@intentius/chant-lexicon-pulumi 0.124.57 → 0.124.58

package/README.md

@@ -39,16 +39,19 @@ A program that reads another stack through `StackReference` orders its stack aft
 
 ## Gated stack operations
 
-`src/stack-ops.ts` ([#4578](https://github.com/INTENTIUS/chant/issues/4578)) runs three stack operations, each only after its gated request (#4551) is approved on the workspace ledger by someone other than the requester, under the op `pulumi-stack-ops`. The first call records the request and returns the `chant approve` command; the same call after the approval spends it, runs once, and records how it ended.
+`src/stack-ops.ts` ([#4578](https://github.com/INTENTIUS/chant/issues/4578)) runs stack operations, each only after its gated request (#4551) is approved on the workspace ledger by someone other than the requester, under the op `pulumi-stack-ops`. The first call records the request and returns the `chant approve` command; the same call after the approval spends it, runs once, and records how it ended.
 
 | Function | Request | What runs after approval |
 |---|---|---|
 | `gatedStackExport` | `stack-export` of `<stack>` | `pulumi stack export --stack <s>` (or plunge's), written mode 600 to a file outside every git working tree; refused in CI |
 | `gatedStackCancel` | `stack-cancel` of `<stack>` with its lock id | `pulumi cancel --yes --stack <s>`, once the lock is still the approved one (read from a `file://` backend's lock directory); refused on plunge, which has no stack lock |
 | `gatedStackMove` | `stack-move` of `move:<source>:<dest>` with the URNs | `pulumi state move --source <s> --dest <d> --yes <urn>...`, or `plunge stack move --stack <s> --dest <d> <urn>... --json --yes` after plunge's plan; both stacks preview first, and the move runs only when the previews change nothing but the moved resources |
+| `gatedStackAction` | `stack-action` of `action:<stack>:<name>` with the URN and the preview's digest | `pulumi up --yes --target <urn> --replace <urn> --stack <s>` (or plunge's), once ([#4654](https://github.com/INTENTIUS/chant/issues/4654)); see below |
 
 `pulumiStackLockIds({ dir, stack })` ([#4615](https://github.com/INTENTIUS/chant/issues/4615)) reads the lock ids a stack holds now, the same read `gatedStackCancel` checks with, so a product can offer the id to approve. It answers `checked: false` on a backend other than `file://`, and no ids for a plunge stack.
 
+A day-2 action on a stack is a `command:local:Command` or `command:remote:Command` resource whose replacement is the operation, such as a key rotation. `gatedStackAction({ dir, stack, urn, name, engine, ... })` refuses any other resource type with `action-type` before anything runs. Each call previews `preview --json --target <urn> --replace <urn> --stack <s>` and refuses with `action-scope`, naming the other URNs, when the preview changes anything besides that one replacement; nothing is asked for then. The request binds the stack, the URN and the preview's digest, so a preview that changed after the approval asks again. Once approved, the update runs, and the finished line keeps `result: applied` (or `failed`) with `detail.result` set to `ok` (or `failed`), the exit code and the last lines of output. The same call after it ran answers `spent`, unless it passes `anew`. A stack on plunge runs both through plunge.
+
 The writes go through `runGatedPulumi` and `runGatedPlunge` in `src/run.ts`, whose fixed forms (`PULUMI_GATED_COMMANDS`, `PLUNGE_GATED_COMMANDS`) are the only ones allowed.
 
 ## Drift: `chant workspace drift`

package/dist/index.d.ts

@@ -16,7 +16,7 @@ export { pulumiEngineEvents, pulumiStreamPreview, pulumiAppliedSteps, pulumiPoli
 export { readPulumiDrift, type PulumiDriftRunners } from "./drift-read.js";
 export { pulumiAuditCatalog } from "./lint/audit-catalog.js";
 export { PulumiWatchOp, type PulumiWatchOpConfig, type PulumiWatchOpResources } from "./composites/pulumi-watch-op.js";
-export { gatedStackExport, gatedStackCancel, gatedStackMove, moveLeftovers, diyStackLockIds, pulumiStackLockIds, type PulumiStackLocks, PULUMI_STACK_OPS_OP, type PulumiStackOpOutcome, type PulumiStackOpCommon, type PulumiStackOpKind } from "./stack-ops.js";
+export { gatedStackExport, gatedStackCancel, gatedStackMove, gatedStackAction, checkStackActionUrn, stackActionScope, stackActionSubject, PulumiStackActionRefused, PULUMI_ACTION_TYPE_PREFIX, type PulumiStackActionOptions, type PulumiStackActionResult, type PulumiStackActionRefusal, moveLeftovers, diyStackLockIds, pulumiStackLockIds, type PulumiStackLocks, PULUMI_STACK_OPS_OP, type PulumiStackOpOutcome, type PulumiStackOpCommon, type PulumiStackOpKind } from "./stack-ops.js";
 export { initReviewStack, removeReviewStack, parseReviewStackLocation, prNumberOf, pulumiTemplateStack, reviewConfigSource, reviewStackFor, reviewStackLocation, reviewStackTeardown, REVIEW_STACK_TEARDOWN, type ReviewStackOptions, type ReviewStackOutcome, type ReviewStackTeardown, type ReviewStackTeardownOptions, } from "./review-stack.js";
 export { pulumiStackReferences, parsePulumiStackName, stackReferenceOwner, PULUMI_STACK_REFERENCE_TYPE, type PulumiStackReference } from "./stack-references.js";
 export { PulumiAdoptOp, type PulumiAdoptOpConfig, type PulumiAdoptOpResources, type PulumiAdoptStack } from "./composites/pulumi-adopt-op.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE9P,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAElG,OAAO,EAAE,0BAA0B,EAAE,KAAK,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE5d,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAElG,OAAO,EAAE,0BAA0B,EAAE,KAAK,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -18,7 +18,7 @@ export { readPulumiDrift } from "./drift-read.js";
 export { pulumiAuditCatalog } from "./lint/audit-catalog.js";
 // The Preview/Drift watch composite and its step builders (#4494).
 export { PulumiWatchOp } from "./composites/pulumi-watch-op.js";
-export { gatedStackExport, gatedStackCancel, gatedStackMove, moveLeftovers, diyStackLockIds, pulumiStackLockIds, PULUMI_STACK_OPS_OP } from "./stack-ops.js";
+export { gatedStackExport, gatedStackCancel, gatedStackMove, gatedStackAction, checkStackActionUrn, stackActionScope, stackActionSubject, PulumiStackActionRefused, PULUMI_ACTION_TYPE_PREFIX, moveLeftovers, diyStackLockIds, pulumiStackLockIds, PULUMI_STACK_OPS_OP } from "./stack-ops.js";
 // Review stacks (INTENTIUS/plywood#15): pr-<n> stacks only.
 export { initReviewStack, removeReviewStack, parseReviewStackLocation, prNumberOf, pulumiTemplateStack, reviewConfigSource, reviewStackFor, reviewStackLocation, reviewStackTeardown, REVIEW_STACK_TEARDOWN, } from "./review-stack.js";
 export { pulumiStackReferences, parsePulumiStackName, stackReferenceOwner, PULUMI_STACK_REFERENCE_TYPE } from "./stack-references.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "bd4f4c6d8c0e2162c083f09b24e92eaef8d4d6000a8a3754a20051c8d325e939",
+    "manifest.json": "d9975374a07d5764ef1b0b209c48fc2ec1b4ec4669808c6d6b1b6429d23a97d6",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "883bcdf6a960e21360e79df010ca2087719fffec60fc39541c5ecd32d661e328",
     "rules/member-dir-absolute.ts": "4805d5e247ad544f942e1b2c36fc15a5087ca0aacaf804183a269021bd60e276",
@@ -25,5 +25,5 @@
     "skills/chant-pulumi-stack-export.md": "aadd67f5e067de61dfda43d57492bca08bd22429e4baf314d6856a810dc0e8dc",
     "skills/chant-pulumi-plunge.md": "8a7f2f9f1124744dee9645905f141057ca01f5a88e34e1bc3858d69406d7ff3a"
   },
-  "composite": "24002abc5170f337f1d8d38e0a8be8e4aa119a771e14ed829945a0ebbc198060"
+  "composite": "a4603282326e0ed1abf7f6c24fd702e35975fbbc9b1cdee72341269a8f9a9ac1"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pulumi",
-  "version": "0.124.57",
+  "version": "0.124.58",
   "chantVersion": ">=0.1.0",
   "namespace": "Pulumi"
 }

