@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/src/state/store.ts

@@ -0,0 +1,225 @@
+/**
+ * A state where it is, opened for its lock and for what a run keeps beside
+ * it. Each backend locks its own way:
+ *
+ *   s3       the lock file `use_lockfile` takes, `<key>.tflock`, written only
+ *            when absent
+ *   gcs      the lock object `<prefix>/<workspace>.tflock`, written only when
+ *            absent; the ID `force-unlock` takes is its generation
+ *   azurerm  a lease on the state blob, with the lock info base64 in its
+ *            `terraformlockid` metadata; the binary cannot write the blob
+ *            while chant holds the lease, so the store writes it
+ *   local    a lock file `<path>.tflock` beside the state, created only when
+ *            absent. It keeps another chant run out; the binary's own local
+ *            lock is a file lock it takes per command, so the run writes
+ *            with `-lock=false` while it holds this one. A bare
+ *            `terraform apply` on the same checkout at the same time is not
+ *            kept out. Ruled on #4481 (ruling 4, 2026-10-25): chant's own
+ *            lock file, no Terraform lock-info file, local backends allowed.
+ *
+ * Lifted from terragucci's `backend.ts` (c493e0e): `StateStore`, `s3Store`,
+ * `gcsStore` and `azureStore`, plus a local store and `removeBeside`.
+ */
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join } from "node:path";
+import { AzureBlobClient, type AzureTarget } from "./azure-blob";
+import type { AzureState, GcsState, LocalState, LockableState, S3State } from "./backend";
+import { GcsClient } from "./gcs";
+import { StoreError, type StoreFetch } from "./object-store";
+import { S3Client } from "./s3";
+
+/** The lock a state's backend holds: the ID `force-unlock` takes, and the lock info the binary (or a run) wrote. */
+export interface LockHolder {
+  id: string;
+  /** The lock info as written, JSON. */
+  info: string;
+}
+
+/** A state where it is, for what locks it and keeps beside it. */
+export interface StateStore {
+  readonly backend: LockableState["backend"];
+  /** Where the state is. */
+  readonly location: string;
+  /** Where its lock is: the lock object, or the blob whose lease is the lock. */
+  readonly lockLocation: string;
+  /** The lock the backend holds now, or undefined. */
+  heldLock(): Promise<LockHolder | undefined>;
+  /** Take the state's lock with `info`, the way the backend takes it: false when it is held. */
+  lock(info: string): Promise<boolean>;
+  /** Release the lock `lock` took, or the one `adopt` took over. */
+  unlock(): Promise<void>;
+  /**
+   * Write a new state under the lock, for a backend whose lock keeps the
+   * binary from writing (azurerm's lease); undefined for a backend the
+   * binary writes with `-lock=false` while the run holds the lock.
+   */
+  write?: (body: string) => Promise<void>;
+  /**
+   * The object beside the state whose key is the state's with `suffix` after
+   * it, in the same bucket, container or directory, under the state's own
+   * access controls: read (undefined when there is none), written, removed.
+   */
+  readBeside(suffix: string): Promise<string | undefined>;
+  writeBeside(suffix: string, body: string): Promise<void>;
+  removeBeside(suffix: string): Promise<void>;
+  /** Where the object beside the state with `suffix` is, for messages. */
+  besideLocation(suffix: string): string;
+  /**
+   * Take over a lock this store finds held, which an earlier run of the same
+   * operation left held on purpose: `unlock` then releases it. A lease
+   * (azurerm) is taken over by its ID, the others need nothing.
+   */
+  adopt(held: LockHolder): void;
+}
+
+/** The ID in a lock info's JSON, or "" when it names none. */
+export function lockId(text: string): string {
+  try {
+    const v = JSON.parse(text) as { ID?: unknown };
+    return typeof v.ID === "string" ? v.ID : "";
+  } catch {
+    return "";
+  }
+}
+
+const JSON_TYPE = "application/json";
+
+/** The S3 state, locked by the lock file `use_lockfile` takes. */
+function s3Store(o: S3State, fetchFn?: StoreFetch): StateStore {
+  const client = new S3Client(o.target, fetchFn);
+  const lockKey = `${o.key}.tflock`;
+  return {
+    backend: "s3",
+    location: `s3://${o.bucket}/${o.key}`,
+    lockLocation: `s3://${o.bucket}/${lockKey}`,
+    heldLock: async () => {
+      const text = await client.get(lockKey);
+      return text === undefined ? undefined : { id: lockId(text), info: text };
+    },
+    lock: (info) => client.putIfAbsent(lockKey, info, JSON_TYPE),
+    unlock: () => client.remove(lockKey),
+    readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+    writeBeside: (suffix, body) => client.put(`${o.key}${suffix}`, body, JSON_TYPE),
+    removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+    besideLocation: (suffix) => `s3://${o.bucket}/${o.key}${suffix}`,
+    adopt: () => {},
+  };
+}
+
+/** The GCS state, locked by `<prefix>/<workspace>.tflock`, whose generation is the lock's ID. */
+function gcsStore(o: GcsState, fetchFn?: StoreFetch): StateStore {
+  const client = new GcsClient(o.target, fetchFn);
