@intentius/chant-lexicon-pulumi 0.124.54 → 0.124.55

package/dist/member-engine.d.ts

@@ -1,8 +1,33 @@
 /** What runs a Pulumi member's stack. */
 export type PulumiMemberEngine = "pulumi" | "plunge";
-/** Which engine runs the member, and the rule that said so (see `./run.ts`'s module comment). */
-export declare function pulumiMemberEngine(dir: string, configured?: PulumiMemberEngine): {
+/** Where the engine decision came from, first rule that answered. */
+export type PulumiMemberEngineSource = "member-config" | "plywood.yml" | "PULUMI_BACKEND_URL" | "Pulumi.yaml" | "default";
+/** Inputs beyond the member directory. All optional. */
+export interface PulumiMemberEngineOptions {
+    /** The job environment; defaults to `process.env`. Only `PULUMI_BACKEND_URL` is read. */
+    env?: Record<string, string | undefined>;
+    /** Where the search for `plywood.yml` stops (inclusive). Default: the first directory holding `.git`, else the filesystem root. */
+    plywoodRoot?: string;
+}
+/**
+ * The `engine` and `backend` keys of the nearest `plywood.yml`, looking in
+ * `dir` and each parent up to the repository root. plywood passes no
+ * detection of its own: the file is read here (chant#4559).
+ */
+export declare function readPlywoodEngine(dir: string, stopAt?: string): {
+    file: string;
+    engine?: PulumiMemberEngine;
+    backend?: string;
+} | undefined;
+/**
+ * Which engine runs the member, the rule that said so, and where it came from
+ * (see `./run.ts`'s module comment). First rule that answers:
+ * the member's config, `engine` (then a `plunge+` `backend`) in `plywood.yml`,
+ * `PULUMI_BACKEND_URL`, `backend.url` in `Pulumi.yaml`, else pulumi.
+ */
+export declare function pulumiMemberEngine(dir: string, configured?: PulumiMemberEngine, opts?: PulumiMemberEngineOptions): {
     engine: PulumiMemberEngine;
     because: string;
+    source: PulumiMemberEngineSource;
 };
 //# sourceMappingURL=member-engine.d.ts.map

package/dist/member-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"member-engine.d.ts","sourceRoot":"","sources":["../src/member-engine.ts"],"names":[],"mappings":"AAWA,yCAAyC;AACzC,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErD,iGAAiG;AACjG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,kBAAkB,GAAG;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAchI"}
+{"version":3,"file":"member-engine.d.ts","sourceRoot":"","sources":["../src/member-engine.ts"],"names":[],"mappings":"AAWA,yCAAyC;AACzC,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAErD,qEAAqE;AACrE,MAAM,MAAM,wBAAwB,GAAG,eAAe,GAAG,aAAa,GAAG,oBAAoB,GAAG,aAAa,GAAG,SAAS,CAAC;AAE1H,wDAAwD;AACxD,MAAM,WAAW,yBAAyB;IACxC,yFAAyF;IACzF,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,mIAAmI;IACnI,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAKD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAuB3I;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,kBAAkB,EAC/B,IAAI,GAAE,yBAA8B,GACnC;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,CA4BnF"}

