@intentius/chant-lexicon-pulumi 0.124.58 → 0.124.60

package/dist/change-set.d.ts

@@ -68,7 +68,11 @@
  * each step's op, URN, provider, id, inputs before and after, `diffReasons`,
  * `replaceReasons` and `detailedDiff`, sorted by URN and op. It leaves out
  * `config`, `duration`, `diagnostics` and `changeSummary`, and the states'
- * outputs, which at preview are the last deployment's or unknown. For a
+ * outputs, which at preview are the last deployment's or unknown. It also
+ * leaves out what the engine makes up while planning a create or a
+ * replacement (plywood#56): an autoname such as `events-3f45941` is drawn
+ * again by every preview, so it reads as {@link PULUMI_GENERATED}. See
+ * {@link pulumiPlannedInputs}. Unknowns already print as one fixed string. For a
  * member on the resource lock grain the `pulumi-up` capability passes
  * `changedOnly` (#4541, ruling B), which leaves `same` and `read` steps out.
  *
@@ -140,14 +144,44 @@ export interface PulumiPreviewDigestOptions {
      */
     changedOnly?: boolean;
 }
+/** What stands in a digest for an input the engine made up while planning (plywood#56). */
+export declare const PULUMI_GENERATED = "<generated at plan time>";
+/**
+ * The inputs a step would write, with the values the engine made up while
+ * planning replaced by {@link PULUMI_GENERATED} (plywood#56). Two previews of
+ * one create draw different autonames (`events-3f45941`, then
+ * `events-9c01d2e`), and a digest over them could never match a later plan of
+ * the same change.
+ *
+ * Only a create or a replacement draws a name: an update's inputs keep the one
+ * the resource was created with, and that stays in `before` and `after`. A
+ * value counts as generated when the engine lists its key in `__defaults`
+ * (the inputs the provider filled in, not the program) and it reads as an
+ * autoname of this resource: its logical name, or the start of it when the
+ * provider shortened it, then a dash and seven hex characters. An engine that
+ * prints no `__defaults` is held to the exact logical name. Every other input
+ * stays in, the defaults that are plain values included, so a changed input
+ * still changes the digest. `before` is the recorded state and is never masked.
+ */
+export declare function pulumiPlannedInputs(step: PulumiStep): Json | null;
 /**
  * The member's plan digest: `computePlanDigest("pulumi-preview", …)` over
  * what each step proposes, sorted by URN and op, so two renderings of one
- * preview agree. See the module comment for what it leaves out. With
- * `changedOnly`, `same` and `read` steps are left out too, under the label
- * `pulumi-preview-changed`, so the two digests never collide.
+ * preview agree. See the module comment for what it leaves out, and
+ * {@link pulumiPlannedInputs} for the values the engine made up that it leaves
+ * out of a create. With `changedOnly`, `same` and `read` steps are left out
+ * too, under the label `pulumi-preview-changed`, so the two digests never
+ * collide.
  */
 export declare function pulumiPreviewDigest(preview: unknown, opts?: PulumiPreviewDigestOptions): string;
+/**
+ * The digest of each resource the preview changes, by URN (plywood#55): the
+ * steps of that URN (a replace is several), as {@link pulumiPreviewDigest}
+ * reads them, with the values the engine made up left out. A `same` or `read` step is not in it whatever the lock grain,
+ * so what a pull request left alone never makes its plan differ from a plan
+ * made after another change landed on it.
+ */
+export declare function pulumiResourceDigests(preview: unknown): Record<string, string>;
 /** The action and disruption one URN's steps mean, or undefined for an op the change set has no action for. */
 export declare function pulumiStepsAction(steps: PulumiStep[]): {
     action: ChangeSetAction;

package/dist/change-set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../src/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH,OAAO,KAAK,EACV,eAAe,EAEf,mBAAmB,EAGnB,aAAa,EACd,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAA6E,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhH,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CAC9E;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,EAAE,GAAG,SAAS,CAGlE;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,EAAE,CAI5E;AAID,kHAAkH;AAClH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAA6B,CAAC;AAEnF,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,0BAA+B,GAAG,MAAM,CAgBnG;AAID,+GAA+G;AAC/G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAElJ;AAsFD,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qGAAqG;IACrG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAyH9E"}
+{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../src/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAEH,OAAO,KAAK,EACV,eAAe,EAEf,mBAAmB,EAGnB,aAAa,EACd,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EAA6E,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhH,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,OAAO,CAAC,EAAE,IAAI,CAAC;CAChB;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CAC9E;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,EAAE,GAAG,SAAS,CAGlE;AAED,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,0GAA0G;AAC1G,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,EAAE,CAI5E;AAID,kHAAkH;AAClH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAA6B,CAAC;AAEnF,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAW3D;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAcjE;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,0BAA+B,GAAG,MAAM,CAMnG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAID,+GAA+G;AAC/G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG,SAAS,CAElJ;AAsFD,MAAM,WAAW,sBAAsB;IACrC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qGAAqG;IACrG,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,MAAM,CAAC,EAAE,0BAA0B,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAyH9E"}

