@intentius/chant-lexicon-terraform 0.124.46 → 0.124.49

package/dist/config.d.ts

@@ -165,7 +165,7 @@ export declare const terraformConfigSchema: z.ZodObject<{
         state: "state";
     }>>;
     /** Named root modules. The name is the entity-key prefix, so keep it stable. */
-    roots: z.ZodRecord<z.ZodString, z.ZodObject<{
+    roots: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         /** Root module directory, relative to the project root (where `chant.config.*` lives). */
         dir: z.ZodString;
         /** Terraform workspace to select for this root. Omitted means `default`. */
@@ -225,6 +225,17 @@ export declare const terraformConfigSchema: z.ZodObject<{
             plan: "plan";
             state: "state";
         }>>;
+    }, z.core.$strict>>>;
+    /**
+     * One pulumi workspace member read into the graph (#3179). `chant workspace
+     * graph` writes this into the reader project it makes for a `pulumi` member;
+     * it is not meant to be written by hand. `dir` is the member's directory,
+     * absolute; `label` names the entities. The graph is the checked-in
+     * `stack-export.json` there; the program is never run.
+     */
+    pulumiMember: z.ZodOptional<z.ZodObject<{
+        dir: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type TerraformRootConfig = z.infer<typeof terraformRootSchema>;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;EAA2C,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;EAA4B,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,mBAAmB;IAC9B,0FAA0F;;IAE1F,4EAA4E;;IAE5E,0DAA0D;;IAE1D,0DAA0D;;IAE1D;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;;IAEH,+EAA+E;;;;;;IAE/E;;;;;;;;;;;;;;OAcG;;;;;kBAEH,CAAC;AAEH,eAAO,MAAM,qBAAqB;IAChC;;;;;;;OAOG;;;;;;IAEH;;;;;;;OAOG;;;;;;IAEH;;;;;;;;;;;OAWG;;IAEH,6FAA6F;;;;;IAE7F,gFAAgF;;QAxFhF,0FAA0F;;QAE1F,4EAA4E;;QAE5E,0DAA0D;;QAE1D,0DAA0D;;QAE1D;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;;QAEH,+EAA+E;;;;;;QAE/E;;;;;;;;;;;;;;WAcG;;;;;;kBAwCH,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,SAAS,CAAC,EAAE,eAAe,CAAC;KAC7B;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;EAA2C,CAAC;AAClF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;GAQG;AACH;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;EAA4B,CAAC;AAErE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,mBAAmB;IAC9B,0FAA0F;;IAE1F,4EAA4E;;IAE5E,0DAA0D;;IAE1D,0DAA0D;;IAE1D;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;;IAEH,+EAA+E;;;;;;IAE/E;;;;;;;;;;;;;;OAcG;;;;;kBAEH,CAAC;AAEH,eAAO,MAAM,qBAAqB;IAChC;;;;;;;OAOG;;;;;;IAEH;;;;;;;OAOG;;;;;;IAEH;;;;;;;;;;;OAWG;;IAEH,6FAA6F;;;;;IAE7F,gFAAgF;;QAxFhF,0FAA0F;;QAE1F,4EAA4E;;QAE5E,0DAA0D;;QAE1D,0DAA0D;;QAE1D;;;;;;;;;;;;;;;;;;;;;;;;WAwBG;;QAEH,+EAA+E;;;;;;QAE/E;;;;;;;;;;;;;;WAcG;;;;;;IAwCH;;;;;;OAMG;;;;;kBAEH,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,OAAO,QAAQ,yBAAyB,CAAC;IACvC,UAAU,WAAW;QACnB,SAAS,CAAC,EAAE,eAAe,CAAC;KAC7B;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,wBAAwB,GAAG,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC"}

package/dist/config.js

@@ -137,5 +137,13 @@ export const terraformConfigSchema = z.strictObject({
     /** The default {@link TerraformRootConfig.observe} for every root that sets none (#4358). */
     observe: terraformObserveDepthSchema.optional(),
     /** Named root modules. The name is the entity-key prefix, so keep it stable. */
-    roots: z.record(z.string(), terraformRootSchema),
+    roots: z.record(z.string(), terraformRootSchema).default({}),
+    /**
+     * One pulumi workspace member read into the graph (#3179). `chant workspace
+     * graph` writes this into the reader project it makes for a `pulumi` member;
+     * it is not meant to be written by hand. `dir` is the member's directory,
+     * absolute; `label` names the entities. The graph is the checked-in
+     * `stack-export.json` there; the program is never run.
+     */
+    pulumiMember: z.strictObject({ dir: z.string().min(1), label: z.string().optional() }).optional(),
 });