package/dist/member-engine.js

@@ -6,24 +6,75 @@
  * only a member on plunge has a checked-in `engine-graph.json` read (#4529).
  */
 import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { parseYAML } from "@intentius/chant/yaml";
-/** Which engine runs the member, and the rule that said so (see `./run.ts`'s module comment). */
-export function pulumiMemberEngine(dir, configured) {
+const PLUNGE_URL = /^plunge[+:]/;
+const PLYWOOD_FILES = ["plywood.yml", "plywood.yaml"];
+/**
+ * The `engine` and `backend` keys of the nearest `plywood.yml`, looking in
+ * `dir` and each parent up to the repository root. plywood passes no
+ * detection of its own: the file is read here (chant#4559).
+ */
+export function readPlywoodEngine(dir, stopAt) {
+    let cur = resolve(dir);
+    const stop = stopAt ? resolve(stopAt) : undefined;
+    for (let depth = 0; depth < 32; depth++) {
+        for (const name of PLYWOOD_FILES) {
+            const file = join(cur, name);
+            if (!existsSync(file))
+                continue;
+            try {
+                const doc = parseYAML(readFileSync(file, "utf-8"));
+                const engine = doc?.engine === "pulumi" || doc?.engine === "plunge" ? doc.engine : undefined;
+                const backend = typeof doc?.backend === "string" ? doc.backend : undefined;
+                return { file, engine, backend };
+            }
+            catch {
+                // An unreadable plywood.yml fails plywood's own config check; here it names no engine.
+                return { file };
+            }
+        }
+        if (cur === stop || (!stop && existsSync(join(cur, ".git"))))
+            return undefined;
+        const parent = dirname(cur);
+        if (parent === cur)
+            return undefined;
+        cur = parent;
+    }
+    return undefined;
+}
+/**
+ * Which engine runs the member, the rule that said so, and where it came from
+ * (see `./run.ts`'s module comment). First rule that answers:
+ * the member's config, `engine` (then a `plunge+` `backend`) in `plywood.yml`,
+ * `PULUMI_BACKEND_URL`, `backend.url` in `Pulumi.yaml`, else pulumi.
+ */
+export function pulumiMemberEngine(dir, configured, opts = {}) {
     if (configured)
-        return { engine: configured, because: `the member's config says engine: ${configured}` };
+        return { engine: configured, because: `the member's config says engine: ${configured}`, source: "member-config" };
+    const plywood = readPlywoodEngine(dir, opts.plywoodRoot);
+    if (plywood?.engine) {
+        return { engine: plywood.engine, because: `${plywood.file} says engine: ${plywood.engine}`, source: "plywood.yml" };
+    }
+    if (plywood?.backend && PLUNGE_URL.test(plywood.backend)) {
+        return { engine: "plunge", because: `${plywood.file} names the plunge backend ${plywood.backend}`, source: "plywood.yml" };
+    }
+    const envUrl = (opts.env ?? process.env).PULUMI_BACKEND_URL;
+    if (envUrl && PLUNGE_URL.test(envUrl)) {
+        return { engine: "plunge", because: `PULUMI_BACKEND_URL names the plunge backend ${envUrl}`, source: "PULUMI_BACKEND_URL" };
+    }
     const file = join(dir, "Pulumi.yaml");
     if (existsSync(file)) {
         try {
             const doc = parseYAML(readFileSync(file, "utf-8"));
             const backend = doc.backend;
             const url = typeof backend?.url === "string" ? backend.url : undefined;
-            if (url && /^plunge[+:]/.test(url))
-                return { engine: "plunge", because: `Pulumi.yaml names the plunge backend ${url}` };
+            if (url && PLUNGE_URL.test(url))
+                return { engine: "plunge", because: `Pulumi.yaml names the plunge backend ${url}`, source: "Pulumi.yaml" };
         }
         catch {
             // An unreadable Pulumi.yaml fails the member file check; here it just names no backend.
         }
     }
-    return { engine: "pulumi", because: "nothing names plunge" };
+    return { engine: "pulumi", because: "nothing names plunge", source: "default" };
 }

package/dist/member-outputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"member-outputs.d.ts","sourceRoot":"","sources":["../src/member-outputs.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAClI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAuE,KAAK,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAIxI,sDAAsD;AACtD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,MAAM,WAAW,yBAAyB;IACxC,qHAAqH;IACrH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,oEAAoE;IACpE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAcD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAGjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAcpJ;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAErF;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAoB9F;AAED,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,EAAE,kBAAyC,CAAC"}
+{"version":3,"file":"member-outputs.d.ts","sourceRoot":"","sources":["../src/member-outputs.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAClI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAqE,KAAK,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAItI,sDAAsD;AACtD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,MAAM,WAAW,yBAAyB;IACxC,qHAAqH;IACrH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,oEAAoE;IACpE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAcD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAGjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAcpJ;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAErF;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAoB9F;AAED,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,EAAE,kBAAyC,CAAC"}