+  return {
+    backend: "gcs",
+    location: `gs://${o.bucket}/${o.key}`,
+    lockLocation: `gs://${o.bucket}/${o.lock}`,
+    heldLock: async () => {
+      const head = await client.head(o.lock);
+      const info = head.exists ? await client.get(o.lock) : undefined;
+      if (!head.exists || info === undefined) return undefined;
+      return { id: head.generation ?? lockId(info), info };
+    },
+    lock: (info) => client.putIfAbsent(o.lock, info, JSON_TYPE),
+    unlock: () => client.remove(o.lock),
+    readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+    writeBeside: (suffix, body) => client.put(`${o.key}${suffix}`, body, JSON_TYPE),
+    removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+    besideLocation: (suffix) => `gs://${o.bucket}/${o.key}${suffix}`,
+    adopt: () => {},
+  };
+}
+
+/** The metadata an azurerm backend keeps a lock's info in, base64 JSON, on the leased blob. */
+export const LOCK_METADATA = "terraformlockid";
+
+/** The azurerm state blob, locked by a lease on it with the lock info in its metadata. */
+function azureStore(o: AzureState, fetchFn?: StoreFetch): StateStore {
+  const client = new AzureBlobClient({ account: o.account, container: o.container, endpoint: o.endpoint, ...o.auth } as AzureTarget, fetchFn);
+  let leaseId: string | undefined;
+  const at = `az://${o.account}/${o.container}/${o.key}`;
+  return {
+    backend: "azurerm",
+    location: at,
+    lockLocation: at,
+    heldLock: async () => {
+      const head = await client.head(o.key);
+      if (!head.exists || head.leaseState !== "leased") return undefined;
+      const meta = head.metadata[LOCK_METADATA];
+      const info = meta ? Buffer.from(meta, "base64").toString("utf-8") : "";
+      return { id: lockId(info), info };
+    },
+    lock: async (info) => {
+      const id = lockId(info);
+      // The backend leases a blob that is there: a state with none yet gets an empty one first, as the backend makes it.
+      if (!(await client.head(o.key)).exists) await client.putBlob(o.key, "", JSON_TYPE, { ifNoneMatch: true });
+      if (!(await client.lease(o.key, "acquire", id))) return false;
+      leaseId = id;
+      await client.setMetadata(o.key, { [LOCK_METADATA]: Buffer.from(info).toString("base64") }, id);
+      return true;
+    },
+    unlock: async () => {
+      if (!leaseId) return;
+      const id = leaseId;
+      await client.setMetadata(o.key, {}, id);
+      await client.lease(o.key, "release", id);
+      leaseId = undefined;
+    },
+    write: async (body) => {
+      if (!leaseId) throw new StoreError(`${at} is written under its lease, and none is held`);
+      // As the backend writes it: a snapshot first when it takes snapshots, and the lock info kept on the blob.
+      if (o.snapshot && (await client.head(o.key)).exists) await client.snapshot(o.key);
+      const meta = (await client.head(o.key)).metadata;
+      await client.putBlob(o.key, body, JSON_TYPE, { leaseId, metadata: meta });
+    },
+    readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+    writeBeside: async (suffix, body) => void (await client.putBlob(`${o.key}${suffix}`, body, JSON_TYPE)),
+    removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+    besideLocation: (suffix) => `${at}${suffix}`,
+    adopt: (held) => {
+      leaseId = held.id;
+    },
+  };
+}
+
+/** A local state, locked by `<path>.tflock` created only when absent. `dir` is the root the path is relative to. */
+function localStore(o: LocalState, dir: string): StateStore {
+  const file = isAbsolute(o.path) ? o.path : join(dir, o.path);
+  const lockFile = `${file}.tflock`;
+  const read = (f: string): string | undefined => (existsSync(f) ? readFileSync(f, "utf-8") : undefined);
+  return {
+    backend: "local",
+    location: file,
+    lockLocation: lockFile,
+    heldLock: async () => {
+      const text = read(lockFile);
+      return text === undefined ? undefined : { id: lockId(text), info: text };
+    },
+    lock: async (info) => {
+      mkdirSync(dirname(lockFile), { recursive: true });
+      try {
+        writeFileSync(lockFile, info, { flag: "wx" });
+        return true;
+      } catch (e) {
+        if ((e as NodeJS.ErrnoException).code === "EEXIST") return false;
+        throw e;
+      }
+    },
+    unlock: async () => rmSync(lockFile, { force: true }),
+    readBeside: async (suffix) => read(`${file}${suffix}`),
+    writeBeside: async (suffix, body) => {
+      mkdirSync(dirname(file), { recursive: true });
+      writeFileSync(`${file}${suffix}`, body);
+    },
+    removeBeside: async (suffix) => rmSync(`${file}${suffix}`, { force: true }),
+    besideLocation: (suffix) => `${file}${suffix}`,
+    adopt: () => {},
+  };
+}
+
+/** The store a state is in, opened with the credentials stateObject chose. `dir` is the root a local path is relative to. */
+export function stateStore(o: LockableState, dir: string, fetchFn?: StoreFetch): StateStore {
+  if (o.backend === "s3") return s3Store(o, fetchFn);
+  if (o.backend === "gcs") return gcsStore(o, fetchFn);
+  if (o.backend === "azurerm") return azureStore(o, fetchFn);
+  return localStore(o, dir);
+}

