@intentius/chant-lexicon-pulumi 0.124.55 → 0.124.56

package/dist/check-step.d.ts

@@ -0,0 +1,61 @@
+import type { CheckStageMember, CheckStepOutcome, CheckStepsAdapter, CheckStepsContext } from "@intentius/chant/components/check-steps";
+import { type PulumiMemberEngine } from "./member-engine.js";
+import { type PulumiRunner } from "./run.js";
+/** A runner for `bin` with exactly `env` (the check job's), never the process's whole environment. */
+export declare function checkRunner(bin: PulumiMemberEngine, env: Record<string, string>): PulumiRunner;
+/** One key the project declares in `Pulumi.yaml`'s `config:`. */
+export interface PulumiConfigKey {
+    /** The full key, `<project>:<name>` for a project key. */
+    key: string;
+    type?: string;
+    items?: {
+        type?: string;
+    };
+    secret: boolean;
+    /** Whether it has a `default` or a project-level `value`. */
+    hasDefault: boolean;
+}
+/** The project's config schema: its name, the keys it declares, and where its stack files are. */
+export interface PulumiProjectSchema {
+    project: string;
+    keys: PulumiConfigKey[];
+    /** The directory the stack files are in, relative to the project (`stackConfigDir`), or "." */
+    stackConfigDir: string;
+}
+/** Read `Pulumi.yaml`'s schema from its parsed document. A short-form entry (`key: value`) is a value with no type. */
+export declare function pulumiProjectSchema(doc: unknown): PulumiProjectSchema;
+/**
+ * What is wrong with one stack's config (`config:` of its
+ * `Pulumi.<stack>.yaml`, parsed) against the project's schema, as lines
+ * naming the stack and key. Empty when it passes. Keys of other namespaces
+ * (a provider's `aws:region`) are not checked: the project declares no type
+ * for them.
+ */
+export declare function pulumiStackConfigProblems(schema: PulumiProjectSchema, stack: string, stackDoc: unknown): string[];
+/** The stacks the project lists by their `Pulumi.<stack>.yaml` files in `dir`, sorted. */
+export declare function listedStacks(dir: string): string[];
+/** What `pulumi about --json` reported, for the check report. */
+export interface PulumiAboutDetail {
+    engine: PulumiMemberEngine;
+    version?: string;
+    plugins: Array<{
+        name: string;
+        version?: string;
+    }>;
+    backend?: {
+        name?: string;
+        url?: string;
+        user?: string;
+    };
+}
+/** Read `pulumi about --json`'s document. Undefined when it is not JSON. */
+export declare function pulumiAboutDetail(engine: PulumiMemberEngine, stdout: string | undefined): PulumiAboutDetail | undefined;
+export interface PulumiCheckStepsOptions {
+    /** The runner for an engine, given the check job's environment. Default {@link checkRunner}. */
+    runner?: (engine: PulumiMemberEngine, env: Record<string, string>) => PulumiRunner;
+}
+/** The steps for one member, in order: install, each stack's config, about. */
+export declare function pulumiMemberCheck(member: CheckStageMember, ctx: Pick<CheckStepsContext, "env" | "log">, opts?: PulumiCheckStepsOptions): Promise<CheckStepOutcome[]>;
+/** The pulumi lexicon's check steps, for `LexiconPlugin.checkSteps`. */
+export declare function pulumiCheckSteps(opts?: PulumiCheckStepsOptions): CheckStepsAdapter;
+//# sourceMappingURL=check-step.d.ts.map

package/dist/check-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-step.d.ts","sourceRoot":"","sources":["../src/check-step.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAExI,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAA+C,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAOvF,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAE9F;AAID,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,6DAA6D;IAC7D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,eAAe,EAAE,CAAC;IACxB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,CAAC;CACxB;AASD,uHAAuH;AACvH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,CAsBrE;AAoBD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CA2BjH;AAOD,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAMlD;AASD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAkBvH;AAUD,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,YAAY,CAAC;CACpF;AAED,+EAA+E;AAC/E,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,CAAC,EAAE,IAAI,GAAE,uBAA4B,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAsF9K;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,iBAAiB,CAUtF"}