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "677b09338e0529b5fb9902a9c28caddf2085636cbd66a26a13ecd8e0bed6a214",
+    "manifest.json": "79de496d2a488bf4411f970d2901d39dd5637b654e0f6c364960554e4a2b8163",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "7c10245b2c3335253b48ee7d8b075d89f43116bde20313a5d1031b343fef1282",
@@ -56,5 +56,5 @@
     "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "978620763d9bbdd92b651e07573818db7775489ddf487e67c8b3af5cd7fc5a77"
+  "composite": "1e1d62846c6afd833c8031d6d001f3d4deff7867252d399fbda1f319ec6b1bbe"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.46",
+  "version": "0.124.49",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAsR7B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAkS7B,CAAC"}

package/dist/plugin.js

@@ -1,3 +1,4 @@
+import { lastMemberReport, readPulumiMember, setLastMemberReport } from "./workspace-member.js";
 import { terraformBehaviourKinds } from "./behaviour/kinds.js";
 import { createSkillsLoader } from "@intentius/chant/lexicon-plugin-helpers";
 import { terraformSerializer } from "./serializer.js";
@@ -155,7 +156,14 @@ export const terraformPlugin = {
      * project root, which is what relative `dir` paths resolve against.
      */
     async buildRoots(ctx) {
+        setLastMemberReport(undefined);
         const namespace = ctx.config.terraform;
+        // A pulumi workspace member (#3179): its checked-in stack export, never the program.
+        if (namespace?.pulumiMember) {
+            const read = readPulumiMember({ member: namespace.pulumiMember });
+            setLastMemberReport(read.report);
+            return { entities: read.entities, warnings: read.warnings };
+        }
         const roots = namespace?.roots ?? {};
         if (Object.keys(roots).length === 0)
             return { entities: new Map(), warnings: [] };
@@ -167,6 +175,10 @@ export const terraformPlugin = {
             moduleRoot: namespace?.moduleRoot,
         });
     },
+    graphMeta() {
+        const report = lastMemberReport();
+        return report ? { pulumiMember: report } : undefined;
+    },
     /** `chant terraform pin-rollout` (#3189). */
     commands() {
         return terraformCommands;

package/dist/workspace-member.d.ts

@@ -0,0 +1,30 @@
+import { type Declarable } from "@intentius/chant/declarable";
+/** The conventional place of the export, in the member's directory. */
+export declare const PULUMI_EXPORT_FILE = "stack-export.json";
+export interface PulumiMemberConfig {
+    /** The member's directory, absolute. */
+    dir: string;
+    /** Names the entities (`<label>/...`): the member's name. */
+    label?: string;
+}
+/** What the read found, carried on the graph's `meta.pulumiMember`. */
+export interface PulumiMemberReport {
+    /** The export read, relative to the member's directory. */
+    export?: string;
+    objects: number;
+    /** False when the member has no readable export. */
+    exported: boolean;
+    /** Why nothing was read; set with `exported: false`. */
+    reason?: string;
+}
+export declare function readPulumiMember(opts: {
+    member: PulumiMemberConfig;
+}): {
+    entities: Map<string, Declarable>;
+    warnings: string[];
+    report: PulumiMemberReport;
+};
+/** The report of the read in this process, left for `graphMeta` (see the aws member reader). */
+export declare function setLastMemberReport(report: PulumiMemberReport | undefined): void;
+export declare function lastMemberReport(): PulumiMemberReport | undefined;
+//# sourceMappingURL=workspace-member.d.ts.map

package/dist/workspace-member.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-member.d.ts","sourceRoot":"","sources":["../src/workspace-member.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGjF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAAG;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,kBAAkB,CAAC;CAC5B,CAmDA;AAID,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAEhF;AAED,wBAAgB,gBAAgB,IAAI,kBAAkB,GAAG,SAAS,CAEjE"}