package/src/terragrunt/affected.ts

@@ -245,7 +245,8 @@ export function terragruntAffected(input: TerragruntAffectedInput): TerragruntAf
     const moduleDirs = terragruntModuleDirs(unit);
     const called = new Map<string, string>();
     for (const m of moduleDirs) {
-      for (const d of rootWatchPaths(input.dir, { dir: m })) if (!moduleDirs.includes(d) && !called.has(d)) called.set(d, m);
+      // Terragrunt runs tofu when it is installed, so a module's `.tofu` files count (chant#4457).
+      for (const d of rootWatchPaths(input.dir, { dir: m }, "tofu")) if (!moduleDirs.includes(d) && !called.has(d)) called.set(d, m);
     }
     const viaFile = new Map<string, string[]>();
     const viaCall = new Map<string, string[]>();

package/src/workspace-kinds.test.ts

@@ -8,7 +8,7 @@
 import { join } from "node:path";
 import { describe, expect, it } from "vitest";
 import { describeWorkspaceKindConformance } from "@intentius/chant-test-utils";
-import { checkMemberFile, loadMemberFileSchema, readPackageKinds } from "../../../packages/core/src/workspace/kinds";
+import { readPackageKinds } from "../../../packages/core/src/workspace/kinds";
 
 const main = `terraform {\n  required_version = ">= 1.5.0"\n}\n\nresource "null_resource" "x" {}\n`;
 