package/dist/check-step.js

@@ -0,0 +1,270 @@
+/**
+ * The pulumi lexicon's steps in chant's check stage (#4633). `chant ci
+ * check` runs them after the `ci.hooks.check` hooks, for each workspace
+ * member of kind `pulumi` (`LexiconPlugin.checkSteps`,
+ * `@intentius/chant/components/check-steps`), so a product's check
+ * (`plywood check`) gets them through chant with nothing of its own:
+ *
+ * - `pulumi-install`: `pulumi install` (`plunge install` for a member on
+ *   plunge, `./member-engine.ts`) in the member's directory, which fetches
+ *   the program's dependencies and plugins the way `Pulumi.yaml` says;
+ * - `stack-config`: each stack's `Pulumi.<stack>.yaml` checked against the
+ *   project's config schema in `Pulumi.yaml`, with no command run (a key
+ *   with a type and no default must be set, a value must read as its type,
+ *   and a `secret: true` key must be encrypted). The stacks are the ones the
+ *   project lists by their files, plus the member's declared stack;
+ * - `pulumi-about`: `pulumi about --json`, which reports the engine, its
+ *   plugins and the backend for the report.
+ *
+ * The argv go through `runCheckPulumi` (`./run.ts`), which refuses any
+ * other. The environment is the check job's ({@link CheckStepsContext.env}):
+ * no forge token, no OIDC request variables, no cloud credential, so neither
+ * command can write a stack. A failure names the member and stack, and the
+ * check exits with chant's `failed` code.
+ *
+ * The runner is injectable, so the tests run no binary.
+ */
+import { execFile } from "node:child_process";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { parseYAML } from "@intentius/chant/yaml";
+import { pulumiMemberEngine } from "./member-engine.js";
+import { engineEnv, pulumiRunFailure, runCheckPulumi } from "./run.js";
+const execFileAsync = promisify(execFile);
+/** The lexicon name the report carries. */
+const LEXICON = "pulumi";
+/** A runner for `bin` with exactly `env` (the check job's), never the process's whole environment. */
+export function checkRunner(bin, env) {
+    return (args, opts) => execFileAsync(bin, args, { cwd: opts.cwd, maxBuffer: 64 * 1024 * 1024, env: engineEnv({ ...env, ...opts.env }) });
+}
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/** The key in its full form: a bare name belongs to the project. */
+function fullKey(project, key) {
+    return key.includes(":") ? key : `${project}:${key}`;
+}
+/** Read `Pulumi.yaml`'s schema from its parsed document. A short-form entry (`key: value`) is a value with no type. */
+export function pulumiProjectSchema(doc) {
+    const d = isRecord(doc) ? doc : {};
+    const project = typeof d.name === "string" ? d.name : "";
+    const config = isRecord(d.config) ? d.config : {};
+    const keys = [];
+    for (const [name, entry] of Object.entries(config)) {
+        const key = fullKey(project, name);
+        const schema = isRecord(entry) && ("type" in entry || "default" in entry || "value" in entry || "secret" in entry || "description" in entry || "items" in entry);
+        if (!schema) {
+            keys.push({ key, secret: false, hasDefault: true });
+            continue;
+        }
+        const e = entry;
+        keys.push({
+            key,
+            ...(typeof e.type === "string" ? { type: e.type } : {}),
+            ...(isRecord(e.items) && typeof e.items.type === "string" ? { items: { type: e.items.type } } : {}),
+            secret: e.secret === true,
+            hasDefault: "default" in e || "value" in e,
+        });
+    }
+    return { project, keys, stackConfigDir: typeof d.stackConfigDir === "string" && d.stackConfigDir.length > 0 ? d.stackConfigDir : "." };
+}
+const isSecure = (v) => isRecord(v) && typeof v.secure === "string";
+/** Whether a scalar stack value reads as `type`. Values are strings once Pulumi reads them, so `"3"` is an integer. */
+function readsAs(type, value) {
+    switch (type) {
+        case "string":
+            return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+        case "integer":
+            return (typeof value === "number" && Number.isInteger(value)) || (typeof value === "string" && /^-?[0-9]+$/.test(value.trim()));
+        case "boolean":
+            return typeof value === "boolean" || value === "true" || value === "false";
+        case "array":
+            return Array.isArray(value);
+        default:
+            return true;
+    }
+}
+/**
+ * What is wrong with one stack's config (`config:` of its
+ * `Pulumi.<stack>.yaml`, parsed) against the project's schema, as lines
