[DNM/WIP] PSS: Add logic for initialising a new working directory with PSS.

.changes/v1.14/UPGRADE NOTES-20250814-162650.yaml

@@ -0,0 +1,5 @@
+kind: UPGRADE NOTES
+body: 'The parallelism of Terraform operations within container runtimes may be reduced depending on the CPU bandwidth limit setting.'
+time: 2025-08-14T16:26:50.569878+02:00
+custom:
+    Issue: "37436"

.changes/v1.14/UPGRADE NOTES-20250814-162752.yaml

@@ -0,0 +1,5 @@
+kind: UPGRADE NOTES
+body: 'Building Terraform 1.14 requires macOS Monterey or later (due to being built on Go 1.25 which imposes these requirements)'
+time: 2025-08-14T16:27:52.659896+02:00
+custom:
+    Issue: "37436"

.go-version

@@ -1 +1 @@
-1.24.5
+1.25

docs/plugin-protocol/tfplugin6.proto

@@ -425,6 +425,11 @@ service Provider {
     // ConfigureStateStore configures the state store, such as S3 connection in the context of already configured provider
     rpc ConfigureStateStore(ConfigureStateStore.Request) returns (ConfigureStateStore.Response);
 
+    // ReadStateBytes streams byte chunks of a given state file from a state store
+    rpc ReadStateBytes(ReadStateBytes.Request) returns (stream ReadStateBytes.Response);
+    // WriteStateBytes streams byte chunks of a given state file into a state store
+    rpc WriteStateBytes(stream WriteStateBytes.RequestChunk) returns (WriteStateBytes.Response);
+
     // GetStates returns a list of all states (i.e. CE workspaces) managed by a given state store
     rpc GetStates(GetStates.Request) returns (GetStates.Response);
     // DeleteState instructs a given state store to delete a specific state (i.e. a CE workspace)
@@ -918,7 +923,6 @@ message ValidateListResourceConfig {
     }
 }
 
-
 message ValidateStateStore {
     message Request {
         string type_name = 1;
@@ -939,6 +943,39 @@ message ConfigureStateStore {
     }
 }
 
+message ReadStateBytes {
+    message Request {
+        string type_name = 1;
+        string state_id = 2;
+    }
+    message Response {
+        bytes bytes = 1;
+        int64 total_length = 2;
+        StateRange range = 3;
+        repeated Diagnostic diagnostics = 4;
+    }
+}
+
+message WriteStateBytes {
+    message RequestChunk {
+        // TODO: Can we decouple this outside of the stream?
+        string type_name = 1;
+        string state_id = 3;
+
+        bytes bytes = 2;
+        int64 total_length = 4;
+        StateRange range = 5;
+    }
+    message Response {
+        repeated Diagnostic diagnostics = 1;
+    }
+}
+
+message StateRange {
+    int64 start = 1;
+    int64 end = 2;
+}
+
 message GetStates {
 	message Request {
 		string type_name = 1;

go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform
 
-go 1.24.5
+go 1.25
 
 godebug winsymlink=0
 

internal/backend/pluggable/pluggable.go

@@ -68,6 +68,15 @@ func (p *Pluggable) ConfigSchema() *configschema.Block {
 	return val.Body
 }
 
+// ProviderSchema returns the schema for the provider implementing the state store.
+//
+// This isn't part of the backend.Backend interface but is needed in calling code.
+// When it's used the backend.Backend will need to be cast to a Pluggable.
+func (p *Pluggable) ProviderSchema() *configschema.Block {
+	schemaResp := p.provider.GetProviderSchema()
+	return schemaResp.Provider.Body
+}
+
 // PrepareConfig validates configuration for the state store in
 // the state storage provider. The configuration sent from Terraform core
 // will not include any values from environment variables; it is the

internal/backend/remote-state/azure/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/azure
 
-go 1.24.5
+go 1.25
 
 require (
 	github.com/hashicorp/go-azure-helpers v0.72.0

internal/backend/remote-state/consul/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/consul
 
-go 1.24.5
+go 1.25
 
 require (
 	github.com/hashicorp/consul/api v1.32.1

internal/backend/remote-state/cos/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/cos
 
-go 1.24.5
+go 1.25
 
 require (
 	github.com/hashicorp/terraform v0.0.0-00010101000000-000000000000

internal/backend/remote-state/gcs/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/gcs
 
-go 1.24.5
+go 1.25
 
 require (
 	cloud.google.com/go/kms v1.15.5

internal/backend/remote-state/kubernetes/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/kubernetes
 
-go 1.24.5
+go 1.25
 
 require (
 	github.com/hashicorp/terraform v0.0.0-00010101000000-000000000000

internal/backend/remote-state/oci/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/oci
 
-go 1.24.5
+go 1.25
 
 require (
 	github.com/google/go-cmp v0.7.0

internal/backend/remote-state/oss/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/oss
 
-go 1.24.5
+go 1.25
 
 require (
 	github.com/aliyun/alibaba-cloud-sdk-go v1.61.1501

internal/backend/remote-state/pg/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/pg
 
-go 1.24.5
+go 1.25
 
 require (
 	github.com/hashicorp/go-uuid v1.0.3

internal/backend/remote-state/s3/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/terraform/internal/backend/remote-state/s3
 
