@intentius/chant-lexicon-pulumi 0.124.54 → 0.124.55

package/dist/engine-events.js

@@ -0,0 +1,280 @@
+/**
+ * The engine event stream of `pulumi up --json`, and of `pulumi preview
+ * --json` run with `PULUMI_ENABLE_STREAMING_JSON_PREVIEW=true` (#4541,
+ * ruling C): one `apitype.EngineEvent` per line, the same shape for stock
+ * Pulumi and plunge (`sdk/go/common/apitype/events.go`).
+ *
+ * The printed preview document drops policy events
+ * (`pkg/backend/display/json.go` `ShowPreviewDigest`), so the pulumi-up
+ * capability previews with the stream instead, and reads both the change set
+ * and CrossGuard's verdict from one engine run:
+ *
+ * - {@link pulumiStreamPreview}: the stream turned back into the document
+ *   `pulumiPreviewPart` and `pulumiPreviewDigest` read (`./change-set.ts`).
+ *   Steps come from `resourcePreEvent`, filtered as the printed document
+ *   filters them (`shouldShow`: a non-logical replacement step is left out,
+ *   and `same` steps are kept, since chant always passes `--show-sames`).
+ *   Each state is normalized to the printed form: a blinded secret envelope
+ *   becomes `"[secret]"`, an empty `inputs` or `outputs` map and an empty
+ *   `id` are left out, and `detailedDiff`'s `diffKind` is read as `kind`.
+ *   The digest of the result equals the digest of the printed document for
+ *   the same preview (checked against `testdata/pulumi-stream`).
+ * - {@link pulumiPolicyEvents} and {@link pulumiPolicyFindings}: the
+ *   `policyEvent` lines, as `@intentius/chant/gate-policy` findings. A
+ *   `mandatory` violation denies; `advisory` ones are warnings; `disabled`
+ *   ones are dropped.
+ * - {@link pulumiStreamSummary}: the `summaryEvent`, and plunge's
+ *   per-resource timings (INTENTIUS/plunge#55) when the steps carry them.
+ * - {@link pulumiStreamTimings}: those timings alone, by URN. plunge puts
+ *   `metadata.plungeTimings` on each `resOutputsEvent` and
+ *   `resOpFailedEvent` of `up --json`: one entry per provider call (`kind:
+ *   "provider"`, `call` one of check, diff, create, read, update, delete)
+ *   and per write or delete of the resource's record (`kind: "record"`),
+ *   each with `startedAt` and `durationMs`, and `failed` when it failed.
+ *   Every call is on exactly one event, and a replacement's create and
+ *   delete steps split a URN's calls over two events, so the reader joins
+ *   them. Stock Pulumi prints no such field, and the reader then finds none.
+ *
+ * During `up`, the engine may first preview: those `resourcePreEvent`s carry
+ * `planning: true`. {@link pulumiAppliedSteps} keeps only the steps the update
+ * ran, which is what the stock apply compares with the approved shape
+ * (ruling A).
+ *
+ * Like `./change-set.ts`, this module imports only `./values` and types, so it
+ * bundles without node's process modules.
+ */
+import { isObject, PULUMI_BLINDED_SECRET, PULUMI_SECRET_SIG, PULUMI_SIG_KEY } from "./values.js";
+/** The env var that makes `preview --json` stream engine events instead of printing one document (`sdk/go/common/env/env.go`). */
+export const PULUMI_STREAMING_PREVIEW_ENV = "PULUMI_ENABLE_STREAMING_JSON_PREVIEW";
+/** The calls plunge times (INTENTIUS/plunge#55), by kind. */
+export const PLUNGE_TIMING_CALLS = {
+    provider: ["check", "diff", "create", "read", "update", "delete"],
+    record: ["write", "delete"],
+};
+/**
+ * `value` as a {@link PlungeTiming}, or undefined when it is not one. A
+ * `call` outside the kind's list is kept, so a newer plunge's calls still
+ * read; an entry with no kind, no start or a negative duration is dropped.
+ */
+export function plungeTimingOf(value) {
+    if (!isObject(value))
+        return undefined;
+    const v = value;
+    if (v.kind !== "provider" && v.kind !== "record")
+        return undefined;
+    if (typeof v.call !== "string" || v.call === "")
+        return undefined;
+    if (typeof v.startedAt !== "string" || !Number.isFinite(Date.parse(v.startedAt)))
+        return undefined;
+    if (typeof v.durationMs !== "number" || !Number.isFinite(v.durationMs) || v.durationMs < 0)
+        return undefined;
+    return { kind: v.kind, call: v.call, startedAt: v.startedAt, durationMs: v.durationMs, ...(v.failed === true ? { failed: true } : {}) };
+}
+/** Every line of `stream` that parses as a JSON object. Other lines (a banner, a progress line) are skipped. */
+export function pulumiEngineEvents(stream) {
+    const out = [];
+    for (const line of stream.split("\n")) {
+        const text = line.trim();
+        if (!text.startsWith("{"))
+            continue;
+        try {
+            const v = JSON.parse(text);
+            if (isObject(v))
+                out.push(v);
+        }
+        catch {
+            // A line that is not one event: the stream's events are one per line.
+        }
+    }
+    return out;
+}
+/** Ops that are part of a replacement (`deploy.IsReplacementStep`). */
+const REPLACEMENT_OPS = new Set(["replace", "create-replacement", "delete-replaced", "read-replacement", "discard-replaced", "import-replacement"]);
+/** The printed document's filter (`shouldShow`), with `--show-sames` on: a non-logical replacement step is left out. */
+function shown(m) {
+    return !(m.logical !== true && REPLACEMENT_OPS.has(m.op ?? ""));
+}
+/** A value with every blinded secret envelope read as the printed document's `"[secret]"`. */
+function blinded(v) {
+    if (Array.isArray(v))
+        return v.map(blinded);
+    if (!isObject(v))
+        return v;
+    if (v[PULUMI_SIG_KEY] === PULUMI_SECRET_SIG)
+        return PULUMI_BLINDED_SECRET;
+    return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, blinded(x)]));
+}
+/** A step state in the printed document's form (`apitype.ResourceV3`, empty fields omitted). */
+function stateOf(s) {
+    if (!s || typeof s !== "object" || Array.isArray(s))
+        return undefined;
+    const map = (m) => (isObject(m) && Object.keys(m).length > 0 ? blinded(m) : undefined);
+    const inputs = map(s.inputs);
+    const outputs = map(s.outputs);
+    return {
+        ...(s.urn ? { urn: s.urn } : {}),
+        ...(typeof s.custom === "boolean" ? { custom: s.custom } : {}),
+        ...(s.delete ? { delete: true } : {}),
+        ...(s.id ? { id: s.id } : {}),
+        ...(s.type ? { type: s.type } : {}),
+        ...(s.parent ? { parent: s.parent } : {}),
+        ...(inputs ? { inputs } : {}),
+        ...(outputs ? { outputs } : {}),
+    };
+}
+/** One event step as a printed preview step (`getPreviewMetadataStep`). */
+export function pulumiStepOfEvent(m) {
+    const oldState = stateOf(m.old);
+    const newState = stateOf(m.new);
+    const detailedDiff = isObject(m.detailedDiff)
+        ? Object.fromEntries(Object.entries(m.detailedDiff).map(([k, d]) => [k, { ...(typeof d?.diffKind === "string" ? { kind: d.diffKind } : {}), ...(typeof d?.inputDiff === "boolean" ? { inputDiff: d.inputDiff } : {}) }]))
+        : undefined;
+    return {
+        ...(m.op ? { op: m.op } : {}),
+        ...(m.urn ? { urn: m.urn } : {}),