package/dist/workspace-member.js

@@ -0,0 +1,91 @@
+/**
+ * Reading a pulumi workspace member into the graph (#3179).
+ *
+ * `chant workspace graph` writes a reader project for a member of kind
+ * `pulumi`, with `terraform.pulumiMember` in its config (see
+ * `workspace-kinds.json`). The plugin's `buildRoots` hook calls
+ * {@link readPulumiMember}, which reads the `pulumi stack export` JSON the
+ * member has checked in, at {@link PULUMI_EXPORT_FILE} in its directory. chant
+ * never runs the program and never calls `pulumi`: with no export there are no
+ * nodes, and `meta.pulumiMember` says `exported: false` and why.
+ *
+ * Nodes are the export's resources, keyed `<label>/<urn tail>`, where the tail
+ * is the URN after its stack and project (`aws:s3/bucket:Bucket::assets`).
+ * Provider resources (`pulumi:providers:*`) are left out; the resources that
+ * name them are not edged to them. Edges come from each resource's
+ * `dependencies` and `parent`, kept only when the target is a node. Inputs and
+ * outputs are not copied into the node, since an export can hold secrets.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+/** The conventional place of the export, in the member's directory. */
+export const PULUMI_EXPORT_FILE = "stack-export.json";
+const PROVIDER = /^pulumi:providers:/;
+/** `urn:pulumi:<stack>::<project>::<tail>`: the tail, or the whole URN when it has another shape. */
+function urnTail(urn) {
+    const parts = urn.split("::");
+    return urn.startsWith("urn:pulumi:") && parts.length >= 4 ? parts.slice(2).join("::") : urn;
+}
+export function readPulumiMember(opts) {
+    const { member } = opts;
+    const label = member.label ?? basename(member.dir);
+    const missing = (reason) => ({
+        entities: new Map(),
+        warnings: [`pulumi member "${label}" was not read: ${reason}`],
+        report: { objects: 0, exported: false, reason },
+    });
+    const file = join(member.dir, PULUMI_EXPORT_FILE);
+    if (!existsSync(file)) {
+        return missing(`no ${PULUMI_EXPORT_FILE} in the member; run \`pulumi stack export --file ${PULUMI_EXPORT_FILE}\` and check it in, and chant will read it (chant does not run the program)`);
+    }
+    let resources;
+    try {
+        const doc = JSON.parse(readFileSync(file, "utf-8"));
+        const list = doc?.deployment?.resources;
+        if (list !== undefined && !Array.isArray(list))
+            return missing(`${PULUMI_EXPORT_FILE} has a deployment.resources that is not a list`);
+        resources = (list ?? []);
+    }
+    catch (e) {
+        return missing(`${PULUMI_EXPORT_FILE} is not readable JSON: ${e.message}`);
+    }
+    const keyOf = new Map();
+    for (const r of resources) {
+        if (typeof r?.urn !== "string" || typeof r.type !== "string" || PROVIDER.test(r.type))
+            continue;
+        keyOf.set(r.urn, `${label}/${urnTail(r.urn)}`);
+    }
+    const entities = new Map();
+    for (const r of resources) {
+        const key = typeof r?.urn === "string" ? keyOf.get(r.urn) : undefined;
+        if (!key)
+            continue;
+        const references = new Map();
+        const add = (urn, via) => {
+            const to = typeof urn === "string" ? keyOf.get(urn) : undefined;
+            if (to && to !== key)
+                references.set(`${to}|${via}`, { to, viaAttr: via });
+        };
+        add(r.parent, "parent");
+        for (const d of Array.isArray(r.dependencies) ? r.dependencies : [])
+            add(d, "dependencies");
+        entities.set(key, {
+            lexicon: "terraform",
+            entityType: r.type,
+            kind: "resource",
+            props: {},
+            references: [...references.values()],
+            [DECLARABLE_MARKER]: true,
+        });
+    }
+    return { entities, warnings: [], report: { export: PULUMI_EXPORT_FILE, objects: entities.size, exported: true } };
+}
+let lastReport;
+/** The report of the read in this process, left for `graphMeta` (see the aws member reader). */
+export function setLastMemberReport(report) {
+    lastReport = report;
+}
+export function lastMemberReport() {
+    return lastReport;
+}