+ * naming the stack and key. Empty when it passes. Keys of other namespaces
+ * (a provider's `aws:region`) are not checked: the project declares no type
+ * for them.
+ */
+export function pulumiStackConfigProblems(schema, stack, stackDoc) {
+    const raw = isRecord(stackDoc) && isRecord(stackDoc.config) ? stackDoc.config : {};
+    const values = new Map();
+    for (const [k, v] of Object.entries(raw))
+        values.set(fullKey(schema.project, k), v);
+    const problems = [];
+    for (const k of schema.keys) {
+        if (!k.type && !k.secret)
+            continue;
+        if (!values.has(k.key)) {
+            if (k.type && !k.hasDefault)
+                problems.push(`stack ${stack} is missing the configuration value ${k.key} (type ${k.type}, no default)`);
+            continue;
+        }
+        const value = values.get(k.key);
+        if (k.secret && !isSecure(value)) {
+            problems.push(`stack ${stack} sets ${k.key} in plain text, and the project declares it secret; set it with pulumi config set --secret`);
+            continue;
+        }
+        if (isSecure(value) || !k.type)
+            continue;
+        if (!readsAs(k.type, value)) {
+            problems.push(`stack ${stack} sets ${k.key} to ${JSON.stringify(value)}, which is not of type ${k.type}`);
+            continue;
+        }
+        if (k.type === "array" && k.items?.type && Array.isArray(value)) {
+            const bad = value.findIndex((item) => !isSecure(item) && !readsAs(k.items.type, item));
+            if (bad >= 0)
+                problems.push(`stack ${stack} sets ${k.key}[${bad}] to ${JSON.stringify(value[bad])}, which is not of type ${k.items.type}`);
+        }
+    }
+    return problems;
+}
+/** The project's file in `dir`, `Pulumi.yaml` or `Pulumi.yml`. */
+function projectFile(dir) {
+    return ["Pulumi.yaml", "Pulumi.yml"].map((f) => join(dir, f)).find((f) => existsSync(f));
+}
+/** The stacks the project lists by their `Pulumi.<stack>.yaml` files in `dir`, sorted. */
+export function listedStacks(dir) {
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .map((f) => /^Pulumi\.(.+)\.ya?ml$/.exec(f)?.[1])
+        .filter((s) => s !== undefined)
+        .sort();
+}
+/** The stack file for `stack` in `dir`, if there is one. */
+function stackFile(dir, stack) {
+    return [`Pulumi.${stack}.yaml`, `Pulumi.${stack}.yml`].map((f) => join(dir, f)).find((f) => existsSync(f));
+}
+/** Read `pulumi about --json`'s document. Undefined when it is not JSON. */
+export function pulumiAboutDetail(engine, stdout) {
+    if (!stdout)
+        return undefined;
+    let doc;
+    try {
+        doc = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(doc))
+        return undefined;
+    const cli = isRecord(doc.cli) ? doc.cli : {};
+    const plugins = Array.isArray(doc.plugins)
+        ? doc.plugins.filter(isRecord).map((p) => ({ name: String(p.name ?? ""), ...(typeof p.version === "string" ? { version: p.version } : {}) })).filter((p) => p.name)
+        : [];
+    const b = isRecord(doc.backend) ? doc.backend : undefined;
+    const backend = b
+        ? { ...(typeof b.name === "string" ? { name: b.name } : {}), ...(typeof b.url === "string" ? { url: b.url } : {}), ...(typeof b.user === "string" ? { user: b.user } : {}) }
+        : undefined;
+    return { engine, ...(typeof cli.version === "string" ? { version: cli.version } : {}), plugins, ...(backend ? { backend } : {}) };
+}
+// ── The steps ───────────────────────────────────────────────────────
+/** The last lines of what a failed run printed, for its reason. */
+function tail(text) {
+    const lines = (text ?? "").trim().split("\n").filter(Boolean);
+    return lines.slice(-3).join(" | ");
+}
+/** The steps for one member, in order: install, each stack's config, about. */
+export async function pulumiMemberCheck(member, ctx, opts = {}) {
+    const fields = member.fields ?? {};
+    const declaredEngine = fields.engine === "pulumi" || fields.engine === "plunge" ? fields.engine : undefined;
+    const declaredStack = typeof fields.stack === "string" && fields.stack.length > 0 ? fields.stack : undefined;
+    const { engine } = pulumiMemberEngine(member.dir, declaredEngine, { env: ctx.env });
+    const run = (opts.runner ?? checkRunner)(engine, ctx.env);
+    const out = [];
+    const base = { lexicon: LEXICON, member: member.name };
+    const file = projectFile(member.dir);
+    if (!file) {
+        out.push({ ...base, step: "pulumi-install", exit: 1, outcome: "failed", reason: `member ${member.name} has no Pulumi.yaml in ${member.dir}` });
+        return out;
+    }
+    // pulumi install
