@intentius/chant-lexicon-pulumi 0.124.55 → 0.124.57

package/README.md

@@ -27,7 +27,7 @@ A step pinned to its own engine release sets `engineVersion` (and `engineRoot` w
 
 The CI install lines take a version, download the release's Linux archive and its checksums file, and fail unless the archive matches its line there. For the default releases (Pulumi 3.272.0, plunge 0.1.0) the line must also hold the sha256 the lexicon records per architecture. Each release goes under its own versioned directory and is linked into `/usr/local/bin`, and a line skips the download when that directory already holds the binary, or for Pulumi when the `pulumi` on PATH is that version.
 
-The preview streams its engine events (`PULUMI_ENABLE_STREAMING_JSON_PREVIEW=true`, `src/engine-events.ts`), so one run gives the change set and CrossGuard's findings. A mandatory violation denies the plan. On plunge the saved plan's stamp refuses a plan whose records moved (plunge exit 40, chant's moved code 4). On stock Pulumi the apply previews again, then compares the steps in `up`'s event stream with the approved shape (`src/plan-shape.ts`), and a step outside it fails the apply. A member on the resource lock grain, the default on plunge, leaves `same` and `read` steps out of its digest. The step's `config` is written into a scratch copy of `Pulumi.<stack>.yaml` and passed with `--config-file`, never `--config`, which writes the working tree's file. A release cut records the stack's directory (`releaseInputs`), unless its backend is a file path relative to that directory. Under a release, a promote or rollback previews and applies the recorded copy, after `pulumi install` (or `plunge install`) in the copy when its runtime needs one (`src/release-copy.ts`); a Node copy with no recorded lockfile is refused by name.
+The preview streams its engine events (`PULUMI_ENABLE_STREAMING_JSON_PREVIEW=true`, `src/engine-events.ts`), so one run gives the change set and CrossGuard's findings. A mandatory violation denies the plan. On plunge the saved plan's stamp refuses a plan whose records moved (plunge exit 40, chant's moved code 4). On stock Pulumi the apply previews again, then compares the steps in `up`'s event stream with the approved shape (`src/plan-shape.ts`), and a step outside it fails the apply. A member on the resource lock grain, the default on plunge, leaves `same` and `read` steps out of its digest. The step's `config` is written into a scratch copy of `Pulumi.<stack>.yaml` and passed with `--config-file`, never `--config`, which writes the working tree's file. A release cut records the stack's directory (`releaseInputs`), unless its backend is a file path relative to that directory. Under a release, a promote or rollback previews and applies the recorded copy, after `pulumi install` (or `plunge install`) in the copy when its runtime needs one (`src/release-copy.ts`); a Node copy with no recorded lockfile is refused by name. A job's checkout gets the same install before its first engine run when nothing installed the program there (`prepareProgram`), and a Node checkout with no lockfile is refused by name.
 
 After `up`, the capability runs `stack export --stack <s>`, replaces every secret with `[secret]`, drops the secrets provider's state, and writes the export through chant's index store as `<env>/<stack>__pulumi-export` ([#4546](https://github.com/INTENTIUS/chant/issues/4546), `refs/chant/snapshots` by default). The graph, the preview's prior state and the drift read take that export first, so a stack chant applies needs no checked-in `stack-export.json`. A failed export leaves the apply standing and says why in the step's `exportSnapshot` output.
 

package/dist/changed-units.d.ts

@@ -0,0 +1,5 @@
+/** The unit core names for a `pulumi-up` step on `stack` in `dir` (deploy-units.ts `pulumiStackUnit`). */
+export declare function pulumiStackUnit(dir: string, stack: string): string;
+/** The stack units `changedFiles` (relative to `projectRoot`, `/` separators) touch, sorted. */
+export declare function pulumiChangedUnits(projectRoot: string, changedFiles: readonly string[]): string[];
+//# sourceMappingURL=changed-units.d.ts.map

package/dist/changed-units.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed-units.d.ts","sourceRoot":"","sources":["../src/changed-units.ts"],"names":[],"mappings":"AAgCA,0GAA0G;AAC1G,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlE;AA2CD,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAejG"}

