@intentius/chant-lexicon-pulumi 0.124.56 → 0.124.57

package/README.md

@@ -27,7 +27,7 @@ A step pinned to its own engine release sets `engineVersion` (and `engineRoot` w
 
 The CI install lines take a version, download the release's Linux archive and its checksums file, and fail unless the archive matches its line there. For the default releases (Pulumi 3.272.0, plunge 0.1.0) the line must also hold the sha256 the lexicon records per architecture. Each release goes under its own versioned directory and is linked into `/usr/local/bin`, and a line skips the download when that directory already holds the binary, or for Pulumi when the `pulumi` on PATH is that version.
 
-The preview streams its engine events (`PULUMI_ENABLE_STREAMING_JSON_PREVIEW=true`, `src/engine-events.ts`), so one run gives the change set and CrossGuard's findings. A mandatory violation denies the plan. On plunge the saved plan's stamp refuses a plan whose records moved (plunge exit 40, chant's moved code 4). On stock Pulumi the apply previews again, then compares the steps in `up`'s event stream with the approved shape (`src/plan-shape.ts`), and a step outside it fails the apply. A member on the resource lock grain, the default on plunge, leaves `same` and `read` steps out of its digest. The step's `config` is written into a scratch copy of `Pulumi.<stack>.yaml` and passed with `--config-file`, never `--config`, which writes the working tree's file. A release cut records the stack's directory (`releaseInputs`), unless its backend is a file path relative to that directory. Under a release, a promote or rollback previews and applies the recorded copy, after `pulumi install` (or `plunge install`) in the copy when its runtime needs one (`src/release-copy.ts`); a Node copy with no recorded lockfile is refused by name.
+The preview streams its engine events (`PULUMI_ENABLE_STREAMING_JSON_PREVIEW=true`, `src/engine-events.ts`), so one run gives the change set and CrossGuard's findings. A mandatory violation denies the plan. On plunge the saved plan's stamp refuses a plan whose records moved (plunge exit 40, chant's moved code 4). On stock Pulumi the apply previews again, then compares the steps in `up`'s event stream with the approved shape (`src/plan-shape.ts`), and a step outside it fails the apply. A member on the resource lock grain, the default on plunge, leaves `same` and `read` steps out of its digest. The step's `config` is written into a scratch copy of `Pulumi.<stack>.yaml` and passed with `--config-file`, never `--config`, which writes the working tree's file. A release cut records the stack's directory (`releaseInputs`), unless its backend is a file path relative to that directory. Under a release, a promote or rollback previews and applies the recorded copy, after `pulumi install` (or `plunge install`) in the copy when its runtime needs one (`src/release-copy.ts`); a Node copy with no recorded lockfile is refused by name. A job's checkout gets the same install before its first engine run when nothing installed the program there (`prepareProgram`), and a Node checkout with no lockfile is refused by name.
 
 After `up`, the capability runs `stack export --stack <s>`, replaces every secret with `[secret]`, drops the secrets provider's state, and writes the export through chant's index store as `<env>/<stack>__pulumi-export` ([#4546](https://github.com/INTENTIUS/chant/issues/4546), `refs/chant/snapshots` by default). The graph, the preview's prior state and the drift read take that export first, so a stack chant applies needs no checked-in `stack-export.json`. A failed export leaves the apply standing and says why in the step's `exportSnapshot` output.
 

package/dist/changed-units.d.ts

@@ -0,0 +1,5 @@
+/** The unit core names for a `pulumi-up` step on `stack` in `dir` (deploy-units.ts `pulumiStackUnit`). */
+export declare function pulumiStackUnit(dir: string, stack: string): string;
+/** The stack units `changedFiles` (relative to `projectRoot`, `/` separators) touch, sorted. */
+export declare function pulumiChangedUnits(projectRoot: string, changedFiles: readonly string[]): string[];
+//# sourceMappingURL=changed-units.d.ts.map

package/dist/changed-units.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed-units.d.ts","sourceRoot":"","sources":["../src/changed-units.ts"],"names":[],"mappings":"AAgCA,0GAA0G;AAC1G,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlE;AA2CD,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAejG"}