package/dist/change-set.js

@@ -68,7 +68,11 @@
  * each step's op, URN, provider, id, inputs before and after, `diffReasons`,
  * `replaceReasons` and `detailedDiff`, sorted by URN and op. It leaves out
  * `config`, `duration`, `diagnostics` and `changeSummary`, and the states'
- * outputs, which at preview are the last deployment's or unknown. For a
+ * outputs, which at preview are the last deployment's or unknown. It also
+ * leaves out what the engine makes up while planning a create or a
+ * replacement (plywood#56): an autoname such as `events-3f45941` is drawn
+ * again by every preview, so it reads as {@link PULUMI_GENERATED}. See
+ * {@link pulumiPlannedInputs}. Unknowns already print as one fixed string. For a
  * member on the resource lock grain the `pulumi-up` capability passes
  * `changedOnly` (#4541, ruling B), which leaves `same` and `read` steps out.
  *
@@ -108,30 +112,98 @@ export function pulumiExportResources(doc) {
 const byString = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
 /** Step ops that change nothing: what {@link PulumiPreviewDigestOptions.changedOnly} leaves out of the digest. */
 export const PULUMI_UNCHANGED_OPS = new Set(["same", "read"]);
+/** What stands in a digest for an input the engine made up while planning (plywood#56). */
+export const PULUMI_GENERATED = "<generated at plan time>";
+/** Pulumi's autonaming: the logical name, a dash and seven random hex characters. */
+const AUTONAME = /^(.+)-[0-9a-f]{7}$/;
+/** The step's resource name: the last part of its URN. */
+function logicalName(urn) {
+    const at = urn?.lastIndexOf("::") ?? -1;
+    return urn && at >= 0 ? urn.slice(at + 2) : (urn ?? "");
+}
 /**
- * The member's plan digest: `computePlanDigest("pulumi-preview", …)` over
- * what each step proposes, sorted by URN and op, so two renderings of one
- * preview agree. See the module comment for what it leaves out. With
- * `changedOnly`, `same` and `read` steps are left out too, under the label
- * `pulumi-preview-changed`, so the two digests never collide.
+ * The inputs a step would write, with the values the engine made up while
+ * planning replaced by {@link PULUMI_GENERATED} (plywood#56). Two previews of
+ * one create draw different autonames (`events-3f45941`, then
+ * `events-9c01d2e`), and a digest over them could never match a later plan of
+ * the same change.
+ *
+ * Only a create or a replacement draws a name: an update's inputs keep the one
+ * the resource was created with, and that stays in `before` and `after`. A
+ * value counts as generated when the engine lists its key in `__defaults`
+ * (the inputs the provider filled in, not the program) and it reads as an
+ * autoname of this resource: its logical name, or the start of it when the
+ * provider shortened it, then a dash and seven hex characters. An engine that
+ * prints no `__defaults` is held to the exact logical name. Every other input
+ * stays in, the defaults that are plain values included, so a changed input
+ * still changes the digest. `before` is the recorded state and is never masked.
  */
-export function pulumiPreviewDigest(preview, opts = {}) {
-    const steps = (pulumiSteps(preview) ?? [])
-        .filter((s) => !opts.changedOnly || !PULUMI_UNCHANGED_OPS.has(s.op ?? ""))
-        .map((s) => ({
+export function pulumiPlannedInputs(step) {
+    const inputs = step.newState?.inputs;
+    if (!isObject(inputs))
+        return inputs ?? null;
+    const draws = step.oldState === undefined || step.op === "create" || step.op === "create-replacement" || step.op === "replace";
+    if (!draws)
+        return inputs;
+    const name = logicalName(step.urn).toLowerCase();
+    const filled = Array.isArray(inputs.__defaults) ? new Set(inputs.__defaults.filter((k) => typeof k === "string")) : undefined;
+    const out = {};
+    for (const [key, value] of Object.entries(inputs)) {
+        const stem = typeof value === "string" ? AUTONAME.exec(value)?.[1]?.toLowerCase() : undefined;
+        const generated = stem !== undefined && name !== "" && (filled ? filled.has(key) && (name.startsWith(stem) || stem.startsWith(name)) : stem === name);
+        out[key] = generated ? PULUMI_GENERATED : value;
+    }
+    return out;
+}
+/** One step as a digest sees it: what it proposes, without the values the engine made up. */
+function digestStep(s) {
+    return {
         op: s.op ?? null,
         urn: s.urn ?? null,
         provider: s.provider ?? null,
         id: s.newState?.id ?? s.oldState?.id ?? null,
         before: s.oldState?.inputs ?? null,
-        after: s.newState?.inputs ?? null,
+        after: pulumiPlannedInputs(s),
         diffReasons: [...(s.diffReasons ?? [])].sort(),
         replaceReasons: [...(s.replaceReasons ?? [])].sort(),
         detailedDiff: s.detailedDiff ?? null,
-    }))
-        .sort((a, b) => byString(`${a.urn}\u0000${a.op}`, `${b.urn}\u0000${b.op}`));
+    };
+}
+const byStep = (a, b) => byString(`${a.urn}\u0000${a.op}`, `${b.urn}\u0000${b.op}`);
+/**
+ * The member's plan digest: `computePlanDigest("pulumi-preview", …)` over
+ * what each step proposes, sorted by URN and op, so two renderings of one
+ * preview agree. See the module comment for what it leaves out, and
+ * {@link pulumiPlannedInputs} for the values the engine made up that it leaves
+ * out of a create. With `changedOnly`, `same` and `read` steps are left out
+ * too, under the label `pulumi-preview-changed`, so the two digests never
+ * collide.
+ */
+export function pulumiPreviewDigest(preview, opts = {}) {
+    const steps = (pulumiSteps(preview) ?? [])
+        .filter((s) => !opts.changedOnly || !PULUMI_UNCHANGED_OPS.has(s.op ?? ""))
+        .map(digestStep)
+        .sort(byStep);
     return computePlanDigest(opts.changedOnly ? "pulumi-preview-changed" : "pulumi-preview", steps);
 }
+/**
+ * The digest of each resource the preview changes, by URN (plywood#55): the
+ * steps of that URN (a replace is several), as {@link pulumiPreviewDigest}
+ * reads them, with the values the engine made up left out. A `same` or `read` step is not in it whatever the lock grain,
+ * so what a pull request left alone never makes its plan differ from a plan
+ * made after another change landed on it.
+ */
+export function pulumiResourceDigests(preview) {
+    const byUrn = new Map();
+    for (const s of pulumiSteps(preview) ?? []) {
+        if (PULUMI_UNCHANGED_OPS.has(s.op ?? ""))
+            continue;
+        const list = byUrn.get(s.urn) ?? [];
+        list.push(digestStep(s));
+        byUrn.set(s.urn, list);
+    }
+    return Object.fromEntries([...byUrn].sort(([a], [b]) => byString(a, b)).map(([urn, steps]) => [urn, computePlanDigest("pulumi-resource", steps.sort(byStep))]));
+}
 const REPLACE_OPS = new Set(["replace", "create-replacement", "delete-replaced"]);
 /** The action and disruption one URN's steps mean, or undefined for an op the change set has no action for. */
 export function pulumiStepsAction(steps) {

package/dist/drift-read.d.ts

@@ -13,8 +13,12 @@
  * | plunge | unset | `plunge drift --resource <urn> --stream`, once per resource in the export |
  * | plunge | `<urn>` | the same, for that URN alone |
  *
- * Each read passes `--stack` (#4496): the member's declared
- * `pulumi.member.stack`, else the stack the export's URNs name.
+ * Each read passes `--stack` (#4496): the stack asked for (`chant workspace
+ * drift --stack`), else the member's declared `pulumi.member.stack`, else the
+ * stack the export's URNs name. A stack asked for is read from that stack's
+ * export in the index store alone; with none there the read is refused
+ * (`no-drift-read`), where without `--stack` the member reads the store's
+ * export, then the checked-in file.
  *
  * The one read is `refresh`. The member's engine is `pulumiMemberEngine`'s:
  * the member config's `engine`, then a plunge backend URL in `Pulumi.yaml`.
@@ -25,10 +29,13 @@
  */
 import type { ReadDriftOptions, ReadDriftResult } from "@intentius/chant/drift-record";
 import { type PulumiRunner } from "./run.js";
+import type { SnapshotStore } from "@intentius/chant/lifecycle/snapshot-store";
 /** The runners, injectable so the tests run no binary. */
 export interface PulumiDriftRunners {
     run?: PulumiRunner;
     plunge?: PulumiRunner;
+    /** The index store the exports are read from. Default: the project's. */
+    exportStore?: SnapshotStore | null;
 }
 /** `LexiconPlugin.readDrift` for the pulumi lexicon. */
 export declare function readPulumiDrift(options: ReadDriftOptions, runners?: PulumiDriftRunners): Promise<ReadDriftResult>;

package/dist/drift-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drift-read.d.ts","sourceRoot":"","sources":["../src/drift-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAA0B,gBAAgB,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAG/G,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAEnF,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAmC3H"}
+{"version":3,"file":"drift-read.d.ts","sourceRoot":"","sources":["../src/drift-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAA0B,gBAAgB,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAG/G,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAEnF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE/E,0DAA0D;AAC1D,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,yEAAyE;IACzE,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CACpC;AAED,wDAAwD;AACxD,wBAAsB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgD3H"}

package/dist/drift-read.js

@@ -1,5 +1,6 @@
 import { driftRecordLine, driftSettle, driftStart } from "@intentius/chant/drift-record";
 import { pulumiMemberEngine, refreshPulumiMember } from "./run.js";
+import { readStoredPulumiExport } from "./stack-export-snapshot.js";
 /** `LexiconPlugin.readDrift` for the pulumi lexicon. */
 export async function readPulumiDrift(options, runners = {}) {
     const member = options.config.pulumi?.member;
@@ -9,6 +10,18 @@ export async function readPulumiDrift(options, runners = {}) {
         return { refused: { code: "read-unsupported", message: `a Pulumi member answers refresh, not ${options.read}` } };
     }
     const { engine } = pulumiMemberEngine(member.dir, member.engine);
+    const stack = options.stack ?? member.stack;
+    if (options.stack !== undefined) {
+        const stored = await readStoredPulumiExport({ dir: member.dir, stack: options.stack, ...(runners.exportStore !== undefined ? { store: runners.exportStore } : {}) });
+        if (!stored) {
+            return {
+                refused: {
+                    code: "no-drift-read",
+                    message: `the index store holds no export for stack ${options.stack} of ${options.member}; the pulumi-up capability writes one after each apply through chant, so apply that stack once, or read without --stack`,
+                },
+            };
+        }
+    }
     let records;
     try {
         records = await refreshPulumiMember({
@@ -16,7 +29,8 @@ export async function readPulumiDrift(options, runners = {}) {
             dir: member.dir,
             observedAt: options.observedAt,
             ...(member.engine ? { engine: member.engine } : {}),
-            ...(member.stack ? { stack: member.stack } : {}),
+            ...(stack ? { stack } : {}),
+            ...(runners.exportStore !== undefined ? { exportStore: runners.exportStore } : {}),
             ...(options.resource !== undefined ? { urns: [options.resource] } : {}),
             ...(runners.run ? { run: runners.run } : {}),
             ...(runners.plunge ? { plunge: runners.plunge } : {}),