package/dist/changed-units.js

@@ -0,0 +1,101 @@
+/**
+ * The Pulumi stacks a change touched, judged from the changed files alone
+ * (`LexiconPlugin.changedUnits`, #3183; INTENTIUS/plywood#22). A Pulumi
+ * program and its stack configs are not chant source, so `chant lifecycle
+ * affected`'s artifact diff never shows them, and without this a pull request
+ * that edits `Pulumi.dev.yaml` selects no component at all.
+ *
+ * A file belongs to the nearest directory at or above it holding a
+ * `Pulumi.yaml` (or `Pulumi.yml`), the project, never above the project root:
+ *
+ *   - `Pulumi.<stack>.yaml` in that directory is the stack's config, so it
+ *     touches that stack alone;
+ *   - any other file there or below (the program, `Pulumi.yaml`, the
+ *     package files) touches every stack of the project, which is each
+ *     `Pulumi.<stack>.yaml` beside `Pulumi.yaml` at head and any the change
+ *     deleted. A stack with no config file has no file to find it by, so a
+ *     program change does not reach it.
+ *
+ * Files under a directory whose name starts with a dot (`.forgejo`, `.chant`,
+ * `.git`) or under `node_modules` are not the program. A file outside every
+ * project, such as a module the program imports from `../shared`, is not
+ * claimed.
+ *
+ * Each unit is named as core's `DEPLOY_UNIT_RULES` names a `pulumi-up` step:
+ * `<dir>/<stack>`, or `<stack>` for a project at the project root.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join, posix } from "node:path";
+const PROJECT_FILES = ["Pulumi.yaml", "Pulumi.yml"];
+const STACK_CONFIG = /^Pulumi\.(.+)\.ya?ml$/;
+/** The unit core names for a `pulumi-up` step on `stack` in `dir` (deploy-units.ts `pulumiStackUnit`). */
+export function pulumiStackUnit(dir, stack) {
+    const d = dir.replace(/\\/g, "/").replace(/^(\.\/)+/, "").replace(/\/+$/, "");
+    return d === "" || d === "." ? stack : `${d}/${stack}`;
+}
+/** The project directory (relative, `""` for the root) holding `file`, or undefined when none does. */
+function projectOf(projectRoot, file, changed) {
+    let dir = posix.dirname(file);
+    for (;;) {
+        const rel = dir === "." ? "" : dir;
+        for (const name of PROJECT_FILES) {
+            const p = rel === "" ? name : `${rel}/${name}`;
+            // A deleted Pulumi.yaml still names its project for the change that deleted it.
+            if (existsSync(join(projectRoot, p)) || changed.has(p))
+                return rel;
+        }
+        if (rel === "")
+            return undefined;
+        dir = posix.dirname(dir);
+    }
+}
+/** The stacks of the project in `dir`: the stack configs at head, and the ones the change names. */
+function stacksOf(projectRoot, dir, changed) {
+    const out = new Set();
+    let names = [];
+    try {
+        names = readdirSync(join(projectRoot, dir));
+    }
+    catch {
+        // The project directory is gone at head; the change's own files still name stacks.
+    }
+    for (const n of names) {
+        const m = STACK_CONFIG.exec(n);
+        if (m)
+            out.add(m[1]);
+    }
+    for (const f of changed) {
+        if (posix.dirname(f) !== (dir === "" ? "." : dir))
+            continue;
+        const m = STACK_CONFIG.exec(posix.basename(f));
+        if (m)
+            out.add(m[1]);
+    }
+    return [...out];
+}
+function ignored(file) {
+    const parts = file.split("/");
+    return parts.slice(0, -1).some((p) => p.startsWith(".") || p === "node_modules");
+}
+/** The stack units `changedFiles` (relative to `projectRoot`, `/` separators) touch, sorted. */
+export function pulumiChangedUnits(projectRoot, changedFiles) {
+    const files = changedFiles.map((f) => f.replace(/\\/g, "/").replace(/^\.\//, "")).filter((f) => f !== "" && !f.startsWith("../") && !ignored(f));
+    const changed = new Set(files);
+    const units = new Set();
+    const whole = new Set();
+    for (const f of files) {
+        const dir = projectOf(projectRoot, f, changed);
+        if (dir === undefined)
+            continue;
+        const here = posix.dirname(f) === (dir === "" ? "." : dir);
+        const m = STACK_CONFIG.exec(posix.basename(f));
+        if (here && m && !PROJECT_FILES.includes(posix.basename(f)))
+            units.add(pulumiStackUnit(dir, m[1]));
+        else
+            whole.add(dir);
+    }
+    for (const dir of whole)
+        for (const stack of stacksOf(projectRoot, dir, files))
+            units.add(pulumiStackUnit(dir, stack));
+    return [...units].sort();
+}