+        ...(m.provider ? { provider: m.provider } : {}),
+        ...(oldState ? { oldState } : {}),
+        ...(newState ? { newState } : {}),
+        ...(m.diffs?.length ? { diffReasons: [...m.diffs] } : {}),
+        ...(m.keys?.length ? { replaceReasons: [...m.keys] } : {}),
+        ...(detailedDiff ? { detailedDiff } : {}),
+    };
+}
+function stepsOf(events, keep) {
+    const out = [];
+    for (const e of events) {
+        const pre = e.resourcePreEvent;
+        if (!pre || !isObject(pre.metadata) || typeof pre.metadata.urn !== "string")
+            continue;
+        if (!keep(pre) || !shown(pre.metadata))
+            continue;
+        out.push(pulumiStepOfEvent(pre.metadata));
+    }
+    return out;
+}
+/** The diagnostics a stream printed, as the printed document lists them (ephemeral and debug ones left out). */
+function diagnosticsOf(events) {
+    return events
+        .map((e) => e.diagnosticEvent)
+        .filter((d) => isObject(d) && d.ephemeral !== true && d.severity !== "debug" && typeof d.message === "string")
+        .map((d) => ({ ...(d.urn ? { urn: d.urn } : {}), message: d.message, severity: d.severity ?? "info" }));
+}
+/**
+ * A streamed preview as the document `pulumi preview --json` prints without
+ * the env var: `steps`, `diagnostics` and, from the summary, `changeSummary`.
+ * What `pulumiPreviewPart` and `pulumiPreviewDigest` read.
+ */
+export function pulumiStreamPreview(stream) {
+    const events = typeof stream === "string" ? pulumiEngineEvents(stream) : stream;
+    const summary = events.map((e) => e.summaryEvent).find((x) => isObject(x));
+    return {
+        steps: stepsOf(events, () => true),
+        diagnostics: diagnosticsOf(events),
+        ...(summary?.resourceChanges ? { changeSummary: summary.resourceChanges } : {}),
+    };
+}
+/** The steps an `up` ran: its `resourcePreEvent`s outside any preview phase (`planning` unset). */
+export function pulumiAppliedSteps(stream) {
+    const events = typeof stream === "string" ? pulumiEngineEvents(stream) : stream;
+    return stepsOf(events, (e) => e.planning !== true);
+}
+/** The URNs whose operation failed during an `up` (`resOpFailedEvent`), sorted. */
+export function pulumiFailedUrns(stream) {
+    const events = typeof stream === "string" ? pulumiEngineEvents(stream) : stream;
+    const urns = events.map((e) => e.resOpFailedEvent?.metadata?.urn).filter((u) => typeof u === "string");
+    return [...new Set(urns)].sort();
+}
+/** The URNs an `up` finished an operation on (`resOutputsEvent` outside a preview phase, `same` left out), sorted. */
+export function pulumiLandedUrns(stream) {
+    const events = typeof stream === "string" ? pulumiEngineEvents(stream) : stream;
+    const urns = events
+        .map((e) => e.resOutputsEvent)
+        .filter((o) => isObject(o) && o.planning !== true && o.metadata?.op !== "same")
+        .map((o) => o.metadata?.urn)
+        .filter((u) => typeof u === "string");
+    return [...new Set(urns)].sort();
+}
+/** The `policyEvent` lines of a stream, `disabled` ones left out. */
+export function pulumiPolicyEvents(stream) {
+    const events = typeof stream === "string" ? pulumiEngineEvents(stream) : stream;
+    const out = [];
+    for (const e of events) {
+        const p = e.policyEvent;
+        if (!p || typeof p !== "object" || p.enforcementLevel === "disabled")
+            continue;
+        out.push({
+            pack: p.policyPackName ?? "",
+            ...(p.policyPackVersion ? { packVersion: p.policyPackVersion } : {}),
+            policy: p.policyName ?? "",
+            enforcementLevel: p.enforcementLevel ?? "advisory",
+            message: (p.message ?? "").trim(),
+            ...(p.resourceUrn ? { urn: p.resourceUrn } : {}),
+            ...(p.severity ? { severity: p.severity } : {}),
+        });
+    }
+    return out;
+}
+/** The rule id a CrossGuard policy is named by in chant's gate and overrides: `crossguard.<pack>.<policy>`. */
+export function crossGuardRule(v) {
+    return `crossguard.${v.pack}.${v.policy}`;
+}
+/**
+ * CrossGuard's violations as gate findings (`@intentius/chant/gate-policy`):
+ * a `mandatory` one denies the plan, an `advisory` (or `remediate`) one is
+ * a warning. CrossGuard has no hold.
+ */
+export function pulumiPolicyFindings(violations) {
+    const where = (v) => (v.urn ? ` (${v.urn})` : "");
+    return {
+        denials: violations.filter((v) => v.enforcementLevel === "mandatory").map((v) => ({ rule: crossGuardRule(v), message: `${v.message}${where(v)}` })),
+        holds: [],
+        warnings: violations.filter((v) => v.enforcementLevel !== "mandatory").map((v) => `${crossGuardRule(v)}: ${v.message}${where(v)}`),
+    };
+}
+/**
+ * plunge's per-resource timings in `up --json` (INTENTIUS/plunge#55), by URN:
+ * every valid entry of `metadata.plungeTimings` on each `resOutputsEvent`
+ * and `resOpFailedEvent`, joined across a URN's events in stream order. A
+ * stock Pulumi stream gives `{}`.
+ */
+export function pulumiStreamTimings(stream) {
+    var _a;
+    const events = typeof stream === "string" ? pulumiEngineEvents(stream) : stream;
+    const timings = {};
+    for (const e of events) {
+        for (const m of [e.resOutputsEvent?.metadata, e.resOpFailedEvent?.metadata]) {
+            if (!m?.urn || !Array.isArray(m.plungeTimings))
+                continue;
+            const read = m.plungeTimings.map(plungeTimingOf).filter((t) => t !== undefined);
+            if (read.length > 0)
+                (timings[_a = m.urn] ?? (timings[_a] = [])).push(...read);
+        }
+    }
+    return timings;
+}
+/** The stream's `summaryEvent`, with plunge's timings when present. Undefined when the stream has no summary. */
+export function pulumiStreamSummary(stream) {
+    const events = typeof stream === "string" ? pulumiEngineEvents(stream) : stream;
+    const s = events.map((e) => e.summaryEvent).find((x) => isObject(x));
+    const timings = pulumiStreamTimings(events);
+    if (!s)
+        return undefined;
+    return {
+        resourceChanges: isObject(s.resourceChanges) ? s.resourceChanges : {},
+        ...(typeof s.durationSeconds === "number" ? { durationSeconds: s.durationSeconds } : {}),
+        ...(typeof s.result === "string" && s.result ? { result: s.result } : {}),
+        ...(s.maybeCorrupt ? { maybeCorrupt: true } : {}),
+        ...(Object.keys(timings).length > 0 ? { timings } : {}),
+    };
+}
+/** The first error a stream reported (an error diagnostic or an `errorEvent`), if any. */
+export function pulumiStreamError(stream) {
+    const events = typeof stream === "string" ? pulumiEngineEvents(stream) : stream;
+    for (const e of events) {
+        if (typeof e.errorEvent?.error === "string" && e.errorEvent.error.trim())
+            return e.errorEvent.error.trim();
+        if (e.diagnosticEvent?.severity === "error" && typeof e.diagnosticEvent.message === "string")
+            return e.diagnosticEvent.message.trim();
+    }
+    return undefined;
+}