package/dist/index.d.ts

@@ -2,7 +2,7 @@ export { pulumiPlugin } from "./plugin.js";
 export { pulumiSerializer } from "./serializer.js";
 export { pulumiConfigSchema, pulumiMemberConfigSchema, type PulumiConfig } from "./config.js";
 export { readPulumiMember, PULUMI_EXPORT_FILE, type PulumiMemberConfig, type PulumiMemberReport } from "./workspace-member.js";
-export { pulumiPreviewPart, pulumiPreviewDigest, pulumiSteps, pulumiExportResources, type PulumiPreviewPartInput, type PulumiStep, type PulumiStepState, type PulumiExportedResource, } from "./change-set.js";
+export { pulumiPreviewPart, pulumiPreviewDigest, pulumiResourceDigests, pulumiPlannedInputs, PULUMI_GENERATED, pulumiSteps, pulumiExportResources, type PulumiPreviewPartInput, type PulumiStep, type PulumiStepState, type PulumiExportedResource, } from "./change-set.js";
 export { pulumiRefreshArgs, pulumiRefreshDriftRecords, pulumiRefreshDocumentRecords, type PulumiRefreshRead, type PulumiRefreshDriftInput, type PulumiRefreshDocumentInput, } from "./drift-record.js";
 export { previewPulumiMember, previewPulumiMemberRead, refreshPulumiMember, pulumiMemberEngine, pulumiMemberStackOutputs, pulumiPreviewArgs, pulumiStackOutputArgs, runAllowedPlunge, runAllowedPulumi, readMemberExport, defaultPulumiRunner, PULUMI_ALLOWED_COMMANDS, PULUMI_APPLY_COMMANDS, runApplyPulumi, runApplyPlunge, pulumiUpArgs, plungeUpArgs, pulumiUpPreviewArgs, PULUMI_REVIEW_STACK_COMMANDS, REVIEW_STACK_NAME, isReviewStackName, reviewStackInitArgs, reviewStackDestroyArgs, reviewStackRmArgs, runReviewStackPulumi, runReviewStackPlunge, type PulumiPolicyPack, type PulumiApplyTail, type PulumiRunner, type PreviewPulumiMemberOptions, type PulumiMemberPreview, type PulumiMemberEngine, type PulumiMemberStackOutputsOptions, type RefreshPulumiMemberOptions, } from "./run.js";
 export { pulumiExportedStackOutputs, pulumiPlannedStackOutputs, type PulumiStackOutput } from "./stack-outputs.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE5d,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAElG,OAAO,EAAE,0BAA0B,EAAE,KAAK,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5H,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,GAChC,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAChH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,+BAA+B,EAC/B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,4BAA4B,EAC5B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,KAAK,uBAAuB,EAAE,KAAK,wBAAwB,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,mBAAmB,EAAE,KAAK,oBAAoB,EAAE,KAAK,mBAAmB,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAE5d,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,UAAU,EACV,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9J,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC3I,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACnI,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,WAAW,IAAI,eAAe,EAAE,MAAM,eAAe,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAElG,OAAO,EAAE,0BAA0B,EAAE,KAAK,kBAAkB,EAAE,KAAK,0BAA0B,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -2,7 +2,7 @@ export { pulumiPlugin } from "./plugin.js";
 export { pulumiSerializer } from "./serializer.js";
 export { pulumiConfigSchema, pulumiMemberConfigSchema } from "./config.js";
 export { readPulumiMember, PULUMI_EXPORT_FILE } from "./workspace-member.js";
-export { pulumiPreviewPart, pulumiPreviewDigest, pulumiSteps, pulumiExportResources, } from "./change-set.js";
+export { pulumiPreviewPart, pulumiPreviewDigest, pulumiResourceDigests, pulumiPlannedInputs, PULUMI_GENERATED, pulumiSteps, pulumiExportResources, } from "./change-set.js";
 export { pulumiRefreshArgs, pulumiRefreshDriftRecords, pulumiRefreshDocumentRecords, } from "./drift-record.js";
 export { previewPulumiMember, previewPulumiMemberRead, refreshPulumiMember, pulumiMemberEngine, pulumiMemberStackOutputs, pulumiPreviewArgs, pulumiStackOutputArgs, runAllowedPlunge, runAllowedPulumi, readMemberExport, defaultPulumiRunner, PULUMI_ALLOWED_COMMANDS, PULUMI_APPLY_COMMANDS, runApplyPulumi, runApplyPlunge, pulumiUpArgs, plungeUpArgs, pulumiUpPreviewArgs, PULUMI_REVIEW_STACK_COMMANDS, REVIEW_STACK_NAME, isReviewStackName, reviewStackInitArgs, reviewStackDestroyArgs, reviewStackRmArgs, runReviewStackPulumi, runReviewStackPlunge, } from "./run.js";
 export { pulumiExportedStackOutputs, pulumiPlannedStackOutputs } from "./stack-outputs.js";

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d9975374a07d5764ef1b0b209c48fc2ec1b4ec4669808c6d6b1b6429d23a97d6",
+    "manifest.json": "6066d06e053b59c3170661488757ef2e85187346d1d3e6e5e69f126a38dd4913",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "883bcdf6a960e21360e79df010ca2087719fffec60fc39541c5ecd32d661e328",
     "rules/member-dir-absolute.ts": "4805d5e247ad544f942e1b2c36fc15a5087ca0aacaf804183a269021bd60e276",
@@ -20,10 +20,10 @@
     "rules/pul012.ts": "136f9764a532f56ce72461641550c9c4cee6af06c30968d8374f1a65a1b810d4",
     "rules/pul013.ts": "a19b397fecc2bda3e5f32c8f339b0befbd8f1148b32e70a3ba4f9370ee103379",
     "rules/pul014.ts": "25dd5ca4cb7f9906c608f4b7f78559efd188215c9a9a2f9f131498a847d3259b",
-    "rules/pul015.ts": "f5eb45e941dfbe1ec53a31fd12258d7adb9877de33b5bcc566a09e3a0829d9da",
+    "rules/pul015.ts": "d6805c3b8bfacf0fc4a08fb466b066d949a8a5d164b7927cebc50111d1807ae9",
     "skills/chant-pulumi.md": "aef93407423daf6d0acc492a4d5bbf002fbae67b4f993ad36f86725686b98d61",
     "skills/chant-pulumi-stack-export.md": "aadd67f5e067de61dfda43d57492bca08bd22429e4baf314d6856a810dc0e8dc",
     "skills/chant-pulumi-plunge.md": "8a7f2f9f1124744dee9645905f141057ca01f5a88e34e1bc3858d69406d7ff3a"
   },
-  "composite": "a4603282326e0ed1abf7f6c24fd702e35975fbbc9b1cdee72341269a8f9a9ac1"
+  "composite": "d6d6dfcd5c8b2e4908518689e3727e4ca7e761bf6a407f7d6dc9bbb116ea9ac3"
 }

package/dist/lint/post-synth/pul015.d.ts

@@ -9,8 +9,9 @@
  * `plunge+file://...` or `plunge://...` runs stock `pulumi` against a
  * backend scheme only plunge opens, and every read fails.
  *
- * The other direction, `engine: "plunge"` with a stock backend, is not
- * reported: plunge is a Pulumi fork and the config may mean it.
+ * One direction only, by maintainer ruling (#4559): `engine: "plunge"` with a
+ * stock backend is not reported, because plunge opens stock backends and the
+ * config may mean it.
  */
 import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
 export declare const pul015: PostSynthCheck;

package/dist/lint/post-synth/pul015.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pul015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/pul015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAkBpB,CAAC"}
+{"version":3,"file":"pul015.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/pul015.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kCAAkC,CAAC;AAK9G,eAAO,MAAM,MAAM,EAAE,cAkBpB,CAAC"}

package/dist/lint/post-synth/pul015.js

@@ -3,7 +3,7 @@ import { lastMemberRead } from "../../workspace-member.js";
 import { finding } from "./member-read-helpers.js";
 export const pul015 = {
     id: "PUL015",
-    description: "pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend",
+    description: "pulumi.member.engine says pulumi, but the resolved engine is plunge",
     check(_ctx) {
         const read = lastMemberRead();
         if (read?.engine !== "pulumi")

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "pulumi",
-  "version": "0.124.58",
+  "version": "0.124.60",
   "chantVersion": ">=0.1.0",
   "namespace": "Pulumi"
 }

package/dist/okf/index.md

@@ -18,5 +18,5 @@ okf_version: '0.2'
 * [PUL012](/rules/PUL012.md) - The pulumi member's stack export holds resources the stack reads and does not manage (external: true)
 * [PUL013](/rules/PUL013.md) - The pulumi member's stack export has a deployment version other than 3, the one chant reads
 * [PUL014](/rules/PUL014.md) - The pulumi member's stack export reads but holds no resources besides the stack and its providers
-* [PUL015](/rules/PUL015.md) - pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend
+* [PUL015](/rules/PUL015.md) - pulumi.member.engine says pulumi, but the resolved engine is plunge
 * [PUL101](/rules/PUL101.md) - `pulumi.member.dir` is an absolute path written in source.