package/dist/member-outputs.js

@@ -1,5 +1,5 @@
 import { pulumiPlannedStackOutputs, pulumiExportedStackOutputs } from "./stack-outputs.js";
-import { previewPulumiMemberRead, pulumiMemberStackOutputs, readMemberExport } from "./run.js";
+import { memberExportOf, previewPulumiMemberRead, pulumiMemberStackOutputs } from "./run.js";
 import { isSecret } from "./values.js";
 import { PULUMI_EXPORT_FILE } from "./workspace-member.js";
 /** The environment variable that makes the source read applied outputs from the checked-in export. */
@@ -64,9 +64,9 @@ export function pulumiOutputSource(options = {}) {
         kinds: ["pulumi"],
         async applied(_ctx, ref) {
             if (appliedFrom() === "export") {
-                const exported = readMemberExport(ref.dir);
+                const exported = await memberExportOf(ref.dir);
                 if (exported === undefined) {
-                    throw new Error(`member-outputs: Pulumi member "${ref.member}" has no readable ${PULUMI_EXPORT_FILE} in ${ref.dir}, and its outputs are read from the export (${PULUMI_APPLIED_OUTPUTS_ENV}=export)`);
+                    throw new Error(`member-outputs: Pulumi member "${ref.member}" has no export in the index store and no readable ${PULUMI_EXPORT_FILE} in ${ref.dir}, and its outputs are read from the export (${PULUMI_APPLIED_OUTPUTS_ENV}=export)`);
                 }
                 return pulumiExportedOutputValues(exported);
             }
@@ -74,7 +74,7 @@ export function pulumiOutputSource(options = {}) {
         },
         async planned(_ctx, ref) {
             const read = await previewPulumiMemberRead({ member: ref.member, dir: ref.dir, ...runners });
-            return pulumiMemberPlannedOutputs(ref.member, { ...read, exported: readMemberExport(ref.dir) });
+            return pulumiMemberPlannedOutputs(ref.member, { ...read, exported: await memberExportOf(ref.dir) });
         },
     };
 }

package/dist/op/activities/index.d.ts

@@ -12,8 +12,16 @@
  *     per resource (`plunge drift --resource <urn> --stream` on plunge), as
  *     drift counts.
  *
- * Neither changes the stack. See `./pulumi.ts`.
+ *   - pulumiAdoptCheck, pulumiAdoptExport, pulumiAdoptPreview, pulumiAdopt:
+ *     `PulumiAdoptOp`'s steps (#4562), the shared bucket check, the stock
+ *     checkpoint's export, `plunge stack adopt --json` and, after the gate,
+ *     `plunge stack adopt --json --yes`. See `./pulumi-adopt.ts`.
+ *
+ * Only `pulumiAdopt` changes anything: it writes plunge's records. See
+ * `./pulumi.ts`.
  */
 export { pulumiPreview, pulumiDrift } from "./pulumi.js";
+export { pulumiAdoptCheck, pulumiAdoptExport, pulumiAdoptPreview, pulumiAdopt } from "./pulumi-adopt.js";
+export type { PulumiAdoptStackArgs, PulumiAdoptCheckArgs, PulumiAdoptCheckResult, PulumiAdoptExportArgs, PulumiAdoptExportResult, PulumiAdoptPreviewArgs, PulumiAdoptPreviewResult, PulumiAdoptArgs, PulumiAdoptResult, } from "./pulumi-adopt.js";
 export type { PulumiMemberArgs, PulumiPreviewArgs, PulumiPreviewResult, PulumiDriftArgs, PulumiDriftResult } from "./pulumi.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACtG,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,wBAAwB,EACxB,eAAe,EACf,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC"}

package/dist/op/activities/index.js

@@ -12,6 +12,13 @@
  *     per resource (`plunge drift --resource <urn> --stream` on plunge), as
  *     drift counts.
  *
- * Neither changes the stack. See `./pulumi.ts`.
+ *   - pulumiAdoptCheck, pulumiAdoptExport, pulumiAdoptPreview, pulumiAdopt:
+ *     `PulumiAdoptOp`'s steps (#4562), the shared bucket check, the stock
+ *     checkpoint's export, `plunge stack adopt --json` and, after the gate,
+ *     `plunge stack adopt --json --yes`. See `./pulumi-adopt.ts`.
+ *
+ * Only `pulumiAdopt` changes anything: it writes plunge's records. See
+ * `./pulumi.ts`.
  */
 export { pulumiPreview, pulumiDrift } from "./pulumi.js";
+export { pulumiAdoptCheck, pulumiAdoptExport, pulumiAdoptPreview, pulumiAdopt } from "./pulumi-adopt.js";