package/dist/changed-units.js

@@ -0,0 +1,101 @@
+/**
+ * The Pulumi stacks a change touched, judged from the changed files alone
+ * (`LexiconPlugin.changedUnits`, #3183; INTENTIUS/plywood#22). A Pulumi
+ * program and its stack configs are not chant source, so `chant lifecycle
+ * affected`'s artifact diff never shows them, and without this a pull request
+ * that edits `Pulumi.dev.yaml` selects no component at all.
+ *
+ * A file belongs to the nearest directory at or above it holding a
+ * `Pulumi.yaml` (or `Pulumi.yml`), the project, never above the project root:
+ *
+ *   - `Pulumi.<stack>.yaml` in that directory is the stack's config, so it
+ *     touches that stack alone;
+ *   - any other file there or below (the program, `Pulumi.yaml`, the
+ *     package files) touches every stack of the project, which is each
+ *     `Pulumi.<stack>.yaml` beside `Pulumi.yaml` at head and any the change
+ *     deleted. A stack with no config file has no file to find it by, so a
+ *     program change does not reach it.
+ *
+ * Files under a directory whose name starts with a dot (`.forgejo`, `.chant`,
+ * `.git`) or under `node_modules` are not the program. A file outside every
+ * project, such as a module the program imports from `../shared`, is not
+ * claimed.
+ *
+ * Each unit is named as core's `DEPLOY_UNIT_RULES` names a `pulumi-up` step:
+ * `<dir>/<stack>`, or `<stack>` for a project at the project root.
+ */
+import { existsSync, readdirSync } from "node:fs";
+import { join, posix } from "node:path";
+const PROJECT_FILES = ["Pulumi.yaml", "Pulumi.yml"];
+const STACK_CONFIG = /^Pulumi\.(.+)\.ya?ml$/;
+/** The unit core names for a `pulumi-up` step on `stack` in `dir` (deploy-units.ts `pulumiStackUnit`). */
+export function pulumiStackUnit(dir, stack) {
+    const d = dir.replace(/\\/g, "/").replace(/^(\.\/)+/, "").replace(/\/+$/, "");
+    return d === "" || d === "." ? stack : `${d}/${stack}`;
+}
+/** The project directory (relative, `""` for the root) holding `file`, or undefined when none does. */
+function projectOf(projectRoot, file, changed) {
+    let dir = posix.dirname(file);
+    for (;;) {
+        const rel = dir === "." ? "" : dir;
+        for (const name of PROJECT_FILES) {
+            const p = rel === "" ? name : `${rel}/${name}`;
+            // A deleted Pulumi.yaml still names its project for the change that deleted it.
+            if (existsSync(join(projectRoot, p)) || changed.has(p))
+                return rel;
+        }
+        if (rel === "")
+            return undefined;
+        dir = posix.dirname(dir);
+    }
+}
+/** The stacks of the project in `dir`: the stack configs at head, and the ones the change names. */
+function stacksOf(projectRoot, dir, changed) {
+    const out = new Set();
+    let names = [];
+    try {
+        names = readdirSync(join(projectRoot, dir));
+    }
+    catch {
+        // The project directory is gone at head; the change's own files still name stacks.
+    }
+    for (const n of names) {
+        const m = STACK_CONFIG.exec(n);
+        if (m)
+            out.add(m[1]);
+    }
+    for (const f of changed) {
+        if (posix.dirname(f) !== (dir === "" ? "." : dir))
+            continue;
+        const m = STACK_CONFIG.exec(posix.basename(f));
+        if (m)
+            out.add(m[1]);
+    }
+    return [...out];
+}
+function ignored(file) {
+    const parts = file.split("/");
+    return parts.slice(0, -1).some((p) => p.startsWith(".") || p === "node_modules");
+}
+/** The stack units `changedFiles` (relative to `projectRoot`, `/` separators) touch, sorted. */
+export function pulumiChangedUnits(projectRoot, changedFiles) {
+    const files = changedFiles.map((f) => f.replace(/\\/g, "/").replace(/^\.\//, "")).filter((f) => f !== "" && !f.startsWith("../") && !ignored(f));
+    const changed = new Set(files);
+    const units = new Set();
+    const whole = new Set();
+    for (const f of files) {
+        const dir = projectOf(projectRoot, f, changed);
+        if (dir === undefined)
+            continue;
+        const here = posix.dirname(f) === (dir === "" ? "." : dir);
+        const m = STACK_CONFIG.exec(posix.basename(f));
+        if (here && m && !PROJECT_FILES.includes(posix.basename(f)))
+            units.add(pulumiStackUnit(dir, m[1]));
+        else
+            whole.add(dir);
+    }
+    for (const dir of whole)
+        for (const stack of stacksOf(projectRoot, dir, files))
+            units.add(pulumiStackUnit(dir, stack));
+    return [...units].sort();
+}

package/dist/composites/pulumi-adopt-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pulumi-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/pulumi-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG5E,0BAA0B;AAC1B,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,sHAAsH;IACtH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2HAA2H;IAC3H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAID,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,sBAAsB,CAsFjF"}
+{"version":3,"file":"pulumi-adopt-op.d.ts","sourceRoot":"","sources":["../../src/composites/pulumi-adopt-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAA6B,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG5E,0BAA0B;AAC1B,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,sHAAsH;IACtH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,qFAAqF;IACrF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2HAA2H;IAC3H,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAED,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAID,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,sBAAsB,CAwFjF"}

package/dist/composites/pulumi-adopt-op.js

@@ -96,9 +96,11 @@ export function PulumiAdoptOp(config) {
     }));
     const waves = config.stacks.flatMap((s, i) => {
         const file = s.from ? { file: exports[i].out.file } : {};
-        const preview = pulumiAdoptPreview(s.member, { dir: s.dir, stack: s.stack, ...where, ...file, id: `preview-${i}` });
+        // Every step gets the stack's backend, so Preview and Adopt read the store Check and Export read.
+        const backend = s.backend ? { backend: s.backend } : {};
+        const preview = pulumiAdoptPreview(s.member, { dir: s.dir, stack: s.stack, ...where, ...file, ...backend, id: `preview-${i}` });
         preview.outcomeAttribute = { name: single ? "Adoptable" : `Adoptable-${slug(s.member)}-${slug(s.stack)}`, from: "resources" };
-        const adopt = pulumiAdopt(s.member, { dir: s.dir, stack: s.stack, ...where, ...file, planDigest: preview.out.planDigest, id: `adopt-${i}` });
+        const adopt = pulumiAdopt(s.member, { dir: s.dir, stack: s.stack, ...where, ...file, ...backend, planDigest: preview.out.planDigest, id: `adopt-${i}` });
         adopt.outcomeAttribute = { name: single ? "Adopted" : `Adopted-${slug(s.member)}-${slug(s.stack)}`, from: "resources" };
         const label = single ? "" : ` ${s.member}/${s.stack}`;
         return [