package/dist/okf/rules/PUL015.md

@@ -1,11 +1,11 @@
 ---
 type: post-synth-check
 title: PUL015
-description: pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend
+description: pulumi.member.engine says pulumi, but the resolved engine is plunge
 id: PUL015
 severity: error
 category: post-synth
 lexicon: pulumi
 docs: https://intentius.io/chant/lexicons/pulumi/rules/
 ---
-pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend
+pulumi.member.engine says pulumi, but the resolved engine is plunge

package/dist/pulumi-up.d.ts

@@ -26,6 +26,8 @@
  *   through `DeployContext.lockGrain`, else `resource` on plunge and
  *   `target` on stock Pulumi, #4552) the digest leaves `same` and `read`
  *   steps out (ruling B);
+ * - `resourceDigests`: one digest per resource the preview changes, by URN,
+ *   whatever the grain (plywood#55);
  * - `outputs` from the stack step's planned outputs;
  * - `shape` from `pulumiPlanShape` (`./plan-shape.ts`);
  * - `artifact`: the engine, the shape, the digest, CrossGuard's findings,

package/dist/pulumi-up.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pulumi-up.d.ts","sourceRoot":"","sources":["../src/pulumi-up.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsIG;AAMH,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EAEpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAuB,KAAK,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAChG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG/E,OAAO,EAWL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAG7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,OAAO,EAcL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,OAAO,CAAC;AAEf,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAM5F,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sDAAsD;IACtD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4HAA4H;IAC5H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0IAA0I;IAC1I,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,0BAA0B;AAC1B,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,YAAY,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,kEAAkE;IAClE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,yFAAyF;IACzF,cAAc,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,gFAAgF;IAChF,YAAY,EAAE,wBAAwB,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpG;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAgCD,yHAAyH;AACzH,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,MAAM,EAAE,MAAM;IAFhC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,qGAAqG;AACrG,qBAAa,uBAAwB,SAAQ,KAAK;aAK9B,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,kBAAkB;IAL9C,QAAQ,CAAC,YAAY,QAAQ;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,IAAqB;IACtC,YACkB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,kBAAkB,EAC5C,MAAM,CAAC,EAAE,MAAM,EAKhB;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,MAAM,EAAE,MAAM;aACd,WAAW,EAAE,MAAM,EAAE;aACrB,OAAO,CAAC,EAAE,kBAAkB;IAH9C,YACkB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,kBAAkB,YAAA,EAI7C;CACF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,MAAM,EAAE,MAAM;aAEd,OAAO,CAAC,EAAE,kBAAkB;IAH9C,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,kBAAkB,YAAA,EAI7C;CACF;AAED,oHAAoH;AACpH,qBAAa,+BAAgC,SAAQ,KAAK;aAC5B,MAAM,EAAE,MAAM;IAA1C,YAA4B,MAAM,EAAE,MAAM,EAGzC;CACF;AAED,qHAAqH;AACrH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,CAElF;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,YAAY,CAAC;IACtC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uLAAuL;IACvL,SAAS,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CAClC;AA0BD,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAI/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAkBvG;AAED,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAOvL;AA+DD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,eAAe,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAWhJ;AA4ND,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIrE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,SAAS,kBAAkB,EAAE,EACtC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;CAAO,GAChD,OAAO,CAAC,YAAY,EAAE,CAAC,CAuBzB;AAyBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAK9E;AAgHD,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,oBAAoB,GAAG,aAAa,GAAG,oBAAoB,GAAG,IAAI,CAqBpI;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,eAAoB,GAAG,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAwDtH;AAED,eAAO,MAAM,kBAAkB,mDAA6B,CAAC"}
+{"version":3,"file":"pulumi-up.d.ts","sourceRoot":"","sources":["../src/pulumi-up.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwIG;AAMH,OAAO,KAAK,EACV,UAAU,EAEV,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EAEpB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAuB,KAAK,SAAS,EAAE,MAAM,2CAA2C,CAAC;AAChG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAG/E,OAAO,EAWL,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAsB,KAAK,kBAAkB,EAAE,KAAK,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAG7G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAKnE,OAAO,EAcL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,OAAO,CAAC;AAEf,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAM5F,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7D,oCAAoC;AACpC,MAAM,WAAW,iBAAiB;IAChC,2FAA2F;IAC3F,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,sDAAsD;IACtD,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4HAA4H;IAC5H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0IAA0I;IAC1I,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,0BAA0B;AAC1B,MAAM,WAAW,kBAAkB;IACjC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,YAAY,EAAE,OAAO,CAAC;IACtB,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,kEAAkE;IAClE,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,yFAAyF;IACzF,cAAc,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,gFAAgF;IAChF,YAAY,EAAE,wBAAwB,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpG;;;;;OAKG;IACH,cAAc,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACvC;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAgCD,yHAAyH;AACzH,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,MAAM,EAAE,MAAM;IAFhC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,qGAAqG;AACrG,qBAAa,uBAAwB,SAAQ,KAAK;aAK9B,MAAM,EAAE,MAAM;aACd,QAAQ,EAAE,kBAAkB;IAL9C,QAAQ,CAAC,YAAY,QAAQ;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,IAAqB;IACtC,YACkB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,kBAAkB,EAC5C,MAAM,CAAC,EAAE,MAAM,EAKhB;CACF;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,MAAM,EAAE,MAAM;aACd,WAAW,EAAE,MAAM,EAAE;aACrB,OAAO,CAAC,EAAE,kBAAkB;IAH9C,YACkB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,kBAAkB,YAAA,EAI7C;CACF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,MAAM,EAAE,MAAM;aAEd,OAAO,CAAC,EAAE,kBAAkB;IAH9C,YACkB,MAAM,EAAE,MAAM,EAC9B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,kBAAkB,YAAA,EAI7C;CACF;AAED,oHAAoH;AACpH,qBAAa,+BAAgC,SAAQ,KAAK;aAC5B,MAAM,EAAE,MAAM;IAA1C,YAA4B,MAAM,EAAE,MAAM,EAGzC;CACF;AAED,qHAAqH;AACrH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,CAElF;AAED,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,YAAY,CAAC;IACtC,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uLAAuL;IACvL,SAAS,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CAClC;AA0BD,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAI/D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAkBvG;AAED,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAOvL;AA+DD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,eAAe,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAWhJ;AA8ND,mGAAmG;AACnG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAIrE;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,oBAAoB,EACzB,OAAO,EAAE,SAAS,kBAAkB,EAAE,EACtC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,aAAa,GAAG,IAAI,CAAA;CAAO,GAChD,OAAO,CAAC,YAAY,EAAE,CAAC,CAuBzB;AAyBD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAK9E;AAgHD,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,oBAAoB,GAAG,aAAa,GAAG,oBAAoB,GAAG,IAAI,CAqBpI;AAED,qEAAqE;AACrE,wBAAgB,wBAAwB,CAAC,IAAI,GAAE,eAAoB,GAAG,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAwDtH;AAED,eAAO,MAAM,kBAAkB,mDAA6B,CAAC"}

package/dist/pulumi-up.js

@@ -26,6 +26,8 @@
  *   through `DeployContext.lockGrain`, else `resource` on plunge and
  *   `target` on stock Pulumi, #4552) the digest leaves `same` and `read`
  *   steps out (ruling B);
+ * - `resourceDigests`: one digest per resource the preview changes, by URN,
+ *   whatever the grain (plywood#55);
  * - `outputs` from the stack step's planned outputs;
  * - `shape` from `pulumiPlanShape` (`./plan-shape.ts`);
  * - `artifact`: the engine, the shape, the digest, CrossGuard's findings,
@@ -139,7 +141,7 @@ import { basename, isAbsolute, join, relative, resolve } from "node:path";
 import { PlanShapeMovedError } from "@intentius/chant/components/covered-round";
 import { computePlanDigest } from "@intentius/chant/lifecycle/plan-digest";
 import { parseYAML } from "@intentius/chant/yaml";
-import { pulumiPreviewPart } from "./change-set.js";
+import { pulumiPreviewPart, pulumiResourceDigests } from "./change-set.js";
 import { PULUMI_STREAMING_PREVIEW_ENV, pulumiAppliedSteps, pulumiFailedUrns, pulumiLandedUrns, pulumiPolicyEvents, pulumiPolicyFindings, pulumiStreamError, pulumiStreamPreview, pulumiStreamSummary, pulumiStreamTimings, } from "./engine-events.js";
 import { CHANT_EXIT } from "@intentius/chant/exit-codes";
 import { pulumiExitOf } from "./exit-codes.js";
@@ -565,6 +567,8 @@ async function planStack(ctx, original, opts) {
         planDigest,
         artifact,
         changeSet: read.part,
+        // plywood#55: each changed resource's own digest, which a merged wave compares with the pull request's per resource.
+        resourceDigests: pulumiResourceDigests(read.preview),
         outputs: { known: planned.known, unknown: planned.unknown },
         shape: read.shape,
         ...(ctx.targets?.length ? { targets: ctx.targets } : {}),

