. ```bash theme={null} rbs infra destroy rbs infra destroy -e staging rbs infra destroy -y # skip confirmation — for automation only ``` Without `-y`, destroy requires typing `yes` after naming the environment it is about to level. There is no partial destroy; to remove individual resources, delete their declarations and apply. ## rbs infra refresh Re-read the live resources from the providers and update the state file to match reality. No resources are changed. ```bash theme={null} rbs infra refresh -e prod ``` Useful after out-of-band changes (console edits, autoscaling) so the next plan diffs against the truth. ## rbs infra import Bring an existing, manually-created resource under rbs management without recreating it. ```bash theme={null} rbs infra import aws_instance.web i-1234567890abcdef0 rbs infra import google_compute_instance.app projects/my-project/zones/us-central1-a/instances/my-instance ``` The address is `.`; the ID is whatever the provider uses to identify the resource. ## rbs infra show Print the current state: every tracked resource with its provider, ID, and attributes. Sensitive attributes are masked. ```bash theme={null} rbs infra show rbs infra show -e prod ``` ## rbs infra output Read values from applied state — workspace outputs, a whole resource, or one attribute. ```bash theme={null} rbs infra output # list everything rbs infra output vpc_id # one workspace output rbs infra output database.maindb.endpoint rbs infra output database.maindb --json ``` Sensitive outputs are masked in listings; addressing one directly reveals it. `--json` prints machine-readable values for scripting. ## rbs infra env Resolve the environment variables a service gets from the infrastructure it uses — the same resolution `rbs run` performs for `service` targets. ```bash theme={null} rbs infra env --uses maindb rbs infra env --uses maindb --uses sessions --need DB_PASSWORD=maindb.password eval "$(rbs infra env --uses maindb --export)" # into the current shell rbs infra env --uses maindb --json ``` `--uses` pulls a resource's conventional exports (`DATABASE_HOST`, `REGISTRY_URL`, ...); `--need NAME=resource.attribute` wires anything explicitly. Values come from applied state, so run `rbs infra apply` first. ## rbs infra graph Show declared resources and their dependency edges. ```bash theme={null} rbs infra graph rbs infra graph --dot | dot -Tsvg -o infra.svg # render with Graphviz ``` ## rbs infra verify Smoke-test every declared resource against the **real** provider binaries — schema validation plus a plan-time dry run — with no credentials and no cloud calls. This is the command to run after editing infrastructure, and the natural CI gate: ```bash theme={null} rbs infra verify # whole workspace rbs infra verify //backend:* # scoped ``` It catches wrong attributes, invalid values, and missing requirements before anything reaches apply. Checks that would need cloud credentials are reported as skipped, never failed; any real failure makes the command exit non-zero. Server-side rules (quotas, IAM, name uniqueness) still need a real apply — verify is the fast local rung, not a sandbox replacement. ## rbs infra schema Browse a provider's complete resource schema — every type it supports, or one type's full attribute table (types, required/optional/computed, sensitivity). ```bash theme={null} rbs infra schema aws # list all resource types rbs infra schema aws --filter s3 # substring filter rbs infra schema aws aws_s3_bucket # one resource in detail rbs infra schema azurerm --version 3.85.0 # pin a provider version (default: latest) ``` ## rbs infra generate Generate typed, validated `.rbs` resource definitions from a provider's schema into your workspace. ```bash theme={null} rbs infra generate aws aws_s3_bucket aws_sqs_queue rbs infra generate google --all # every resource type rbs infra generate aws aws_mq_broker --abstract message_broker ``` | Flag | Meaning | | ------------------- | ----------------------------------------------------------------------------------------- | | `--all` | Generate every resource type the provider supports | | `--out ` | Output root (default `rules/infra/embedded`, which auto-loads like the built-in catalogs) | | `--abstract ` | Also emit a cloud-agnostic abstraction skeleton over the first type | | `--version ` | Provider version (default: latest) | Generated files are grouped one per service (`aws_s3_* → s3.rbs`), carry the provider version pin alongside the schema, and are user-owned — edit or regenerate freely. ## rbs infra scaffold Draft a new cross-cloud abstraction from real provider schemas: attributes that align across providers become the shared surface; the rest become per-adapter candidates for your judgement pass. ```bash theme={null} rbs infra scaffold sql_database \ --map aws=aws_db_instance \ --map google=google_sql_database_instance \ --map azurerm=azurerm_postgresql_flexible_server ``` Writes the abstraction plus one adapter per mapped provider under `infra/` (`--out` to change), and refuses to overwrite existing files — scaffolds are starting points, not round-trip artifacts. Finish by wiring outputs and env exports, then validate with `rbs infra verify` and `rbs infra plan`.