package/dist/run.d.ts

@@ -167,9 +167,25 @@ export declare function runAdoptPlunge(run: PulumiRunner, args: string[], cwd: s
  *
  * - `pulumi cancel --yes --stack <stack>`: releases a stuck update's lock;
  * - `pulumi state move --source <stack> --dest <stack> --yes <urn>...`: moves
- *   resources between stock stacks, never `--include-parents`.
+ *   resources between stock stacks, never `--include-parents`;
+ * - `pulumi up --yes --target <urn> --replace <urn> --stack <stack>`: a
+ *   day-2 action (#4654), the replacement of one `command:` resource, the
+ *   same URN in both places. Its preview, `preview --json --target <urn>
+ *   --replace <urn> --stack <stack>`, is a read and passes
+ *   {@link runAllowedPulumi}. `up` takes `--replace` here only:
+ *   {@link PULUMI_APPLY_COMMANDS} still refuses it.
  */
 export declare const PULUMI_GATED_COMMANDS: readonly string[];
+/** A stack action's preview (#4654): `preview --json --target <urn> --replace <urn> --stack <stack>`, a read. */
+export declare function pulumiActionPreviewArgs(opts: {
+    stack: string;
+    urn: string;
+}): string[];
+/** A stack action's update (#4654): `up --yes --target <urn> --replace <urn> --stack <stack>`, under `pulumi` or `plunge`. */
+export declare function pulumiActionUpArgs(opts: {
+    stack: string;
+    urn: string;
+}): string[];
 /**
  * plunge's resource move (INTENTIUS/plunge#56) in its two forms. The first
  * prints the plan and writes nothing, so it passes {@link runAllowedPlunge};
@@ -197,7 +213,7 @@ export declare function plungeMoveArgs(opts: {
 export declare function runGatedPulumi(run: PulumiRunner, args: string[], cwd: string, env?: Record<string, string>): Promise<{
     stdout: string;
 }>;
-/** Run the moving form of {@link PLUNGE_GATED_COMMANDS}, refusing any other argv. Only `./stack-ops.ts` calls it, after the request is spent. */
+/** Run a writing form of {@link PLUNGE_GATED_COMMANDS}, the move or a stack action's update, refusing any other argv. Only `./stack-ops.ts` calls it, after the request is spent. */
 export declare function runGatedPlunge(run: PulumiRunner, args: string[], cwd: string, env?: Record<string, string>): Promise<{
     stdout: string;
 }>;

package/dist/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAsHA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAKrE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAK9E;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhI;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAIjF;AAED,eAAO,MAAM,mBAAmB,EAAE,YAC+F,CAAC;AAElI;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAA2F,CAAC;AAoD9J,2HAA2H;AAC3H,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAOhJ;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,EAAE,CAE3F;AAoBD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAchJ;AAED,eAAO,MAAM,mBAAmB,EAAE,YAC+F,CAAC;AAElI;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAGxD;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAGlD,CAAC;AAEF,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,4IAA4I;IAC5I,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC3C;AAaD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,GAAG,MAAM,EAAE,CAE1G;AAED,uHAAuH;AACvH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,GAAG,MAAM,EAAE,CAE9F;AAED,0GAA0G;AAC1G,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,GAAG,MAAM,EAAE,CAEhF;AAiDD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAGlD,CAAC;AAEF,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAE/F;AAkBD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAGlD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAGlD,CAAC;AAIF,sCAAsC;AACtC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAElE;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,EAAE,CAE7G;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAEvH;AAkBD,qIAAqI;AACrI,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED,iJAAiJ;AACjJ,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAIzD,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,QAAwC,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAI5E;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE9F;AAED,iDAAiD;AACjD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAExE;AAED,2CAA2C;AAC3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAEnE;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CASnE;AAQD,wGAAwG;AACxG,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAGpJ;AAED,6DAA6D;AAC7D,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAGpJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAyC,CAAC;AAE/F,0GAA0G;AAC1G,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAKjJ;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA2H,CAAC;AAE/K,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAK7D;AAED,+EAA+E;AAC/E,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAEhK,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,EAAE,CAE7E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,EAAE,CAItG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEvE;AAQD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAEzH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQrD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/H;AAED,kHAAkH;AAClH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAU/D;AAqBD,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,yHAAyH;IACzH,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qIAAqI;IACrI,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAED,mHAAmH;AACnH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsB5G;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAElG;AAED,MAAM,WAAW,+BAA+B;IAC9C,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qIAAqI;IACrI,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,+BAA+B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmBtH;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sGAAsG;IACtG,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,sEAAsE;IACtE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qIAAqI;IACrI,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAWD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA4DlG;AAED,MAAM,WAAW,wBAAwB;IACvC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2HAA2H;IAC3H,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qIAAqI;IACrI,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAmBtG"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAsHA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAKrE,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAK9E;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhI;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAIjF;AAED,eAAO,MAAM,mBAAmB,EAAE,YAC+F,CAAC;AAElI;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAA2F,CAAC;AAoD9J,2HAA2H;AAC3H,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAOhJ;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAKlD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,EAAE,CAE3F;AAoBD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAchJ;AAED,eAAO,MAAM,mBAAmB,EAAE,YAC+F,CAAC;AAElI;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAGxD;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAGlD,CAAC;AAEF,uGAAuG;AACvG,MAAM,WAAW,gBAAgB;IAC/B,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,eAAe;IAC9B,4IAA4I;IAC5I,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC3C;AAaD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,GAAG,MAAM,EAAE,CAE1G;AAED,uHAAuH;AACvH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,GAAG,MAAM,EAAE,CAE9F;AAED,0GAA0G;AAC1G,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,eAAe,GAAG,MAAM,EAAE,CAEhF;AAiDD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAGlD,CAAC;AAEF,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAE/F;AAkBD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAIlD,CAAC;AAEF,iHAAiH;AACjH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAEtF;AAED,8HAA8H;AAC9H,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAEjF;AAiBD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAIlD,CAAC;AAIF,sCAAsC;AACtC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAElE;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,EAAE,CAE7G;AAED,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAEvH;AAmBD,qIAAqI;AACrI,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED,qLAAqL;AACrL,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAO9I;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAIzD,CAAC;AAEF,sGAAsG;AACtG,eAAO,MAAM,iBAAiB,QAAwC,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAI5E;AAED,wEAAwE;AACxE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE9F;AAED,iDAAiD;AACjD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAExE;AAED,2CAA2C;AAC3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAEnE;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CASnE;AAQD,wGAAwG;AACxG,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAGpJ;AAED,6DAA6D;AAC7D,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAGpJ;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAyC,CAAC;AAE/F,0GAA0G;AAC1G,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAKjJ;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA2H,CAAC;AAE/K,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAK7D;AAED,+EAA+E;AAC/E,wBAAsB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAK9I;AAED,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAEhK,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,MAAM,EAAE,CAE7E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAAG,MAAM,EAAE,CAItG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEvE;AAQD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAEzH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAQrD;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/H;AAED,kHAAkH;AAClH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAU/D;AAqBD,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,yHAAyH;IACzH,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qIAAqI;IACrI,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAED,mHAAmH;AACnH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsB5G;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAElG;AAED,MAAM,WAAW,+BAA+B;IAC9C,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qIAAqI;IACrI,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,+BAA+B,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmBtH;AAED,MAAM,WAAW,0BAA2B,SAAQ,gBAAgB;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sGAAsG;IACtG,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,sEAAsE;IACtE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qIAAqI;IACrI,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAWD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA4DlG;AAED,MAAM,WAAW,wBAAwB;IACvC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2HAA2H;IAC3H,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,qIAAqI;IACrI,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAmBtG"}