package/dist/rules/pul015.ts

@@ -9,8 +9,9 @@
  * `plunge+file://...` or `plunge://...` runs stock `pulumi` against a
  * backend scheme only plunge opens, and every read fails.
  *
- * The other direction, `engine: "plunge"` with a stock backend, is not
- * reported: plunge is a Pulumi fork and the config may mean it.
+ * One direction only, by maintainer ruling (#4559): `engine: "plunge"` with a
+ * stock backend is not reported, because plunge opens stock backends and the
+ * config may mean it.
  */
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { pulumiMemberEngine } from "../../run";
@@ -19,7 +20,7 @@ import { finding } from "./member-read-helpers";
 
 export const pul015: PostSynthCheck = {
   id: "PUL015",
-  description: "pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend",
+  description: "pulumi.member.engine says pulumi, but the resolved engine is plunge",
 
   check(_ctx: PostSynthContext): PostSynthDiagnostic[] {
     const read = lastMemberRead();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-pulumi",
-  "version": "0.124.58",
+  "version": "0.124.60",
   "type": "module",
   "files": [
     "src/",
@@ -54,7 +54,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.58",
+    "@intentius/chant": "^0.124.60",
     "zod": "^4.3.6"
   },
   "description": "pulumi lexicon for chant: a Pulumi program as a workspace member, its preview in the change set and its refresh as drift records",

package/src/change-set.ts

@@ -68,7 +68,11 @@
  * each step's op, URN, provider, id, inputs before and after, `diffReasons`,
  * `replaceReasons` and `detailedDiff`, sorted by URN and op. It leaves out
  * `config`, `duration`, `diagnostics` and `changeSummary`, and the states'
- * outputs, which at preview are the last deployment's or unknown. For a
+ * outputs, which at preview are the last deployment's or unknown. It also
+ * leaves out what the engine makes up while planning a create or a
+ * replacement (plywood#56): an autoname such as `events-3f45941` is drawn
+ * again by every preview, so it reads as {@link PULUMI_GENERATED}. See
+ * {@link pulumiPlannedInputs}. Unknowns already print as one fixed string. For a
  * member on the resource lock grain the `pulumi-up` capability passes
  * `changedOnly` (#4541, ruling B), which leaves `same` and `read` steps out.
  *
@@ -164,31 +168,104 @@ export interface PulumiPreviewDigestOptions {
   changedOnly?: boolean;
 }
 
+/** What stands in a digest for an input the engine made up while planning (plywood#56). */
+export const PULUMI_GENERATED = "<generated at plan time>";
+
+/** Pulumi's autonaming: the logical name, a dash and seven random hex characters. */
+const AUTONAME = /^(.+)-[0-9a-f]{7}$/;
+
+/** The step's resource name: the last part of its URN. */
+function logicalName(urn: string | undefined): string {
+  const at = urn?.lastIndexOf("::") ?? -1;
+  return urn && at >= 0 ? urn.slice(at + 2) : (urn ?? "");
+}
+
+/**
+ * The inputs a step would write, with the values the engine made up while
+ * planning replaced by {@link PULUMI_GENERATED} (plywood#56). Two previews of
+ * one create draw different autonames (`events-3f45941`, then
+ * `events-9c01d2e`), and a digest over them could never match a later plan of
+ * the same change.
+ *
+ * Only a create or a replacement draws a name: an update's inputs keep the one
+ * the resource was created with, and that stays in `before` and `after`. A
+ * value counts as generated when the engine lists its key in `__defaults`
+ * (the inputs the provider filled in, not the program) and it reads as an
+ * autoname of this resource: its logical name, or the start of it when the
+ * provider shortened it, then a dash and seven hex characters. An engine that
+ * prints no `__defaults` is held to the exact logical name. Every other input
+ * stays in, the defaults that are plain values included, so a changed input
+ * still changes the digest. `before` is the recorded state and is never masked.
+ */
+export function pulumiPlannedInputs(step: PulumiStep): Json | null {
+  const inputs = step.newState?.inputs;
+  if (!isObject(inputs)) return inputs ?? null;
+  const draws = step.oldState === undefined || step.op === "create" || step.op === "create-replacement" || step.op === "replace";
+  if (!draws) return inputs;
+  const name = logicalName(step.urn).toLowerCase();
+  const filled = Array.isArray(inputs.__defaults) ? new Set(inputs.__defaults.filter((k): k is string => typeof k === "string")) : undefined;
+  const out: Json = {};
+  for (const [key, value] of Object.entries(inputs)) {
+    const stem = typeof value === "string" ? AUTONAME.exec(value)?.[1]?.toLowerCase() : undefined;
+    const generated = stem !== undefined && name !== "" && (filled ? filled.has(key) && (name.startsWith(stem) || stem.startsWith(name)) : stem === name);
+    out[key] = generated ? PULUMI_GENERATED : value;
+  }
+  return out;
+}
+
+/** One step as a digest sees it: what it proposes, without the values the engine made up. */
+function digestStep(s: PulumiStep) {
+  return {
+    op: s.op ?? null,
+    urn: s.urn ?? null,
+    provider: s.provider ?? null,
+    id: s.newState?.id ?? s.oldState?.id ?? null,
+    before: s.oldState?.inputs ?? null,
+    after: pulumiPlannedInputs(s),
+    diffReasons: [...(s.diffReasons ?? [])].sort(),
+    replaceReasons: [...(s.replaceReasons ?? [])].sort(),
+    detailedDiff: s.detailedDiff ?? null,
+  };
+}
+
+const byStep = (a: { urn: string | null; op: string | null }, b: { urn: string | null; op: string | null }): number =>
+  byString(`${a.urn}\u0000${a.op}`, `${b.urn}\u0000${b.op}`);
+
 /**
  * The member's plan digest: `computePlanDigest("pulumi-preview", …)` over
  * what each step proposes, sorted by URN and op, so two renderings of one
- * preview agree. See the module comment for what it leaves out. With
- * `changedOnly`, `same` and `read` steps are left out too, under the label
- * `pulumi-preview-changed`, so the two digests never collide.
+ * preview agree. See the module comment for what it leaves out, and
+ * {@link pulumiPlannedInputs} for the values the engine made up that it leaves
+ * out of a create. With `changedOnly`, `same` and `read` steps are left out
+ * too, under the label `pulumi-preview-changed`, so the two digests never
+ * collide.
  */
 export function pulumiPreviewDigest(preview: unknown, opts: PulumiPreviewDigestOptions = {}): string {
   const steps = (pulumiSteps(preview) ?? [])
     .filter((s) => !opts.changedOnly || !PULUMI_UNCHANGED_OPS.has(s.op ?? ""))
-    .map((s) => ({
-      op: s.op ?? null,
-      urn: s.urn ?? null,
-      provider: s.provider ?? null,
-      id: s.newState?.id ?? s.oldState?.id ?? null,
-      before: s.oldState?.inputs ?? null,
-      after: s.newState?.inputs ?? null,
-      diffReasons: [...(s.diffReasons ?? [])].sort(),
-      replaceReasons: [...(s.replaceReasons ?? [])].sort(),
-      detailedDiff: s.detailedDiff ?? null,
-    }))
-    .sort((a, b) => byString(`${a.urn}\u0000${a.op}`, `${b.urn}\u0000${b.op}`));
+    .map(digestStep)
+    .sort(byStep);
   return computePlanDigest(opts.changedOnly ? "pulumi-preview-changed" : "pulumi-preview", steps);
 }
 