package/dist/exit-codes.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Pulumi and plunge exit statuses mapped onto chant's exit-code table
+ * (#4553, `CHANT_EXIT` in `@intentius/chant/exit-codes`).
+ *
+ * Pulumi's own codes (`pkg/cmd/pulumi/cmd/exit_codes.go` upstream) overlap
+ * chant's numbers with other meanings: Pulumi's 3 is an authentication
+ * failure, chant's 3 a run waiting on a person. So nothing passes a raw
+ * Pulumi code through; every code the lexicon reads goes through
+ * {@link pulumiExitOf}. A Pulumi older than its exit-code taxonomy exits 1 for
+ * everything, which maps to `failed`, still right.
+ *
+ * The pulumi apply capability (#4541) wires this into its step: a plan that
+ * moved throws an error with `planMoved: true`, and core exits
+ * `CHANT_EXIT.moved`.
+ */
+import { type ChantExitCode } from "@intentius/chant/exit-codes";
+/** Pulumi's exit statuses. */
+export declare const PULUMI_EXIT: {
+    readonly success: 0;
+    readonly error: 1;
+    readonly configuration: 2;
+    readonly authentication: 3;
+    readonly resource: 4;
+    readonly policyViolation: 5;
+    readonly stackNotFound: 6;
+    /** `--expect-no-changes` found changes. */
+    readonly noChanges: 7;
+    readonly cancelled: 8;
+    readonly timeout: 9;
+    readonly await: 10;
+    readonly internal: 255;
+};
+/** plunge's exit status for a saved plan that moved, or one with no stamp (`pkg/backend/plunge/planstamp.go`, `ExitPlanMoved`). */
+export declare const PLUNGE_PLAN_MOVED_EXIT = 40;
+/**
+ * The table's code for a `pulumi` or `plunge` exit status.
+ *
+ * | Pulumi or plunge | Table |
+ * |---|---|
+ * | 0 | `done` |
+ * | 5 policy violation (a mandatory CrossGuard pack) | `denied` |
+ * | 7 changes under `--expect-no-changes` (a drift job's refresh) | `drift` |
+ * | plunge 40, a moved or unstamped plan | `moved` |
+ * | 1, 2 configuration, 3 authentication, 4 resource, 6 stack not found, 8 cancelled, 9 timeout, 10 await, 255, anything else | `failed` |
+ *
+ * A configuration error is `failed`: the table has no usage code of its own.
+ * Stock Pulumi's moved preview shape (`PlanShapeMovedError`) is core's moved
+ * mark already and never reaches here as a code.
+ */
+export declare function pulumiExitOf(code: number | null | undefined): ChantExitCode;
+/** Whether a `pulumi` or `plunge` exit status is a plan that moved since its approval. */
+export declare function pulumiPlanMoved(code: number | null | undefined): boolean;
+//# sourceMappingURL=exit-codes.d.ts.map