package/dist/run.js

@@ -438,12 +438,39 @@ export async function runAdoptPlunge(run, args, cwd, env) {
  *
  * - `pulumi cancel --yes --stack <stack>`: releases a stuck update's lock;
  * - `pulumi state move --source <stack> --dest <stack> --yes <urn>...`: moves
- *   resources between stock stacks, never `--include-parents`.
+ *   resources between stock stacks, never `--include-parents`;
+ * - `pulumi up --yes --target <urn> --replace <urn> --stack <stack>`: a
+ *   day-2 action (#4654), the replacement of one `command:` resource, the
+ *   same URN in both places. Its preview, `preview --json --target <urn>
+ *   --replace <urn> --stack <stack>`, is a read and passes
+ *   {@link runAllowedPulumi}. `up` takes `--replace` here only:
+ *   {@link PULUMI_APPLY_COMMANDS} still refuses it.
  */
 export const PULUMI_GATED_COMMANDS = [
     "pulumi cancel --yes --stack <stack>",
     "pulumi state move --source <stack> --dest <stack> --yes <urn>...",
+    "pulumi up --yes --target <urn> --replace <urn> --stack <stack>",
 ];
+/** A stack action's preview (#4654): `preview --json --target <urn> --replace <urn> --stack <stack>`, a read. */
+export function pulumiActionPreviewArgs(opts) {
+    return ["preview", "--json", "--target", opts.urn, "--replace", opts.urn, "--stack", opts.stack];
+}
+/** A stack action's update (#4654): `up --yes --target <urn> --replace <urn> --stack <stack>`, under `pulumi` or `plunge`. */
+export function pulumiActionUpArgs(opts) {
+    return ["up", "--yes", "--target", opts.urn, "--replace", opts.urn, "--stack", opts.stack];
+}
+/** Exactly {@link pulumiActionUpArgs}' form: one URN, targeted and replaced, on one stack. */
+function allowedActionUp(args) {
+    return (args.length === 8 &&
+        args[0] === "up" &&
+        args[1] === "--yes" &&
+        args[2] === "--target" &&
+        isUrn(args[3]) &&
+        args[4] === "--replace" &&
+        args[5] === args[3] &&
+        args[6] === "--stack" &&
+        isValue(args[7]));
+}
 /**
  * plunge's resource move (INTENTIUS/plunge#56) in its two forms. The first
  * prints the plan and writes nothing, so it passes {@link runAllowedPlunge};
@@ -452,6 +479,7 @@ export const PULUMI_GATED_COMMANDS = [
 export const PLUNGE_GATED_COMMANDS = [
     "plunge stack move --stack <stack> --dest <stack> <urn>... --json",
     "plunge stack move --stack <stack> --dest <stack> <urn>... --json --yes",
+    "plunge up --yes --target <urn> --replace <urn> --stack <stack>",
 ];
 const isUrn = (v) => typeof v === "string" && v.startsWith("urn:pulumi:");
 /** `cancel --yes --stack <stack>`. */
@@ -480,6 +508,8 @@ function allowedGatedPulumi(args) {
         const urns = args.slice(7);
         return args[2] === "--source" && isValue(args[3]) && args[4] === "--dest" && isValue(args[5]) && args[6] === "--yes" && urns.length > 0 && urns.every(isUrn);
     }
+    if (args[0] === "up")
+        return allowedActionUp(args);
     return false;
 }
 /** Run one of {@link PULUMI_GATED_COMMANDS}, refusing any other argv. Only `./stack-ops.ts` calls it, after the request is spent. */
@@ -489,9 +519,13 @@ export async function runGatedPulumi(run, args, cwd, env) {
     }
     return run(args, env ? { cwd, env } : { cwd });
 }
-/** Run the moving form of {@link PLUNGE_GATED_COMMANDS}, refusing any other argv. Only `./stack-ops.ts` calls it, after the request is spent. */
+/** Run a writing form of {@link PLUNGE_GATED_COMMANDS}, the move or a stack action's update, refusing any other argv. Only `./stack-ops.ts` calls it, after the request is spent. */
 export async function runGatedPlunge(run, args, cwd, env) {
-    if (!allowedPlungeMove(args, true)) {
+    if (args[0] === "up") {
+        if (!allowedActionUp(args))
+            throw new Error(`chant runs a plunge stack action only as ${PLUNGE_GATED_COMMANDS[2]}, not plunge ${args.join(" ")}`);
+    }
+    else if (!allowedPlungeMove(args, true)) {
         throw new Error(`chant moves plunge resources only as ${PLUNGE_GATED_COMMANDS[1]}, not plunge ${args.join(" ")}`);
     }
     return run(args, env ? { cwd, env } : { cwd });

package/dist/stack-ops.d.ts

@@ -4,7 +4,7 @@ import { type PulumiMemberEngine } from "./member-engine.js";
 import { type PulumiRunner } from "./run.js";
 /** The op the requests are recorded under, unless the caller names its own. */
 export declare const PULUMI_STACK_OPS_OP = "pulumi-stack-ops";
-export type PulumiStackOpKind = "stack-export" | "stack-cancel" | "stack-move";
+export type PulumiStackOpKind = "stack-export" | "stack-cancel" | "stack-move" | "stack-action";
 /** chant's gated-request API (#4551), injectable for tests. */
 export interface GatedRequestApi {
     requestGate: typeof RequestGate;
@@ -172,4 +172,63 @@ export declare function moveLeftovers(urns: readonly string[], source: ChangeSet
  * for an empty or non-URN list or two engines.
  */
 export declare function gatedStackMove(opts: PulumiStackMoveOptions): Promise<PulumiStackOpOutcome<PulumiStackMoveResult>>;
+/** Why a stack action was refused before anything was asked (#4654). */
+export type PulumiStackActionRefusal = "action-urn" | "action-type" | "action-scope";
+/** A stack action refused before its request: `code` says why, `urns` names what the preview changed besides the action, for `action-scope`. */
+export declare class PulumiStackActionRefused extends Error {
+    readonly code: PulumiStackActionRefusal;
+    readonly urns: string[];
+    constructor(code: PulumiStackActionRefusal, message: string, urns?: string[]);
+}
+/** The resource types an action may name: the command provider's (`command:local:Command`, `command:remote:Command`). */
+export declare const PULUMI_ACTION_TYPE_PREFIX = "command:";
+/** The subject an action's request is asked and approved under: `action:<stack>:<name>`, or the URN in place of a name. */
+export declare const stackActionSubject: (stack: string, nameOrUrn: string) => string;
+export interface PulumiStackActionOptions extends PulumiStackOpCommon {
+    /** The stack's directory, where `Pulumi.yaml` is. */
+    dir: string;
+    cwd?: string;
+    /** The stack, as `--stack` takes it. */
+    stack: string;
+    engine?: PulumiMemberEngine;
+    /** The `command:` resource whose replacement is the action. */
+    urn: string;
+    /** The action's name in the caller's config, which the subject carries in place of the URN. */
+    name?: string;
+    /** Ask anew even when the same request applied already. Absent, such a call answers `spent`, so a retried job never runs the action twice. */
+    anew?: boolean;
+}
+export interface PulumiStackActionResult {
+    urn: string;
+    engine: PulumiMemberEngine;
+    /** The preview's digest the request bound. */
+    preview: string;
+    /** The update's exit code: 0, since a failed update ends `failed`. */
+    exit: number;
+    /** The update's last lines of output. */
+    tail: string;
+}
+/**
+ * Check an action's URN before anything runs: a Pulumi URN on `stack` whose
+ * type is a command provider's. Throws {@link PulumiStackActionRefused}.
+ */
+export declare function checkStackActionUrn(stack: string, urn: string): void;
+/**
+ * What a preview changes besides the action's replacement (#4654): each URN
+ * with a changing step other than `urn`, and `urn` itself when it changes
+ * other than by replacement or is not replaced at all. Empty when the
+ * preview replaces `urn` and nothing else.
+ */
+export declare function stackActionScope(urn: string, preview: unknown): {
+    others: string[];
+    problem?: string;
+};
+/**
+ * A day-2 action on a stack (#4654): the replacement of one `command:`
+ * resource, previewed, asked for under a gated request, and run once a
+ * second identity approves. Refused before anything runs for a URN that is
+ * not a command resource's (`action-type`), and before anything is asked for
+ * a preview that changes more than that replacement (`action-scope`).
+ */
+export declare function gatedStackAction(opts: PulumiStackActionOptions): Promise<PulumiStackOpOutcome<PulumiStackActionResult>>;
 //# sourceMappingURL=stack-ops.d.ts.map

package/dist/stack-ops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stack-ops.d.ts","sourceRoot":"","sources":["../src/stack-ops.ts"],"names":[],"mappings":"AAuDA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EACV,kBAAkB,IAAI,kBAAkB,EACxC,iBAAiB,IAAI,iBAAiB,EACtC,WAAW,IAAI,WAAW,EAC1B,iBAAiB,IAAI,iBAAiB,EACtC,YAAY,EACZ,iBAAiB,EAElB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAYL,KAAK,YAAY,EAClB,MAAM,OAAO,CAAC;AAGf,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;AAE/E,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,WAAW,CAAC;IAChC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;CAC7C;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,KAAK,EAAE,iBAAiB,CAAC;IACzB,iFAAiF;IACjF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,+DAA+D;AAC/D,MAAM,MAAM,oBAAoB,CAAC,CAAC,IAC9B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC/E,0EAA0E;GACxE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3G,6DAA6D;GAC3D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAC1D;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,GACpE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA8E/E,kFAAkF;AAClF,eAAO,MAAM,UAAU,UAAuF,CAAC;AAE/G,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQlE;AAED,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,iHAAiH;IACjH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CAoC7H;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAQlG;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,+HAA+H;IAC/H,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAc9L;AAED,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,4GAA4G;AAC5G,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CA0C7H;AAID,0BAA0B;AAC1B,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,iGAAiG;IACjG,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,eAAe,CAAC;IACtB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAOD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,EAAE,CAoB3G;AAeD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,CAAC,CAiFvH"}
+{"version":3,"file":"stack-ops.d.ts","sourceRoot":"","sources":["../src/stack-ops.ts"],"names":[],"mappings":"AAqEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EACV,kBAAkB,IAAI,kBAAkB,EACxC,iBAAiB,IAAI,iBAAiB,EACtC,WAAW,IAAI,WAAW,EAC1B,iBAAiB,IAAI,iBAAiB,EACtC,YAAY,EACZ,iBAAiB,EAElB,MAAM,0CAA0C,CAAC;AAIlD,OAAO,EAAsB,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAcL,KAAK,YAAY,EAClB,MAAM,OAAO,CAAC;AAGf,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,GAAG,cAAc,CAAC;AAEhG,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,WAAW,CAAC;IAChC,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;IAC5C,kBAAkB,EAAE,OAAO,kBAAkB,CAAC;IAC9C,iBAAiB,EAAE,OAAO,iBAAiB,CAAC;CAC7C;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,KAAK,EAAE,iBAAiB,CAAC;IACzB,iFAAiF;IACjF,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,+DAA+D;AAC/D,MAAM,MAAM,oBAAoB,CAAC,CAAC,IAC9B;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC/E,0EAA0E;GACxE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3G,6DAA6D;GAC3D;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAC1D;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,CAAC,CAAA;CAAE,GACpE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAgF/E,kFAAkF;AAClF,eAAO,MAAM,UAAU,UAAuF,CAAC;AAE/G,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQlE;AAED,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,iHAAiH;IACjH,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CAoC7H;AAID;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAQlG;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,+HAA+H;IAC/H,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAc9L;AAED,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,4GAA4G;AAC5G,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CA0C7H;AAID,0BAA0B;AAC1B,MAAM,WAAW,eAAe;IAC9B,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,iGAAiG;IACjG,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,MAAM,EAAE,eAAe,CAAC;IACxB,IAAI,EAAE,eAAe,CAAC;IACtB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAOD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,GAAG,MAAM,EAAE,CAoB3G;AAeD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC,qBAAqB,CAAC,CAAC,CAiFvH;AAID,wEAAwE;AACxE,MAAM,MAAM,wBAAwB,GAAG,YAAY,GAAG,aAAa,GAAG,cAAc,CAAC;AAErF,gJAAgJ;AAChJ,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,EAAO,EAK/E;CACF;AAED,yHAAyH;AACzH,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAKpD,2HAA2H;AAC3H,eAAO,MAAM,kBAAkB,UAAW,MAAM,aAAa,MAAM,KAAG,MAAwC,CAAC;AAE/G,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8IAA8I;IAC9I,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,kBAAkB,CAAC;IAC3B,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;CACd;AAMD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAWpE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAiBtG;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,CAAC,CA4D7H"}