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "27fc35795ca8c387b7ce55c46cd22c8ffe372f77a601cc1a33336aa2df5dabc1",
+    "manifest.json": "bd4f4c6d8c0e2162c083f09b24e92eaef8d4d6000a8a3754a20051c8d325e939",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "883bcdf6a960e21360e79df010ca2087719fffec60fc39541c5ecd32d661e328",
     "rules/member-dir-absolute.ts": "4805d5e247ad544f942e1b2c36fc15a5087ca0aacaf804183a269021bd60e276",
@@ -25,5 +25,5 @@
     "skills/chant-pulumi-stack-export.md": "aadd67f5e067de61dfda43d57492bca08bd22429e4baf314d6856a810dc0e8dc",
     "skills/chant-pulumi-plunge.md": "8a7f2f9f1124744dee9645905f141057ca01f5a88e34e1bc3858d69406d7ff3a"
   },
-  "composite": "6ac4e2b566ed424af816c52851540c62b0618ea4a8eea462bb03305465cd219c"
+  "composite": "24002abc5170f337f1d8d38e0a8be8e4aa119a771e14ed829945a0ebbc198060"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pulumi",
-  "version": "0.124.56",
+  "version": "0.124.57",
   "chantVersion": ">=0.1.0",
   "namespace": "Pulumi"
 }

package/dist/op/activities/pulumi-adopt.d.ts

@@ -59,6 +59,11 @@ export interface PulumiAdoptExportResult {
 export interface PulumiAdoptPreviewArgs extends PulumiAdoptStackArgs {
     /** `--file`: the export to adopt, from the Export step when `adoptFromFile`. */
     file?: string;
+    /**
+     * The plunge backend URL plunge adopts onto, passed as `PULUMI_BACKEND_URL`. Default, as the Check
+     * step resolves it: `plywood.yml`'s, `PULUMI_BACKEND_URL`, `Pulumi.yaml`'s.
+     */
+    backend?: string;
 }
 export interface PulumiAdoptPreviewResult {
     member: string;

package/dist/op/activities/pulumi-adopt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pulumi-adopt.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pulumi-adopt.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACpG,OAAO,EAQL,KAAK,iBAAiB,EAEvB,MAAM,aAAa,CAAC;AAErB,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,WAAW,CAAC;AAGnB,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yHAAyH;IACzH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IACjE,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qIAAqI;IACrI,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,iBAAiB,CAAC;IAC1B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,sBAAsB;IAC7D,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAkB,SAAQ,wBAAwB;IACjE,wGAAwG;IACxG,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5F;AAeD,mGAAmG;AACnG,wBAAsB,UAAU,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAuCrH;AAED,gEAAgE;AAChE,wBAAsB,WAAW,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmDxH;AAgCD,kGAAkG;AAClG,wBAAsB,YAAY,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAS3H;AAED,kHAAkH;AAClH,wBAAsB,UAAU,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU3G;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAErG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEvG;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAEzG;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE3F"}
+{"version":3,"file":"pulumi-adopt.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pulumi-adopt.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACpG,OAAO,EAQL,KAAK,iBAAiB,EAEvB,MAAM,aAAa,CAAC;AAErB,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,WAAW,CAAC;AAGnB,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,yHAAyH;IACzH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,qBAAsB,SAAQ,oBAAoB;IACjE,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qIAAqI;IACrI,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,uGAAuG;IACvG,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,iBAAiB,CAAC;IAC1B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,sBAAsB;IAC7D,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAkB,SAAQ,wBAAwB;IACjE,wGAAwG;IACxG,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;CAC5F;AAeD,mGAAmG;AACnG,wBAAsB,UAAU,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAuCrH;AAED,gEAAgE;AAChE,wBAAsB,WAAW,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAmDxH;AAsCD,kGAAkG;AAClG,wBAAsB,YAAY,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAS3H;AAED,kHAAkH;AAClH,wBAAsB,UAAU,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU3G;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAErG;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEvG;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAEzG;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE3F"}