package/dist/exit-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-codes.d.ts","sourceRoot":"","sources":["../src/exit-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE7E,8BAA8B;AAC9B,eAAO,MAAM,WAAW;aACtB,OAAO,EAAE,CAAC;aACV,KAAK,EAAE,CAAC;aACR,aAAa,EAAE,CAAC;aAChB,cAAc,EAAE,CAAC;aACjB,QAAQ,EAAE,CAAC;aACX,eAAe,EAAE,CAAC;aAClB,aAAa,EAAE,CAAC;IAChB,2CAA2C;aAC3C,SAAS,EAAE,CAAC;aACZ,SAAS,EAAE,CAAC;aACZ,OAAO,EAAE,CAAC;aACV,KAAK,EAAE,EAAE;aACT,QAAQ,EAAE,GAAG;CACL,CAAC;AAEX,mIAAmI;AACnI,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,CAa3E;AAED,0FAA0F;AAC1F,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAExE"}

package/dist/exit-codes.js

@@ -0,0 +1,67 @@
+/**
+ * Pulumi and plunge exit statuses mapped onto chant's exit-code table
+ * (#4553, `CHANT_EXIT` in `@intentius/chant/exit-codes`).
+ *
+ * Pulumi's own codes (`pkg/cmd/pulumi/cmd/exit_codes.go` upstream) overlap
+ * chant's numbers with other meanings: Pulumi's 3 is an authentication
+ * failure, chant's 3 a run waiting on a person. So nothing passes a raw
+ * Pulumi code through; every code the lexicon reads goes through
+ * {@link pulumiExitOf}. A Pulumi older than its exit-code taxonomy exits 1 for
+ * everything, which maps to `failed`, still right.
+ *
+ * The pulumi apply capability (#4541) wires this into its step: a plan that
+ * moved throws an error with `planMoved: true`, and core exits
+ * `CHANT_EXIT.moved`.
+ */
+import { CHANT_EXIT } from "@intentius/chant/exit-codes";
+/** Pulumi's exit statuses. */
+export const PULUMI_EXIT = {
+    success: 0,
+    error: 1,
+    configuration: 2,
+    authentication: 3,
+    resource: 4,
+    policyViolation: 5,
+    stackNotFound: 6,
+    /** `--expect-no-changes` found changes. */
+    noChanges: 7,
+    cancelled: 8,
+    timeout: 9,
+    await: 10,
+    internal: 255,
+};
+/** plunge's exit status for a saved plan that moved, or one with no stamp (`pkg/backend/plunge/planstamp.go`, `ExitPlanMoved`). */
+export const PLUNGE_PLAN_MOVED_EXIT = 40;
+/**
+ * The table's code for a `pulumi` or `plunge` exit status.
+ *
+ * | Pulumi or plunge | Table |
+ * |---|---|
+ * | 0 | `done` |
+ * | 5 policy violation (a mandatory CrossGuard pack) | `denied` |
+ * | 7 changes under `--expect-no-changes` (a drift job's refresh) | `drift` |
+ * | plunge 40, a moved or unstamped plan | `moved` |
+ * | 1, 2 configuration, 3 authentication, 4 resource, 6 stack not found, 8 cancelled, 9 timeout, 10 await, 255, anything else | `failed` |
+ *
+ * A configuration error is `failed`: the table has no usage code of its own.
+ * Stock Pulumi's moved preview shape (`PlanShapeMovedError`) is core's moved
+ * mark already and never reaches here as a code.
+ */
+export function pulumiExitOf(code) {
+    switch (code) {
+        case PULUMI_EXIT.success:
+            return CHANT_EXIT.done;
+        case PULUMI_EXIT.policyViolation:
+            return CHANT_EXIT.denied;
+        case PULUMI_EXIT.noChanges:
+            return CHANT_EXIT.drift;
+        case PLUNGE_PLAN_MOVED_EXIT:
+            return CHANT_EXIT.moved;
+        default:
+            return CHANT_EXIT.failed;
+    }
+}
+/** Whether a `pulumi` or `plunge` exit status is a plan that moved since its approval. */
+export function pulumiPlanMoved(code) {
+    return pulumiExitOf(code) === CHANT_EXIT.moved;
+}