+    let installed = true;
+    try {
+        await runCheckPulumi(run, ["install"], member.dir);
+        out.push({ ...base, step: "pulumi-install", exit: 0, outcome: "passed" });
+    }
+    catch (err) {
+        installed = false;
+        const f = pulumiRunFailure(err);
+        const why = f.missingBinary ? `${engine} is not installed in the check job` : tail(f.stderr) || tail(f.stdout) || f.message;
+        out.push({ ...base, step: "pulumi-install", exit: f.exitCode ?? 1, outcome: "failed", reason: `${engine} install failed for member ${member.name}: ${why}` });
+    }
+    // Stack config, run by nothing but this module.
+    let schema;
+    try {
+        schema = pulumiProjectSchema(parseYAML(readFileSync(file, "utf-8")));
+    }
+    catch (err) {
+        out.push({ ...base, step: "stack-config", exit: 1, outcome: "failed", reason: `member ${member.name}: ${file} does not read as YAML (${err instanceof Error ? err.message : String(err)})` });
+    }
+    if (schema) {
+        const stackDir = join(member.dir, schema.stackConfigDir);
+        const stacks = [...new Set([...listedStacks(stackDir), ...(declaredStack ? [declaredStack] : [])])].sort();
+        if (stacks.length === 0)
+            out.push({ ...base, step: "stack-config", exit: 0, outcome: "skipped", reason: `member ${member.name} lists no stack (no Pulumi.<stack>.yaml in ${stackDir})` });
+        for (const stack of stacks) {
+            const at = stackFile(stackDir, stack);
+            let doc = {};
+            if (at) {
+                try {
+                    doc = parseYAML(readFileSync(at, "utf-8"));
+                }
+                catch (err) {
+                    out.push({ ...base, step: "stack-config", stack, exit: 1, outcome: "failed", reason: `member ${member.name}, stack ${stack}: ${at} does not read as YAML (${err instanceof Error ? err.message : String(err)})` });
+                    continue;
+                }
+            }
+            const problems = pulumiStackConfigProblems(schema, stack, doc);
+            out.push(problems.length === 0
+                ? { ...base, step: "stack-config", stack, exit: 0, outcome: "passed" }
+                : { ...base, step: "stack-config", stack, exit: 1, outcome: "failed", reason: `member ${member.name}: ${problems.join("; ")}`, detail: { problems } });
+        }
+    }
+    // pulumi about --json
+    if (!installed) {
+        out.push({ ...base, step: "pulumi-about", exit: 0, outcome: "skipped", reason: `member ${member.name}: ${engine} install failed, so about did not run` });
+        return out;
+    }
+    const aboutArgs = declaredStack ? ["about", "--json", "--stack", declaredStack] : ["about", "--json"];
+    const stackPart = declaredStack ? { stack: declaredStack } : {};
+    try {
+        const { stdout } = await runCheckPulumi(run, aboutArgs, member.dir);
+        const detail = pulumiAboutDetail(engine, stdout);
+        out.push(detail
+            ? { ...base, step: "pulumi-about", ...stackPart, exit: 0, outcome: "passed", detail }
+            : { ...base, step: "pulumi-about", ...stackPart, exit: 1, outcome: "failed", reason: `${engine} about --json for member ${member.name} printed no JSON` });
+    }
+    catch (err) {
+        const f = pulumiRunFailure(err);
+        // about exits non-zero when one of its reads fails (no backend login in a check job), and still prints what it read.
+        const detail = pulumiAboutDetail(engine, f.stdout);
+        if (detail) {
+            ctx.log(`pulumi check: ${engine} about for ${member.name} exited ${f.exitCode ?? 1} and reported: ${tail(f.stderr) || "no reason"}`);
+            out.push({ ...base, step: "pulumi-about", ...stackPart, exit: f.exitCode ?? 1, outcome: "passed", detail });
+        }
+        else {
+            const why = f.missingBinary ? `${engine} is not installed in the check job` : tail(f.stderr) || f.message;
+            out.push({ ...base, step: "pulumi-about", ...stackPart, exit: f.exitCode ?? 1, outcome: "failed", reason: `${engine} about failed for member ${member.name}${declaredStack ? `, stack ${declaredStack}` : ""}: ${why}` });
+        }
+    }
+    return out;
+}
+/** The pulumi lexicon's check steps, for `LexiconPlugin.checkSteps`. */
+export function pulumiCheckSteps(opts = {}) {
+    return {
+        lexicon: LEXICON,
+        kinds: ["pulumi"],
+        async run(ctx) {
+            const out = [];
+            for (const member of ctx.members)
+                out.push(...(await pulumiMemberCheck(member, ctx, opts)));
+            return out;
+        },
+    };
+}