+/**
+ * The digest of each resource the preview changes, by URN (plywood#55): the
+ * steps of that URN (a replace is several), as {@link pulumiPreviewDigest}
+ * reads them, with the values the engine made up left out. A `same` or `read` step is not in it whatever the lock grain,
+ * so what a pull request left alone never makes its plan differ from a plan
+ * made after another change landed on it.
+ */
+export function pulumiResourceDigests(preview: unknown): Record<string, string> {
+  const byUrn = new Map<string, ReturnType<typeof digestStep>[]>();
+  for (const s of pulumiSteps(preview) ?? []) {
+    if (PULUMI_UNCHANGED_OPS.has(s.op ?? "")) continue;
+    const list = byUrn.get(s.urn!) ?? [];
+    list.push(digestStep(s));
+    byUrn.set(s.urn!, list);
+  }
+  return Object.fromEntries([...byUrn].sort(([a], [b]) => byString(a, b)).map(([urn, steps]) => [urn, computePlanDigest("pulumi-resource", steps.sort(byStep))]));
+}
+
 const REPLACE_OPS = new Set(["replace", "create-replacement", "delete-replaced"]);
 
 /** The action and disruption one URN's steps mean, or undefined for an op the change set has no action for. */

package/src/drift-read.test.ts

@@ -9,13 +9,16 @@
  * `plunge-member`'s export is a cut of the recorded plunge stack's. No binary
  * runs here.
  */
-import { readFileSync } from "node:fs";
+import { cpSync, mkdirSync, mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { describe, expect, test } from "vitest";
+import { createSnapshotStore } from "@intentius/chant/lifecycle/snapshot-store";
 import { foldDriftLines, type ReadDriftOptions } from "@intentius/chant/drift-record";
 import { readPulumiDrift } from "./drift-read";
 import { pulumiPlugin } from "./plugin";
 import type { PulumiRunner } from "./run";
+import { writePulumiExportSnapshot } from "./stack-export-snapshot";
 
 const testdata = join(import.meta.dirname, "testdata");
 const text = (...path: string[]) => readFileSync(join(testdata, ...path), "utf-8");
@@ -104,3 +107,72 @@ describe("readPulumiDrift", () => {
     expect(never.calls).toEqual([]);
   });
 });
+
+describe("readPulumiDrift with --stack", () => {
+  const exportText = text("pulumi-preview", "stack-export.json");
+
+  /** A member directory with Pulumi.yaml and no checked-in export, and a store holding the stacks named. */
+  async function memberWithStore(stacks: string[]) {
+    const dir = mkdtempSync(join(tmpdir(), "pulumi-drift-stack-"));
+    cpSync(join(testdata, "pulumi-preview", "Pulumi.yaml"), join(dir, "Pulumi.yaml"));
+    mkdirSync(join(dir, "node_modules"));
+    const store = createSnapshotStore({ store: "local", dir: mkdtempSync(join(tmpdir(), "pulumi-drift-store-")) });
+    for (const stack of stacks) {
+      const wrote = await writePulumiExportSnapshot({
+        dir,
+        stack,
+        environment: "prod",
+        engine: "pulumi",
+        run: async () => ({ stdout: exportText }),
+        store,
+      });
+      expect(wrote.written, JSON.stringify(wrote)).toBe(true);
+    }
+    return { dir, store };
+  }
+
+  test("reads the named stack's stored export and passes that stack to every refresh", async () => {
+    const { dir, store } = await memberWithStore(["staging", "prod-eu"]);
+    const pulumi = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const answer = await readPulumiDrift(options(dir, { stack: "prod-eu" }), { run: pulumi.run, plunge: never.run, exportStore: store });
+    if (!("lines" in answer)) throw new Error(JSON.stringify(answer));
+    expect(pulumi.calls.length).toBeGreaterThan(0);
+    for (const call of pulumi.calls) expect(call.slice(call.indexOf("--stack"), call.indexOf("--stack") + 2)).toEqual(["--stack", "prod-eu"]);
+  });
+
+  test("beats the member's declared stack", async () => {
+    const { dir, store } = await memberWithStore(["staging", "prod-eu"]);
+    const pulumi = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const config = { pulumi: { member: { dir, label: "site", stack: "staging" } } };
+    const answer = await readPulumiDrift({ ...options(dir, { stack: "prod-eu", resource: bucket }), config }, { run: pulumi.run, plunge: never.run, exportStore: store });
+    expect("lines" in answer).toBe(true);
+    expect(pulumi.calls).toEqual([["refresh", "--preview-only", "--json", "--stack", "prod-eu", "--target", bucket]]);
+  });
+
+  test("a store with no export for that stack is an error naming the stack, and nothing runs", async () => {
+    const { dir, store } = await memberWithStore(["staging"]);
+    const spy = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const answer = await readPulumiDrift(options(dir, { stack: "prod-eu" }), { run: spy.run, plunge: never.run, exportStore: store });
+    expect(answer).toMatchObject({ refused: { code: "no-drift-read" } });
+    expect("refused" in answer && answer.refused.message).toMatch(/holds no export for stack prod-eu of site/);
+    expect(spy.calls).toEqual([]);
+  });
+
+  test("an empty store is refused too, though a checked-in export sits beside the member", async () => {
+    const dir = join(testdata, "pulumi-preview");
+    const store = createSnapshotStore({ store: "local", dir: mkdtempSync(join(tmpdir(), "pulumi-drift-store-")) });
+    const spy = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const answer = await readPulumiDrift(options(dir, { stack: "floci" }), { run: spy.run, plunge: never.run, exportStore: store });
+    expect(answer).toMatchObject({ refused: { code: "no-drift-read" } });
+    expect(spy.calls).toEqual([]);
+  });
+
+  test("without --stack the read is as before: the checked-in export when the store has none", async () => {
+    const dir = join(testdata, "pulumi-preview");
+    const store = createSnapshotStore({ store: "local", dir: mkdtempSync(join(tmpdir(), "pulumi-drift-store-")) });
+    const pulumi = fake(() => text("pulumi-refresh", "bucket-edited.json"));
+    const answer = await readPulumiDrift(options(dir, { resource: bucket }), { run: pulumi.run, plunge: never.run, exportStore: store });
+    expect("lines" in answer).toBe(true);
+    expect(pulumi.calls).toEqual([["refresh", "--preview-only", "--json", "--stack", "floci", "--target", bucket]]);
+  });
+});

package/src/drift-read.ts

@@ -13,8 +13,12 @@
  * | plunge | unset | `plunge drift --resource <urn> --stream`, once per resource in the export |
  * | plunge | `<urn>` | the same, for that URN alone |
  *
- * Each read passes `--stack` (#4496): the member's declared
- * `pulumi.member.stack`, else the stack the export's URNs name.
+ * Each read passes `--stack` (#4496): the stack asked for (`chant workspace
+ * drift --stack`), else the member's declared `pulumi.member.stack`, else the
+ * stack the export's URNs name. A stack asked for is read from that stack's
+ * export in the index store alone; with none there the read is refused
+ * (`no-drift-read`), where without `--stack` the member reads the store's
+ * export, then the checked-in file.
  *
  * The one read is `refresh`. The member's engine is `pulumiMemberEngine`'s:
  * the member config's `engine`, then a plunge backend URL in `Pulumi.yaml`.
@@ -27,11 +31,15 @@ import type { DriftLine, DriftRecord, ReadDriftOptions, ReadDriftResult } from "
 import { driftRecordLine, driftSettle, driftStart } from "@intentius/chant/drift-record";
 import type { PulumiConfig } from "./config";
 import { pulumiMemberEngine, refreshPulumiMember, type PulumiRunner } from "./run";
+import { readStoredPulumiExport } from "./stack-export-snapshot";
+import type { SnapshotStore } from "@intentius/chant/lifecycle/snapshot-store";
 
 /** The runners, injectable so the tests run no binary. */
 export interface PulumiDriftRunners {
   run?: PulumiRunner;
   plunge?: PulumiRunner;
+  /** The index store the exports are read from. Default: the project's. */
+  exportStore?: SnapshotStore | null;
 }
 