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.124.46",
+  "version": "0.124.49",
   "type": "module",
   "files": [
     "src/",
     "dist/",
+    "schemas/",
     "workspace-kinds.json"
   ],
   "exports": {
@@ -67,7 +68,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.46",
+    "@intentius/chant": "^0.124.49",
     "zod": "^4.3.6"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/schemas/pulumi.schema.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Pulumi.yaml",
+  "type": "object",
+  "required": [
+    "name",
+    "runtime"
+  ],
+  "properties": {
+    "name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "runtime": {
+      "anyOf": [
+        {
+          "type": "string",
+          "minLength": 1
+        },
+        {
+          "type": "object",
+          "required": [
+            "name"
+          ],
+          "properties": {
+            "name": {
+              "type": "string"
+            }
+          }
+        }
+      ]
+    }
+  }
+}

package/src/config.ts

@@ -146,7 +146,15 @@ export const terraformConfigSchema = z.strictObject({
   /** The default {@link TerraformRootConfig.observe} for every root that sets none (#4358). */
   observe: terraformObserveDepthSchema.optional(),
   /** Named root modules. The name is the entity-key prefix, so keep it stable. */
-  roots: z.record(z.string(), terraformRootSchema),
+  roots: z.record(z.string(), terraformRootSchema).default({}),
+  /**
+   * One pulumi workspace member read into the graph (#3179). `chant workspace
+   * graph` writes this into the reader project it makes for a `pulumi` member;
+   * it is not meant to be written by hand. `dir` is the member's directory,
+   * absolute; `label` names the entities. The graph is the checked-in
+   * `stack-export.json` there; the program is never run.
+   */
+  pulumiMember: z.strictObject({ dir: z.string().min(1), label: z.string().optional() }).optional(),
 });
 
 export type TerraformRootConfig = z.infer<typeof terraformRootSchema>;

package/src/plugin.ts

@@ -1,3 +1,4 @@
+import { lastMemberReport, readPulumiMember, setLastMemberReport } from "./workspace-member";
 import type { AuditEntitiesInput, LexiconPlugin } from "@intentius/chant/lexicon";
 import { terraformBehaviourKinds } from "./behaviour/kinds";
 import type { CompletionContext, HoverContext } from "@intentius/chant/lsp/types";
@@ -180,7 +181,14 @@ export const terraformPlugin: LexiconPlugin = {
    * project root, which is what relative `dir` paths resolve against.
    */
   async buildRoots(ctx): Promise<{ entities: Map<string, Declarable>; warnings: string[] }> {
+    setLastMemberReport(undefined);
     const namespace = (ctx.config as { terraform?: TerraformConfig }).terraform;
+    // A pulumi workspace member (#3179): its checked-in stack export, never the program.
+    if (namespace?.pulumiMember) {
+      const read = readPulumiMember({ member: namespace.pulumiMember });
+      setLastMemberReport(read.report);
+      return { entities: read.entities, warnings: read.warnings };
+    }
     const roots = namespace?.roots ?? {};
     if (Object.keys(roots).length === 0) return { entities: new Map(), warnings: [] };
     return renderTerraformRoots({
@@ -192,6 +200,11 @@ export const terraformPlugin: LexiconPlugin = {
     });
   },
 
+  graphMeta() {
+    const report = lastMemberReport();
+    return report ? { pulumiMember: report } : undefined;
+  },
+
   /** `chant terraform pin-rollout` (#3189). */
   commands() {
     return terraformCommands;