package/dist/index.d.ts

@@ -23,4 +23,5 @@ export { PulumiAdoptOp, type PulumiAdoptOpConfig, type PulumiAdoptOpResources, t
 export { parsePlungeAdoptView, pulumiAdoptDigest, adoptBucketTarget, type PlungeAdoptView, type PlungeAdoptStatus } from "./adopt.js";
 export { pulumiPreview as pulumiPreviewStep, pulumiDrift as pulumiDriftStep } from "./op/builders.js";
 export { pulumiExitOf, pulumiPlanMoved, PULUMI_EXIT, PLUNGE_PLAN_MOVED_EXIT } from "./exit-codes.js";
+export { pulumiPlannedOutputChanges, type PulumiOutputChange, type PulumiPlannedOutputChanges } from "./planned-output-changes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE9P,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE9P,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAElG,OAAO,EAAE,0BAA0B,EAAE,KAAK,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -27,3 +27,5 @@ export { parsePlungeAdoptView, pulumiAdoptDigest, adoptBucketTarget } from "./ad
 export { pulumiPreview as pulumiPreviewStep, pulumiDrift as pulumiDriftStep } from "./op/builders.js";
 // Pulumi and plunge exit statuses on chant's exit-code table (#4553).
 export { pulumiExitOf, pulumiPlanMoved, PULUMI_EXIT, PLUNGE_PLAN_MOVED_EXIT } from "./exit-codes.js";
+// Which stack outputs a preview changes, traced through the export (#4635).
+export { pulumiPlannedOutputChanges } from "./planned-output-changes.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d4de8cb6f01fdb50a4e9b53ae82877b221a4512e50e804f33eface5da48e9840",
+    "manifest.json": "27fc35795ca8c387b7ce55c46cd22c8ffe372f77a601cc1a33336aa2df5dabc1",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "883bcdf6a960e21360e79df010ca2087719fffec60fc39541c5ecd32d661e328",
     "rules/member-dir-absolute.ts": "4805d5e247ad544f942e1b2c36fc15a5087ca0aacaf804183a269021bd60e276",
@@ -25,5 +25,5 @@
     "skills/chant-pulumi-stack-export.md": "aadd67f5e067de61dfda43d57492bca08bd22429e4baf314d6856a810dc0e8dc",
     "skills/chant-pulumi-plunge.md": "8a7f2f9f1124744dee9645905f141057ca01f5a88e34e1bc3858d69406d7ff3a"
   },
-  "composite": "362628fd365ccf7dfb116696cbe7f48f955530635fcba52c4366ad55a66ea747"
+  "composite": "6ac4e2b566ed424af816c52851540c62b0618ea4a8eea462bb03305465cd219c"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pulumi",
-  "version": "0.124.55",
+  "version": "0.124.56",
   "chantVersion": ">=0.1.0",
   "namespace": "Pulumi"
 }