@@ -26,24 +26,11 @@ describeWorkspaceKindConformance({
     { name: "a root with the estate.chdf.hcl sidecar", kind: "choudoufu", files: { "main.tf": main, "estate.chdf.hcl": "" }, claims: true },
     { name: "a root with a live block", kind: "choudoufu", files: { "main.tf": main + '\nlive {\n  name = "prod"\n}\n' }, claims: true },
     { name: "a stock root", kind: "choudoufu", files: { "main.tf": main }, claims: false },
-    // The pulumi kind (#3179) is a probe and a check of Pulumi.yaml.
-    { name: "a Pulumi program", kind: "pulumi", files: { "Pulumi.yaml": "name: app\nruntime: nodejs\n", "index.ts": "" }, claims: true },
-    { name: "a Pulumi program one level down", kind: "pulumi", files: { "infra/Pulumi.yaml": "name: app\nruntime: nodejs\n" }, claims: false },
-    { name: "a stack file alone", kind: "pulumi", files: { "Pulumi.dev.yaml": "config: {}\n" }, claims: false },
   ],
 });
 
-describe("pulumi member file", () => {
-  const packageDir = join(import.meta.dirname, "..");
-  const memberFile = readPackageKinds(packageDir).kinds.find((k) => k.name === "pulumi")!.memberFile!;
-  it("names a schema that loads", () => {
-    expect(loadMemberFileSchema(memberFile, packageDir)).toBeUndefined();
-  });
-  it("passes a program with a runtime, named or in an object", () => {
-    expect(checkMemberFile(memberFile, "Pulumi.yaml", "name: app\nruntime: nodejs\n")).toEqual([]);
-    expect(checkMemberFile(memberFile, "Pulumi.yaml", "name: app\nruntime:\n  name: python\n")).toEqual([]);
-  });
-  it("fails one with no runtime", () => {
-    expect(checkMemberFile(memberFile, "Pulumi.yaml", "name: app\n").length).toBeGreaterThan(0);
+describe("the pulumi kind", () => {
+  it("is not here: it moved to the pulumi lexicon (#4453)", () => {
+    expect(readPackageKinds(join(import.meta.dirname, "..")).kinds.map((k) => k.name)).not.toContain("pulumi");
   });
 });

package/workspace-kinds.json

@@ -1,5 +1,5 @@
 {
-  "$comment": "Member kinds this lexicon supplies to a chant workspace (#2545). chant reads this file as data and never imports the lexicon. Both probes are behold's, narrowed to the member's own directory: a choudoufu estate is a Terraform root with an estate.chdf.hcl sidecar or a live block, and the lexicon's choudoufu mode (#2103) reads it, so the kind lives here. Each kind's graph block is how chant workspace graph reads a member (#2874): a reader project with this lexicon and one root named for the member, with moduleRoot at the workspace root so a member's ../modules calls stay readable. The pulumi kind (#3179) is here because no lexicon knows Pulumi and this one already supplies the other infrastructure-as-code engines' kinds; its graph block reads the pulumi stack export checked in beside Pulumi.yaml as stack-export.json (src/workspace-member.ts); chant never runs the program, and with no export the member has no nodes and meta.pulumiMember says why.",
+  "$comment": "Member kinds this lexicon supplies to a chant workspace (#2545). chant reads this file as data and never imports the lexicon. Both probes are behold's, narrowed to the member's own directory: a choudoufu estate is a Terraform root with an estate.chdf.hcl sidecar or a live block, and the lexicon's choudoufu mode (#2103) reads it, so the kind lives here. Each kind's graph block is how chant workspace graph reads a member (#2874): a reader project with this lexicon and one root named for the member, with moduleRoot at the workspace root so a member's ../modules calls stay readable. The pulumi kind moved to @intentius/chant-lexicon-pulumi (#4453).",
   "schema": 1,
   "kinds": [
     {
@@ -52,29 +52,6 @@
           }
         }
       }
-    },
-    {
-      "name": "pulumi",
-      "description": "a Pulumi program, with a Pulumi.yaml in its directory",
-      "precedence": 310,
-      "probe": {
-        "anyFile": [
-          "Pulumi.yaml"
-        ]
-      },
-      "memberFile": {
-        "path": "Pulumi.yaml",
-        "schema": "schemas/pulumi.schema.json"
-      },
-      "graph": {
-        "lexicon": "terraform",
-        "config": {
-          "pulumiMember": {
-            "dir": "{dir}",
-            "label": "{member}"
-          }
-        }
-      }
     }
   ]
 }