package/dist/op/activities/pulumi-adopt.js

@@ -179,12 +179,17 @@ function summary(a, view) {
         changed: view.status !== "already-adopted",
     };
 }
+/** The backend plunge adopts onto, resolved as the Check step resolves it, as plunge's environment. */
+function adoptEnv(a, dir, deps) {
+    const backend = pulumiStackBackend(dir, { ...(a.backend ? { configured: a.backend } : {}), env: deps.env ?? process.env });
+    return backend ? { PULUMI_BACKEND_URL: backend.url } : undefined;
+}
 /** `plunge stack adopt --json`: the classification, written nowhere. A refusal fails the step. */
 export async function adoptPreview(a, deps = {}) {
     requireStack(a, "pulumiAdoptPreview");
     const dir = stackDir(a);
     const args = plungeAdoptArgs({ stack: a.stack, ...(a.file ? { file: a.file } : {}) });
-    const view = await adoptView(() => runAllowedPlunge(deps.plunge ?? defaultPlungeRunner, args, dir), "pulumiAdoptPreview", `plunge ${args.join(" ")}`);
+    const view = await adoptView(() => runAllowedPlunge(deps.plunge ?? defaultPlungeRunner, args, dir, adoptEnv(a, dir, deps)), "pulumiAdoptPreview", `plunge ${args.join(" ")}`);
     if (view.status === "refused") {
         throw new Error(`pulumiAdoptPreview: plunge refuses to adopt "${a.member}/${a.stack}": ${refusalText(view.refusals)}. Nothing was written.`);
     }
@@ -195,7 +200,7 @@ export async function adoptStack(a, deps = {}) {
     requireStack(a, "pulumiAdopt");
     const dir = stackDir(a);
     const args = plungeAdoptArgs({ stack: a.stack, yes: true, ...(a.file ? { file: a.file } : {}) });
-    const view = await adoptView(() => runAdoptPlunge(deps.plunge ?? defaultPlungeRunner, args, dir), "pulumiAdopt", `plunge ${args.join(" ")}`);
+    const view = await adoptView(() => runAdoptPlunge(deps.plunge ?? defaultPlungeRunner, args, dir, adoptEnv(a, dir, deps)), "pulumiAdopt", `plunge ${args.join(" ")}`);
     if (view.status === "refused") {
         throw new Error(`pulumiAdopt: plunge refused to adopt "${a.member}/${a.stack}": ${refusalText(view.refusals)}. Nothing was written.`);
     }

package/dist/op/activity-contracts.d.ts

@@ -76,6 +76,7 @@ export declare const pulumiAdoptPreviewContract: import("@intentius/chant/op").A
     cwd?: string | undefined;
     stack: string;
     file?: string | undefined;
+    backend?: string | undefined;
 }, {
     member: string;
     stack: string;
@@ -92,6 +93,7 @@ export declare const pulumiAdoptContract: import("@intentius/chant/op").Activity
     cwd?: string | undefined;
     stack: string;
     file?: string | undefined;
+    backend?: string | undefined;
     planDigest?: string | undefined;
 }, {
     member: string;

package/dist/op/activity-contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAiBjC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;EAW/B,CAAC;AAqBF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;EAoBpC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;EAkBrC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;EAKtC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;EAK/B,CAAC"}
+{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EAiBjC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;EAW/B,CAAC;AAqBF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;EAoBpC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;EAkBrC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;EAKtC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;EAK/B,CAAC"}

package/dist/op/activity-contracts.js

@@ -85,5 +85,5 @@ export const pulumiAdoptExportContract = activityContract("pulumiAdoptExport", z
     source: z.string(),
     adoptFromFile: z.boolean(),
 }), memberEntity);
-export const pulumiAdoptPreviewContract = activityContract("pulumiAdoptPreview", z.strictObject({ ...adoptStackArgs, file: z.string().optional() }), z.object(adoptPreviewReturns), memberEntity);
-export const pulumiAdoptContract = activityContract("pulumiAdopt", z.strictObject({ ...adoptStackArgs, file: z.string().optional(), planDigest: z.string().optional() }), z.object({ ...adoptPreviewReturns, matchesApproved: z.boolean().optional() }), memberEntity);
+export const pulumiAdoptPreviewContract = activityContract("pulumiAdoptPreview", z.strictObject({ ...adoptStackArgs, file: z.string().optional(), backend: z.string().optional() }), z.object(adoptPreviewReturns), memberEntity);
+export const pulumiAdoptContract = activityContract("pulumiAdopt", z.strictObject({ ...adoptStackArgs, file: z.string().optional(), backend: z.string().optional(), planDigest: z.string().optional() }), z.object({ ...adoptPreviewReturns, matchesApproved: z.boolean().optional() }), memberEntity);

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoC/E,eAAO,MAAM,YAAY,EAAE,aAqL1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoC/E,eAAO,MAAM,YAAY,EAAE,aAiM1B,CAAC"}

package/dist/plugin.js

@@ -123,6 +123,17 @@ export const pulumiPlugin = {
         });
         return { entities: read.entities, warnings: read.warnings };
     },
+    /**
+     * The stacks a change touched (#3183, INTENTIUS/plywood#22): a changed
+     * `Pulumi.<stack>.yaml` is that stack, any other file of a project is every
+     * stack with a config beside its `Pulumi.yaml`. Named as a `pulumi-up`
+     * step's deploy unit, so `chant components pr-plan` and `fan-out --base`
+     * select the components that update them. See ./changed-units.ts.
+     */
+    async changedUnits(ctx) {
+        const { pulumiChangedUnits } = await import("./changed-units.js");
+        return pulumiChangedUnits(ctx.projectRoot, ctx.changedFiles);
+    },
     graphMeta() {
         const report = lastMemberReport();
         return report ? { pulumiMember: report } : undefined;