package/dist/op/activities/pulumi-adopt.d.ts

@@ -0,0 +1,104 @@
+import type { BucketReport, BucketTarget, CheckBucketOptions } from "@intentius/chant/bucket-check";
+import { type PlungeAdoptStatus } from "../../adopt.js";
+import { type PulumiRunner } from "../../run.js";
+/** The fields every adopt activity takes. */
+export interface PulumiAdoptStackArgs {
+    /** The member's name. */
+    member: string;
+    /** The stack's directory, where `Pulumi.yaml` is. Relative paths resolve against `cwd`. */
+    dir: string;
+    cwd?: string;
+    /** The stack to adopt. */
+    stack: string;
+}
+export interface PulumiAdoptCheckArgs extends PulumiAdoptStackArgs {
+    /** The plunge backend URL (`plunge+s3://...`). Default: `plywood.yml`'s, `PULUMI_BACKEND_URL`, `Pulumi.yaml`'s. */
+    backend?: string;
+    /** The bucket to check, when the URL does not say enough (azblob), as `@intentius/chant/bucket-check` takes it. */
+    bucket?: Record<string, unknown>;
+    /** Key prefixes a lifecycle rule must cover. Default: the URL's path. */
+    namespaces?: string[];
+    /** Settings waived on top of the URL's `allow_insecure` and `PLUNGE_ALLOW_INSECURE`. An unwaivable one stays refused. */
+    allowInsecure?: string[];
+}
+export interface PulumiAdoptCheckResult {
+    member: string;
+    stack: string;
+    /** False when there was no bucket to check. */
+    checked: boolean;
+    /** Why the check did not run. */
+    skipped?: string;
+    store?: string;
+    bucket?: string;
+    correct: boolean;
+    /** Settings that failed and were waived. */
+    waived: string[];
+}
+export interface PulumiAdoptExportArgs extends PulumiAdoptStackArgs {
+    /** The plunge backend URL; its stock form is where the export is read. */
+    backend?: string;
+    /** Where the checkpoint comes from instead: another backend (Pulumi Cloud, `https://api.pulumi.com`), or an export already taken. */
+    from?: {
+        backend?: string;
+        file?: string;
+    };
+}
+export interface PulumiAdoptExportResult {
+    member: string;
+    stack: string;
+    /** The export, a scratch file (mode 600) or `from.file`. */
+    file: string;
+    sha256: string;
+    resources: number;
+    pendingOperations: number;
+    /** The backend it was read from, or `file`. */
+    source: string;
+    /** True when plunge adopts this file (`--file`), on the route from another backend or a given file. */
+    adoptFromFile: boolean;
+}
+export interface PulumiAdoptPreviewArgs extends PulumiAdoptStackArgs {
+    /** `--file`: the export to adopt, from the Export step when `adoptFromFile`. */
+    file?: string;
+}
+export interface PulumiAdoptPreviewResult {
+    member: string;
+    stack: string;
+    status: PlungeAdoptStatus;
+    /** What the gate binds. */
+    planDigest: string;
+    checkpointDigest: string | null;
+    resources: number;
+    /** Resources by fate: marker, record, pending, already-adopted. */
+    fates: Record<string, number>;
+    /** False when the stack is already adopted from this checkpoint. */
+    changed: boolean;
+}
+export interface PulumiAdoptArgs extends PulumiAdoptPreviewArgs {
+    /** The approved preview's digest, to report whether the adoption matched it. */
+    planDigest?: string;
+}
+export interface PulumiAdoptResult extends PulumiAdoptPreviewResult {
+    /** Whether what plunge adopted digests as the approved preview. Absent when no digest was handed in. */
+    matchesApproved?: boolean;
+}
+/** Runners and seams, injectable so the tests run no binary and read no bucket. */
+export interface PulumiAdoptDeps {
+    run?: PulumiRunner;
+    plunge?: PulumiRunner;
+    env?: Record<string, string | undefined>;
+    tmp?: string;
+    checkBucket?: (target: BucketTarget, options: CheckBucketOptions) => Promise<BucketReport>;
+}
+/** The shared bucket check on the stack's backend bucket; throws when a setting fails unwaived. */
+export declare function adoptCheck(a: PulumiAdoptCheckArgs, deps?: PulumiAdoptDeps): Promise<PulumiAdoptCheckResult>;
+/** The stock checkpoint as a scratch file, or the given one. */
+export declare function adoptExport(a: PulumiAdoptExportArgs, deps?: PulumiAdoptDeps): Promise<PulumiAdoptExportResult>;
+/** `plunge stack adopt --json`: the classification, written nowhere. A refusal fails the step. */
+export declare function adoptPreview(a: PulumiAdoptPreviewArgs, deps?: PulumiAdoptDeps): Promise<PulumiAdoptPreviewResult>;
+/** `plunge stack adopt --json --yes`: writes the records. A refusal fails the step; plunge wrote nothing then. */
+export declare function adoptStack(a: PulumiAdoptArgs, deps?: PulumiAdoptDeps): Promise<PulumiAdoptResult>;
+export declare function pulumiAdoptCheck(args: Record<string, unknown>): Promise<PulumiAdoptCheckResult>;
+export declare function pulumiAdoptExport(args: Record<string, unknown>): Promise<PulumiAdoptExportResult>;
+export declare function pulumiAdoptPreview(args: Record<string, unknown>): Promise<PulumiAdoptPreviewResult>;
+export declare function pulumiAdopt(args: Record<string, unknown>): Promise<PulumiAdoptResult>;
+//# sourceMappingURL=pulumi-adopt.d.ts.map