package/dist/check-step.d.ts

@@ -0,0 +1,61 @@
+import type { CheckStageMember, CheckStepOutcome, CheckStepsAdapter, CheckStepsContext } from "@intentius/chant/components/check-steps";
+import { type PulumiMemberEngine } from "./member-engine.js";
+import { type PulumiRunner } from "./run.js";
+/** A runner for `bin` with exactly `env` (the check job's), never the process's whole environment. */
+export declare function checkRunner(bin: PulumiMemberEngine, env: Record<string, string>): PulumiRunner;
+/** One key the project declares in `Pulumi.yaml`'s `config:`. */
+export interface PulumiConfigKey {
+    /** The full key, `<project>:<name>` for a project key. */
+    key: string;
+    type?: string;
+    items?: {
+        type?: string;
+    };
+    secret: boolean;
+    /** Whether it has a `default` or a project-level `value`. */
+    hasDefault: boolean;
+}
+/** The project's config schema: its name, the keys it declares, and where its stack files are. */
+export interface PulumiProjectSchema {
+    project: string;
+    keys: PulumiConfigKey[];
+    /** The directory the stack files are in, relative to the project (`stackConfigDir`), or "." */
+    stackConfigDir: string;
+}
+/** Read `Pulumi.yaml`'s schema from its parsed document. A short-form entry (`key: value`) is a value with no type. */
+export declare function pulumiProjectSchema(doc: unknown): PulumiProjectSchema;
+/**
+ * What is wrong with one stack's config (`config:` of its
+ * `Pulumi.<stack>.yaml`, parsed) against the project's schema, as lines
+ * naming the stack and key. Empty when it passes. Keys of other namespaces
+ * (a provider's `aws:region`) are not checked: the project declares no type
+ * for them.
+ */
+export declare function pulumiStackConfigProblems(schema: PulumiProjectSchema, stack: string, stackDoc: unknown): string[];
+/** The stacks the project lists by their `Pulumi.<stack>.yaml` files in `dir`, sorted. */
+export declare function listedStacks(dir: string): string[];
+/** What `pulumi about --json` reported, for the check report. */
+export interface PulumiAboutDetail {
+    engine: PulumiMemberEngine;
+    version?: string;
+    plugins: Array<{
+        name: string;
+        version?: string;
+    }>;
+    backend?: {
+        name?: string;
+        url?: string;
+        user?: string;
+    };
+}
+/** Read `pulumi about --json`'s document. Undefined when it is not JSON. */
+export declare function pulumiAboutDetail(engine: PulumiMemberEngine, stdout: string | undefined): PulumiAboutDetail | undefined;
+export interface PulumiCheckStepsOptions {
+    /** The runner for an engine, given the check job's environment. Default {@link checkRunner}. */
+    runner?: (engine: PulumiMemberEngine, env: Record<string, string>) => PulumiRunner;
+}
+/** The steps for one member, in order: install, each stack's config, about. */
+export declare function pulumiMemberCheck(member: CheckStageMember, ctx: Pick<CheckStepsContext, "env" | "log">, opts?: PulumiCheckStepsOptions): Promise<CheckStepOutcome[]>;
+/** The pulumi lexicon's check steps, for `LexiconPlugin.checkSteps`. */
+export declare function pulumiCheckSteps(opts?: PulumiCheckStepsOptions): CheckStepsAdapter;
+//# sourceMappingURL=check-step.d.ts.map

package/dist/check-step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-step.d.ts","sourceRoot":"","sources":["../src/check-step.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAExI,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAA+C,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAOvF,sGAAsG;AACtG,wBAAgB,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,YAAY,CAE9F;AAID,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC9B,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,6DAA6D;IAC7D,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,eAAe,EAAE,CAAC;IACxB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,CAAC;CACxB;AASD,uHAAuH;AACvH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,CAsBrE;AAoBD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CA2BjH;AAOD,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAMlD;AASD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAkBvH;AAUD,MAAM,WAAW,uBAAuB;IACtC,gGAAgG;IAChG,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,YAAY,CAAC;CACpF;AAED,+EAA+E;AAC/E,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,KAAK,CAAC,EAAE,IAAI,GAAE,uBAA4B,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAsF9K;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG,iBAAiB,CAUtF"}