-go 1.24.5
+go 1.25
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.36.0

internal/builtin/providers/terraform/provider.go

@@ -291,6 +291,18 @@ func (p *Provider) ConfigureStateStore(req providers.ConfigureStateStoreRequest)
 	return resp
 }
 
+func (p *Provider) ReadStateBytes(req providers.ReadStateBytesRequest) providers.ReadStateBytesResponse {
+	var resp providers.ReadStateBytesResponse
+	resp.Diagnostics.Append(fmt.Errorf("unsupported state store type %q", req.TypeName))
+	return resp
+}
+
+func (p *Provider) WriteStateBytes(req providers.WriteStateBytesRequest) providers.WriteStateBytesResponse {
+	var resp providers.WriteStateBytesResponse
+	resp.Diagnostics.Append(fmt.Errorf("unsupported state store type %q", req.TypeName))
+	return resp
+}
+
 func (p *Provider) GetStates(req providers.GetStatesRequest) providers.GetStatesResponse {
 	var resp providers.GetStatesResponse
 	resp.Diagnostics.Append(fmt.Errorf("unsupported state store type %q", req.TypeName))

internal/command/arguments/init.go

@@ -78,6 +78,10 @@ type Init struct {
 	// TODO(SarahFrench/radeksimko): Remove this once the feature is no longer
 	// experimental
 	EnablePssExperiment bool
+
+	// CreateDefaultWorkspace indicates whether the default workspace should be created by
+	// Terraform when initializing a state store for the first time.
+	CreateDefaultWorkspace bool
 }
 
 // ParseInit processes CLI arguments, returning an Init value and errors.
@@ -111,7 +115,7 @@ func ParseInit(args []string) (*Init, tfdiags.Diagnostics) {
 	cmdFlags.BoolVar(&init.Json, "json", false, "json")
 	cmdFlags.Var(&init.BackendConfig, "backend-config", "")
 	cmdFlags.Var(&init.PluginPath, "plugin-dir", "plugin directory")
-
+	cmdFlags.BoolVar(&init.CreateDefaultWorkspace, "create-default-workspace", true, "when -input=false, use this flag to block creation of the default workspace")
 	// Used for enabling experimental code that's invoked before configuration is parsed.
 	cmdFlags.BoolVar(&init.EnablePssExperiment, "enable-pluggable-state-storage-experiment", false, "Enable the pluggable state storage experiment")
 
@@ -139,6 +143,14 @@ func ParseInit(args []string) (*Init, tfdiags.Diagnostics) {
 		))
 	}
 
+	if init.InputEnabled && !init.CreateDefaultWorkspace {
+		diags = diags.Append(tfdiags.Sourceless(
+			tfdiags.Warning,
+			"Invalid init options",
+			"The flag -create-default-workspace=false is ignored when Terraform is configured to ask users for input. Instead, add -input=false or remove the -create-default-workspace flag",
+		))
+	}
+
 	init.Args = cmdFlags.Args()
 
 	backendFlagSet := FlagIsSet(cmdFlags, "backend")

internal/command/arguments/init_test.go

@@ -40,10 +40,11 @@ func TestParseInit_basicValid(t *testing.T) {
 					FlagName: "-backend-config",
 					Items:    &flagNameValue,
 				},
-				Vars:            &Vars{},
-				InputEnabled:    true,
-				CompactWarnings: false,
-				TargetFlags:     nil,
+				Vars:                   &Vars{},
+				InputEnabled:           true,
+				CompactWarnings:        false,
+				TargetFlags:            nil,
+				CreateDefaultWorkspace: true,
 			},
 		},
 		"setting multiple options": {
@@ -72,11 +73,12 @@ func TestParseInit_basicValid(t *testing.T) {
 					FlagName: "-backend-config",
 					Items:    &flagNameValue,
 				},
-				Vars:            &Vars{},
-				InputEnabled:    true,
-				Args:            []string{},
-				CompactWarnings: true,
-				TargetFlags:     nil,
+				Vars:                   &Vars{},
+				InputEnabled:           true,
+				Args:                   []string{},
+				CompactWarnings:        true,
+				TargetFlags:            nil,
+				CreateDefaultWorkspace: true,
 			},
 		},
 		"with cloud option": {
@@ -101,11 +103,12 @@ func TestParseInit_basicValid(t *testing.T) {
 					FlagName: "-backend-config",
 					Items:    &[]FlagNameValue{{Name: "-backend-config", Value: "backend.config"}},
 				},
-				Vars:            &Vars{},
-				InputEnabled:    false,
-				Args:            []string{},
-				CompactWarnings: false,
-				TargetFlags:     []string{"foo_bar.baz"},
+				Vars:                   &Vars{},
+				InputEnabled:           false,
+				Args:                   []string{},
+				CompactWarnings:        false,
+				TargetFlags:            []string{"foo_bar.baz"},
+				CreateDefaultWorkspace: true,
 			},
 		},
 	}

internal/command/cloud_test.go

@@ -135,7 +135,7 @@ func TestCloud_withBackendConfig(t *testing.T) {
 
 	// Initialize the backend
 	ic := &InitCommand{
-		Meta{
+		Meta: Meta{
 			Ui:               ui,
 			View:             view,
 			testingOverrides: metaOverridesForProvider(testProvider()),