 /** `LexiconPlugin.readDrift` for the pulumi lexicon. */
@@ -42,6 +50,18 @@ export async function readPulumiDrift(options: ReadDriftOptions, runners: Pulumi
     return { refused: { code: "read-unsupported", message: `a Pulumi member answers refresh, not ${options.read}` } };
   }
   const { engine } = pulumiMemberEngine(member.dir, member.engine);
+  const stack = options.stack ?? member.stack;
+  if (options.stack !== undefined) {
+    const stored = await readStoredPulumiExport({ dir: member.dir, stack: options.stack, ...(runners.exportStore !== undefined ? { store: runners.exportStore } : {}) });
+    if (!stored) {
+      return {
+        refused: {
+          code: "no-drift-read",
+          message: `the index store holds no export for stack ${options.stack} of ${options.member}; the pulumi-up capability writes one after each apply through chant, so apply that stack once, or read without --stack`,
+        },
+      };
+    }
+  }
   let records: DriftRecord[];
   try {
     records = await refreshPulumiMember({
@@ -49,7 +69,8 @@ export async function readPulumiDrift(options: ReadDriftOptions, runners: Pulumi
       dir: member.dir,
       observedAt: options.observedAt,
       ...(member.engine ? { engine: member.engine } : {}),
-      ...(member.stack ? { stack: member.stack } : {}),
+      ...(stack ? { stack } : {}),
+      ...(runners.exportStore !== undefined ? { exportStore: runners.exportStore } : {}),
       ...(options.resource !== undefined ? { urns: [options.resource] } : {}),
       ...(runners.run ? { run: runners.run } : {}),
       ...(runners.plunge ? { plunge: runners.plunge } : {}),

package/src/index.ts

@@ -5,6 +5,9 @@ export { readPulumiMember, PULUMI_EXPORT_FILE, type PulumiMemberConfig, type Pul
 export {
   pulumiPreviewPart,
   pulumiPreviewDigest,
+  pulumiResourceDigests,
+  pulumiPlannedInputs,
+  PULUMI_GENERATED,
   pulumiSteps,
   pulumiExportResources,
   type PulumiPreviewPartInput,

package/src/lint/post-synth/post-synth.test.ts

@@ -1,5 +1,7 @@
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, describe, expect, test } from "vitest";
+import { afterEach, describe, expect, test, vi } from "vitest";
 import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
 import { PULUMI_SECRET_SIG, PULUMI_SIG_KEY } from "../../values";
 import { setLastMemberRead, setLastMemberReport } from "../../workspace-member";
@@ -23,6 +25,7 @@ import { pul015 } from "./pul015";
 const ctx = { outputs: new Map(), entities: new Map() } as unknown as PostSynthContext;
 
 afterEach(() => {
+  vi.unstubAllEnvs();
   setLastMemberReport(undefined);
   setLastMemberRead(undefined);
 });
@@ -196,4 +199,47 @@ describe("pulumi post-synth checks", () => {
     readWith([], { dir: stockDir, engine: "plunge" });
     expect(pul015.check(ctx)).toEqual([]);
   });
+
+  test("PUL015 names the source of the resolved plunge engine", () => {
+    // Pulumi.yaml
+    readWith([], { dir: plungeDir, engine: "pulumi" });
+    expect(pul015.check(ctx)[0].message).toContain("Pulumi.yaml names the plunge backend");
+
+    // PULUMI_BACKEND_URL, on a program whose Pulumi.yaml names no backend
+    vi.stubEnv("PULUMI_BACKEND_URL", "plunge+s3://bucket/state");
+    readWith([], { dir: stockDir, engine: "pulumi" });
+    const fromEnv = pul015.check(ctx);
+    expect(fromEnv).toHaveLength(1);
+    expect(fromEnv[0].message).toContain("PULUMI_BACKEND_URL names the plunge backend plunge+s3://bucket/state");
+    readWith([], { dir: stockDir, engine: "plunge" });
+    expect(pul015.check(ctx)).toEqual([]);
+    vi.stubEnv("PULUMI_BACKEND_URL", "s3://bucket/state");
+    readWith([], { dir: stockDir, engine: "pulumi" });
+    expect(pul015.check(ctx)).toEqual([]);
+    vi.unstubAllEnvs();
+
+    // plywood.yml, engine and backend
+    const root = mkdtempSync(join(tmpdir(), "pul015-"));
+    mkdirSync(join(root, ".git"));
+    const member = join(root, "infra");
+    mkdirSync(member);
+    writeFileSync(join(member, "Pulumi.yaml"), "name: app\nruntime: nodejs\n");
+    writeFileSync(join(root, "plywood.yml"), "engine: plunge\n");
+    readWith([], { dir: member, engine: "pulumi" });
+    const fromEngine = pul015.check(ctx);
+    expect(fromEngine).toHaveLength(1);
+    expect(fromEngine[0].message).toContain("plywood.yml says engine: plunge");
+    writeFileSync(join(root, "plywood.yml"), "backend: plunge+file:///state\n");
+    const fromBackend = pul015.check(ctx);
+    expect(fromBackend).toHaveLength(1);
+    expect(fromBackend[0].message).toContain("plywood.yml names the plunge backend plunge+file:///state");
+    writeFileSync(join(root, "plywood.yml"), "engine: pulumi\n");
+    expect(pul015.check(ctx)).toEqual([]);
+  });
+
+  test("PUL015 does not report the other direction: engine plunge on a stock backend", () => {
+    vi.stubEnv("PULUMI_BACKEND_URL", "s3://bucket/state");
+    readWith([], { dir: stockDir, engine: "plunge" });
+    expect(pul015.check(ctx)).toEqual([]);
+  });
 });

package/src/lint/post-synth/pul015.ts

@@ -9,8 +9,9 @@
  * `plunge+file://...` or `plunge://...` runs stock `pulumi` against a
  * backend scheme only plunge opens, and every read fails.
  *
- * The other direction, `engine: "plunge"` with a stock backend, is not
- * reported: plunge is a Pulumi fork and the config may mean it.
+ * One direction only, by maintainer ruling (#4559): `engine: "plunge"` with a
+ * stock backend is not reported, because plunge opens stock backends and the
+ * config may mean it.
  */
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import { pulumiMemberEngine } from "../../run";
@@ -19,7 +20,7 @@ import { finding } from "./member-read-helpers";
 
 export const pul015: PostSynthCheck = {
   id: "PUL015",
-  description: "pulumi.member.engine says pulumi, but Pulumi.yaml names a plunge backend",
+  description: "pulumi.member.engine says pulumi, but the resolved engine is plunge",
 
   check(_ctx: PostSynthContext): PostSynthDiagnostic[] {
     const read = lastMemberRead();