package/dist/check-step.js

@@ -0,0 +1,270 @@
+/**
+ * The pulumi lexicon's steps in chant's check stage (#4633). `chant ci
+ * check` runs them after the `ci.hooks.check` hooks, for each workspace
+ * member of kind `pulumi` (`LexiconPlugin.checkSteps`,
+ * `@intentius/chant/components/check-steps`), so a product's check
+ * (`plywood check`) gets them through chant with nothing of its own:
+ *
+ * - `pulumi-install`: `pulumi install` (`plunge install` for a member on
+ *   plunge, `./member-engine.ts`) in the member's directory, which fetches
+ *   the program's dependencies and plugins the way `Pulumi.yaml` says;
+ * - `stack-config`: each stack's `Pulumi.<stack>.yaml` checked against the
+ *   project's config schema in `Pulumi.yaml`, with no command run (a key
+ *   with a type and no default must be set, a value must read as its type,
+ *   and a `secret: true` key must be encrypted). The stacks are the ones the
+ *   project lists by their files, plus the member's declared stack;
+ * - `pulumi-about`: `pulumi about --json`, which reports the engine, its
+ *   plugins and the backend for the report.
+ *
+ * The argv go through `runCheckPulumi` (`./run.ts`), which refuses any
+ * other. The environment is the check job's ({@link CheckStepsContext.env}):
+ * no forge token, no OIDC request variables, no cloud credential, so neither
+ * command can write a stack. A failure names the member and stack, and the
+ * check exits with chant's `failed` code.
+ *
+ * The runner is injectable, so the tests run no binary.
+ */
+import { execFile } from "node:child_process";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { parseYAML } from "@intentius/chant/yaml";
+import { pulumiMemberEngine } from "./member-engine.js";
+import { engineEnv, pulumiRunFailure, runCheckPulumi } from "./run.js";
+const execFileAsync = promisify(execFile);
+/** The lexicon name the report carries. */
+const LEXICON = "pulumi";
+/** A runner for `bin` with exactly `env` (the check job's), never the process's whole environment. */
+export function checkRunner(bin, env) {
+    return (args, opts) => execFileAsync(bin, args, { cwd: opts.cwd, maxBuffer: 64 * 1024 * 1024, env: engineEnv({ ...env, ...opts.env }) });
+}
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/** The key in its full form: a bare name belongs to the project. */
+function fullKey(project, key) {
+    return key.includes(":") ? key : `${project}:${key}`;
+}
+/** Read `Pulumi.yaml`'s schema from its parsed document. A short-form entry (`key: value`) is a value with no type. */
+export function pulumiProjectSchema(doc) {
+    const d = isRecord(doc) ? doc : {};
+    const project = typeof d.name === "string" ? d.name : "";
+    const config = isRecord(d.config) ? d.config : {};
+    const keys = [];
+    for (const [name, entry] of Object.entries(config)) {
+        const key = fullKey(project, name);
+        const schema = isRecord(entry) && ("type" in entry || "default" in entry || "value" in entry || "secret" in entry || "description" in entry || "items" in entry);
+        if (!schema) {
+            keys.push({ key, secret: false, hasDefault: true });
+            continue;
+        }
+        const e = entry;
+        keys.push({
+            key,
+            ...(typeof e.type === "string" ? { type: e.type } : {}),
+            ...(isRecord(e.items) && typeof e.items.type === "string" ? { items: { type: e.items.type } } : {}),
+            secret: e.secret === true,
+            hasDefault: "default" in e || "value" in e,
+        });
+    }
+    return { project, keys, stackConfigDir: typeof d.stackConfigDir === "string" && d.stackConfigDir.length > 0 ? d.stackConfigDir : "." };
+}
+const isSecure = (v) => isRecord(v) && typeof v.secure === "string";
+/** Whether a scalar stack value reads as `type`. Values are strings once Pulumi reads them, so `"3"` is an integer. */
+function readsAs(type, value) {
+    switch (type) {
+        case "string":
+            return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+        case "integer":
+            return (typeof value === "number" && Number.isInteger(value)) || (typeof value === "string" && /^-?[0-9]+$/.test(value.trim()));
+        case "boolean":
+            return typeof value === "boolean" || value === "true" || value === "false";
+        case "array":
+            return Array.isArray(value);
+        default:
+            return true;
+    }
+}
+/**
+ * What is wrong with one stack's config (`config:` of its
+ * `Pulumi.<stack>.yaml`, parsed) against the project's schema, as lines
+ * naming the stack and key. Empty when it passes. Keys of other namespaces
+ * (a provider's `aws:region`) are not checked: the project declares no type
+ * for them.
+ */
+export function pulumiStackConfigProblems(schema, stack, stackDoc) {
+    const raw = isRecord(stackDoc) && isRecord(stackDoc.config) ? stackDoc.config : {};
+    const values = new Map();
+    for (const [k, v] of Object.entries(raw))
+        values.set(fullKey(schema.project, k), v);
+    const problems = [];
+    for (const k of schema.keys) {
+        if (!k.type && !k.secret)
+            continue;
+        if (!values.has(k.key)) {
+            if (k.type && !k.hasDefault)
+                problems.push(`stack ${stack} is missing the configuration value ${k.key} (type ${k.type}, no default)`);
+            continue;
+        }
+        const value = values.get(k.key);
+        if (k.secret && !isSecure(value)) {
+            problems.push(`stack ${stack} sets ${k.key} in plain text, and the project declares it secret; set it with pulumi config set --secret`);
+            continue;
+        }
+        if (isSecure(value) || !k.type)
+            continue;
+        if (!readsAs(k.type, value)) {
+            problems.push(`stack ${stack} sets ${k.key} to ${JSON.stringify(value)}, which is not of type ${k.type}`);
+            continue;
+        }
+        if (k.type === "array" && k.items?.type && Array.isArray(value)) {
+            const bad = value.findIndex((item) => !isSecure(item) && !readsAs(k.items.type, item));
+            if (bad >= 0)
+                problems.push(`stack ${stack} sets ${k.key}[${bad}] to ${JSON.stringify(value[bad])}, which is not of type ${k.items.type}`);
+        }
+    }
+    return problems;
+}
+/** The project's file in `dir`, `Pulumi.yaml` or `Pulumi.yml`. */
+function projectFile(dir) {
+    return ["Pulumi.yaml", "Pulumi.yml"].map((f) => join(dir, f)).find((f) => existsSync(f));
+}
+/** The stacks the project lists by their `Pulumi.<stack>.yaml` files in `dir`, sorted. */
+export function listedStacks(dir) {
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir)
+        .map((f) => /^Pulumi\.(.+)\.ya?ml$/.exec(f)?.[1])
+        .filter((s) => s !== undefined)
+        .sort();
+}
+/** The stack file for `stack` in `dir`, if there is one. */
+function stackFile(dir, stack) {