package/dist/op/activities/pulumi-adopt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pulumi-adopt.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pulumi-adopt.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACpG,OAAO,EAQL,KAAK,iBAAiB,EAEvB,MAAM,aAAa,CAAC;AAErB,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,WAAW,CAAC;AAGnB,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yHAAyH;IACzH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IACjE,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qIAAqI;IACrI,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,iBAAiB,CAAC;IAC1B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,sBAAsB;IAC7D,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAkB,SAAQ,wBAAwB;IACjE,wGAAwG;IACxG,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5F;AAeD,mGAAmG;AACnG,wBAAsB,UAAU,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAuCrH;AAED,gEAAgE;AAChE,wBAAsB,WAAW,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmDxH;AAgCD,kGAAkG;AAClG,wBAAsB,YAAY,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAS3H;AAED,kHAAkH;AAClH,wBAAsB,UAAU,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU3G;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAErG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEvG;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAEzG;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE3F"}

package/dist/op/activities/pulumi-adopt.js

@@ -0,0 +1,216 @@
+/**
+ * `PulumiAdoptOp`'s activities (#4562): check the bucket, export the stock
+ * checkpoint, preview the adoption, adopt. The composite
+ * (`../../composites/pulumi-adopt-op.ts`) puts its gate between the preview
+ * and the adoption, bound to the preview's `planDigest`.
+ *
+ * - `pulumiAdoptCheck`: the shared bucket check (#4558, `@intentius/chant/bucket-check`)
+ *   on the bucket the stack's backend URL names. A failing setting that is
+ *   not waived (`allow_insecure` on the URL, `PLUNGE_ALLOW_INSECURE`, or the
+ *   step's `allowInsecure`) refuses the stack by name with its fix, before
+ *   anything is exported. A `file://` backend has no bucket and is skipped.
+ * - `pulumiAdoptExport`: stock `pulumi stack export --stack <s>`, through the
+ *   read allowlist (#4546), against the stack's stock backend at the same
+ *   root (the backend URL without `plunge+`) or the step's `from.backend`
+ *   (Pulumi Cloud, for the `--file` route). The export is kept in a scratch
+ *   file under the OS temp dir, mode 600, since it holds secret ciphertext:
+ *   it is the back-out copy, and on the `--file` route the document plunge
+ *   adopts. `from.file` names an export taken by hand instead, and nothing
+ *   runs. The result gives the file, its SHA-256 and its counts.
+ * - `pulumiAdoptPreview`: `plunge stack adopt --json --stack <s> [--file f]`,
+ *   which classifies and writes nothing. A refused adoption fails the step,
+ *   naming each refusal. Its `planDigest` (`../../adopt.ts`'s
+ *   `pulumiAdoptDigest`) is what the gate binds.
+ * - `pulumiAdopt`: `plunge stack adopt --json --yes --stack <s> [--file f]`
+ *   through `runAdoptPlunge`, the one entry point allowed to write. It
+ *   reports whether what plunge adopted digests as the approved preview did.
+ *
+ * None of them calls a cloud API but the bucket check's reads: adoption
+ * writes plunge's records only, and the next `plunge up` writes the
+ * markers.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { adoptBucketTarget, adoptFates, parsePlungeAdoptView, pulumiAdoptDigest, pulumiStackBackend, stockBackendUrl, } from "../../adopt.js";
+import { pulumiExportResources } from "../../change-set.js";
+import { defaultPlungeRunner, defaultPulumiRunner, plungeAdoptArgs, pulumiRunFailure, runAdoptPlunge, runAllowedPlunge, runAllowedPulumi, } from "../../run.js";
+import { isObject } from "../../values.js";
+function stackDir(a) {
+    return isAbsolute(a.dir) ? a.dir : resolve(a.cwd ?? process.cwd(), a.dir);
+}
+function requireStack(a, what) {
+    if (typeof a?.dir !== "string" || a.dir === "")
+        throw new Error(`${what}: the step needs "dir", the directory holding Pulumi.yaml`);
+    if (typeof a.stack !== "string" || a.stack === "" || a.stack.startsWith("-"))