package/dist/workspace-member.d.ts

@@ -1,30 +0,0 @@
-import { type Declarable } from "@intentius/chant/declarable";
-/** The conventional place of the export, in the member's directory. */
-export declare const PULUMI_EXPORT_FILE = "stack-export.json";
-export interface PulumiMemberConfig {
-    /** The member's directory, absolute. */
-    dir: string;
-    /** Names the entities (`<label>/...`): the member's name. */
-    label?: string;
-}
-/** What the read found, carried on the graph's `meta.pulumiMember`. */
-export interface PulumiMemberReport {
-    /** The export read, relative to the member's directory. */
-    export?: string;
-    objects: number;
-    /** False when the member has no readable export. */
-    exported: boolean;
-    /** Why nothing was read; set with `exported: false`. */
-    reason?: string;
-}
-export declare function readPulumiMember(opts: {
-    member: PulumiMemberConfig;
-}): {
-    entities: Map<string, Declarable>;
-    warnings: string[];
-    report: PulumiMemberReport;
-};
-/** The report of the read in this process, left for `graphMeta` (see the aws member reader). */
-export declare function setLastMemberReport(report: PulumiMemberReport | undefined): void;
-export declare function lastMemberReport(): PulumiMemberReport | undefined;
-//# sourceMappingURL=workspace-member.d.ts.map

package/dist/workspace-member.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workspace-member.d.ts","sourceRoot":"","sources":["../src/workspace-member.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAGjF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAAG;IACtE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE,kBAAkB,CAAC;CAC5B,CAmDA;AAID,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,IAAI,CAEhF;AAED,wBAAgB,gBAAgB,IAAI,kBAAkB,GAAG,SAAS,CAEjE"}