package/src/testdata/pulumi-member/Pulumi.yaml

@@ -0,0 +1,2 @@
+name: app
+runtime: nodejs

package/src/testdata/pulumi-member/stack-export.json

@@ -0,0 +1,53 @@
+{
+  "version": 3,
+  "deployment": {
+    "manifest": { "time": "2026-10-20T12:00:00Z", "magic": "x", "version": "v3.100.0" },
+    "resources": [
+      { "urn": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev", "custom": false, "type": "pulumi:pulumi:Stack" },
+      { "urn": "urn:pulumi:dev::app::pulumi:providers:aws::default", "custom": true, "id": "p1", "type": "pulumi:providers:aws" },
+      {
+        "urn": "urn:pulumi:dev::app::aws:s3/bucket:Bucket::assets",
+        "custom": true,
+        "id": "assets-1",
+        "type": "aws:s3/bucket:Bucket",
+        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev",
+        "provider": "urn:pulumi:dev::app::pulumi:providers:aws::default::p1",
+        "inputs": { "acl": "private" }
+      },
+      {
+        "urn": "urn:pulumi:dev::app::aws:iam/role:Role::web",
+        "custom": true,
+        "id": "web-1",
+        "type": "aws:iam/role:Role",
+        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev"
+      },
+      {
+        "urn": "urn:pulumi:dev::app::aws:iam/rolePolicy:RolePolicy::webReadsAssets",
+        "custom": true,
+        "id": "web-1:read",
+        "type": "aws:iam/rolePolicy:RolePolicy",
+        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev",
+        "dependencies": [
+          "urn:pulumi:dev::app::aws:iam/role:Role::web",
+          "urn:pulumi:dev::app::aws:s3/bucket:Bucket::assets",
+          "urn:pulumi:dev::app::aws:s3/bucket:Bucket::elsewhere"
+        ],
+        "inputs": { "policy": { "4dabf18193072939515568f2c6568e55": "1b47061264138c4ac30d75fd1eb44270", "ciphertext": "secret" } }
+      },
+      {
+        "urn": "urn:pulumi:dev::app::my:mod:Web$aws:lambda/function:Function::handler",
+        "custom": true,
+        "id": "fn",
+        "type": "aws:lambda/function:Function",
+        "parent": "urn:pulumi:dev::app::my:mod:Web::web-app",
+        "dependencies": ["urn:pulumi:dev::app::aws:iam/role:Role::web"]
+      },
+      {
+        "urn": "urn:pulumi:dev::app::my:mod:Web::web-app",
+        "custom": false,
+        "type": "my:mod:Web",
+        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev"
+      }
+    ]
+  }
+}

package/src/testdata/pulumi-unexported/Pulumi.yaml

@@ -0,0 +1,2 @@
+name: app
+runtime: nodejs

package/src/workspace-kinds.test.ts

@@ -6,7 +6,9 @@
  * sidecar or a live block, which this lexicon's choudoufu mode reads.
  */
 import { join } from "node:path";
+import { describe, expect, it } from "vitest";
 import { describeWorkspaceKindConformance } from "@intentius/chant-test-utils";
+import { checkMemberFile, loadMemberFileSchema, readPackageKinds } from "../../../packages/core/src/workspace/kinds";
 
 const main = `terraform {\n  required_version = ">= 1.5.0"\n}\n\nresource "null_resource" "x" {}\n`;
 
@@ -24,5 +26,24 @@ describeWorkspaceKindConformance({
     { name: "a root with the estate.chdf.hcl sidecar", kind: "choudoufu", files: { "main.tf": main, "estate.chdf.hcl": "" }, claims: true },
     { name: "a root with a live block", kind: "choudoufu", files: { "main.tf": main + '\nlive {\n  name = "prod"\n}\n' }, claims: true },
     { name: "a stock root", kind: "choudoufu", files: { "main.tf": main }, claims: false },
+    // The pulumi kind (#3179) is a probe and a check of Pulumi.yaml.
+    { name: "a Pulumi program", kind: "pulumi", files: { "Pulumi.yaml": "name: app\nruntime: nodejs\n", "index.ts": "" }, claims: true },
+    { name: "a Pulumi program one level down", kind: "pulumi", files: { "infra/Pulumi.yaml": "name: app\nruntime: nodejs\n" }, claims: false },
+    { name: "a stack file alone", kind: "pulumi", files: { "Pulumi.dev.yaml": "config: {}\n" }, claims: false },
   ],
 });
+
+describe("pulumi member file", () => {
+  const packageDir = join(import.meta.dirname, "..");
+  const memberFile = readPackageKinds(packageDir).kinds.find((k) => k.name === "pulumi")!.memberFile!;
+  it("names a schema that loads", () => {
+    expect(loadMemberFileSchema(memberFile, packageDir)).toBeUndefined();
+  });
+  it("passes a program with a runtime, named or in an object", () => {
+    expect(checkMemberFile(memberFile, "Pulumi.yaml", "name: app\nruntime: nodejs\n")).toEqual([]);
+    expect(checkMemberFile(memberFile, "Pulumi.yaml", "name: app\nruntime:\n  name: python\n")).toEqual([]);
+  });
+  it("fails one with no runtime", () => {
+    expect(checkMemberFile(memberFile, "Pulumi.yaml", "name: app\n").length).toBeGreaterThan(0);
+  });
+});