package/dist/pulumi-up.d.ts

@@ -107,11 +107,17 @@
  *
  * The cut records tracked files, so a Node program's copy has no
  * `node_modules`. Before the copy's first preview, `plan` and `run` call
- * `prepareReleaseCopy` (`./release-copy.ts`), which runs `pulumi install`
+ * `prepareProgram` (`./release-copy.ts`), which runs `pulumi install`
  * (`plunge install`) in the copy when its runtime needs one, and refuses a
  * Node copy with no lockfile by name, since an install would take today's
  * versions rather than the release's.
  *
+ * A CI job's checkout has the same gap, so the same call prepares the
+ * step's own directory by the same rule (plywood#22): a Node program with
+ * no `node_modules` in its directory or above it, and a lockfile beside its
+ * package.json, gets one `<engine> install` before the job's first engine
+ * run; with no lockfile the step refuses by name.
+ *
  * ## review stacks (#4609)
  *
  * When `DeployContext.env` is a pull request's environment `pr-<n>` (`chant
@@ -150,6 +156,15 @@ export interface PulumiUpStepInput {
     config?: Record<string, unknown>;
     /** `pulumi` or `plunge`; see `pulumiMemberEngine`. */
     engine?: PulumiMemberEngine;
+    /**
+     * The stack's backend URL (INTENTIUS/plywood#22), such as
+     * `plunge+s3://...` or `s3://...`: every engine command the step runs
+     * (preview, up, the stack output and export reads, a review stack's init)
+     * gets it as `PULUMI_BACKEND_URL`, over the job's own. It also answers the
+     * engine where `pulumiMemberEngine` would read `PULUMI_BACKEND_URL`.
+     * Absent: the job's `PULUMI_BACKEND_URL` or `Pulumi.yaml`'s, as before.
+     */
+    backend?: string;
     /**
      * The engine release this stack is pinned to (#4592): the step runs
      * `<engineRoot>/<engine>-<engineVersion>/<engine>`, the path the pulumi

package/dist/pulumi-up.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pulumi-up.d.ts","sourceRoot":"","sources":["../src/pulumi-up.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgIG;AAMH,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EAEpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAuB,KAAK,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAChG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG/E,OAAO,EAWL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAG7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE,OAAO,EAcL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,OAAO,CAAC;AAEf,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAM5F,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sDAAsD;IACtD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4HAA4H;IAC5H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0IAA0I;IAC1I,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,0BAA0B;AAC1B,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,YAAY,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,kEAAkE;IAClE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,yFAAyF;IACzF,cAAc,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,gFAAgF;IAChF,YAAY,EAAE,wBAAwB,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpG;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAgCD,yHAAyH;AACzH,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,MAAM,EAAE,MAAM;IAFhC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,qGAAqG;AACrG,qBAAa,uBAAwB,SAAQ,KAAK;aAK9B,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,kBAAkB;IAL9C,QAAQ,CAAC,YAAY,QAAQ;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,IAAqB;IACtC,YACkB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,kBAAkB,EAC5C,MAAM,CAAC,EAAE,MAAM,EAKhB;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,MAAM,EAAE,MAAM;aACd,WAAW,EAAE,MAAM,EAAE;aACrB,OAAO,CAAC,EAAE,kBAAkB;IAH9C,YACkB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,kBAAkB,YAAA,EAI7C;CACF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,MAAM,EAAE,MAAM;aAEd,OAAO,CAAC,EAAE,kBAAkB;IAH9C,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,kBAAkB,YAAA,EAI7C;CACF;AAED,oHAAoH;AACpH,qBAAa,+BAAgC,SAAQ,KAAK;aAC5B,MAAM,EAAE,MAAM;IAA1C,YAA4B,MAAM,EAAE,MAAM,EAGzC;CACF;AAED,qHAAqH;AACrH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,CAElF;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,YAAY,CAAC;IACtC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uLAAuL;IACvL,SAAS,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CAClC;AA0BD,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAI/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAkBvG;AAED,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAOvL;AA+CD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,eAAe,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAWhJ;AAwND,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIrE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,SAAS,kBAAkB,EAAE,EACtC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;CAAO,GAChD,OAAO,CAAC,YAAY,EAAE,CAAC,CAuBzB;AAyBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAK9E;AAgHD,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,oBAAoB,GAAG,aAAa,GAAG,oBAAoB,GAAG,IAAI,CAqBpI;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,eAAoB,GAAG,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CA+CtH;AAED,eAAO,MAAM,kBAAkB,mDAA6B,CAAC"}
+{"version":3,"file":"pulumi-up.d.ts","sourceRoot":"","sources":["../src/pulumi-up.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsIG;AAMH,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EAEpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAuB,KAAK,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAChG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG/E,OAAO,EAWL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAG7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,OAAO,EAcL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,OAAO,CAAC;AAEf,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAM5F,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sDAAsD;IACtD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4HAA4H;IAC5H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0IAA0I;IAC1I,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,0BAA0B;AAC1B,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,YAAY,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,kEAAkE;IAClE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,yFAAyF;IACzF,cAAc,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,gFAAgF;IAChF,YAAY,EAAE,wBAAwB,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpG;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAgCD,yHAAyH;AACzH,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,MAAM,EAAE,MAAM;IAFhC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,qGAAqG;AACrG,qBAAa,uBAAwB,SAAQ,KAAK;aAK9B,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,kBAAkB;IAL9C,QAAQ,CAAC,YAAY,QAAQ;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,IAAqB;IACtC,YACkB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,kBAAkB,EAC5C,MAAM,CAAC,EAAE,MAAM,EAKhB;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,MAAM,EAAE,MAAM;aACd,WAAW,EAAE,MAAM,EAAE;aACrB,OAAO,CAAC,EAAE,kBAAkB;IAH9C,YACkB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,kBAAkB,YAAA,EAI7C;CACF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,MAAM,EAAE,MAAM;aAEd,OAAO,CAAC,EAAE,kBAAkB;IAH9C,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,kBAAkB,YAAA,EAI7C;CACF;AAED,oHAAoH;AACpH,qBAAa,+BAAgC,SAAQ,KAAK;aAC5B,MAAM,EAAE,MAAM;IAA1C,YAA4B,MAAM,EAAE,MAAM,EAGzC;CACF;AAED,qHAAqH;AACrH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,CAElF;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,YAAY,CAAC;IACtC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uLAAuL;IACvL,SAAS,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CAClC;AA0BD,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAI/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAkBvG;AAED,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAOvL;AA+DD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,eAAe,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAWhJ;AA4ND,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIrE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,SAAS,kBAAkB,EAAE,EACtC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;CAAO,GAChD,OAAO,CAAC,YAAY,EAAE,CAAC,CAuBzB;AAyBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAK9E;AAgHD,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,oBAAoB,GAAG,aAAa,GAAG,oBAAoB,GAAG,IAAI,CAqBpI;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,eAAoB,GAAG,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAwDtH;AAED,eAAO,MAAM,kBAAkB,mDAA6B,CAAC"}