+    return [`Pulumi.${stack}.yaml`, `Pulumi.${stack}.yml`].map((f) => join(dir, f)).find((f) => existsSync(f));
+}
+/** Read `pulumi about --json`'s document. Undefined when it is not JSON. */
+export function pulumiAboutDetail(engine, stdout) {
+    if (!stdout)
+        return undefined;
+    let doc;
+    try {
+        doc = JSON.parse(stdout);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(doc))
+        return undefined;
+    const cli = isRecord(doc.cli) ? doc.cli : {};
+    const plugins = Array.isArray(doc.plugins)
+        ? doc.plugins.filter(isRecord).map((p) => ({ name: String(p.name ?? ""), ...(typeof p.version === "string" ? { version: p.version } : {}) })).filter((p) => p.name)
+        : [];
+    const b = isRecord(doc.backend) ? doc.backend : undefined;
+    const backend = b
+        ? { ...(typeof b.name === "string" ? { name: b.name } : {}), ...(typeof b.url === "string" ? { url: b.url } : {}), ...(typeof b.user === "string" ? { user: b.user } : {}) }
+        : undefined;
+    return { engine, ...(typeof cli.version === "string" ? { version: cli.version } : {}), plugins, ...(backend ? { backend } : {}) };
+}
+// ── The steps ───────────────────────────────────────────────────────
+/** The last lines of what a failed run printed, for its reason. */
+function tail(text) {
+    const lines = (text ?? "").trim().split("\n").filter(Boolean);
+    return lines.slice(-3).join(" | ");
+}
+/** The steps for one member, in order: install, each stack's config, about. */
+export async function pulumiMemberCheck(member, ctx, opts = {}) {
+    const fields = member.fields ?? {};
+    const declaredEngine = fields.engine === "pulumi" || fields.engine === "plunge" ? fields.engine : undefined;
+    const declaredStack = typeof fields.stack === "string" && fields.stack.length > 0 ? fields.stack : undefined;
+    const { engine } = pulumiMemberEngine(member.dir, declaredEngine, { env: ctx.env });
+    const run = (opts.runner ?? checkRunner)(engine, ctx.env);
+    const out = [];
+    const base = { lexicon: LEXICON, member: member.name };
+    const file = projectFile(member.dir);
+    if (!file) {
+        out.push({ ...base, step: "pulumi-install", exit: 1, outcome: "failed", reason: `member ${member.name} has no Pulumi.yaml in ${member.dir}` });
+        return out;
+    }
+    // pulumi install
+    let installed = true;
+    try {
+        await runCheckPulumi(run, ["install"], member.dir);
+        out.push({ ...base, step: "pulumi-install", exit: 0, outcome: "passed" });
+    }
+    catch (err) {
+        installed = false;
+        const f = pulumiRunFailure(err);
+        const why = f.missingBinary ? `${engine} is not installed in the check job` : tail(f.stderr) || tail(f.stdout) || f.message;
+        out.push({ ...base, step: "pulumi-install", exit: f.exitCode ?? 1, outcome: "failed", reason: `${engine} install failed for member ${member.name}: ${why}` });
+    }
+    // Stack config, run by nothing but this module.
+    let schema;
+    try {
+        schema = pulumiProjectSchema(parseYAML(readFileSync(file, "utf-8")));
+    }
+    catch (err) {
+        out.push({ ...base, step: "stack-config", exit: 1, outcome: "failed", reason: `member ${member.name}: ${file} does not read as YAML (${err instanceof Error ? err.message : String(err)})` });
+    }
+    if (schema) {
+        const stackDir = join(member.dir, schema.stackConfigDir);
+        const stacks = [...new Set([...listedStacks(stackDir), ...(declaredStack ? [declaredStack] : [])])].sort();
+        if (stacks.length === 0)
+            out.push({ ...base, step: "stack-config", exit: 0, outcome: "skipped", reason: `member ${member.name} lists no stack (no Pulumi.<stack>.yaml in ${stackDir})` });
+        for (const stack of stacks) {
+            const at = stackFile(stackDir, stack);
+            let doc = {};
+            if (at) {
+                try {
+                    doc = parseYAML(readFileSync(at, "utf-8"));
+                }
+                catch (err) {
+                    out.push({ ...base, step: "stack-config", stack, exit: 1, outcome: "failed", reason: `member ${member.name}, stack ${stack}: ${at} does not read as YAML (${err instanceof Error ? err.message : String(err)})` });
+                    continue;
+                }
+            }
+            const problems = pulumiStackConfigProblems(schema, stack, doc);
+            out.push(problems.length === 0
+                ? { ...base, step: "stack-config", stack, exit: 0, outcome: "passed" }
+                : { ...base, step: "stack-config", stack, exit: 1, outcome: "failed", reason: `member ${member.name}: ${problems.join("; ")}`, detail: { problems } });
+        }
+    }
+    // pulumi about --json
+    if (!installed) {
+        out.push({ ...base, step: "pulumi-about", exit: 0, outcome: "skipped", reason: `member ${member.name}: ${engine} install failed, so about did not run` });
+        return out;
+    }
+    const aboutArgs = declaredStack ? ["about", "--json", "--stack", declaredStack] : ["about", "--json"];
+    const stackPart = declaredStack ? { stack: declaredStack } : {};
+    try {
+        const { stdout } = await runCheckPulumi(run, aboutArgs, member.dir);
+        const detail = pulumiAboutDetail(engine, stdout);
+        out.push(detail
+            ? { ...base, step: "pulumi-about", ...stackPart, exit: 0, outcome: "passed", detail }
+            : { ...base, step: "pulumi-about", ...stackPart, exit: 1, outcome: "failed", reason: `${engine} about --json for member ${member.name} printed no JSON` });
+    }
+    catch (err) {
+        const f = pulumiRunFailure(err);
+        // about exits non-zero when one of its reads fails (no backend login in a check job), and still prints what it read.
+        const detail = pulumiAboutDetail(engine, f.stdout);
+        if (detail) {
+            ctx.log(`pulumi check: ${engine} about for ${member.name} exited ${f.exitCode ?? 1} and reported: ${tail(f.stderr) || "no reason"}`);
+            out.push({ ...base, step: "pulumi-about", ...stackPart, exit: f.exitCode ?? 1, outcome: "passed", detail });
+        }
+        else {
+            const why = f.missingBinary ? `${engine} is not installed in the check job` : tail(f.stderr) || f.message;
+            out.push({ ...base, step: "pulumi-about", ...stackPart, exit: f.exitCode ?? 1, outcome: "failed", reason: `${engine} about failed for member ${member.name}${declaredStack ? `, stack ${declaredStack}` : ""}: ${why}` });
+        }
+    }
+    return out;
+}
+/** The pulumi lexicon's check steps, for `LexiconPlugin.checkSteps`. */
+export function pulumiCheckSteps(opts = {}) {
+    return {
+        lexicon: LEXICON,
+        kinds: ["pulumi"],
+        async run(ctx) {
+            const out = [];
+            for (const member of ctx.members)
+                out.push(...(await pulumiMemberCheck(member, ctx, opts)));
+            return out;
+        },
+    };
+}