package/dist/index.d.ts

@@ -4,13 +4,23 @@ export { pulumiConfigSchema, pulumiMemberConfigSchema, type PulumiConfig } from
 export { readPulumiMember, PULUMI_EXPORT_FILE, type PulumiMemberConfig, type PulumiMemberReport } from "./workspace-member.js";
 export { pulumiPreviewPart, pulumiPreviewDigest, pulumiSteps, pulumiExportResources, type PulumiPreviewPartInput, type PulumiStep, type PulumiStepState, type PulumiExportedResource, } from "./change-set.js";
 export { pulumiRefreshArgs, pulumiRefreshDriftRecords, pulumiRefreshDocumentRecords, type PulumiRefreshRead, type PulumiRefreshDriftInput, type PulumiRefreshDocumentInput, } from "./drift-record.js";
-export { previewPulumiMember, previewPulumiMemberRead, refreshPulumiMember, pulumiMemberEngine, pulumiMemberStackOutputs, pulumiPreviewArgs, pulumiStackOutputArgs, runAllowedPlunge, runAllowedPulumi, readMemberExport, defaultPulumiRunner, PULUMI_ALLOWED_COMMANDS, type PulumiRunner, type PreviewPulumiMemberOptions, type PulumiMemberPreview, type PulumiMemberEngine, type PulumiMemberStackOutputsOptions, type RefreshPulumiMemberOptions, } from "./run.js";
+export { previewPulumiMember, previewPulumiMemberRead, refreshPulumiMember, pulumiMemberEngine, pulumiMemberStackOutputs, pulumiPreviewArgs, pulumiStackOutputArgs, runAllowedPlunge, runAllowedPulumi, readMemberExport, defaultPulumiRunner, PULUMI_ALLOWED_COMMANDS, PULUMI_APPLY_COMMANDS, runApplyPulumi, runApplyPlunge, pulumiUpArgs, plungeUpArgs, pulumiUpPreviewArgs, PULUMI_REVIEW_STACK_COMMANDS, REVIEW_STACK_NAME, isReviewStackName, reviewStackInitArgs, reviewStackDestroyArgs, reviewStackRmArgs, runReviewStackPulumi, runReviewStackPlunge, type PulumiPolicyPack, type PulumiApplyTail, type PulumiRunner, type PreviewPulumiMemberOptions, type PulumiMemberPreview, type PulumiMemberEngine, type PulumiMemberStackOutputsOptions, type RefreshPulumiMemberOptions, } from "./run.js";
 export { pulumiExportedStackOutputs, pulumiPlannedStackOutputs, type PulumiStackOutput } from "./stack-outputs.js";
 export { PULUMI_UNKNOWN, PULUMI_SIG_KEY, PULUMI_SECRET_SIG } from "./values.js";
 export { pulumiOutputSource, pulumiStackOutputSource, pulumiMemberPlannedOutputs, pulumiExportedOutputValues, pulumiPartHasChanges, PULUMI_APPLIED_OUTPUTS_ENV, type PulumiAppliedFrom, type PulumiOutputSourceOptions, } from "./member-outputs.js";
-export { pulumiCapabilityPlugin } from "./capability-plugin.js";
+export { pulumiCapabilityPlugin, PULUMI_VERB_FAMILIES } from "./capability-plugin.js";
+export { createPulumiUpCapability, pulumiReviewStep, PR_ENV_TEMPLATE_VARIABLE, pulumiUpCapability, pulumiUpMember, pulumiReleaseInputs, pulumiScratchConfig, pulumiDefaultLockGrain, PulumiPlanMovedError, PulumiPolicyDeniedError, PulumiAppliedShapeError, PulumiResourceGrainRefusedError, type PulumiUpStepInput, type PulumiUpStepOutput, type PulumiUpArtifact, type PulumiUpOptions, type PulumiLockGrain, } from "./pulumi-up.js";
+export { pulumiPlanShape, pulumiShapeDifferences, type PulumiPlanShapeOptions } from "./plan-shape.js";
+export { pulumiLockRows } from "./lock-rows.js";
+export { pulumiEngineEvents, pulumiStreamPreview, pulumiAppliedSteps, pulumiPolicyEvents, pulumiPolicyFindings, pulumiStreamSummary, crossGuardRule, PULUMI_STREAMING_PREVIEW_ENV, type PulumiEngineEvent, type PulumiPolicyViolation, type PulumiApplySummary, } from "./engine-events.js";
 export { readPulumiDrift, type PulumiDriftRunners } from "./drift-read.js";
 export { pulumiAuditCatalog } from "./lint/audit-catalog.js";
 export { PulumiWatchOp, type PulumiWatchOpConfig, type PulumiWatchOpResources } from "./composites/pulumi-watch-op.js";
+export { gatedStackExport, gatedStackCancel, gatedStackMove, moveLeftovers, diyStackLockIds, pulumiStackLockIds, type PulumiStackLocks, PULUMI_STACK_OPS_OP, type PulumiStackOpOutcome, type PulumiStackOpCommon, type PulumiStackOpKind } from "./stack-ops.js";
+export { initReviewStack, removeReviewStack, parseReviewStackLocation, prNumberOf, pulumiTemplateStack, reviewConfigSource, reviewStackFor, reviewStackLocation, reviewStackTeardown, REVIEW_STACK_TEARDOWN, type ReviewStackOptions, type ReviewStackOutcome, type ReviewStackTeardown, type ReviewStackTeardownOptions, } from "./review-stack.js";
+export { pulumiStackReferences, parsePulumiStackName, stackReferenceOwner, PULUMI_STACK_REFERENCE_TYPE, type PulumiStackReference } from "./stack-references.js";