package/dist/stack-ops.js

@@ -16,6 +16,7 @@
  * | export | `stack-export` | `<stack>` | `stack`, `engine`, `deliver: requester` |
  * | cancel | `stack-cancel` | `<stack>` | `stack`, `lockId` |
  * | move | `stack-move` | `move:<source>:<dest>` | `source`, `dest`, `engine`, `urns` (sorted, comma-joined) |
+ * | action | `stack-action` | `action:<stack>:<name>` (the URN without a name) | `stack`, `urn`, `engine`, `preview` (the preview's digest), `name` when given |
  *
  * The first call records the pending fact and answers `waiting` with the
  * `chant approve` command. A later call with the same request reuses the
@@ -47,17 +48,30 @@
  *   again afterwards; a change left on either finishes the request `failed`
  *   with the changes named.
  *
+ * - action (#4654): a day-2 action is a `command:` resource
+ *   (`command:local:Command`, `command:remote:Command`) whose replacement is
+ *   the operation. Its type is checked before anything runs (`action-type`).
+ *   Each call previews `preview --json --target <urn> --replace <urn>`, and
+ *   refuses (`action-scope`) unless the preview changes that URN alone, by
+ *   a replacement. The request binds the preview's digest, so a preview
+ *   that moved after the approval asks again. Once approved, `up --yes
+ *   --target <urn> --replace <urn> --stack <s>` under the stack's engine,
+ *   and the finished line keeps chant's `applied | failed` with
+ *   `detail.result` `ok` or `failed`, the exit code and the output's last
+ *   lines. A request that applied answers `spent` to the same call, unless
+ *   the caller asks `anew`.
+ *
  * The writes go through `runGatedPulumi` and `runGatedPlunge`
  * (`./run.ts`), whose fixed forms are the whole of what may run.
  */
 import { createHash } from "node:crypto";
 import { existsSync, readdirSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import { pulumiNodeKey } from "@intentius/chant/pulumi-urn";
+import { parsePulumiUrn, pulumiNodeKey } from "@intentius/chant/pulumi-urn";
 import { pulumiStackBackend } from "./adopt.js";
-import { pulumiExportResources } from "./change-set.js";
+import { pulumiExportResources, pulumiPreviewDigest, pulumiSteps, PULUMI_UNCHANGED_OPS } from "./change-set.js";
 import { pulumiMemberEngine } from "./member-engine.js";
-import { defaultPlungeRunner, defaultPulumiRunner, plungeMoveArgs, previewPulumiMemberRead, pulumiCancelArgs, pulumiRunFailure, pulumiStateMoveArgs, runAllowedPlunge, runAllowedPulumi, runGatedPlunge, runGatedPulumi, } from "./run.js";
+import { defaultPlungeRunner, defaultPulumiRunner, plungeMoveArgs, previewPulumiMemberRead, pulumiActionPreviewArgs, pulumiActionUpArgs, pulumiCancelArgs, pulumiRunFailure, pulumiStateMoveArgs, runAllowedPlunge, runAllowedPulumi, runGatedPlunge, runGatedPulumi, } from "./run.js";
 import { isObject } from "./values.js";
 /** The op the requests are recorded under, unless the caller names its own. */
 export const PULUMI_STACK_OPS_OP = "pulumi-stack-ops";
@@ -80,12 +94,13 @@ const sameFields = (a, b) => Object.keys(a).length === Object.keys(b).length &&
  * every operation. `precheck` runs after the approval and before the request
  * is spent, so a refusal there leaves the approval unspent.
  */
-async function askThenAct(common, kind, subject, fields, description, act, precheck) {
+async function askThenAct(common, kind, subject, fields, description, act, precheck, options = {}) {
     const api = await gatedApi(common.gated);
     const op = common.op ?? PULUMI_STACK_OPS_OP;
     const cwd = common.ledgerCwd ?? process.cwd();
+    // With reuseApplied (#4654), a request with these fields that applied already is asked again as itself, so it answers `spent`.
     const standing = (await api.readGatedRequests(op, { cwd }).catch(() => []))
-        .filter((r) => !r.applied && r.request.kind === kind && r.request.subject === subject && r.request.by === common.by && sameFields(r.request.fields, fields))
+        .filter((r) => (options.reuseApplied || !r.applied) && r.request.kind === kind && r.request.subject === subject && r.request.by === common.by && sameFields(r.request.fields, fields))
         .at(-1);
     const request = { kind, subject, by: common.by, at: standing?.request.at ?? common.now ?? new Date().toISOString(), fields };
     const asked = await api.requestGate({
@@ -398,3 +413,121 @@ export async function gatedStackMove(opts) {
         }
     });
 }
+/** A stack action refused before its request: `code` says why, `urns` names what the preview changed besides the action, for `action-scope`. */
+export class PulumiStackActionRefused extends Error {
+    constructor(code, message, urns = []) {
+        super(`${code}: ${message}`);
+        this.name = "PulumiStackActionRefused";
+        this.code = code;
+        this.urns = urns;
+    }
+}
+/** The resource types an action may name: the command provider's (`command:local:Command`, `command:remote:Command`). */
+export const PULUMI_ACTION_TYPE_PREFIX = "command:";
+/** An action's name as a caller's config gives it, for the request's subject. */
+const ACTION_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/;
+/** The subject an action's request is asked and approved under: `action:<stack>:<name>`, or the URN in place of a name. */
+export const stackActionSubject = (stack, nameOrUrn) => `action:${stack}:${nameOrUrn}`;
+/** The last `n` lines of `text`, trimmed. */
+const lastLines = (text, n) => (text ?? "").trim().split("\n").slice(-n).join("\n");
+/**
+ * Check an action's URN before anything runs: a Pulumi URN on `stack` whose
+ * type is a command provider's. Throws {@link PulumiStackActionRefused}.
+ */
+export function checkStackActionUrn(stack, urn) {
+    const parsed = parsePulumiUrn(urn);
+    if (!parsed)
+        throw new PulumiStackActionRefused("action-urn", `${JSON.stringify(urn)} is not a resource URN (urn:pulumi:<stack>::<project>::<type>::<name>)`);
+    const stackName = stack.split("/").at(-1);
+    if (parsed.stack !== stackName)
+        throw new PulumiStackActionRefused("action-urn", `${urn} names stack ${parsed.stack}, and the action runs on ${stack}`);
+    if (!parsed.type.startsWith(PULUMI_ACTION_TYPE_PREFIX)) {
+        throw new PulumiStackActionRefused("action-type", `${urn} is a ${parsed.type}, and an action is a command resource (command:local:Command or command:remote:Command), whose replacement runs it; replacing any other resource is an update`);
+    }
+}
+/**
+ * What a preview changes besides the action's replacement (#4654): each URN
+ * with a changing step other than `urn`, and `urn` itself when it changes
+ * other than by replacement or is not replaced at all. Empty when the
+ * preview replaces `urn` and nothing else.
+ */
+export function stackActionScope(urn, preview) {
+    const steps = pulumiSteps(preview) ?? [];
+    const others = new Set();
+    let replaced = false;
+    let problem;
+    for (const s of steps) {
+        const op = s.op ?? "";
+        if (PULUMI_UNCHANGED_OPS.has(op))
+            continue;
+        if (s.urn !== urn) {
+            others.add(s.urn);
+            continue;
+        }
+        if (op === "replace" || op === "create-replacement" || op === "delete-replaced")
+            replaced = true;
+        else
+            problem = `the preview shows ${op} of ${urn}, not its replacement`;
+    }
+    if (!problem && !replaced)
+        problem = `the preview does not replace ${urn}`;
+    return { others: [...others].sort(), ...(problem ? { problem } : {}) };
+}
+/**
+ * A day-2 action on a stack (#4654): the replacement of one `command:`
+ * resource, previewed, asked for under a gated request, and run once a
+ * second identity approves. Refused before anything runs for a URN that is
+ * not a command resource's (`action-type`), and before anything is asked for
+ * a preview that changes more than that replacement (`action-scope`).
+ */
+export async function gatedStackAction(opts) {
+    checkStackActionUrn(opts.stack, opts.urn);
+    if (opts.name !== undefined && !ACTION_NAME.test(opts.name))
+        throw new Error(`an action's name is letters, digits, "_", "." and "-", not ${JSON.stringify(opts.name)}`);
+    const env = opts.env ?? process.env;
+    const dir = stackDirOf(opts.dir, opts.cwd);
+    const engine = engineOf(dir, opts.engine, env);
+    const target = { stack: opts.stack, urn: opts.urn };
+    const previewArgs = pulumiActionPreviewArgs(target);
+    let stdout;
+    try {
+        ({ stdout } = engine === "plunge" ? await runAllowedPlunge(opts.plunge ?? defaultPlungeRunner, previewArgs, dir) : await runAllowedPulumi(opts.run ?? defaultPulumiRunner, previewArgs, dir));
+    }
+    catch (err) {
+        throw new Error(`${engine} ${previewArgs.join(" ")} failed: ${why(err, engine)}`);
+    }
+    let preview;
+    try {
+        preview = JSON.parse(stdout);
+    }
+    catch {
+        throw new Error(`${engine} ${previewArgs.join(" ")} printed no JSON`);
+    }
+    const scope = stackActionScope(opts.urn, preview);
+    if (scope.others.length > 0) {
+        throw new PulumiStackActionRefused("action-scope", `the preview of ${opts.stack} replacing ${opts.urn} also changes ${scope.others.join(", ")}, and an action replaces its command resource alone; nothing was asked for`, scope.others);
+    }
+    if (scope.problem)
+        throw new PulumiStackActionRefused("action-scope", `${scope.problem}; nothing was asked for`);
+    const digest = pulumiPreviewDigest(preview, { changedOnly: true });
+    const subject = stackActionSubject(opts.stack, opts.name ?? opts.urn);
+    const fields = { stack: opts.stack, urn: opts.urn, engine, preview: digest, ...(opts.name ? { name: opts.name } : {}) };
+    return askThenAct(opts, "stack-action", subject, fields, `action ${opts.name ?? opts.urn} on stack ${opts.stack}: replace ${opts.urn}, requested by ${opts.by}`, async () => {
+        const args = pulumiActionUpArgs(target);
+        try {
+            const done = engine === "plunge" ? await runGatedPlunge(opts.plunge ?? defaultPlungeRunner, args, dir) : await runGatedPulumi(opts.run ?? defaultPulumiRunner, args, dir);
+            const tail = lastLines(done.stdout, 10);
+            return { result: { urn: opts.urn, engine, preview: digest, exit: 0, tail }, detail: { result: "ok", exit: 0, tail: tail.slice(-400), urn: opts.urn } };
+        }
+        catch (err) {
+            const f = pulumiRunFailure(err);
+            const exit = f.exitCode ?? 1;
+            const tail = lastLines(`${f.stdout ?? ""}\n${f.stderr ?? ""}`, 10);
+            return {
+                result: { urn: opts.urn, engine, preview: digest, exit, tail },
+                detail: { result: "failed", exit, tail: tail.slice(-400), urn: opts.urn },
+                failed: `${engine} ${args.join(" ")} failed: ${why(err, engine)}`,
+            };
+        }
+    }, undefined, { reuseApplied: !opts.anew });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-pulumi",
-  "version": "0.124.57",
+  "version": "0.124.58",
   "type": "module",
   "files": [
     "src/",
@@ -54,7 +54,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.57",
+    "@intentius/chant": "^0.124.58",
     "zod": "^4.3.6"
   },
   "description": "pulumi lexicon for chant: a Pulumi program as a workspace member, its preview in the change set and its refresh as drift records",