package/dist/pulumi-up.js

@@ -107,11 +107,17 @@
  *
  * The cut records tracked files, so a Node program's copy has no
  * `node_modules`. Before the copy's first preview, `plan` and `run` call
- * `prepareReleaseCopy` (`./release-copy.ts`), which runs `pulumi install`
+ * `prepareProgram` (`./release-copy.ts`), which runs `pulumi install`
  * (`plunge install`) in the copy when its runtime needs one, and refuses a
  * Node copy with no lockfile by name, since an install would take today's
  * versions rather than the release's.
  *
+ * A CI job's checkout has the same gap, so the same call prepares the
+ * step's own directory by the same rule (plywood#22): a Node program with
+ * no `node_modules` in its directory or above it, and a lockfile beside its
+ * package.json, gets one `<engine> install` before the job's first engine
+ * run; with no lockfile the step refuses by name.
+ *
  * ## review stacks (#4609)
  *
  * When `DeployContext.env` is a pull request's environment `pr-<n>` (`chant
@@ -142,12 +148,13 @@ import { ciEngineDir, ciRelease, CI_ENGINE_ROOT } from "./ci-setup.js";
 import { pulumiMemberPlannedOutputs } from "./member-outputs.js";
 import { pulumiPlanShape, pulumiShapeDifferences } from "./plan-shape.js";
 import { pulumiLockRows } from "./lock-rows.js";
+import { stackRowKey } from "@intentius/chant/lifecycle/lock-rows";
 import { pulumiTraceFacts } from "./trace-facts.js";
 import { defaultPlungeRunner, defaultPulumiRunner, engineRunnerAt, plungeUpArgs, pulumiMemberStackOutputs, pulumiRunFailure, pulumiUpArgs, pulumiUpPreviewArgs, memberExportOf, runAllowedPlunge, runAllowedPulumi, runApplyPlunge, runApplyPulumi, } from "./run.js";
 import { writePulumiExportSnapshot } from "./stack-export-snapshot.js";
 import { pointerSegment, pulumiStackReferences, stackReferenceOwner } from "./stack-references.js";
 import { isObject } from "./values.js";
-import { prepareReleaseCopy } from "./release-copy.js";
+import { prepareProgram } from "./release-copy.js";
 import { initReviewStack, reviewConfigSource, reviewStackFor, reviewStackLocation } from "./review-stack.js";
 /**
  * The packs a preview runs (#4613). With `ctx.policyBase` each step pack in
@@ -328,17 +335,30 @@ function locationOf(r, stack) {
 }
 /** A plan file name with nothing a path could read into. */
 const fileSafe = (s) => s.replace(/[^A-Za-z0-9._-]+/g, "_");
+/** The environment the engine is picked from: the job's, with the step's backend as `PULUMI_BACKEND_URL`. */
+function engineEnv(input, opts) {
+    if (input.backend === undefined)
+        return opts.env ? { env: opts.env } : {};
+    return { env: { ...(opts.env ?? process.env), PULUMI_BACKEND_URL: input.backend } };
+}
+/** `run` with `PULUMI_BACKEND_URL` set to the step's backend over whatever env the call passes. */
+function withBackend(run, backend) {
+    return (args, o) => run(args, { ...o, env: { ...(o.env ?? {}), PULUMI_BACKEND_URL: backend } });
+}
 function resolveStep(input, opts, declared) {
     requireInput(input);
+    if (input.backend !== undefined && (typeof input.backend !== "string" || input.backend.trim() === "")) {
+        throw new Error('pulumi-up: "backend" is the stack\'s backend URL, such as plunge+s3://<bucket> or s3://<bucket>');
+    }
     const dir = stackDir(input);
     const member = pulumiUpMember(input);
-    const picked = pulumiMemberEngine(dir, input.engine, opts.env ? { env: opts.env } : {});
+    const picked = pulumiMemberEngine(dir, input.engine, engineEnv(input, opts));
     // #4552: the step's own grain, else ci.lockGrain as the caller read it at base, else the engine's default.
     const grain = input.lockGrain ?? declared ?? pulumiDefaultLockGrain(picked.engine);
     if (grain === "resource" && picked.engine === "pulumi")
         throw new PulumiResourceGrainRefusedError(member);
     const engineBin = pulumiUpEngineBin(input, picked.engine);
-    return { dir, member, engine: picked.engine, ...(engineBin ? { engineBin } : {}), engineSource: picked.source, engineBecause: picked.because, grain };
+    return { dir, member, engine: picked.engine, ...(engineBin ? { engineBin } : {}), engineSource: picked.source, engineBecause: picked.because, grain, ...(input.backend ? { backend: input.backend } : {}) };
 }
 /**
  * The binary a step pinned with `engineVersion` runs (#4592): the versioned
@@ -362,7 +382,7 @@ export function pulumiUpEngineBin(input, engine) {
 }
 /** The `run` and `plunge` options for the stack output and export reads: the pinned binary's for both when the step names one (#4592), else the caller's. */
 function runnerOptions(r, opts) {
-    if (r.engineBin) {
+    if (r.engineBin || r.backend) {
         const { pulumi, plunge } = runnersFor(r, opts);
         return { run: pulumi, plunge };
     }