+        throw new Error(`${what}: the step needs "stack", the stack to adopt`);
+}
+function refusalText(refusals) {
+    return refusals.map((r) => `${r.code}${r.urn ? ` (${r.urn})` : ""}: ${r.reason}`).join("; ");
+}
+/** The shared bucket check on the stack's backend bucket; throws when a setting fails unwaived. */
+export async function adoptCheck(a, deps = {}) {
+    requireStack(a, "pulumiAdoptCheck");
+    const env = deps.env ?? process.env;
+    const dir = stackDir(a);
+    const base = { member: a.member, stack: a.stack };
+    let target;
+    let namespaces;
+    let waived;
+    if (a.bucket) {
+        target = a.bucket;
+        namespaces = a.namespaces ?? [];
+        waived = [...(env.PLUNGE_ALLOW_INSECURE ?? "").split(",").map((s) => s.trim()).filter(Boolean)];
+    }
+    else {
+        const backend = pulumiStackBackend(dir, { ...(a.backend ? { configured: a.backend } : {}), env });
+        if (!backend) {
+            throw new Error(`pulumiAdoptCheck: "${a.member}/${a.stack}" names no backend (the step's backend, plywood.yml, PULUMI_BACKEND_URL or Pulumi.yaml), so its bucket cannot be checked before adoption`);
+        }
+        const found = adoptBucketTarget(backend.url, env);
+        if ("skip" in found)
+            return { ...base, checked: false, skipped: found.skip, correct: true, waived: [] };
+        if ("refuse" in found)
+            throw new Error(`pulumiAdoptCheck: refusing to adopt "${a.member}/${a.stack}": ${found.refuse}`);
+        target = found.target;
+        namespaces = a.namespaces ?? found.namespaces;
+        waived = found.waived;
+    }
+    waived = [...new Set([...waived, ...(a.allowInsecure ?? [])])];
+    const check = deps.checkBucket ??
+        (async (t, o) => {
+            const mod = await import("@intentius/chant/bucket-check");
+            return mod.checkBucket(t, o);
+        });
+    const report = await check(target, { namespaces });
+    const failing = report.settings.filter((f) => f.verdict !== "ok");
+    const refused = failing.filter((f) => f.unwaivable || !waived.includes(f.setting));
+    if (refused.length > 0) {
+        const lines = refused.map((f) => `${f.setting} (${f.verdict}): ${f.found}${f.fix ? `; fix: ${f.fix}` : ""}${f.unwaivable ? "; no waiver reaches it" : ""}`);
+        throw new Error(`pulumiAdoptCheck: refusing to adopt "${a.member}/${a.stack}": the ${report.store} bucket ${report.bucket} fails the shared check: ${lines.join(" | ")}`);
+    }
+    return { ...base, checked: true, store: report.store, bucket: report.bucket, correct: report.correct, waived: failing.map((f) => f.setting) };
+}
+/** The stock checkpoint as a scratch file, or the given one. */
+export async function adoptExport(a, deps = {}) {
+    requireStack(a, "pulumiAdoptExport");
+    const env = deps.env ?? process.env;
+    const dir = stackDir(a);
+    const base = { member: a.member, stack: a.stack };
+    const summarize = (text, file, source, adoptFromFile) => {
+        let doc;
+        try {
+            doc = JSON.parse(text);
+        }
+        catch {
+            throw new Error(`pulumiAdoptExport: the export of "${a.member}/${a.stack}" from ${source} is not JSON`);
+        }
+        const deployment = isObject(doc) && isObject(doc.deployment) ? doc.deployment : undefined;
+        const pending = deployment && Array.isArray(deployment.pending_operations) ? deployment.pending_operations.length : 0;
+        return {
+            ...base,
+            file,
+            sha256: createHash("sha256").update(text).digest("hex"),
+            resources: pulumiExportResources(doc).length,
+            pendingOperations: pending,
+            source,
+            adoptFromFile,
+        };
+    };
+    if (a.from?.file) {
+        const file = isAbsolute(a.from.file) ? a.from.file : resolve(dir, a.from.file);
+        if (!existsSync(file))
+            throw new Error(`pulumiAdoptExport: the export ${file} for "${a.member}/${a.stack}" does not exist`);
+        return summarize(readFileSync(file, "utf-8"), file, "file", true);
+    }
+    let source;
+    if (a.from?.backend) {
+        source = a.from.backend;
+    }