package/dist/composites/pulumi-adopt-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pulumi-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/pulumi-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG5E,0BAA0B;AAC1B,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,sHAAsH;IACtH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2HAA2H;IAC3H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAID,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,sBAAsB,CAsFjF"}
+{"version":3,"file":"pulumi-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/pulumi-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG5E,0BAA0B;AAC1B,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,sHAAsH;IACtH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2HAA2H;IAC3H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAID,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,sBAAsB,CAwFjF"}

package/dist/composites/pulumi-adopt-op.js

@@ -96,9 +96,11 @@ export function PulumiAdoptOp(config) {
     }));
     const waves = config.stacks.flatMap((s, i) => {
         const file = s.from ? { file: exports[i].out.file } : {};
-        const preview = pulumiAdoptPreview(s.member, { dir: s.dir, stack: s.stack, ...where, ...file, id: `preview-${i}` });
+        // Every step gets the stack's backend, so Preview and Adopt read the store Check and Export read.
+        const backend = s.backend ? { backend: s.backend } : {};
+        const preview = pulumiAdoptPreview(s.member, { dir: s.dir, stack: s.stack, ...where, ...file, ...backend, id: `preview-${i}` });
         preview.outcomeAttribute = { name: single ? "Adoptable" : `Adoptable-${slug(s.member)}-${slug(s.stack)}`, from: "resources" };
-        const adopt = pulumiAdopt(s.member, { dir: s.dir, stack: s.stack, ...where, ...file, planDigest: preview.out.planDigest, id: `adopt-${i}` });
+        const adopt = pulumiAdopt(s.member, { dir: s.dir, stack: s.stack, ...where, ...file, ...backend, planDigest: preview.out.planDigest, id: `adopt-${i}` });
         adopt.outcomeAttribute = { name: single ? "Adopted" : `Adopted-${slug(s.member)}-${slug(s.stack)}`, from: "resources" };
         const label = single ? "" : ` ${s.member}/${s.stack}`;
         return [