package/src/index.ts

@@ -108,7 +108,7 @@ export { readPulumiDrift, type PulumiDriftRunners } from "./drift-read";
 export { pulumiAuditCatalog } from "./lint/audit-catalog";
 // The Preview/Drift watch composite and its step builders (#4494).
 export { PulumiWatchOp, type PulumiWatchOpConfig, type PulumiWatchOpResources } from "./composites/pulumi-watch-op";
-export { gatedStackExport, gatedStackCancel, gatedStackMove, moveLeftovers, diyStackLockIds, pulumiStackLockIds, type PulumiStackLocks, PULUMI_STACK_OPS_OP, type PulumiStackOpOutcome, type PulumiStackOpCommon, type PulumiStackOpKind } from "./stack-ops";
+export { gatedStackExport, gatedStackCancel, gatedStackMove, gatedStackAction, checkStackActionUrn, stackActionScope, stackActionSubject, PulumiStackActionRefused, PULUMI_ACTION_TYPE_PREFIX, type PulumiStackActionOptions, type PulumiStackActionResult, type PulumiStackActionRefusal, moveLeftovers, diyStackLockIds, pulumiStackLockIds, type PulumiStackLocks, PULUMI_STACK_OPS_OP, type PulumiStackOpOutcome, type PulumiStackOpCommon, type PulumiStackOpKind } from "./stack-ops";
 // Review stacks (INTENTIUS/plywood#15): pr-<n> stacks only.
 export {
   initReviewStack,

package/src/run.test.ts

@@ -14,6 +14,8 @@ import {
   plungeAdoptArgs,
   plungeGraphArgs,
   plungeMoveArgs,
+  pulumiActionPreviewArgs,
+  pulumiActionUpArgs,
   pulumiCancelArgs,
   pulumiStateMoveArgs,
   runGatedPlunge,
@@ -93,6 +95,44 @@ describe("gated stack operations (#4578)", () => {
   });
 });
 
+describe("a stack action's forms (#4654)", () => {
+  const u = "urn:pulumi:prod-us::shop::command:local:Command::rotate";
+  const other = "urn:pulumi:prod-us::shop::command:local:Command::flush";
+  test("the preview is a read; the update passes the gated entry points only", async () => {
+    const { run, calls } = fake(() => "{}");
+    await runAllowedPulumi(run, pulumiActionPreviewArgs({ stack: "prod-us", urn: u }), "/tmp");
+    await runAllowedPlunge(run, pulumiActionPreviewArgs({ stack: "prod-us", urn: u }), "/tmp");
+    await runGatedPulumi(run, pulumiActionUpArgs({ stack: "prod-us", urn: u }), "/tmp");
+    await runGatedPlunge(run, pulumiActionUpArgs({ stack: "prod-us", urn: u }), "/tmp");
+    const up = ["up", "--yes", "--target", u, "--replace", u, "--stack", "prod-us"];
+    expect(calls.map((c) => c.args)).toEqual([
+      ["preview", "--json", "--target", u, "--replace", u, "--stack", "prod-us"],
+      ["preview", "--json", "--target", u, "--replace", u, "--stack", "prod-us"],
+      up,
+      up,
+    ]);
+  });
+
+  test("no other update form gets through", async () => {
+    const { run, calls } = fake(() => "{}");
+    const up = pulumiActionUpArgs({ stack: "prod-us", urn: u });
+    await expect(runAllowedPulumi(run, up, "/tmp")).rejects.toThrow(/not pulumi up/);
+    await expect(runApplyPulumi(run, up, "/tmp")).rejects.toThrow();
+    for (const args of [
+      ["up", "--yes", "--target", u, "--replace", other, "--stack", "prod-us"],
+      ["up", "--yes", "--replace", u, "--stack", "prod-us"],
+      ["up", "--yes", "--target", u, "--replace", u, "--stack", "prod-us", "--skip-preview"],
+      ["up", "--target", u, "--replace", u, "--stack", "prod-us"],
+      ["up", "--yes", "--target", "rotate", "--replace", "rotate", "--stack", "prod-us"],
+      ["up", "--yes", "--target", u, "--replace", u, "--stack", "--json"],
+    ]) {
+      await expect(runGatedPulumi(run, args, "/tmp")).rejects.toThrow(/gated Pulumi stack operation only as/);
+      await expect(runGatedPlunge(run, args, "/tmp")).rejects.toThrow(/plunge stack action only as/);
+    }
+    expect(calls).toEqual([]);
+  });
+});
+
 describe("plunge stack adopt (#4562)", () => {
   test("the preview form passes runAllowedPlunge, and only runAdoptPlunge runs --yes", async () => {
     const { run, calls } = fake(() => "{}");