+export { PulumiAdoptOp, type PulumiAdoptOpConfig, type PulumiAdoptOpResources, type PulumiAdoptStack } from "./composites/pulumi-adopt-op.js";
+export { parsePlungeAdoptView, pulumiAdoptDigest, adoptBucketTarget, type PlungeAdoptView, type PlungeAdoptStatus } from "./adopt.js";
 export { pulumiPreview as pulumiPreviewStep, pulumiDrift as pulumiDriftStep } from "./op/builders.js";
+export { pulumiExitOf, pulumiPlanMoved, PULUMI_EXIT, PLUNGE_PLAN_MOVED_EXIT } from "./exit-codes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE9P,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -4,13 +4,26 @@ export { pulumiConfigSchema, pulumiMemberConfigSchema } from "./config.js";
 export { readPulumiMember, PULUMI_EXPORT_FILE } from "./workspace-member.js";
 export { pulumiPreviewPart, pulumiPreviewDigest, pulumiSteps, pulumiExportResources, } from "./change-set.js";
 export { pulumiRefreshArgs, pulumiRefreshDriftRecords, pulumiRefreshDocumentRecords, } from "./drift-record.js";
-export { previewPulumiMember, previewPulumiMemberRead, refreshPulumiMember, pulumiMemberEngine, pulumiMemberStackOutputs, pulumiPreviewArgs, pulumiStackOutputArgs, runAllowedPlunge, runAllowedPulumi, readMemberExport, defaultPulumiRunner, PULUMI_ALLOWED_COMMANDS, } from "./run.js";
+export { previewPulumiMember, previewPulumiMemberRead, refreshPulumiMember, pulumiMemberEngine, pulumiMemberStackOutputs, pulumiPreviewArgs, pulumiStackOutputArgs, runAllowedPlunge, runAllowedPulumi, readMemberExport, defaultPulumiRunner, PULUMI_ALLOWED_COMMANDS, PULUMI_APPLY_COMMANDS, runApplyPulumi, runApplyPlunge, pulumiUpArgs, plungeUpArgs, pulumiUpPreviewArgs, PULUMI_REVIEW_STACK_COMMANDS, REVIEW_STACK_NAME, isReviewStackName, reviewStackInitArgs, reviewStackDestroyArgs, reviewStackRmArgs, runReviewStackPulumi, runReviewStackPlunge, } from "./run.js";
 export { pulumiExportedStackOutputs, pulumiPlannedStackOutputs } from "./stack-outputs.js";
 export { PULUMI_UNKNOWN, PULUMI_SIG_KEY, PULUMI_SECRET_SIG } from "./values.js";
 export { pulumiOutputSource, pulumiStackOutputSource, pulumiMemberPlannedOutputs, pulumiExportedOutputValues, pulumiPartHasChanges, PULUMI_APPLIED_OUTPUTS_ENV, } from "./member-outputs.js";
-export { pulumiCapabilityPlugin } from "./capability-plugin.js";
+export { pulumiCapabilityPlugin, PULUMI_VERB_FAMILIES } from "./capability-plugin.js";
+// The apply capability (#4541): a Pulumi or plunge stack as a component step that plans and applies.
+export { createPulumiUpCapability, pulumiReviewStep, PR_ENV_TEMPLATE_VARIABLE, pulumiUpCapability, pulumiUpMember, pulumiReleaseInputs, pulumiScratchConfig, pulumiDefaultLockGrain, PulumiPlanMovedError, PulumiPolicyDeniedError, PulumiAppliedShapeError, PulumiResourceGrainRefusedError, } from "./pulumi-up.js";
+export { pulumiPlanShape, pulumiShapeDifferences } from "./plan-shape.js";
+export { pulumiLockRows } from "./lock-rows.js";
+export { pulumiEngineEvents, pulumiStreamPreview, pulumiAppliedSteps, pulumiPolicyEvents, pulumiPolicyFindings, pulumiStreamSummary, crossGuardRule, PULUMI_STREAMING_PREVIEW_ENV, } from "./engine-events.js";
 export { readPulumiDrift } from "./drift-read.js";
 export { pulumiAuditCatalog } from "./lint/audit-catalog.js";
 // The Preview/Drift watch composite and its step builders (#4494).
 export { PulumiWatchOp } from "./composites/pulumi-watch-op.js";
+export { gatedStackExport, gatedStackCancel, gatedStackMove, moveLeftovers, diyStackLockIds, pulumiStackLockIds, PULUMI_STACK_OPS_OP } from "./stack-ops.js";
+// Review stacks (INTENTIUS/plywood#15): pr-<n> stacks only.
+export { initReviewStack, removeReviewStack, parseReviewStackLocation, prNumberOf, pulumiTemplateStack, reviewConfigSource, reviewStackFor, reviewStackLocation, reviewStackTeardown, REVIEW_STACK_TEARDOWN, } from "./review-stack.js";
+export { pulumiStackReferences, parsePulumiStackName, stackReferenceOwner, PULUMI_STACK_REFERENCE_TYPE } from "./stack-references.js";
+export { PulumiAdoptOp } from "./composites/pulumi-adopt-op.js";
+export { parsePlungeAdoptView, pulumiAdoptDigest, adoptBucketTarget } from "./adopt.js";
 export { pulumiPreview as pulumiPreviewStep, pulumiDrift as pulumiDriftStep } from "./op/builders.js";
+// Pulumi and plunge exit statuses on chant's exit-code table (#4553).
+export { pulumiExitOf, pulumiPlanMoved, PULUMI_EXIT, PLUNGE_PLAN_MOVED_EXIT } from "./exit-codes.js";