package/src/workspace-member.test.ts

@@ -0,0 +1,89 @@
+/**
+ * The pulumi member kind's graph block (#3179): the reader project the kind's
+ * graph config describes, run through chant graph over a checked-in
+ * `pulumi stack export`. Nothing here runs Pulumi.
+ */
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { dirname, join } from "node:path";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import type { GraphIR } from "@intentius/chant/graph-ir";
+import { runGraph } from "@intentius/chant/cli/handlers/graph";
+import { readPackageKinds, substituteGraphConfig } from "../../../packages/core/src/workspace/kinds";
+import { terraformPlugin } from "./plugin";
+
+const packageDir = join(import.meta.dirname, "..");
+const member = join(import.meta.dirname, "testdata", "pulumi-member");
+
+const scratch: string[] = [];
+afterEach(async () => {
+  vi.restoreAllMocks();
+  await Promise.all(scratch.splice(0).map((d) => rm(d, { recursive: true, force: true })));
+});
+
+async function graphOf(dir: string): Promise<{ ir: GraphIR; err: string[]; exit: number }> {
+  const graph = readPackageKinds(packageDir).kinds.find((k) => k.name === "pulumi")!.graph!;
+  expect(graph.lexicon).toBe("terraform");
+  const config = substituteGraphConfig(graph.config, { member: "infra", dir, workspace: dirname(dir) });
+  const project = await mkdtemp(join(tmpdir(), "chant-pulumi-member-"));
+  scratch.push(project);
+  await writeFile(join(project, "chant.config.json"), JSON.stringify({ lexicons: ["terraform"], terraform: config, graph: { lint: "report" } }));
+  const out: string[] = [];
+  const err: string[] = [];
+  vi.spyOn(console, "log").mockImplementation((line: unknown) => void out.push(String(line)));
+  vi.spyOn(console, "error").mockImplementation((line: unknown) => void err.push(String(line)));
+  const cwd = process.cwd();
+  process.chdir(project);
+  try {
+    const exit = await runGraph({ args: { command: "graph", path: ".", format: "ir" } as never, plugins: [terraformPlugin], serializers: [] });
+    return { ir: exit === 0 ? (JSON.parse(out.join("\n")) as GraphIR) : { nodes: [], edges: [], groups: {} }, err, exit };
+  } finally {
+    process.chdir(cwd);
+  }
+}
+
+describe("pulumi member graph block (#3179)", () => {
+  test("the export's resources are nodes; provider resources are left out", async () => {
+    const { ir, err, exit } = await graphOf(member);
+    expect(exit, err.join("\n")).toBe(0);
+    expect(ir.nodes.map((n) => [n.id, n.kind]).sort()).toEqual([
+      ["infra/aws:iam/role:Role::web", "aws:iam/role:Role"],
+      ["infra/aws:iam/rolePolicy:RolePolicy::webReadsAssets", "aws:iam/rolePolicy:RolePolicy"],
+      ["infra/aws:s3/bucket:Bucket::assets", "aws:s3/bucket:Bucket"],
+      ["infra/my:mod:Web$aws:lambda/function:Function::handler", "aws:lambda/function:Function"],
+      ["infra/my:mod:Web::web-app", "my:mod:Web"],
+      ["infra/pulumi:pulumi:Stack::app-dev", "pulumi:pulumi:Stack"],
+    ]);
+    expect(ir.meta?.pulumiMember).toEqual({ export: "stack-export.json", objects: 6, exported: true });
+  });
+
+  test("dependencies and parent are edges; a dependency outside the export is not", async () => {
+    const { ir } = await graphOf(member);
+    const edges = ir.edges.map((e) => `${e.from.slice(6)} -> ${e.to.slice(6)} via ${e.viaAttr}`).sort();
+    expect(edges).toEqual([
+      "aws:iam/role:Role::web -> pulumi:pulumi:Stack::app-dev via parent",
+      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> aws:iam/role:Role::web via dependencies",
+      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> aws:s3/bucket:Bucket::assets via dependencies",
+      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> pulumi:pulumi:Stack::app-dev via parent",
+      "aws:s3/bucket:Bucket::assets -> pulumi:pulumi:Stack::app-dev via parent",
+      "my:mod:Web$aws:lambda/function:Function::handler -> aws:iam/role:Role::web via dependencies",
+      "my:mod:Web$aws:lambda/function:Function::handler -> my:mod:Web::web-app via parent",
+      "my:mod:Web::web-app -> pulumi:pulumi:Stack::app-dev via parent",
+    ]);
+  });
+
+  test("inputs are not copied into the graph", async () => {
+    const { ir } = await graphOf(member);
+    expect(JSON.stringify(ir)).not.toContain("ciphertext");
+  });
+
+  test("a program with no export has no nodes, and the member says why", async () => {
+    const { ir, err, exit } = await graphOf(join(import.meta.dirname, "testdata", "pulumi-unexported"));
+    expect(exit, err.join("\n")).toBe(0);
+    expect(ir.nodes).toEqual([]);
+    const report = ir.meta?.pulumiMember as { exported: boolean; reason: string };
+    expect(report.exported).toBe(false);
+    expect(report.reason).toMatch(/pulumi stack export/);
+    expect(err.join("\n")).toMatch(/was not read/);
+  });
+});