package/src/run.ts

@@ -492,13 +492,45 @@ export async function runAdoptPlunge(run: PulumiRunner, args: string[], cwd: str
  *
  * - `pulumi cancel --yes --stack <stack>`: releases a stuck update's lock;
  * - `pulumi state move --source <stack> --dest <stack> --yes <urn>...`: moves
- *   resources between stock stacks, never `--include-parents`.
+ *   resources between stock stacks, never `--include-parents`;
+ * - `pulumi up --yes --target <urn> --replace <urn> --stack <stack>`: a
+ *   day-2 action (#4654), the replacement of one `command:` resource, the
+ *   same URN in both places. Its preview, `preview --json --target <urn>
+ *   --replace <urn> --stack <stack>`, is a read and passes
+ *   {@link runAllowedPulumi}. `up` takes `--replace` here only:
+ *   {@link PULUMI_APPLY_COMMANDS} still refuses it.
  */
 export const PULUMI_GATED_COMMANDS: readonly string[] = [
   "pulumi cancel --yes --stack <stack>",
   "pulumi state move --source <stack> --dest <stack> --yes <urn>...",
+  "pulumi up --yes --target <urn> --replace <urn> --stack <stack>",
 ];
 
+/** A stack action's preview (#4654): `preview --json --target <urn> --replace <urn> --stack <stack>`, a read. */
+export function pulumiActionPreviewArgs(opts: { stack: string; urn: string }): string[] {
+  return ["preview", "--json", "--target", opts.urn, "--replace", opts.urn, "--stack", opts.stack];
+}
+
+/** A stack action's update (#4654): `up --yes --target <urn> --replace <urn> --stack <stack>`, under `pulumi` or `plunge`. */
+export function pulumiActionUpArgs(opts: { stack: string; urn: string }): string[] {
+  return ["up", "--yes", "--target", opts.urn, "--replace", opts.urn, "--stack", opts.stack];
+}
+
+/** Exactly {@link pulumiActionUpArgs}' form: one URN, targeted and replaced, on one stack. */
+function allowedActionUp(args: readonly string[]): boolean {
+  return (
+    args.length === 8 &&
+    args[0] === "up" &&
+    args[1] === "--yes" &&
+    args[2] === "--target" &&
+    isUrn(args[3]) &&
+    args[4] === "--replace" &&
+    args[5] === args[3] &&
+    args[6] === "--stack" &&
+    isValue(args[7])
+  );
+}
+
 /**
  * plunge's resource move (INTENTIUS/plunge#56) in its two forms. The first
  * prints the plan and writes nothing, so it passes {@link runAllowedPlunge};
@@ -507,6 +539,7 @@ export const PULUMI_GATED_COMMANDS: readonly string[] = [
 export const PLUNGE_GATED_COMMANDS: readonly string[] = [
   "plunge stack move --stack <stack> --dest <stack> <urn>... --json",
   "plunge stack move --stack <stack> --dest <stack> <urn>... --json --yes",
+  "plunge up --yes --target <urn> --replace <urn> --stack <stack>",
 ];
 
 const isUrn = (v: string | undefined): v is string => typeof v === "string" && v.startsWith("urn:pulumi:");
@@ -539,6 +572,7 @@ function allowedGatedPulumi(args: string[]): boolean {
     const urns = args.slice(7);
     return args[2] === "--source" && isValue(args[3]) && args[4] === "--dest" && isValue(args[5]) && args[6] === "--yes" && urns.length > 0 && urns.every(isUrn);
   }
+  if (args[0] === "up") return allowedActionUp(args);
   return false;
 }
 
@@ -550,9 +584,11 @@ export async function runGatedPulumi(run: PulumiRunner, args: string[], cwd: str
   return run(args, env ? { cwd, env } : { cwd });
 }
 
-/** Run the moving form of {@link PLUNGE_GATED_COMMANDS}, refusing any other argv. Only `./stack-ops.ts` calls it, after the request is spent. */
+/** Run a writing form of {@link PLUNGE_GATED_COMMANDS}, the move or a stack action's update, refusing any other argv. Only `./stack-ops.ts` calls it, after the request is spent. */
 export async function runGatedPlunge(run: PulumiRunner, args: string[], cwd: string, env?: Record<string, string>): Promise<{ stdout: string }> {
-  if (!allowedPlungeMove(args, true)) {
+  if (args[0] === "up") {
+    if (!allowedActionUp(args)) throw new Error(`chant runs a plunge stack action only as ${PLUNGE_GATED_COMMANDS[2]}, not plunge ${args.join(" ")}`);
+  } else if (!allowedPlungeMove(args, true)) {
     throw new Error(`chant moves plunge resources only as ${PLUNGE_GATED_COMMANDS[1]}, not plunge ${args.join(" ")}`);
   }
   return run(args, env ? { cwd, env } : { cwd });