+    else {
+        const backend = pulumiStackBackend(dir, { ...(a.backend ? { configured: a.backend } : {}), env });
+        source = backend ? stockBackendUrl(backend.url) : undefined;
+    }
+    const args = ["stack", "export", "--stack", a.stack];
+    let stdout;
+    try {
+        ({ stdout } = await runAllowedPulumi(deps.run ?? defaultPulumiRunner, args, dir, source ? { PULUMI_BACKEND_URL: source } : undefined));
+    }
+    catch (err) {
+        const f = pulumiRunFailure(err);
+        const why = f.missingBinary ? "the pulumi binary was not found on PATH" : (f.stderr?.trim() || f.message).split("\n").slice(-3).join("\n");
+        throw new Error(`pulumiAdoptExport: pulumi ${args.join(" ")} for "${a.member}/${a.stack}"${source ? ` against ${source}` : ""} failed: ${why}`);
+    }
+    const scratch = mkdtempSync(join(deps.tmp ?? tmpdir(), "chant-pulumi-adopt-"));
+    const file = join(scratch, `${a.stack.replace(/[^A-Za-z0-9._-]+/g, "_")}.export.json`);
+    writeFileSync(file, stdout, { mode: 0o600 });
+    return summarize(stdout, file, source ?? "the selected backend", a.from?.backend !== undefined);
+}
+/** The adopt document from a run, its failure's stdout included; throws when there is none. */
+async function adoptView(run, what, command) {
+    try {
+        const { stdout } = await run();
+        const view = parsePlungeAdoptView(stdout);
+        if (!view)
+            throw new Error(`${what}: ${command} printed no adopt document`);
+        return view;
+    }
+    catch (err) {
+        const f = pulumiRunFailure(err);
+        const view = parsePlungeAdoptView(f.stdout);
+        if (view)
+            return view;
+        if (err instanceof Error && err.message.startsWith(`${what}:`))
+            throw err;
+        const why = f.missingBinary ? "the plunge binary was not found on PATH" : (f.stderr?.trim() || f.message).split("\n").slice(-3).join("\n");
+        throw new Error(`${what}: ${command} failed: ${why}`);
+    }
+}
+function summary(a, view) {
+    return {
+        member: a.member,
+        stack: a.stack,
+        status: view.status,
+        planDigest: pulumiAdoptDigest(view),
+        checkpointDigest: view.checkpoint.digest ?? null,
+        resources: view.resources.length,
+        fates: adoptFates(view),
+        changed: view.status !== "already-adopted",
+    };
+}
+/** `plunge stack adopt --json`: the classification, written nowhere. A refusal fails the step. */
+export async function adoptPreview(a, deps = {}) {
+    requireStack(a, "pulumiAdoptPreview");
+    const dir = stackDir(a);
+    const args = plungeAdoptArgs({ stack: a.stack, ...(a.file ? { file: a.file } : {}) });
+    const view = await adoptView(() => runAllowedPlunge(deps.plunge ?? defaultPlungeRunner, args, dir), "pulumiAdoptPreview", `plunge ${args.join(" ")}`);
+    if (view.status === "refused") {
+        throw new Error(`pulumiAdoptPreview: plunge refuses to adopt "${a.member}/${a.stack}": ${refusalText(view.refusals)}. Nothing was written.`);
+    }
+    return summary(a, view);
+}
+/** `plunge stack adopt --json --yes`: writes the records. A refusal fails the step; plunge wrote nothing then. */
+export async function adoptStack(a, deps = {}) {
+    requireStack(a, "pulumiAdopt");
+    const dir = stackDir(a);
+    const args = plungeAdoptArgs({ stack: a.stack, yes: true, ...(a.file ? { file: a.file } : {}) });
+    const view = await adoptView(() => runAdoptPlunge(deps.plunge ?? defaultPlungeRunner, args, dir), "pulumiAdopt", `plunge ${args.join(" ")}`);
+    if (view.status === "refused") {
+        throw new Error(`pulumiAdopt: plunge refused to adopt "${a.member}/${a.stack}": ${refusalText(view.refusals)}. Nothing was written.`);
+    }
+    const out = summary(a, view);
+    return { ...out, ...(a.planDigest ? { matchesApproved: out.planDigest === a.planDigest } : {}) };
+}
+export async function pulumiAdoptCheck(args) {
+    return adoptCheck(args);
+}
+export async function pulumiAdoptExport(args) {
+    return adoptExport(args);
+}
+export async function pulumiAdoptPreview(args) {
+    return adoptPreview(args);
+}
+export async function pulumiAdopt(args) {
+    return adoptStack(args);
+}