package/dist/member-outputs.d.ts

@@ -1,5 +1,6 @@
 import type { EngineOutputSource, EnginePlannedOutputs } from "@intentius/chant/components/verbs/member-outputs";
 import type { ChangeSetPart } from "@intentius/chant/change-set";
+import { type PulumiOutputChange } from "./planned-output-changes.js";
 import { type PulumiMemberEngine, type PulumiRunner } from "./run.js";
 /** Where a member's applied outputs are read from. */
 export type PulumiAppliedFrom = "cli" | "export";
@@ -26,14 +27,20 @@ export declare function pulumiPartHasChanges(part: ChangeSetPart): boolean;
  * the preview's error. A preview that plans no stack outputs (no stack step,
  * or one without outputs, which is what a real `pulumi preview --json`
  * prints, #4475) gives the export's outputs when it plans nothing to apply,
- * since no apply will move them, and names every output the export holds
- * unknown otherwise, so nothing reads a value the preview did not plan.
+ * since no apply will move them. With changes, each output is traced to the
+ * export's resources (#4635, {@link pulumiPlannedOutputChanges}): the ones
+ * the preview leaves alone keep their value, and the rest are unknown, so
+ * nothing reads a value the preview may move. `outputChanges` lists each
+ * output's verdict and why.
  */
 export declare function pulumiMemberPlannedOutputs(member: string, read: {
     part: ChangeSetPart;
     preview: unknown;
     exported?: unknown;
-}): EnginePlannedOutputs;
+    targeted?: boolean;
+}): EnginePlannedOutputs & {
+    outputChanges?: PulumiOutputChange[];
+};
 /** The applied outputs a `pulumi stack export` records, secrets left out. */
 export declare function pulumiExportedOutputValues(exported: unknown): Record<string, unknown>;
 /** A Pulumi member's outputs for `member-outputs`, `kinds: ["pulumi"]`. */

package/dist/member-outputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"member-outputs.d.ts","sourceRoot":"","sources":["../src/member-outputs.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAClI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAqE,KAAK,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAItI,sDAAsD;AACtD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,MAAM,WAAW,yBAAyB;IACxC,qHAAqH;IACrH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,oEAAoE;IACpE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAcD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAGjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAcpJ;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAErF;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAoB9F;AAED,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,EAAE,kBAAyC,CAAC"}
+{"version":3,"file":"member-outputs.d.ts","sourceRoot":"","sources":["../src/member-outputs.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAClI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAA8B,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EAAqE,KAAK,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAItI,sDAAsD;AACtD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,MAAM,WAAW,yBAAyB;IACxC,qHAAqH;IACrH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,oEAAoE;IACpE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAcD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAGjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACtF,oBAAoB,GAAG;IAAE,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAkBjE;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAErF;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAoB9F;AAED,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,EAAE,kBAAyC,CAAC"}

package/dist/member-outputs.js

@@ -1,3 +1,4 @@
+import { pulumiPlannedOutputChanges } from "./planned-output-changes.js";
 import { pulumiPlannedStackOutputs, pulumiExportedStackOutputs } from "./stack-outputs.js";
 import { memberExportOf, previewPulumiMemberRead, pulumiMemberStackOutputs } from "./run.js";
 import { isSecret } from "./values.js";
@@ -33,8 +34,11 @@ export function pulumiPartHasChanges(part) {
  * the preview's error. A preview that plans no stack outputs (no stack step,
  * or one without outputs, which is what a real `pulumi preview --json`
  * prints, #4475) gives the export's outputs when it plans nothing to apply,
- * since no apply will move them, and names every output the export holds
- * unknown otherwise, so nothing reads a value the preview did not plan.
+ * since no apply will move them. With changes, each output is traced to the
+ * export's resources (#4635, {@link pulumiPlannedOutputChanges}): the ones
+ * the preview leaves alone keep their value, and the rest are unknown, so
+ * nothing reads a value the preview may move. `outputChanges` lists each
+ * output's verdict and why.
  */
 export function pulumiMemberPlannedOutputs(member, read) {
     const { part } = read;
@@ -47,7 +51,11 @@ export function pulumiMemberPlannedOutputs(member, read) {
         const exported = read.exported === undefined ? [] : pulumiExportedStackOutputs(read.exported);
         if (!changes)
             return { known: knownValues(exported), unknown: [], planDigest: part.member.planDigest, changes };
-        return { known: {}, unknown: exported.filter((o) => !o.secret).map((o) => o.name), planDigest: part.member.planDigest, changes };
+        if (part.member.holes.length > 0 || read.exported === undefined) {
+            return { known: {}, unknown: exported.filter((o) => !o.secret).map((o) => o.name), planDigest: part.member.planDigest, changes };
+        }
+        const traced = pulumiPlannedOutputChanges({ part, exported: read.exported, ...(read.targeted ? { targeted: true } : {}) });
+        return { known: traced.known, unknown: traced.unknown, planDigest: part.member.planDigest, changes, outputChanges: traced.outputs };
     }
     const unknown = planned.filter((o) => o.unknown).map((o) => o.name);
     return { known: knownValues(planned), unknown, planDigest: part.member.planDigest, changes: changes || unknown.length > 0 };