package/src/preview-generated.test.ts

@@ -0,0 +1,113 @@
+/**
+ * Values the engine makes up while planning stay out of the digest (plywood#56).
+ * `testdata/pulumi-preview/preview-create.json` is a recorded first preview:
+ * its queues carry autonames (`events-3f45941`, `worker-0-84f29f5`) the
+ * provider filled in, listed in each step's `__defaults`.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { PULUMI_GENERATED, pulumiPlannedInputs, pulumiPreviewDigest, pulumiResourceDigests, type PulumiStep } from "./change-set";
+
+const created = JSON.parse(readFileSync(join(import.meta.dirname, "testdata", "pulumi-preview", "preview-create.json"), "utf-8")) as { steps: PulumiStep[] };
+const copy = () => JSON.parse(JSON.stringify(created)) as typeof created;
+const stepOf = (doc: typeof created, name: string) => doc.steps.find((s) => s.urn?.endsWith(`::${name}`))!;
+const inputsOf = (doc: typeof created, name: string) => stepOf(doc, name).newState!.inputs as Record<string, unknown>;
+
+/** The same preview drawn again: every autoname gets another suffix. */
+function replanned(): typeof created {
+  const doc = copy();
+  for (const s of doc.steps) {
+    const inputs = s.newState?.inputs as Record<string, unknown> | undefined;
+    if (!inputs || !Array.isArray(inputs.__defaults)) continue;
+    for (const key of inputs.__defaults as string[]) {
+      const v = inputs[key];
+      if (typeof v === "string" && /-[0-9a-f]{7}$/.test(v)) inputs[key] = v.replace(/[0-9a-f]{7}$/, "0123abc");
+    }
+  }
+  return doc;
+}
+
+describe("a create's digest leaves out what the engine drew while planning", () => {
+  test("the recorded preview holds autonames, and a second draw gives the same digest", () => {
+    expect(inputsOf(created, "events").name).toBe("events-3f45941");
+    expect(inputsOf(replanned(), "events").name).toBe("events-0123abc");
+    expect(pulumiPreviewDigest(replanned())).toBe(pulumiPreviewDigest(created));
+    expect(pulumiPreviewDigest(replanned(), { changedOnly: true })).toBe(pulumiPreviewDigest(created, { changedOnly: true }));
+  });
+
+  test("the name is replaced by one marker, and the rest of the inputs are kept", () => {
+    const planned = pulumiPlannedInputs(stepOf(created, "events")) as Record<string, unknown>;
+    expect(planned.name).toBe(PULUMI_GENERATED);
+    expect(planned.messageRetentionSeconds).toBe(3600);
+    expect(planned.maxMessageSize).toBe(262144);
+    expect(planned.tags).toEqual({ "corpus-owner": "plunge", "corpus-program": "aws-ts" });
+  });
+
+  test("two creates that differ in an input a reviewer saw still differ", () => {
+    for (const change of [
+      (d: typeof created) => { inputsOf(d, "events").messageRetentionSeconds = 7200; },
+      (d: typeof created) => { (inputsOf(d, "worker-0").tags as Record<string, string>)["corpus-index"] = "9"; },
+      // a default that is a plain value counts: it decides what gets applied
+      (d: typeof created) => { inputsOf(d, "events").maxMessageSize = 1024; },
+      // a name the program set is not a draw, and a changed one is a change
+      (d: typeof created) => { inputsOf(d, "app-role").name = "rec-ts-other"; },
+    ]) {
+      const other = replanned();
+      change(other);
+      expect(pulumiPreviewDigest(other)).not.toBe(pulumiPreviewDigest(created));
+    }
+  });
+
+  test("a different logical name or a new resource changes the digest", () => {
+    const renamed = replanned();
+    stepOf(renamed, "events").urn = stepOf(renamed, "events").urn!.replace("::events", "::journal");
+    expect(pulumiPreviewDigest(renamed)).not.toBe(pulumiPreviewDigest(created));
+    const extra = replanned();
+    extra.steps.push({ ...stepOf(extra, "docs-notify"), urn: stepOf(extra, "docs-notify").urn!.replace("::docs-notify", "::more-notify") });
+    expect(pulumiPreviewDigest(extra)).not.toBe(pulumiPreviewDigest(created));
+  });
+
+  test("a string that only looks like a suffix is kept unless the engine filled it in", () => {
+    const doc = copy();
+    const step = stepOf(doc, "events");
+    (step.newState!.inputs as Record<string, unknown>).description = "events-3f45941";
+    expect((pulumiPlannedInputs(step) as Record<string, unknown>).description).toBe("events-3f45941");
+    // a name the program wrote is not listed in __defaults
+    (step.newState!.inputs as Record<string, unknown>).__defaults = [];
+    expect((pulumiPlannedInputs(step) as Record<string, unknown>).name).toBe("events-3f45941");
+  });
+
+  test("an engine that prints no __defaults is held to the exact logical name", () => {
+    const step: PulumiStep = { op: "create", urn: "urn:pulumi:dev::p::aws:sqs/queue:Queue::events", newState: { inputs: { name: "events-3f45941", other: "worker-3f45941" } } };
+    expect(pulumiPlannedInputs(step)).toEqual({ name: PULUMI_GENERATED, other: "worker-3f45941" });
+  });
+
+  test("an update keeps its inputs, since it draws no name", () => {
+    const update: PulumiStep = {
+      op: "update",
+      urn: "urn:pulumi:dev::p::aws:sqs/queue:Queue::events",
+      oldState: { inputs: { name: "events-3f45941", messageRetentionSeconds: 60 } },
+      newState: { inputs: { __defaults: ["name"], name: "events-3f45941", messageRetentionSeconds: 7200 } },
+    };
+    expect(pulumiPlannedInputs(update)).toBe(update.newState!.inputs);
+    const other = JSON.parse(JSON.stringify(update)) as PulumiStep;
+    (other.oldState!.inputs as Record<string, unknown>).name = "events-aaaaaaa";
+    (other.newState!.inputs as Record<string, unknown>).name = "events-aaaaaaa";
+    expect(pulumiPreviewDigest({ steps: [other] })).not.toBe(pulumiPreviewDigest({ steps: [update] }));
+  });
+
+  test("a replacement draws a new name too", () => {
+    const replace = (suffix: string): PulumiStep => ({
+      op: "replace",
+      urn: "urn:pulumi:dev::p::aws:sqs/queue:Queue::events",
+      oldState: { inputs: { name: "events-1111111", fifoQueue: false } },
+      newState: { inputs: { __defaults: ["name"], name: `events-${suffix}`, fifoQueue: true } },
+      replaceReasons: ["fifoQueue"],
+    });
+    expect(pulumiPreviewDigest({ steps: [replace("2222222")] })).toBe(pulumiPreviewDigest({ steps: [replace("3333333")] }));
+    const flipped = replace("2222222");
+    (flipped.newState!.inputs as Record<string, unknown>).fifoQueue = false;
+    expect(pulumiPreviewDigest({ steps: [flipped] })).not.toBe(pulumiPreviewDigest({ steps: [replace("2222222")] }));
+  });
+});

package/src/pulumi-up.test.ts

@@ -18,7 +18,7 @@ import { join, relative } from "node:path";
 import { describe, expect, test } from "vitest";
 import { isPlanMovedError, type DeployContext } from "@intentius/chant/components/capability";
 import { PlanShapeMovedError } from "@intentius/chant/components/covered-round";
-import { pulumiPreviewDigest } from "./change-set";
+import { pulumiPreviewDigest, pulumiResourceDigests } from "./change-set";
 import { pulumiStreamPreview, PULUMI_STREAMING_PREVIEW_ENV } from "./engine-events";
 import {
   createPulumiUpCapability,
@@ -111,6 +111,17 @@ describe("plan on plunge", () => {
     expect(artifact.policy.warnings).toHaveLength(1);
   });
 
+  test("answers a digest for each resource the preview changes, on either grain (plywood#55)", async () => {
+    const cap = createPulumiUpCapability({ plunge: engine().run, env: {}, tmp: tmp(), snapshots: null });
+    const resource = await cap.plan!(ctx, step({ engine: "plunge" }));
+    const stack = await cap.plan!(ctx, step({ engine: "plunge", lockGrain: "target" }));
+    expect(resource.resourceDigests).toEqual(pulumiResourceDigests(pulumiStreamPreview(stream)));
+    expect(stack.resourceDigests).toEqual(resource.resourceDigests);
+    const changed = (pulumiStreamPreview(stream) as { steps: { op: string }[] }).steps.filter((x) => x.op !== "same" && x.op !== "read");
+    expect(Object.keys(resource.resourceDigests!).length).toBeGreaterThan(0);
+    expect(Object.keys(resource.resourceDigests!).length).toBeLessThanOrEqual(changed.length);
+  });
+
   test("the target grain keeps every step in the digest", async () => {
     const cap = createPulumiUpCapability({ plunge: engine().run, env: {}, tmp: tmp(), snapshots: null });
     const planned = await cap.plan!(ctx, step({ engine: "plunge", lockGrain: "target" }));

package/src/pulumi-up.ts

@@ -26,6 +26,8 @@
  *   through `DeployContext.lockGrain`, else `resource` on plunge and
  *   `target` on stock Pulumi, #4552) the digest leaves `same` and `read`
  *   steps out (ruling B);
+ * - `resourceDigests`: one digest per resource the preview changes, by URN,
+ *   whatever the grain (plywood#55);
  * - `outputs` from the stack step's planned outputs;
  * - `shape` from `pulumiPlanShape` (`./plan-shape.ts`);
  * - `artifact`: the engine, the shape, the digest, CrossGuard's findings,
@@ -154,7 +156,7 @@ import type { GatePolicyFindings } from "@intentius/chant/gate-policy";
 import { computePlanDigest } from "@intentius/chant/lifecycle/plan-digest";
 import type { SnapshotStore } from "@intentius/chant/lifecycle/snapshot-store";
 import { parseYAML } from "@intentius/chant/yaml";
-import { pulumiPreviewPart } from "./change-set";
+import { pulumiPreviewPart, pulumiResourceDigests } from "./change-set";
 import {
   PULUMI_STREAMING_PREVIEW_ENV,
   pulumiAppliedSteps,
@@ -795,6 +797,8 @@ async function planStack(ctx: DeployContext, original: PulumiUpStepInput, opts:
     planDigest,
     artifact,
     changeSet: read.part,
+    // plywood#55: each changed resource's own digest, which a merged wave compares with the pull request's per resource.
+    resourceDigests: pulumiResourceDigests(read.preview),
     outputs: { known: planned.known, unknown: planned.unknown },
     shape: read.shape,
     ...(ctx.targets?.length ? { targets: ctx.targets } : {}),