package/dist/workspace-member.js

@@ -1,91 +0,0 @@
-/**
- * Reading a pulumi workspace member into the graph (#3179).
- *
- * `chant workspace graph` writes a reader project for a member of kind
- * `pulumi`, with `terraform.pulumiMember` in its config (see
- * `workspace-kinds.json`). The plugin's `buildRoots` hook calls
- * {@link readPulumiMember}, which reads the `pulumi stack export` JSON the
- * member has checked in, at {@link PULUMI_EXPORT_FILE} in its directory. chant
- * never runs the program and never calls `pulumi`: with no export there are no
- * nodes, and `meta.pulumiMember` says `exported: false` and why.
- *
- * Nodes are the export's resources, keyed `<label>/<urn tail>`, where the tail
- * is the URN after its stack and project (`aws:s3/bucket:Bucket::assets`).
- * Provider resources (`pulumi:providers:*`) are left out; the resources that
- * name them are not edged to them. Edges come from each resource's
- * `dependencies` and `parent`, kept only when the target is a node. Inputs and
- * outputs are not copied into the node, since an export can hold secrets.
- */
-import { existsSync, readFileSync } from "node:fs";
-import { basename, join } from "node:path";
-import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
-/** The conventional place of the export, in the member's directory. */
-export const PULUMI_EXPORT_FILE = "stack-export.json";
-const PROVIDER = /^pulumi:providers:/;
-/** `urn:pulumi:<stack>::<project>::<tail>`: the tail, or the whole URN when it has another shape. */
-function urnTail(urn) {
-    const parts = urn.split("::");
-    return urn.startsWith("urn:pulumi:") && parts.length >= 4 ? parts.slice(2).join("::") : urn;
-}
-export function readPulumiMember(opts) {
-    const { member } = opts;
-    const label = member.label ?? basename(member.dir);
-    const missing = (reason) => ({
-        entities: new Map(),
-        warnings: [`pulumi member "${label}" was not read: ${reason}`],
-        report: { objects: 0, exported: false, reason },
-    });
-    const file = join(member.dir, PULUMI_EXPORT_FILE);
-    if (!existsSync(file)) {
-        return missing(`no ${PULUMI_EXPORT_FILE} in the member; run \`pulumi stack export --file ${PULUMI_EXPORT_FILE}\` and check it in, and chant will read it (chant does not run the program)`);
-    }
-    let resources;
-    try {
-        const doc = JSON.parse(readFileSync(file, "utf-8"));
-        const list = doc?.deployment?.resources;
-        if (list !== undefined && !Array.isArray(list))
-            return missing(`${PULUMI_EXPORT_FILE} has a deployment.resources that is not a list`);
-        resources = (list ?? []);
-    }
-    catch (e) {
-        return missing(`${PULUMI_EXPORT_FILE} is not readable JSON: ${e.message}`);
-    }
-    const keyOf = new Map();
-    for (const r of resources) {
-        if (typeof r?.urn !== "string" || typeof r.type !== "string" || PROVIDER.test(r.type))
-            continue;
-        keyOf.set(r.urn, `${label}/${urnTail(r.urn)}`);
-    }
-    const entities = new Map();
-    for (const r of resources) {
-        const key = typeof r?.urn === "string" ? keyOf.get(r.urn) : undefined;
-        if (!key)
-            continue;
-        const references = new Map();
-        const add = (urn, via) => {
-            const to = typeof urn === "string" ? keyOf.get(urn) : undefined;
-            if (to && to !== key)
-                references.set(`${to}|${via}`, { to, viaAttr: via });
-        };
-        add(r.parent, "parent");
-        for (const d of Array.isArray(r.dependencies) ? r.dependencies : [])
-            add(d, "dependencies");
-        entities.set(key, {
-            lexicon: "terraform",
-            entityType: r.type,
-            kind: "resource",
-            props: {},
-            references: [...references.values()],
-            [DECLARABLE_MARKER]: true,
-        });
-    }
-    return { entities, warnings: [], report: { export: PULUMI_EXPORT_FILE, objects: entities.size, exported: true } };
-}
-let lastReport;
-/** The report of the read in this process, left for `graphMeta` (see the aws member reader). */
-export function setLastMemberReport(report) {
-    lastReport = report;
-}
-export function lastMemberReport() {
-    return lastReport;
-}

package/schemas/pulumi.schema.json

@@ -1,34 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "title": "Pulumi.yaml",
-  "type": "object",
-  "required": [
-    "name",
-    "runtime"
-  ],
-  "properties": {
-    "name": {
-      "type": "string",
-      "minLength": 1
-    },
-    "runtime": {
-      "anyOf": [
-        {
-          "type": "string",
-          "minLength": 1
-        },
-        {
-          "type": "object",
-          "required": [
-            "name"
-          ],
-          "properties": {
-            "name": {
-              "type": "string"
-            }
-          }
-        }
-      ]
-    }
-  }
-}