package/src/stack-ops.test.ts

@@ -16,8 +16,11 @@ import {
   diyStackLockIds,
   gatedStackCancel,
   gatedStackExport,
+  gatedStackAction,
   gatedStackMove,
   moveLeftovers,
+  PulumiStackActionRefused,
+  stackActionScope,
   pulumiStackLockIds,
   PULUMI_STACK_OPS_OP,
   type GatedRequestApi,
@@ -284,3 +287,112 @@ describe("the stack lock reader (chant#4615)", () => {
     expect(await pulumiStackLockIds({ dir, stack: "dev", engine: "plunge", env: {} })).toEqual({ checked: true, ids: [] });
   });
 });
+
+describe("action (chant#4654)", () => {
+  const rotate = "urn:pulumi:prod-us::shop::command:local:Command::rotate";
+  const bucket = "urn:pulumi:prod-us::shop::aws:s3/bucket:Bucket::b";
+  const stackUrn = "urn:pulumi:prod-us::shop::pulumi:pulumi:Stack::shop-prod-us";
+  const replaceSteps = (urn: string) => [
+    { op: "create-replacement", urn, newState: { type: "command:local:Command", inputs: { create: "./rotate.sh" } } },
+    { op: "replace", urn, newState: { type: "command:local:Command", inputs: { create: "./rotate.sh" } } },
+    { op: "delete-replaced", urn, oldState: { type: "command:local:Command", inputs: { create: "./rotate.sh" } } },
+  ];
+  const doc = (steps: unknown[]) => JSON.stringify({ steps: [{ op: "same", urn: stackUrn }, ...steps] });
+  const previewArgs = ["preview", "--json", "--target", rotate, "--replace", rotate, "--stack", "prod-us"];
+  const upArgs = ["up", "--yes", "--target", rotate, "--replace", rotate, "--stack", "prod-us"];
+
+  test("the first call previews the replacement and answers waiting, with no update", async () => {
+    const l = ledger();
+    const pulumi = runner(() => doc(replaceSteps(rotate)));
+    const first = await gatedStackAction({ by: "alice", rules: { mode: "ledger" }, gated: l.api, env: {}, run: pulumi.run, dir: stackDir(), stack: "prod-us", engine: "pulumi", urn: rotate, name: "rotate" });
+    expect(first.status).toBe("waiting");
+    expect(first.digest).toMatch(/^sha256:/);
+    expect(pulumi.calls).toEqual([previewArgs]);
+    expect(pulumi.calls.some((c) => c[0] === "up")).toBe(false);
+    expect(first.request).toMatchObject({
+      kind: "stack-action",
+      subject: "action:prod-us:rotate",
+      fields: { stack: "prod-us", urn: rotate, engine: "pulumi", name: "rotate", preview: expect.stringMatching(/sha256:/) },
+    });
+    expect(l.spent.size).toBe(0);
+  });
+
+  test("a preview that replaces a second resource is refused action-scope, naming it, and asks for nothing", async () => {
+    const l = ledger();
+    const pulumi = runner(() => doc([...replaceSteps(rotate), ...replaceSteps(bucket)]));
+    const call = gatedStackAction({ by: "alice", rules: { mode: "ledger" }, gated: l.api, env: {}, run: pulumi.run, dir: stackDir(), stack: "prod-us", engine: "pulumi", urn: rotate });
+    await expect(call).rejects.toThrow(PulumiStackActionRefused);
+    await expect(call).rejects.toMatchObject({ code: "action-scope", urns: [bucket] });
+    await expect(call).rejects.toThrow(new RegExp(`^action-scope: .*${bucket.replace(/[$.]/g, "\\$&")}`));
+    expect(l.pending).toEqual([]);
+    expect(pulumi.calls.every((c) => c[0] === "preview")).toBe(true);
+  });
+
+  test("a preview that does not replace the URN, or updates it in place, is refused action-scope", () => {
+    expect(stackActionScope(rotate, JSON.parse(doc([])))).toEqual({ others: [], problem: `the preview does not replace ${rotate}` });
+    expect(stackActionScope(rotate, JSON.parse(doc([{ op: "update", urn: rotate }])))).toMatchObject({ problem: `the preview shows update of ${rotate}, not its replacement` });
+    expect(stackActionScope(rotate, JSON.parse(doc(replaceSteps(rotate))))).toEqual({ others: [] });
+  });
+
+  test("a URN of another type is refused action-type before any engine call", async () => {
+    const l = ledger();
+    const pulumi = runner(() => doc([]));
+    const common = { by: "alice", rules: { mode: "ledger" as const }, gated: l.api, env: {}, run: pulumi.run, dir: stackDir(), stack: "prod-us", engine: "pulumi" as const };
+    await expect(gatedStackAction({ ...common, urn: bucket })).rejects.toMatchObject({ code: "action-type" });
+    await expect(gatedStackAction({ ...common, urn: bucket })).rejects.toThrow(/aws:s3\/bucket:Bucket/);
+    await expect(gatedStackAction({ ...common, urn: "rotate" })).rejects.toMatchObject({ code: "action-urn" });
+    await expect(gatedStackAction({ ...common, urn: "urn:pulumi:dev::shop::command:local:Command::rotate" })).rejects.toMatchObject({ code: "action-urn" });
+    expect(pulumi.calls).toEqual([]);
+    expect(l.pending).toEqual([]);
+  });
+
+  test("after a second identity approves, the update runs once, applied and finished are written, and a repeat is spent", async () => {
+    const l = ledger();
+    const pulumi = runner((args) => (args[0] === "up" ? "Updating (prod-us)\n    ++ command:local:Command rotate created replacement\nResources: 1 replaced" : doc(replaceSteps(rotate))));
+    const opts = { by: "alice", rules: { mode: "ledger" as const }, gated: l.api, env: {}, run: pulumi.run, dir: stackDir(), stack: "prod-us", engine: "pulumi" as const, urn: rotate, name: "rotate" };
+    const first = await gatedStackAction(opts);
+    l.approve(first.digest, "alice");
+    expect((await gatedStackAction(opts)).status).toBe("refused");
+    expect(pulumi.calls.filter((c) => c[0] === "up")).toEqual([]);
+
+    l.approve(first.digest, "bob");
+    const done = await gatedStackAction(opts);
+    expect(done.status).toBe("done");
+    expect(done.digest).toBe(first.digest);
+    if (done.status !== "done") throw new Error("not done");
+    expect(done.result).toMatchObject({ urn: rotate, engine: "pulumi", exit: 0, tail: expect.stringContaining("1 replaced") });
+    expect(pulumi.calls.filter((c) => c[0] === "up")).toEqual([upArgs]);
+    expect(l.spent.has(first.digest)).toBe(true);
+    expect(l.finished).toEqual([{ digest: first.digest, result: "applied", detail: expect.objectContaining({ result: "ok", exit: 0, urn: rotate }) }]);
+
+    const again = await gatedStackAction(opts);
+    expect(again.status).toBe("spent");
+    expect(again.digest).toBe(first.digest);
+    expect(pulumi.calls.filter((c) => c[0] === "up")).toHaveLength(1);
+    // Asked anew, the same action is a new request that waits for its own approval.
+    const anew = await gatedStackAction({ ...opts, anew: true, now: "2000-01-01T00:00:00.000Z" });
+    expect(anew.status).toBe("waiting");
+    expect(pulumi.calls.filter((c) => c[0] === "up")).toHaveLength(1);
+  });
+
+  test("a failed update finishes failed with the exit code and the output's tail", async () => {
+    const l = ledger();
+    const pulumi = runner((args) => (args[0] === "up" ? Object.assign(new Error("exit 255"), { code: 255, stdout: "error: rotate.sh exited 3" }) : doc(replaceSteps(rotate))));
+    const opts = { by: "alice", rules: { mode: "ledger" as const }, gated: l.api, env: {}, run: pulumi.run, dir: stackDir(), stack: "prod-us", engine: "pulumi" as const, urn: rotate };
+    l.approve((await gatedStackAction(opts)).digest, "bob");
+    const failed = await gatedStackAction(opts);
+    expect(failed.status).toBe("failed");
+    expect(l.finished[0]).toMatchObject({ result: "failed", detail: { result: "failed", exit: 255, tail: "error: rotate.sh exited 3", urn: rotate } });
+  });
+
+  test("a stack on plunge previews and updates under plunge", async () => {
+    const l = ledger();
+    const plunge = runner((args) => (args[0] === "up" ? "done" : doc(replaceSteps(rotate))));
+    const opts = { by: "alice", rules: { mode: "ledger" as const }, gated: l.api, env: {}, plunge: plunge.run, dir: stackDir(), stack: "prod-us", engine: "plunge" as const, urn: rotate };
+    const first = await gatedStackAction(opts);
+    expect(first.request.fields.engine).toBe("plunge");
+    l.approve(first.digest, "bob");
+    expect((await gatedStackAction(opts)).status).toBe("done");
+    expect(plunge.calls).toEqual([previewArgs, previewArgs, upArgs]);
+  });
+});

package/src/stack-ops.ts

@@ -16,6 +16,7 @@
  * | export | `stack-export` | `<stack>` | `stack`, `engine`, `deliver: requester` |
  * | cancel | `stack-cancel` | `<stack>` | `stack`, `lockId` |
  * | move | `stack-move` | `move:<source>:<dest>` | `source`, `dest`, `engine`, `urns` (sorted, comma-joined) |
+ * | action | `stack-action` | `action:<stack>:<name>` (the URN without a name) | `stack`, `urn`, `engine`, `preview` (the preview's digest), `name` when given |
  *
  * The first call records the pending fact and answers `waiting` with the
  * `chant approve` command. A later call with the same request reuses the
@@ -47,6 +48,19 @@
  *   again afterwards; a change left on either finishes the request `failed`
  *   with the changes named.
  *
+ * - action (#4654): a day-2 action is a `command:` resource
+ *   (`command:local:Command`, `command:remote:Command`) whose replacement is
+ *   the operation. Its type is checked before anything runs (`action-type`).
+ *   Each call previews `preview --json --target <urn> --replace <urn>`, and
+ *   refuses (`action-scope`) unless the preview changes that URN alone, by
+ *   a replacement. The request binds the preview's digest, so a preview
+ *   that moved after the approval asks again. Once approved, `up --yes
+ *   --target <urn> --replace <urn> --stack <s>` under the stack's engine,
+ *   and the finished line keeps chant's `applied | failed` with
+ *   `detail.result` `ok` or `failed`, the exit code and the output's last
+ *   lines. A request that applied answers `spent` to the same call, unless
+ *   the caller asks `anew`.
+ *
  * The writes go through `runGatedPulumi` and `runGatedPlunge`
  * (`./run.ts`), whose fixed forms are the whole of what may run.
  */
@@ -63,15 +77,17 @@ import type {
   GatedRequestRules,
   RequestGateResult,
 } from "@intentius/chant/lifecycle/gated-request";
-import { pulumiNodeKey } from "@intentius/chant/pulumi-urn";
+import { parsePulumiUrn, pulumiNodeKey } from "@intentius/chant/pulumi-urn";
 import { pulumiStackBackend } from "./adopt";
-import { pulumiExportResources } from "./change-set";
+import { pulumiExportResources, pulumiPreviewDigest, pulumiSteps, PULUMI_UNCHANGED_OPS } from "./change-set";
 import { pulumiMemberEngine, type PulumiMemberEngine } from "./member-engine";
 import {
   defaultPlungeRunner,
   defaultPulumiRunner,
   plungeMoveArgs,
   previewPulumiMemberRead,
+  pulumiActionPreviewArgs,
+  pulumiActionUpArgs,
   pulumiCancelArgs,
   pulumiRunFailure,
   pulumiStateMoveArgs,
@@ -86,7 +102,7 @@ import { isObject } from "./values";
 /** The op the requests are recorded under, unless the caller names its own. */
 export const PULUMI_STACK_OPS_OP = "pulumi-stack-ops";
 
-export type PulumiStackOpKind = "stack-export" | "stack-cancel" | "stack-move";
+export type PulumiStackOpKind = "stack-export" | "stack-cancel" | "stack-move" | "stack-action";
 