@@ -370,11 +390,16 @@ function runnerOptions(r, opts) {
 }
 /** The runners a resolved step uses: the pinned binary's when it names one, else the options' or the PATH default. */
 function runnersFor(r, opts) {
+    let out;
     if (r.engineBin) {
         const pinned = opts.runAt ? opts.runAt(r.engineBin) : engineRunnerAt(r.engineBin);
-        return { pulumi: pinned, plunge: pinned };
+        out = { pulumi: pinned, plunge: pinned };
     }
-    return { pulumi: opts.run ?? defaultPulumiRunner, plunge: opts.plunge ?? defaultPlungeRunner };
+    else {
+        out = { pulumi: opts.run ?? defaultPulumiRunner, plunge: opts.plunge ?? defaultPlungeRunner };
+    }
+    // plywood#22: the step's backend reaches every command, whichever call site runs it.
+    return r.backend ? { pulumi: withBackend(out.pulumi, r.backend), plunge: withBackend(out.plunge, r.backend) } : out;
 }
 /** The scratch directory, the config copy in it and plunge's plan file path. */
 function scratchFor(r, input, opts) {
@@ -475,10 +500,10 @@ function isArtifact(value) {
     const v = value;
     return v?.kind === "pulumi-up" && typeof v.planDigest === "string" && typeof v.shape === "object" && v.shape !== null;
 }
-/** A release's copy of the program, made runnable before its first engine run (#4542). */
-async function readyCopy(r, opts) {
+/** The program's directory, a release's copy (#4542) or the checkout in place (plywood#22), made runnable before its first engine run. */
+async function readyProgram(r, opts) {
     const runners = runnersFor(r, opts);
-    await prepareReleaseCopy({ dir: r.dir, member: r.member, engine: r.engine, run: r.engine === "plunge" ? runners.plunge : runners.pulumi });
+    await prepareProgram({ dir: r.dir, member: r.member, engine: r.engine, run: r.engine === "plunge" ? runners.plunge : runners.pulumi });
 }
 async function planStack(ctx, original, opts) {
     // #4609: in pr-<n>, the review stack, made from the template before its first preview.
@@ -488,7 +513,7 @@ async function planStack(ctx, original, opts) {
     const unresolved = [...(ctx.unresolvedInputs ?? [])].sort();
     if (unresolved.length > 0)
         return { ...waitingStack(ctx, r, input, unresolved), ...location };
-    await readyCopy(r, opts);
+    await readyProgram(r, opts);
     if (review) {
         const runners = runnersFor(r, opts);
         await initReviewStack({
@@ -648,7 +673,7 @@ async function runStack(ctx, original, opts) {
     const handed = ctx.plans?.[r.member];
     const fromWave = isArtifact(handed);
     const targets = ctx.targets && ctx.targets.length > 0 ? ctx.targets : undefined;
-    await readyCopy(r, opts);
+    await readyProgram(r, opts);
     // Ruling D: no approved plan handed in, so plan here and apply that.
     let approved;
     if (fromWave) {
@@ -809,16 +834,26 @@ export function createPulumiUpCapability(opts = {}) {
         // #4552: resource on plunge, the stack (target) on stock Pulumi.
         defaultLockGrain(input) {
             requireInput(input);
-            return pulumiDefaultLockGrain(pulumiMemberEngine(stackDir(input), input.engine, opts.env ? { env: opts.env } : {}).engine);
+            return pulumiDefaultLockGrain(pulumiMemberEngine(stackDir(input), input.engine, engineEnv(input, opts)).engine);
         },
         // Stock Pulumi keeps the stack grain: its backend's stack lock already orders updates, and nothing in it is per resource.
         lockGrainRefusal(input, grain) {
             if (grain !== "resource")
                 return undefined;
             requireInput(input);
-            const engine = pulumiMemberEngine(stackDir(input), input.engine, opts.env ? { env: opts.env } : {}).engine;
+            const engine = pulumiMemberEngine(stackDir(input), input.engine, engineEnv(input, opts)).engine;
             return engine === "pulumi" ? new PulumiResourceGrainRefusedError(pulumiUpMember(input)).message : undefined;
         },
+        // The ruling for ci-products (2026-10-28): a stock stack waits for its stack row on the ledger in place of the backend's lock.
+        // plunge keeps the resource grain, and a plunge stack declared on the target grain waits on the same row.
+        targetLockRow(input, plan) {
+            requireInput(input);
+            const project = readProject(stackDir(input))?.name;
+            const stack = plan && isArtifact(plan.artifact) ? plan.artifact.stack : input.stack;
+            if (typeof project !== "string" || !stack)
+                return undefined;
+            return { key: stackRowKey(project, stack), target: pulumiUpMember(input), address: `${project}/${stack}` };
+        },
         // URN rows, object rows, and the stack row when something may appear only at apply (./lock-rows.ts).
         lockRows(input, plan) {
             if (!plan.changeSet)