package/dist/op/activities/pulumi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pulumi.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pulumi.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAgD,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAElG,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iFAAiF;IACjF,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,oHAAoH;IACpH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyB/F;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmB3F"}
+{"version":3,"file":"pulumi.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pulumi.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAgD,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAElG,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iFAAiF;IACjF,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,oHAAoH;IACpH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAQD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyB/F;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmB3F"}

package/dist/op/activities/pulumi.js

@@ -7,7 +7,8 @@
  * already allow: `pulumi preview --json` (or `plunge preview --json`) and
  * `pulumi refresh --preview-only --json --target <urn>` (or `plunge drift
  * --resource <urn> --stream`). Neither changes the stack. There is no apply
- * activity, because chant never runs `pulumi up`.
+ * activity: a stack applies as a component step through the `pulumi-up`
+ * capability (`../../pulumi-up.ts`, #4541), the only caller of `up`.
  *
  * `dir` is the member's directory, where `Pulumi.yaml` is, resolved against
  * `cwd` (default: the process's working directory, the project root on a

package/dist/op/activity-contracts.d.ts

@@ -31,4 +31,77 @@ export declare const pulumiDriftContract: import("@intentius/chant/op").Activity
     notObserved: number;
     records: number;
 }>;
+export declare const pulumiAdoptCheckContract: import("@intentius/chant/op").ActivityContract<{
+    member: string;
+    dir: string;
+    cwd?: string | undefined;
+    stack: string;
+    backend?: string | undefined;
+    bucket?: Record<string, unknown> | undefined;
+    namespaces?: string[] | undefined;
+    allowInsecure?: string[] | undefined;
+}, {
+    member: string;
+    stack: string;
+    checked: boolean;
+    skipped?: string | undefined;
+    store?: string | undefined;
+    bucket?: string | undefined;
+    correct: boolean;
+    waived: string[];
+}>;
+export declare const pulumiAdoptExportContract: import("@intentius/chant/op").ActivityContract<{
+    member: string;
+    dir: string;
+    cwd?: string | undefined;
+    stack: string;
+    backend?: string | undefined;
+    from?: {
+        backend?: string | undefined;
+        file?: string | undefined;
+    } | undefined;
+}, {
+    member: string;
+    stack: string;
+    file: string;
+    sha256: string;
+    resources: number;
+    pendingOperations: number;
+    source: string;
+    adoptFromFile: boolean;
+}>;
+export declare const pulumiAdoptPreviewContract: import("@intentius/chant/op").ActivityContract<{
+    member: string;
+    dir: string;
+    cwd?: string | undefined;
+    stack: string;
+    file?: string | undefined;
+}, {
+    member: string;
+    stack: string;
+    status: "adopted" | "already-adopted" | "refused" | "would-adopt";
+    planDigest: string;
+    checkpointDigest: string | null;
+    resources: number;
+    fates: Record<string, number>;
+    changed: boolean;
+}>;
+export declare const pulumiAdoptContract: import("@intentius/chant/op").ActivityContract<{
+    member: string;
+    dir: string;
+    cwd?: string | undefined;
+    stack: string;
+    file?: string | undefined;
+    planDigest?: string | undefined;
+}, {
+    member: string;
+    stack: string;
+    status: "adopted" | "already-adopted" | "refused" | "would-adopt";
+    planDigest: string;
+    checkpointDigest: string | null;
+    resources: number;
+    fates: Record<string, number>;
+    changed: boolean;
+    matchesApproved?: boolean | undefined;
+}>;
 //# sourceMappingURL=activity-contracts.d.ts.map

package/dist/op/activity-contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAiBjC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;EAW/B,CAAC"}
+{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAiBjC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;EAW/B,CAAC;AAqBF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;EAoBpC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;EAkBrC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;EAKtC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;EAK/B,CAAC"}