 /** chant's gated-request API (#4551), injectable for tests. */
 export interface GatedRequestApi {
@@ -152,12 +168,14 @@ async function askThenAct<T>(
   description: string,
   act: () => Promise<{ result: T; detail: Record<string, string | number | boolean>; failed?: string }>,
   precheck?: () => Promise<void>,
+  options: { reuseApplied?: boolean } = {},
 ): Promise<PulumiStackOpOutcome<T>> {
   const api = await gatedApi(common.gated);
   const op = common.op ?? PULUMI_STACK_OPS_OP;
   const cwd = common.ledgerCwd ?? process.cwd();
+  // With reuseApplied (#4654), a request with these fields that applied already is asked again as itself, so it answers `spent`.
   const standing = (await api.readGatedRequests(op, { cwd }).catch(() => []))
-    .filter((r) => !r.applied && r.request.kind === kind && r.request.subject === subject && r.request.by === common.by && sameFields(r.request.fields, fields))
+    .filter((r) => (options.reuseApplied || !r.applied) && r.request.kind === kind && r.request.subject === subject && r.request.by === common.by && sameFields(r.request.fields, fields))
     .at(-1);
   const request: GatedRequest = { kind, subject, by: common.by, at: standing?.request.at ?? common.now ?? new Date().toISOString(), fields };
   const asked: RequestGateResult = await api.requestGate({
@@ -550,3 +568,170 @@ export async function gatedStackMove(opts: PulumiStackMoveOptions): Promise<Pulu
     },
   );
 }
+
+// ── action ───────────────────────────────────────────────────────────────
+
+/** Why a stack action was refused before anything was asked (#4654). */
+export type PulumiStackActionRefusal = "action-urn" | "action-type" | "action-scope";
+
+/** A stack action refused before its request: `code` says why, `urns` names what the preview changed besides the action, for `action-scope`. */
+export class PulumiStackActionRefused extends Error {
+  readonly code: PulumiStackActionRefusal;
+  readonly urns: string[];
+  constructor(code: PulumiStackActionRefusal, message: string, urns: string[] = []) {
+    super(`${code}: ${message}`);
+    this.name = "PulumiStackActionRefused";
+    this.code = code;
+    this.urns = urns;
+  }
+}
+
+/** The resource types an action may name: the command provider's (`command:local:Command`, `command:remote:Command`). */
+export const PULUMI_ACTION_TYPE_PREFIX = "command:";
+
+/** An action's name as a caller's config gives it, for the request's subject. */
+const ACTION_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/;
+
+/** The subject an action's request is asked and approved under: `action:<stack>:<name>`, or the URN in place of a name. */
+export const stackActionSubject = (stack: string, nameOrUrn: string): string => `action:${stack}:${nameOrUrn}`;
+
+export interface PulumiStackActionOptions extends PulumiStackOpCommon {
+  /** The stack's directory, where `Pulumi.yaml` is. */
+  dir: string;
+  cwd?: string;
+  /** The stack, as `--stack` takes it. */
+  stack: string;
+  engine?: PulumiMemberEngine;
+  /** The `command:` resource whose replacement is the action. */
+  urn: string;
+  /** The action's name in the caller's config, which the subject carries in place of the URN. */
+  name?: string;
+  /** Ask anew even when the same request applied already. Absent, such a call answers `spent`, so a retried job never runs the action twice. */
+  anew?: boolean;
+}
+
+export interface PulumiStackActionResult {
+  urn: string;
+  engine: PulumiMemberEngine;
+  /** The preview's digest the request bound. */
+  preview: string;
+  /** The update's exit code: 0, since a failed update ends `failed`. */
+  exit: number;
+  /** The update's last lines of output. */
+  tail: string;
+}
+
+/** The last `n` lines of `text`, trimmed. */
+const lastLines = (text: string | undefined, n: number): string =>
+  (text ?? "").trim().split("\n").slice(-n).join("\n");
+
+/**
+ * Check an action's URN before anything runs: a Pulumi URN on `stack` whose
+ * type is a command provider's. Throws {@link PulumiStackActionRefused}.
+ */
+export function checkStackActionUrn(stack: string, urn: string): void {
+  const parsed = parsePulumiUrn(urn);
+  if (!parsed) throw new PulumiStackActionRefused("action-urn", `${JSON.stringify(urn)} is not a resource URN (urn:pulumi:<stack>::<project>::<type>::<name>)`);
+  const stackName = stack.split("/").at(-1);
+  if (parsed.stack !== stackName) throw new PulumiStackActionRefused("action-urn", `${urn} names stack ${parsed.stack}, and the action runs on ${stack}`);
+  if (!parsed.type.startsWith(PULUMI_ACTION_TYPE_PREFIX)) {
+    throw new PulumiStackActionRefused(
+      "action-type",
+      `${urn} is a ${parsed.type}, and an action is a command resource (command:local:Command or command:remote:Command), whose replacement runs it; replacing any other resource is an update`,
+    );
+  }
+}
+
+/**
+ * What a preview changes besides the action's replacement (#4654): each URN
+ * with a changing step other than `urn`, and `urn` itself when it changes
+ * other than by replacement or is not replaced at all. Empty when the
+ * preview replaces `urn` and nothing else.
+ */
+export function stackActionScope(urn: string, preview: unknown): { others: string[]; problem?: string } {
+  const steps = pulumiSteps(preview) ?? [];
+  const others = new Set<string>();
+  let replaced = false;
+  let problem: string | undefined;
+  for (const s of steps) {
+    const op = s.op ?? "";
+    if (PULUMI_UNCHANGED_OPS.has(op)) continue;
+    if (s.urn !== urn) {
+      others.add(s.urn!);
+      continue;
+    }
+    if (op === "replace" || op === "create-replacement" || op === "delete-replaced") replaced = true;
+    else problem = `the preview shows ${op} of ${urn}, not its replacement`;
+  }
+  if (!problem && !replaced) problem = `the preview does not replace ${urn}`;
+  return { others: [...others].sort(), ...(problem ? { problem } : {}) };
+}
+
+/**
+ * A day-2 action on a stack (#4654): the replacement of one `command:`
+ * resource, previewed, asked for under a gated request, and run once a
+ * second identity approves. Refused before anything runs for a URN that is
+ * not a command resource's (`action-type`), and before anything is asked for
+ * a preview that changes more than that replacement (`action-scope`).
+ */
+export async function gatedStackAction(opts: PulumiStackActionOptions): Promise<PulumiStackOpOutcome<PulumiStackActionResult>> {
+  checkStackActionUrn(opts.stack, opts.urn);
+  if (opts.name !== undefined && !ACTION_NAME.test(opts.name)) throw new Error(`an action's name is letters, digits, "_", "." and "-", not ${JSON.stringify(opts.name)}`);
+  const env = opts.env ?? process.env;
+  const dir = stackDirOf(opts.dir, opts.cwd);
+  const engine = engineOf(dir, opts.engine, env);
+  const target = { stack: opts.stack, urn: opts.urn };
+
+  const previewArgs = pulumiActionPreviewArgs(target);
+  let stdout: string;
+  try {
+    ({ stdout } = engine === "plunge" ? await runAllowedPlunge(opts.plunge ?? defaultPlungeRunner, previewArgs, dir) : await runAllowedPulumi(opts.run ?? defaultPulumiRunner, previewArgs, dir));
+  } catch (err) {
+    throw new Error(`${engine} ${previewArgs.join(" ")} failed: ${why(err, engine)}`);
+  }
+  let preview: unknown;
+  try {
+    preview = JSON.parse(stdout);
+  } catch {
+    throw new Error(`${engine} ${previewArgs.join(" ")} printed no JSON`);
+  }
+  const scope = stackActionScope(opts.urn, preview);
+  if (scope.others.length > 0) {
+    throw new PulumiStackActionRefused(
+      "action-scope",
+      `the preview of ${opts.stack} replacing ${opts.urn} also changes ${scope.others.join(", ")}, and an action replaces its command resource alone; nothing was asked for`,
+      scope.others,
+    );
+  }
+  if (scope.problem) throw new PulumiStackActionRefused("action-scope", `${scope.problem}; nothing was asked for`);
+
+  const digest = pulumiPreviewDigest(preview, { changedOnly: true });
+  const subject = stackActionSubject(opts.stack, opts.name ?? opts.urn);
+  const fields: Record<string, string> = { stack: opts.stack, urn: opts.urn, engine, preview: digest, ...(opts.name ? { name: opts.name } : {}) };
+  return askThenAct(
+    opts,
+    "stack-action",
+    subject,
+    fields,
+    `action ${opts.name ?? opts.urn} on stack ${opts.stack}: replace ${opts.urn}, requested by ${opts.by}`,
+    async () => {
+      const args = pulumiActionUpArgs(target);
+      try {
+        const done = engine === "plunge" ? await runGatedPlunge(opts.plunge ?? defaultPlungeRunner, args, dir) : await runGatedPulumi(opts.run ?? defaultPulumiRunner, args, dir);
+        const tail = lastLines(done.stdout, 10);
+        return { result: { urn: opts.urn, engine, preview: digest, exit: 0, tail }, detail: { result: "ok", exit: 0, tail: tail.slice(-400), urn: opts.urn } };
+      } catch (err) {
+        const f = pulumiRunFailure(err);
+        const exit = f.exitCode ?? 1;
+        const tail = lastLines(`${f.stdout ?? ""}\n${f.stderr ?? ""}`, 10);
+        return {
+          result: { urn: opts.urn, engine, preview: digest, exit, tail },
+          detail: { result: "failed", exit, tail: tail.slice(-400), urn: opts.urn },
+          failed: `${engine} ${args.join(" ")} failed: ${why(err, engine)}`,
+        };
+      }
+    },
+    undefined,
+    { reuseApplied: !opts.anew },
+  );
+}