package/dist/index.d.ts

@@ -23,4 +23,5 @@ export { PulumiAdoptOp, type PulumiAdoptOpConfig, type PulumiAdoptOpResources, t
 export { parsePlungeAdoptView, pulumiAdoptDigest, adoptBucketTarget, type PlungeAdoptView, type PlungeAdoptStatus } from "./adopt.js";
 export { pulumiPreview as pulumiPreviewStep, pulumiDrift as pulumiDriftStep } from "./op/builders.js";
 export { pulumiExitOf, pulumiPlanMoved, PULUMI_EXIT, PLUNGE_PLAN_MOVED_EXIT } from "./exit-codes.js";
+export { pulumiPlannedOutputChanges, type PulumiOutputChange, type PulumiPlannedOutputChanges } from "./planned-output-changes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE9P,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE9P,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAElG,OAAO,EAAE,0BAA0B,EAAE,KAAK,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -27,3 +27,5 @@ export { parsePlungeAdoptView, pulumiAdoptDigest, adoptBucketTarget } from "./ad
 export { pulumiPreview as pulumiPreviewStep, pulumiDrift as pulumiDriftStep } from "./op/builders.js";
 // Pulumi and plunge exit statuses on chant's exit-code table (#4553).
 export { pulumiExitOf, pulumiPlanMoved, PULUMI_EXIT, PLUNGE_PLAN_MOVED_EXIT } from "./exit-codes.js";
+// Which stack outputs a preview changes, traced through the export (#4635).
+export { pulumiPlannedOutputChanges } from "./planned-output-changes.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d4de8cb6f01fdb50a4e9b53ae82877b221a4512e50e804f33eface5da48e9840",
+    "manifest.json": "bd4f4c6d8c0e2162c083f09b24e92eaef8d4d6000a8a3754a20051c8d325e939",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "883bcdf6a960e21360e79df010ca2087719fffec60fc39541c5ecd32d661e328",
     "rules/member-dir-absolute.ts": "4805d5e247ad544f942e1b2c36fc15a5087ca0aacaf804183a269021bd60e276",
@@ -25,5 +25,5 @@
     "skills/chant-pulumi-stack-export.md": "aadd67f5e067de61dfda43d57492bca08bd22429e4baf314d6856a810dc0e8dc",
     "skills/chant-pulumi-plunge.md": "8a7f2f9f1124744dee9645905f141057ca01f5a88e34e1bc3858d69406d7ff3a"
   },
-  "composite": "362628fd365ccf7dfb116696cbe7f48f955530635fcba52c4366ad55a66ea747"
+  "composite": "24002abc5170f337f1d8d38e0a8be8e4aa119a771e14ed829945a0ebbc198060"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pulumi",
-  "version": "0.124.55",
+  "version": "0.124.57",
   "chantVersion": ">=0.1.0",
   "namespace": "Pulumi"
 }

package/dist/member-outputs.d.ts

@@ -1,5 +1,6 @@
 import type { EngineOutputSource, EnginePlannedOutputs } from "@intentius/chant/components/verbs/member-outputs";
 import type { ChangeSetPart } from "@intentius/chant/change-set";
+import { type PulumiOutputChange } from "./planned-output-changes.js";
 import { type PulumiMemberEngine, type PulumiRunner } from "./run.js";
 /** Where a member's applied outputs are read from. */
 export type PulumiAppliedFrom = "cli" | "export";
@@ -26,14 +27,20 @@ export declare function pulumiPartHasChanges(part: ChangeSetPart): boolean;
  * the preview's error. A preview that plans no stack outputs (no stack step,
  * or one without outputs, which is what a real `pulumi preview --json`
  * prints, #4475) gives the export's outputs when it plans nothing to apply,
- * since no apply will move them, and names every output the export holds
- * unknown otherwise, so nothing reads a value the preview did not plan.
+ * since no apply will move them. With changes, each output is traced to the
+ * export's resources (#4635, {@link pulumiPlannedOutputChanges}): the ones
+ * the preview leaves alone keep their value, and the rest are unknown, so
+ * nothing reads a value the preview may move. `outputChanges` lists each
+ * output's verdict and why.
  */
 export declare function pulumiMemberPlannedOutputs(member: string, read: {
     part: ChangeSetPart;
     preview: unknown;
     exported?: unknown;
-}): EnginePlannedOutputs;
+    targeted?: boolean;
+}): EnginePlannedOutputs & {
+    outputChanges?: PulumiOutputChange[];
+};
 /** The applied outputs a `pulumi stack export` records, secrets left out. */
 export declare function pulumiExportedOutputValues(exported: unknown): Record<string, unknown>;
 /** A Pulumi member's outputs for `member-outputs`, `kinds: ["pulumi"]`. */