package/dist/planned-output-changes.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Which of a stack's outputs its preview changes (#4635). A real `pulumi
+ * preview --json` plans no stack outputs (recorded, #4475), so until this
+ * module every output of a stack with any change was unknown, and every
+ * stack reading any of them waited for the `up`. Here each output the last
+ * deployment holds is traced, by value, to the resource properties in the
+ * export that hold the same value, and the preview's entry for each such
+ * resource says whether the value can move:
+ *
+ * | the resource's entry | the property | verdict |
+ * |---|---|---|
+ * | replace, delete, or a `mayAppear` update | any | changes |
+ * | update | an input the diff names, or one that is unknown | changes |
+ * | update | an input the diff leaves alone; `id`, `arn` or `urn` | stable |
+ * | update | any other output (a provider-computed `version`) | may change |
+ * | no-op, read, or no entry in a targeted preview | any | stable |
+ *
+ * An output is changing when one of its matches changes, or when every
+ * match only may change; it is unchanged, with the export's value, when no
+ * match changes and one is stable. An output no property matches (one the
+ * program computed, such as `` `${bucket.arn}/*` ``), or an object, is
+ * untraced, and so unknown while the stack has changes. A list traces each
+ * string in it. Strings shorter than four characters match nothing, so a
+ * `"1"` or a `"true"` traces no output. Secret outputs are left out, as
+ * everywhere: chant reads outputs blind.
+ *
+ * The trace runs only when the preview plans no stack outputs and has
+ * changes; core's `member-outputs` and `pulumi-up`'s plan then take its
+ * unchanged outputs as known and the rest as unknown, so a stack reading
+ * through `StackReference` (#4547) an output the change moves is held until
+ * the producer applied and the reader is previewed again, and one reading
+ * only unchanged outputs plans now.
+ */
+import type { ChangeSetPart } from "@intentius/chant/change-set";
+/** One output's verdict, and the resource property that decided it. */
+export interface PulumiOutputChange {
+    output: string;
+    verdict: "changing" | "unchanged" | "untraced";
+    /** The deciding match: `<urn tail>.<property>` and the resource's action. Absent when untraced. */
+    because?: string;
+}
+/** The trace of every output the export holds that is not secret, by name. */
+export interface PulumiPlannedOutputChanges {
+    outputs: PulumiOutputChange[];
+    /** Unchanged outputs with the export's value. */
+    known: Record<string, unknown>;
+    /** Changing and untraced outputs. */
+    unknown: string[];
+}
+/**
+ * Trace each of the export's stack outputs through the member's part (the
+ * change set its preview became). `targeted` says the preview was narrowed
+ * with `--target`, so a resource it did not list is not touched by it.
+ */
+export declare function pulumiPlannedOutputChanges(input: {
+    part: ChangeSetPart;
+    exported: unknown;
+    targeted?: boolean;
+}): PulumiPlannedOutputChanges;
+//# sourceMappingURL=planned-output-changes.d.ts.map

package/dist/planned-output-changes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planned-output-changes.d.ts","sourceRoot":"","sources":["../src/planned-output-changes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAKjF,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC;IAC/C,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,qCAAqC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAiDD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,0BAA0B,CAiC5I"}