package/dist/release-copy.d.ts

@@ -16,6 +16,12 @@ export declare class PulumiReleaseCopyRefusedError extends Error {
     readonly member: string;
     constructor(member: string, reason: string);
 }
+/** An in-place program that cannot be made runnable, with the reason (plywood#22). */
+export declare class PulumiProgramNotReadyError extends Error {
+    readonly member: string;
+    readonly dir: string;
+    constructor(member: string, dir: string, reason: string);
+}
 /** What preparing a copy did. */
 export type ReleaseCopyPrepared = {
     action: "not-a-copy";
@@ -26,15 +32,49 @@ export type ReleaseCopyPrepared = {
     action: "installed";
     command: string;
 };
+/** What preparing a program's directory did: a release copy or an in-place checkout. */
+export type ProgramPrepared = {
+    place: "copy" | "checkout";
+} & ({
+    action: "none";
+    reason: string;
+} | {
+    action: "installed";
+    command: string;
+});
 /** Why the copy needs an install, or why not; throws when it cannot be prepared. */
 export declare function releaseCopyNeeds(dir: string, member: string): {
     install: boolean;
     reason: string;
 };
+/**
+ * Why a program's directory needs an install, or why not: a release copy
+ * (`copy`) or an in-place checkout (`checkout`). Throws when it cannot be
+ * prepared: a Node program with no lockfile beside its package.json.
+ */
+export declare function programNeeds(dir: string, member: string, place: "copy" | "checkout"): {
+    install: boolean;
+    reason: string;
+};
+/**
+ * Make a program's directory runnable before its first engine run, once per
+ * directory in this process: `install` there when {@link programNeeds} says
+ * so. A release copy follows the copy's rules, any other directory the
+ * checkout's. Throws for a directory that cannot be prepared, or an install
+ * that fails. The first caller's engine runs the install; a second engine
+ * asking for the same directory waits on it.
+ */
+export declare function prepareProgram(opts: {
+    dir: string;
+    member: string;
+    engine: PulumiMemberEngine;
+    run: PulumiRunner;
+}): Promise<ProgramPrepared>;
 /**
  * Make a release copy runnable, once per directory in this process: `install`
  * in the copy when {@link releaseCopyNeeds} says so. Throws for a copy that
- * cannot be prepared, or an install that fails.
+ * cannot be prepared, or an install that fails. A directory that is not a
+ * copy is left alone; {@link prepareProgram} prepares both.
  */
 export declare function prepareReleaseCopy(opts: {
     dir: string;
@@ -42,6 +82,6 @@ export declare function prepareReleaseCopy(opts: {
     engine: PulumiMemberEngine;
     run: PulumiRunner;
 }): Promise<ReleaseCopyPrepared>;
-/** Forget every prepared copy. For tests. */
+/** Forget every prepared directory. For tests. */
 export declare function resetPreparedReleaseCopies(): void;
 //# sourceMappingURL=release-copy.d.ts.map

package/dist/release-copy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-copy.d.ts","sourceRoot":"","sources":["../src/release-copy.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAG/E,qIAAqI;AACrI,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D,4DAA4D;AAC5D,eAAO,MAAM,cAAc,UAAuG,CAAC;AAEnI,uDAAuD;AACvD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGlD;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAc9F;AAED,yDAAyD;AACzD,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,MAAM,EAAE,MAAM;IADhC,YACkB,MAAM,EAAE,MAAM,EAC9B,MAAM,EAAE,MAAM,EAIf;CACF;AAED,iCAAiC;AACjC,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBlG;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,YAAY,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsBrJ;AAED,6CAA6C;AAC7C,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}
+{"version":3,"file":"release-copy.d.ts","sourceRoot":"","sources":["../src/release-copy.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAG/E,qIAAqI;AACrI,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAE3D,4DAA4D;AAC5D,eAAO,MAAM,cAAc,UAAuG,CAAC;AAEnI,uDAAuD;AACvD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGlD;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAc9F;AAED,yDAAyD;AACzD,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,MAAM,EAAE,MAAM;IADhC,YACkB,MAAM,EAAE,MAAM,EAC9B,MAAM,EAAE,MAAM,EAIf;CACF;AAED,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,KAAK;aAEjC,MAAM,EAAE,MAAM;aACd,GAAG,EAAE,MAAM;IAF7B,YACkB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EAIf;CACF;AAED,iCAAiC;AACjC,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7C,wFAAwF;AACxF,MAAM,MAAM,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,GAAG,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAa/I,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAElG;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAmC1H;AAID;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,YAAY,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAuB7I;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,YAAY,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAI3J;AAED,kDAAkD;AAClD,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}