package/dist/member-outputs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"member-outputs.d.ts","sourceRoot":"","sources":["../src/member-outputs.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAClI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAqE,KAAK,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAItI,sDAAsD;AACtD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,MAAM,WAAW,yBAAyB;IACxC,qHAAqH;IACrH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,oEAAoE;IACpE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAcD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAGjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAcpJ;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAErF;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAoB9F;AAED,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,EAAE,kBAAyC,CAAC"}
+{"version":3,"file":"member-outputs.d.ts","sourceRoot":"","sources":["../src/member-outputs.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AAClI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAA8B,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE/F,OAAO,EAAqE,KAAK,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAItI,sDAAsD;AACtD,MAAM,MAAM,iBAAiB,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEjD,sGAAsG;AACtG,eAAO,MAAM,0BAA0B,iCAAiC,CAAC;AAEzE,MAAM,WAAW,yBAAyB;IACxC,qHAAqH;IACrH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,oEAAoE;IACpE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAcD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAGjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACtF,oBAAoB,GAAG;IAAE,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAkBjE;AAED,6EAA6E;AAC7E,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAErF;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAoB9F;AAED,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,EAAE,kBAAyC,CAAC"}

package/dist/member-outputs.js

@@ -1,3 +1,4 @@
+import { pulumiPlannedOutputChanges } from "./planned-output-changes.js";
 import { pulumiPlannedStackOutputs, pulumiExportedStackOutputs } from "./stack-outputs.js";
 import { memberExportOf, previewPulumiMemberRead, pulumiMemberStackOutputs } from "./run.js";
 import { isSecret } from "./values.js";
@@ -33,8 +34,11 @@ export function pulumiPartHasChanges(part) {
  * the preview's error. A preview that plans no stack outputs (no stack step,
  * or one without outputs, which is what a real `pulumi preview --json`
  * prints, #4475) gives the export's outputs when it plans nothing to apply,
- * since no apply will move them, and names every output the export holds
- * unknown otherwise, so nothing reads a value the preview did not plan.
+ * since no apply will move them. With changes, each output is traced to the
+ * export's resources (#4635, {@link pulumiPlannedOutputChanges}): the ones
+ * the preview leaves alone keep their value, and the rest are unknown, so
+ * nothing reads a value the preview may move. `outputChanges` lists each
+ * output's verdict and why.
  */
 export function pulumiMemberPlannedOutputs(member, read) {
     const { part } = read;
@@ -47,7 +51,11 @@ export function pulumiMemberPlannedOutputs(member, read) {
         const exported = read.exported === undefined ? [] : pulumiExportedStackOutputs(read.exported);
         if (!changes)
             return { known: knownValues(exported), unknown: [], planDigest: part.member.planDigest, changes };
-        return { known: {}, unknown: exported.filter((o) => !o.secret).map((o) => o.name), planDigest: part.member.planDigest, changes };
+        if (part.member.holes.length > 0 || read.exported === undefined) {
+            return { known: {}, unknown: exported.filter((o) => !o.secret).map((o) => o.name), planDigest: part.member.planDigest, changes };
+        }
+        const traced = pulumiPlannedOutputChanges({ part, exported: read.exported, ...(read.targeted ? { targeted: true } : {}) });
+        return { known: traced.known, unknown: traced.unknown, planDigest: part.member.planDigest, changes, outputChanges: traced.outputs };
     }
     const unknown = planned.filter((o) => o.unknown).map((o) => o.name);
     return { known: knownValues(planned), unknown, planDigest: part.member.planDigest, changes: changes || unknown.length > 0 };

package/dist/op/activities/pulumi-adopt.d.ts

@@ -59,6 +59,11 @@ export interface PulumiAdoptExportResult {
 export interface PulumiAdoptPreviewArgs extends PulumiAdoptStackArgs {
     /** `--file`: the export to adopt, from the Export step when `adoptFromFile`. */
     file?: string;
+    /**
+     * The plunge backend URL plunge adopts onto, passed as `PULUMI_BACKEND_URL`. Default, as the Check
+     * step resolves it: `plywood.yml`'s, `PULUMI_BACKEND_URL`, `Pulumi.yaml`'s.
+     */
+    backend?: string;
 }
 export interface PulumiAdoptPreviewResult {
     member: string;