package/dist/planned-output-changes.js

@@ -0,0 +1,94 @@
+import { isPulumiNodeless } from "@intentius/chant/pulumi-urn";
+import { pulumiExportedStackOutputs } from "./stack-outputs.js";
+import { isObject, isSecret } from "./values.js";
+/** Properties that stay put through an in-place update. */
+const STABLE_OUTPUTS = new Set(["id", "arn", "urn"]);
+const tailOf = (urn) => urn.split("::").slice(2).join("::") || urn;
+/** Every (resource, property) of the export holding a string worth matching, by value. */
+function holdersByValue(exported) {
+    const deployment = isObject(exported) && isObject(exported.deployment) ? exported.deployment : {};
+    const resources = Array.isArray(deployment.resources) ? deployment.resources : [];
+    const by = new Map();
+    const add = (value, h) => {
+        if (typeof value !== "string" || value.length < 4)
+            return;
+        const list = by.get(value) ?? [];
+        list.push(h);
+        by.set(value, list);
+    };
+    for (const r of resources) {
+        if (!isObject(r) || typeof r.urn !== "string" || typeof r.type !== "string")
+            continue;
+        if (r.custom !== true || isPulumiNodeless(r.type))
+            continue;
+        const inputs = isObject(r.inputs) ? r.inputs : {};
+        add(r.id, { urn: r.urn, prop: "id", input: false });
+        for (const [k, v] of Object.entries(isObject(r.outputs) ? r.outputs : {})) {
+            if (isSecret(v))
+                continue;
+            add(v, { urn: r.urn, prop: k, input: k in inputs });
+        }
+    }
+    return by;
+}
+function verdictOf(h, entry, targeted) {
+    if (!entry)
+        return targeted ? "stable" : "changes";
+    if (entry.mayAppear === true || entry.action === "replace" || entry.action === "delete" || entry.action === "forget")
+        return "changes";
+    if (entry.action !== "update")
+        return "stable";
+    const attr = entry.attributes.find((a) => a.path === h.prop);
+    if (attr)
+        return "changes";
+    if (h.input || STABLE_OUTPUTS.has(h.prop))
+        return "stable";
+    return "maybe";
+}
+/**
+ * Trace each of the export's stack outputs through the member's part (the
+ * change set its preview became). `targeted` says the preview was narrowed
+ * with `--target`, so a resource it did not list is not touched by it.
+ */
+export function pulumiPlannedOutputChanges(input) {
+    const byUrn = new Map();
+    for (const e of input.part.entries)
+        if (!byUrn.has(e.address))
+            byUrn.set(e.address, e);
+    const holders = holdersByValue(input.exported);
+    const targeted = input.targeted === true;
+    const traceString = (value) => {
+        const list = holders.get(value) ?? [];
+        if (list.length === 0)
+            return { verdict: "untraced" };
+        const judged = list.map((h) => ({ h, v: verdictOf(h, byUrn.get(h.urn), targeted), action: byUrn.get(h.urn)?.action ?? "unlisted" }));
+        const why = (j) => `${tailOf(j.h.urn)}.${j.h.prop} (${j.action})`;
+        const changes = judged.find((j) => j.v === "changes");
+        if (changes)
+            return { verdict: "changing", because: why(changes) };
+        const stable = judged.find((j) => j.v === "stable");
+        if (stable)
+            return { verdict: "unchanged", because: why(stable) };
+        return { verdict: "changing", because: why(judged[0]) };
+    };
+    const outputs = [];
+    const known = {};
+    for (const o of pulumiExportedStackOutputs(input.exported)) {
+        if (o.secret)
+            continue;
+        let traced;
+        if (typeof o.value === "string")
+            traced = traceString(o.value);
+        else if (Array.isArray(o.value) && o.value.length > 0 && o.value.every((v) => typeof v === "string")) {
+            const each = o.value.map(traceString);
+            traced = each.find((t) => t.verdict === "changing") ?? each.find((t) => t.verdict === "untraced") ?? each[0];
+        }
+        else
+            traced = { verdict: "untraced" };
+        outputs.push({ output: o.name, verdict: traced.verdict, ...(traced.because ? { because: traced.because } : {}) });
+        if (traced.verdict === "unchanged")
+            known[o.name] = o.value;
+    }
+    outputs.sort((a, b) => (a.output < b.output ? -1 : a.output > b.output ? 1 : 0));
+    return { outputs, known, unknown: outputs.filter((o) => o.verdict !== "unchanged").map((o) => o.output) };
+}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoC/E,eAAO,MAAM,YAAY,EAAE,aAwK1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoC/E,eAAO,MAAM,YAAY,EAAE,aAqL1B,CAAC"}