state

Subcommands for inspecting and managing resources in the Kyku state file.

Usage

kyku state <subcommand> [options]

Subcommands

state list

List all resources tracked in state.

kyku state list [options]

Flag	Default	Description
`-e, --env <environment>`	`default`	Environment workspace

Example output:

Resources in state (env: default):
  vpc-main    Vpc    providerId: vpc-0abc123
  vm-web      Vm     providerId: i-0def456
  sg-web      SecurityGroup  providerId: sg-0ghi789

state show

Show details of a specific resource in state.

kyku state show <id> [options]

Flag	Default	Description
`-e, --env <environment>`	`default`	Environment workspace
`-p, --passphrase <phrase>`	—	Passphrase for encrypted state

Example:

kyku state show vm-web

Output shows the full state entry: type, provider, providerId, config, dependencies, outputs, timestamps.

state rm

Remove a resource from state. Does not destroy the cloud resource.

kyku state rm <id> [options]

Flag	Default	Description
`-e, --env <environment>`	`default`	Environment workspace

Example:

kyku state rm vm-web

Warning: This removes the resource from Kyku’s tracking only. The cloud resource continues to exist and will need to be cleaned up manually.

state mv

Rename a resource id in the state file. Does not call the cloud. Dependent dependencies entries are rewritten to the new id. Stored configs are not walked except for a top-level config.id that matches the old id.

kyku state mv <from> <to> [options]

Flag	Default	Description
`-e, --env <environment>`	`default`	Environment workspace
`-p, --passphrase <phrase>`	—	Passphrase for encrypted state

Example:

# Config id changed from vpc-old to vpc-new; keep state aligned
kyku state mv vpc-old vpc-new

After this, kyku plan against the renamed config is a no-op (zero changes). Missing source or a target that already exists exits 1. A timestamped backup is written under .kyku/ before the file is mutated. Encrypted state works with --passphrase.

There is no cross-file move and no bulk/glob rename.

state push

Upload local .kyku state into the remote backend declared in the config file (S3, GCS, or Spaces). Verifies a round-trip, then renames the local file to .migrated (it is not deleted).

kyku state push [options]

Flag	Default	Description
`-e, --env <environment>`	`default`	Environment workspace
`-c, --config <path>`	`./infrastructure.ts`	Config file (must declare `backend`)
`--force`	`false`	Overwrite remote state if it already exists

Refuses when the remote object already exists unless --force is set. There is no state pull / state sync, and plan/apply do not auto-migrate.

Examples

# List all resources
kyku state list

# List resources in production
kyku state list --env=prod

# Show a specific resource with decrypted secrets
kyku state show db-main --passphrase "your-passphrase"

# Remove a resource from state (NOT destroy)
kyku state rm vm-web

# Rename a resource id after a config id change
kyku state mv vpc-old vpc-new

# Move local state to the configured remote backend
kyku state push