package/dist/init-templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-templates.d.ts","sourceRoot":"","sources":["../src/init-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAiDhE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,GAAG,QAAQ,EAAE,eAAe,CAatF,CAAC"}
+{"version":3,"file":"init-templates.d.ts","sourceRoot":"","sources":["../src/init-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAmDhE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,GAAG,QAAQ,EAAE,eAAe,CAatF,CAAC"}

package/dist/init-templates.js

@@ -3,9 +3,11 @@ function chantConfig(member) {
 import "@intentius/chant-lexicon-pulumi";
 
 /**
- * Reads the Pulumi program in ./infra as a member: its graph is the
- * stack-export.json checked in beside Pulumi.yaml. Refresh it after each
- * \`pulumi up\` with \`pulumi stack export --file stack-export.json\`.
+ * Reads the Pulumi program in ./infra as a member. Its graph is the stack
+ * export that chant's pulumi-up apply writes to refs/chant/snapshots after
+ * each update, so nothing is checked in. A stack applied outside chant can
+ * check in stack-export.json beside Pulumi.yaml instead, taken with
+ * \`pulumi stack export --file stack-export.json\` after each update.
  * \`dir\` is relative to this file (PUL101 warns on an absolute one).
  */
 export default {

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "b111925400d3a7fc78c40cf39bcb31998f7eb2a7f81967f90093fba0e3b3b6fc",
+    "manifest.json": "d4de8cb6f01fdb50a4e9b53ae82877b221a4512e50e804f33eface5da48e9840",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "883bcdf6a960e21360e79df010ca2087719fffec60fc39541c5ecd32d661e328",
     "rules/member-dir-absolute.ts": "4805d5e247ad544f942e1b2c36fc15a5087ca0aacaf804183a269021bd60e276",
@@ -20,10 +20,10 @@
     "rules/pul012.ts": "136f9764a532f56ce72461641550c9c4cee6af06c30968d8374f1a65a1b810d4",
     "rules/pul013.ts": "a19b397fecc2bda3e5f32c8f339b0befbd8f1148b32e70a3ba4f9370ee103379",
     "rules/pul014.ts": "25dd5ca4cb7f9906c608f4b7f78559efd188215c9a9a2f9f131498a847d3259b",
-    "rules/pul015.ts": "8a2394d3b486850ad52e8999ccd91feb608d02de986a8574dedbff632fe6c89b",
+    "rules/pul015.ts": "f5eb45e941dfbe1ec53a31fd12258d7adb9877de33b5bcc566a09e3a0829d9da",
     "skills/chant-pulumi.md": "aef93407423daf6d0acc492a4d5bbf002fbae67b4f993ad36f86725686b98d61",
     "skills/chant-pulumi-stack-export.md": "aadd67f5e067de61dfda43d57492bca08bd22429e4baf314d6856a810dc0e8dc",
     "skills/chant-pulumi-plunge.md": "8a7f2f9f1124744dee9645905f141057ca01f5a88e34e1bc3858d69406d7ff3a"
   },
-  "composite": "350f3fecc5eedd8d92b1c5e1878b523bee6bc93d6580deee8fba49803fc4836f"
+  "composite": "362628fd365ccf7dfb116696cbe7f48f955530635fcba52c4366ad55a66ea747"
 }