package/src/testdata/pulumi-member/Pulumi.yaml

@@ -1,2 +0,0 @@
-name: app
-runtime: nodejs

package/src/testdata/pulumi-member/stack-export.json

@@ -1,53 +0,0 @@
-{
-  "version": 3,
-  "deployment": {
-    "manifest": { "time": "2026-10-20T12:00:00Z", "magic": "x", "version": "v3.100.0" },
-    "resources": [
-      { "urn": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev", "custom": false, "type": "pulumi:pulumi:Stack" },
-      { "urn": "urn:pulumi:dev::app::pulumi:providers:aws::default", "custom": true, "id": "p1", "type": "pulumi:providers:aws" },
-      {
-        "urn": "urn:pulumi:dev::app::aws:s3/bucket:Bucket::assets",
-        "custom": true,
-        "id": "assets-1",
-        "type": "aws:s3/bucket:Bucket",
-        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev",
-        "provider": "urn:pulumi:dev::app::pulumi:providers:aws::default::p1",
-        "inputs": { "acl": "private" }
-      },
-      {
-        "urn": "urn:pulumi:dev::app::aws:iam/role:Role::web",
-        "custom": true,
-        "id": "web-1",
-        "type": "aws:iam/role:Role",
-        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev"
-      },
-      {
-        "urn": "urn:pulumi:dev::app::aws:iam/rolePolicy:RolePolicy::webReadsAssets",
-        "custom": true,
-        "id": "web-1:read",
-        "type": "aws:iam/rolePolicy:RolePolicy",
-        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev",
-        "dependencies": [
-          "urn:pulumi:dev::app::aws:iam/role:Role::web",
-          "urn:pulumi:dev::app::aws:s3/bucket:Bucket::assets",
-          "urn:pulumi:dev::app::aws:s3/bucket:Bucket::elsewhere"
-        ],
-        "inputs": { "policy": { "4dabf18193072939515568f2c6568e55": "1b47061264138c4ac30d75fd1eb44270", "ciphertext": "secret" } }
-      },
-      {
-        "urn": "urn:pulumi:dev::app::my:mod:Web$aws:lambda/function:Function::handler",
-        "custom": true,
-        "id": "fn",
-        "type": "aws:lambda/function:Function",
-        "parent": "urn:pulumi:dev::app::my:mod:Web::web-app",
-        "dependencies": ["urn:pulumi:dev::app::aws:iam/role:Role::web"]
-      },
-      {
-        "urn": "urn:pulumi:dev::app::my:mod:Web::web-app",
-        "custom": false,
-        "type": "my:mod:Web",
-        "parent": "urn:pulumi:dev::app::pulumi:pulumi:Stack::app-dev"
-      }
-    ]
-  }
-}