package/src/workspace-member.ts

@@ -0,0 +1,126 @@
+/**
+ * Reading a pulumi workspace member into the graph (#3179).
+ *
+ * `chant workspace graph` writes a reader project for a member of kind
+ * `pulumi`, with `terraform.pulumiMember` in its config (see
+ * `workspace-kinds.json`). The plugin's `buildRoots` hook calls
+ * {@link readPulumiMember}, which reads the `pulumi stack export` JSON the
+ * member has checked in, at {@link PULUMI_EXPORT_FILE} in its directory. chant
+ * never runs the program and never calls `pulumi`: with no export there are no
+ * nodes, and `meta.pulumiMember` says `exported: false` and why.
+ *
+ * Nodes are the export's resources, keyed `<label>/<urn tail>`, where the tail
+ * is the URN after its stack and project (`aws:s3/bucket:Bucket::assets`).
+ * Provider resources (`pulumi:providers:*`) are left out; the resources that
+ * name them are not edged to them. Edges come from each resource's
+ * `dependencies` and `parent`, kept only when the target is a node. Inputs and
+ * outputs are not copied into the node, since an export can hold secrets.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+import type { EntityReference } from "@intentius/chant/graph-ir";
+
+/** The conventional place of the export, in the member's directory. */
+export const PULUMI_EXPORT_FILE = "stack-export.json";
+
+export interface PulumiMemberConfig {
+  /** The member's directory, absolute. */
+  dir: string;
+  /** Names the entities (`<label>/...`): the member's name. */
+  label?: string;
+}
+
+/** What the read found, carried on the graph's `meta.pulumiMember`. */
+export interface PulumiMemberReport {
+  /** The export read, relative to the member's directory. */
+  export?: string;
+  objects: number;
+  /** False when the member has no readable export. */
+  exported: boolean;
+  /** Why nothing was read; set with `exported: false`. */
+  reason?: string;
+}
+
+interface ExportedResource {
+  urn?: unknown;
+  type?: unknown;
+  parent?: unknown;
+  dependencies?: unknown;
+}
+
+const PROVIDER = /^pulumi:providers:/;
+
+/** `urn:pulumi:<stack>::<project>::<tail>`: the tail, or the whole URN when it has another shape. */
+function urnTail(urn: string): string {
+  const parts = urn.split("::");
+  return urn.startsWith("urn:pulumi:") && parts.length >= 4 ? parts.slice(2).join("::") : urn;
+}
+
+export function readPulumiMember(opts: { member: PulumiMemberConfig }): {
+  entities: Map<string, Declarable>;
+  warnings: string[];
+  report: PulumiMemberReport;
+} {
+  const { member } = opts;
+  const label = member.label ?? basename(member.dir);
+  const missing = (reason: string) => ({
+    entities: new Map<string, Declarable>(),
+    warnings: [`pulumi member "${label}" was not read: ${reason}`],
+    report: { objects: 0, exported: false, reason } as PulumiMemberReport,
+  });
+
+  const file = join(member.dir, PULUMI_EXPORT_FILE);
+  if (!existsSync(file)) {
+    return missing(`no ${PULUMI_EXPORT_FILE} in the member; run \`pulumi stack export --file ${PULUMI_EXPORT_FILE}\` and check it in, and chant will read it (chant does not run the program)`);
+  }
+  let resources: ExportedResource[];
+  try {
+    const doc = JSON.parse(readFileSync(file, "utf-8")) as { deployment?: { resources?: unknown } };
+    const list = doc?.deployment?.resources;
+    if (list !== undefined && !Array.isArray(list)) return missing(`${PULUMI_EXPORT_FILE} has a deployment.resources that is not a list`);
+    resources = (list ?? []) as ExportedResource[];
+  } catch (e) {
+    return missing(`${PULUMI_EXPORT_FILE} is not readable JSON: ${(e as Error).message}`);
+  }
+
+  const keyOf = new Map<string, string>();
+  for (const r of resources) {
+    if (typeof r?.urn !== "string" || typeof r.type !== "string" || PROVIDER.test(r.type)) continue;
+    keyOf.set(r.urn, `${label}/${urnTail(r.urn)}`);
+  }
+
+  const entities = new Map<string, Declarable>();
+  for (const r of resources) {
+    const key = typeof r?.urn === "string" ? keyOf.get(r.urn) : undefined;
+    if (!key) continue;
+    const references = new Map<string, EntityReference>();
+    const add = (urn: unknown, via: string) => {
+      const to = typeof urn === "string" ? keyOf.get(urn) : undefined;
+      if (to && to !== key) references.set(`${to}|${via}`, { to, viaAttr: via });
+    };
+    add(r.parent, "parent");
+    for (const d of Array.isArray(r.dependencies) ? r.dependencies : []) add(d, "dependencies");
+    entities.set(key, {
+      lexicon: "terraform",
+      entityType: r.type as string,
+      kind: "resource",
+      props: {},
+      references: [...references.values()],
+      [DECLARABLE_MARKER]: true,
+    } as unknown as Declarable);
+  }
+
+  return { entities, warnings: [], report: { export: PULUMI_EXPORT_FILE, objects: entities.size, exported: true } };
+}
+
+let lastReport: PulumiMemberReport | undefined;
+
+/** The report of the read in this process, left for `graphMeta` (see the aws member reader). */
+export function setLastMemberReport(report: PulumiMemberReport | undefined): void {
+  lastReport = report;
+}
+
+export function lastMemberReport(): PulumiMemberReport | undefined {
+  return lastReport;
+}