package/dist/lint/post-synth/pul015.d.ts

@@ -2,7 +2,8 @@
  * PUL015: the config says stock pulumi for a member on a plunge backend.
  *
  * `pulumi.member.engine` decides which binary runs the member's preview,
- * outputs and drift; with none set, a `backend.url` in `Pulumi.yaml` that
+ * outputs and drift; with none set, `plywood.yml`'s engine, a `plunge`
+ * `PULUMI_BACKEND_URL`, or a `backend.url` in `Pulumi.yaml` that
  * starts with `plunge` means plunge (`../../run.ts`, `pulumiMemberEngine`).
  * The config wins, so `engine: "pulumi"` on a program whose backend is
  * `plunge+file://...` or `plunge://...` runs stock `pulumi` against a

package/dist/lint/post-synth/pul015.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pul015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/pul015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAkBpB,CAAC"}
+{"version":3,"file":"pul015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/pul015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAkBpB,CAAC"}

package/dist/lock-rows.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The rows a Pulumi or plunge apply holds on the resource lock grain
+ * (#4552), from the member's change-set part (`./change-set.ts`):
+ *
+ * - `urn <urn>` for every resource the preview changes (create, update,
+ *   replace, delete or forget). The URN carries the project and the stack,
+ *   so two stacks never meet on a URN row.
+ * - `object <id>` for an update, replace, delete or forget whose resource
+ *   has an id, so two members that act on one live object meet on its row,
+ *   whatever lexicon or stack they are in.
+ * - The root `pulumi:pulumi:Stack` URN's row when its step is not `same`:
+ *   two runs that rewrite the stack's outputs serialize. It is one more
+ *   changed entry, so it needs no rule of its own.
+ * - When any entry is `mayAppear` (a component may register children only
+ *   at apply, or the last export holds a resource the preview did not list),
+ *   one `stack <project>/<stack>` row in place of the URN rows (ruling C),
+ *   which conflicts with every `urn` row of the stack. The `object` rows stay.
+ *
+ * `same` and `read` steps hold nothing.
+ */
+import type { ChangeSetPart } from "@intentius/chant/change-set";
+import { type LockRow } from "@intentius/chant/lifecycle/lock-rows";
+/**
+ * The rows of one Pulumi member's part. `target` names the member in a
+ * refusal (`<project>/<stack>`); `fallback` gives the project and stack when
+ * no entry's address is a URN.
+ */
+export declare function pulumiLockRows(part: ChangeSetPart, target: string, fallback?: {
+    project?: string;
+    stack?: string;
+}): LockRow[];
+//# sourceMappingURL=lock-rows.d.ts.map

package/dist/lock-rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-rows.d.ts","sourceRoot":"","sources":["../src/lock-rows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAwD,KAAK,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAe1H;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,EAAE,CAclI"}

package/dist/lock-rows.js

@@ -0,0 +1,36 @@
+import { objectRowKey, sortedLockRows, stackRowKey, urnRowKey } from "@intentius/chant/lifecycle/lock-rows";
+import { parsePulumiUrn } from "@intentius/chant/pulumi-urn";
+const HOLDS = new Set(["create", "update", "replace", "delete", "forget"]);
+/** The project and stack a part's URNs name, or the fallbacks when no URN parses. */
+function stackOf(part, fallback) {
+    for (const e of part.entries) {
+        const parsed = parsePulumiUrn(e.address);
+        if (parsed)
+            return { project: parsed.project, stack: parsed.stack };
+    }
+    const stack = part.member.scope ?? fallback.stack;
+    return fallback.project && stack ? { project: fallback.project, stack } : undefined;
+}
+/**
+ * The rows of one Pulumi member's part. `target` names the member in a
+ * refusal (`<project>/<stack>`); `fallback` gives the project and stack when
+ * no entry's address is a URN.
+ */
+export function pulumiLockRows(part, target, fallback = {}) {
+    const changing = part.entries.filter((e) => HOLDS.has(e.action));
+    const rows = [];
+    for (const e of changing) {
+        if (e.action !== "create" && e.id)
+            rows.push({ key: objectRowKey(e.id), target, address: e.address });
+    }
+    if (changing.some((e) => e.mayAppear === true)) {
+        const at = stackOf(part, fallback);
+        if (!at)
+            throw new Error(`"${target}": some resources of the stack may appear only at apply, and neither a URN nor the step names the stack, so its row cannot be keyed`);
+        rows.push({ key: stackRowKey(at.project, at.stack), target, address: `${at.project}/${at.stack}` });
+        return sortedLockRows(rows);
+    }
+    for (const e of changing)
+        rows.push({ key: urnRowKey(e.address), target, address: e.address });
+    return sortedLockRows(rows);
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pulumi",
-  "version": "0.124.54",
+  "version": "0.124.55",
   "chantVersion": ">=0.1.0",
   "namespace": "Pulumi"
 }