package/src/testdata/pulumi-unexported/Pulumi.yaml

@@ -1,2 +0,0 @@
-name: app
-runtime: nodejs

package/src/workspace-member.test.ts

@@ -1,89 +0,0 @@
-/**
- * The pulumi member kind's graph block (#3179): the reader project the kind's
- * graph config describes, run through chant graph over a checked-in
- * `pulumi stack export`. Nothing here runs Pulumi.
- */
-import { afterEach, describe, expect, test, vi } from "vitest";
-import { dirname, join } from "node:path";
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import type { GraphIR } from "@intentius/chant/graph-ir";
-import { runGraph } from "@intentius/chant/cli/handlers/graph";
-import { readPackageKinds, substituteGraphConfig } from "../../../packages/core/src/workspace/kinds";
-import { terraformPlugin } from "./plugin";
-
-const packageDir = join(import.meta.dirname, "..");
-const member = join(import.meta.dirname, "testdata", "pulumi-member");
-
-const scratch: string[] = [];
-afterEach(async () => {
-  vi.restoreAllMocks();
-  await Promise.all(scratch.splice(0).map((d) => rm(d, { recursive: true, force: true })));
-});
-
-async function graphOf(dir: string): Promise<{ ir: GraphIR; err: string[]; exit: number }> {
-  const graph = readPackageKinds(packageDir).kinds.find((k) => k.name === "pulumi")!.graph!;
-  expect(graph.lexicon).toBe("terraform");
-  const config = substituteGraphConfig(graph.config, { member: "infra", dir, workspace: dirname(dir) });
-  const project = await mkdtemp(join(tmpdir(), "chant-pulumi-member-"));
-  scratch.push(project);
-  await writeFile(join(project, "chant.config.json"), JSON.stringify({ lexicons: ["terraform"], terraform: config, graph: { lint: "report" } }));
-  const out: string[] = [];
-  const err: string[] = [];
-  vi.spyOn(console, "log").mockImplementation((line: unknown) => void out.push(String(line)));
-  vi.spyOn(console, "error").mockImplementation((line: unknown) => void err.push(String(line)));
-  const cwd = process.cwd();
-  process.chdir(project);
-  try {
-    const exit = await runGraph({ args: { command: "graph", path: ".", format: "ir" } as never, plugins: [terraformPlugin], serializers: [] });
-    return { ir: exit === 0 ? (JSON.parse(out.join("\n")) as GraphIR) : { nodes: [], edges: [], groups: {} }, err, exit };
-  } finally {
-    process.chdir(cwd);
-  }
-}
-
-describe("pulumi member graph block (#3179)", () => {
-  test("the export's resources are nodes; provider resources are left out", async () => {
-    const { ir, err, exit } = await graphOf(member);
-    expect(exit, err.join("\n")).toBe(0);
-    expect(ir.nodes.map((n) => [n.id, n.kind]).sort()).toEqual([
-      ["infra/aws:iam/role:Role::web", "aws:iam/role:Role"],
-      ["infra/aws:iam/rolePolicy:RolePolicy::webReadsAssets", "aws:iam/rolePolicy:RolePolicy"],
-      ["infra/aws:s3/bucket:Bucket::assets", "aws:s3/bucket:Bucket"],
-      ["infra/my:mod:Web$aws:lambda/function:Function::handler", "aws:lambda/function:Function"],
-      ["infra/my:mod:Web::web-app", "my:mod:Web"],
-      ["infra/pulumi:pulumi:Stack::app-dev", "pulumi:pulumi:Stack"],
-    ]);
-    expect(ir.meta?.pulumiMember).toEqual({ export: "stack-export.json", objects: 6, exported: true });
-  });
-
-  test("dependencies and parent are edges; a dependency outside the export is not", async () => {
-    const { ir } = await graphOf(member);
-    const edges = ir.edges.map((e) => `${e.from.slice(6)} -> ${e.to.slice(6)} via ${e.viaAttr}`).sort();
-    expect(edges).toEqual([
-      "aws:iam/role:Role::web -> pulumi:pulumi:Stack::app-dev via parent",
-      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> aws:iam/role:Role::web via dependencies",
-      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> aws:s3/bucket:Bucket::assets via dependencies",
-      "aws:iam/rolePolicy:RolePolicy::webReadsAssets -> pulumi:pulumi:Stack::app-dev via parent",
-      "aws:s3/bucket:Bucket::assets -> pulumi:pulumi:Stack::app-dev via parent",
-      "my:mod:Web$aws:lambda/function:Function::handler -> aws:iam/role:Role::web via dependencies",
-      "my:mod:Web$aws:lambda/function:Function::handler -> my:mod:Web::web-app via parent",
-      "my:mod:Web::web-app -> pulumi:pulumi:Stack::app-dev via parent",
-    ]);
-  });
-
-  test("inputs are not copied into the graph", async () => {
-    const { ir } = await graphOf(member);
-    expect(JSON.stringify(ir)).not.toContain("ciphertext");
-  });
-
-  test("a program with no export has no nodes, and the member says why", async () => {
-    const { ir, err, exit } = await graphOf(join(import.meta.dirname, "testdata", "pulumi-unexported"));
-    expect(exit, err.join("\n")).toBe(0);
-    expect(ir.nodes).toEqual([]);
-    const report = ir.meta?.pulumiMember as { exported: boolean; reason: string };
-    expect(report.exported).toBe(false);
-    expect(report.reason).toMatch(/pulumi stack export/);
-    expect(err.join("\n")).toMatch(/was not read/);
-  });
-});