package/workspace-kinds.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Member kinds this lexicon supplies to a chant workspace (#2545). chant reads this file as data and never imports the lexicon. Both probes are behold's, narrowed to the member's own directory: a choudoufu estate is a Terraform root with an estate.chdf.hcl sidecar or a live block, and the lexicon's choudoufu mode (#2103) reads it, so the kind lives here. Each kind's graph block is how chant workspace graph reads a member (#2874): a reader project with this lexicon and one root named for the member, with moduleRoot at the workspace root so a member's ../modules calls stay readable.",
+  "$comment": "Member kinds this lexicon supplies to a chant workspace (#2545). chant reads this file as data and never imports the lexicon. Both probes are behold's, narrowed to the member's own directory: a choudoufu estate is a Terraform root with an estate.chdf.hcl sidecar or a live block, and the lexicon's choudoufu mode (#2103) reads it, so the kind lives here. Each kind's graph block is how chant workspace graph reads a member (#2874): a reader project with this lexicon and one root named for the member, with moduleRoot at the workspace root so a member's ../modules calls stay readable. The pulumi kind (#3179) is here because no lexicon knows Pulumi and this one already supplies the other infrastructure-as-code engines' kinds; its graph block reads the pulumi stack export checked in beside Pulumi.yaml as stack-export.json (src/workspace-member.ts); chant never runs the program, and with no export the member has no nodes and meta.pulumiMember says why.",
   "schema": 1,
   "kinds": [
     {
@@ -52,6 +52,29 @@
           }
         }
       }
+    },
+    {
+      "name": "pulumi",
+      "description": "a Pulumi program, with a Pulumi.yaml in its directory",
+      "precedence": 310,
+      "probe": {
+        "anyFile": [
+          "Pulumi.yaml"
+        ]
+      },
+      "memberFile": {
+        "path": "Pulumi.yaml",
+        "schema": "schemas/pulumi.schema.json"
+      },
+      "graph": {
+        "lexicon": "terraform",
+        "config": {
+          "pulumiMember": {
+            "dir": "{dir}",
+            "label": "{member}"
+          }
+        }
+      }
     }
   ]
 }