@intentius/plywood 0.0.0 → 0.1.0

package/dist/plywood.mjs

@@ -578,10 +578,13 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.0.0";
+    version = "0.1.0";
     dependencies = {
-      "@intentius/chant": "0.124.55",
-      "@intentius/chant-lexicon-pulumi": "0.124.55"
+      "@intentius/chant": "0.124.57",
+      "@intentius/chant-lexicon-forgejo": "0.124.57",
+      "@intentius/chant-lexicon-github": "0.124.57",
+      "@intentius/chant-lexicon-gitlab": "0.124.57",
+      "@intentius/chant-lexicon-pulumi": "0.124.57"
     };
   }
 });
@@ -590,7 +593,10 @@ var init_package = __esm({
 var image_digests_default;
 var init_image_digests = __esm({
   "src/image-digests.json"() {
-    image_digests_default = {};
+    image_digests_default = {
+      "ghcr.io/intentius/plywood-pulumi:0.1.0-pulumi3.272.0": "sha256:730237bed59e0054e6839898658069a4bcbdab0ffb8f893487c864bc2f3436c8",
+      "ghcr.io/intentius/plywood-plunge:0.1.0-plunge0.1.0": "sha256:76a50f55cc2fd96c19e4ecb625a19863783374c9dc89d1606cc70a36635cc48d"
+    };
   }
 });
 
@@ -2600,44 +2606,11 @@ var init_chant_product = __esm({
   "src/chant-product.ts"() {
     "use strict";
     REQUIRED2 = ["assertProductWords", "productPipelineJobs", "approveLine", "runChantInProcess"];
-    BUILT_CHANT = true ? "0.124.55" : "unknown";
+    BUILT_CHANT = true ? "0.124.57" : "unknown";
   }
 });
 
 // src/chant-next.ts
-async function acceptsContentsWrite(load) {
-  try {
-    const m = await load();
-    if (typeof m.assertScheduledOpCloud !== "function") return false;
-    m.assertScheduledOpCloud(structuredClone(CONTENTS_WRITE_PROBE));
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function has(load, name, type = "function") {
-  try {
-    const m = await load();
-    return typeof m[name] === type;
-  } catch {
-    return false;
-  }
-}
-function chantNext() {
-  detected ??= (async () => ({
-    // @ts-ignore: the subpath is missing from chant 0.124.55 (chant#4624).
-    checkJob: await has(() => import("@intentius/chant/ci-job-guard"), "checkJob"),
-    planFlags: await has(() => import("@intentius/chant/components/capability"), "PLAN_FLAG_ARGS", "object"),
-    staleNotes: await has(() => import("@intentius/chant/pr-post"), "markStaleNotes"),
-    // @ts-ignore: the subpath is missing from chant 0.124.55 (chant#4631).
-    scheduledOpCloud: await has(() => import("@intentius/chant/scheduled-op-cloud"), "assertScheduledOpCloud"),
-    // @ts-ignore: the subpath is missing from chant 0.124.55 (chant#4631).
-    updateContentsWrite: await acceptsContentsWrite(() => import("@intentius/chant/scheduled-op-cloud")),
-    // @ts-ignore: the subpath is missing from chant 0.124.55 (chant#4636).
-    applyMerge: await has(() => import("@intentius/chant/pr-merge"), "mergeAfterApply")
-  }))();
-  return detected;
-}
 function hasChantRespond(chant) {
   return typeof chant?.CI_RESPOND_FLOOR === "string";
 }
@@ -2651,26 +2624,13 @@ function hasChantPullRequestApprovalStatus(chant) {
   return typeof chant?.APPROVAL_STATUS_PULL_REQUEST_FLOOR === "string";
 }
 function chantAudit() {
-  audit ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/ci-audit");
-      return typeof m.attributeDrift === "function" && typeof m.routeAttributions === "function" && typeof m.parseAuditLogSetting === "function" ? m : void 0;
-    } catch {
-      return void 0;
-    }
-  })();
+  audit ??= import("@intentius/chant/ci-audit").then((m) => m);
   return audit;
 }
-var CONTENTS_WRITE_PROBE, detected, audit;
+var audit;
 var init_chant_next = __esm({
   "src/chant-next.ts"() {
     "use strict";
-    CONTENTS_WRITE_PROBE = {
-      name: "plywood-probe",
-      trigger: { kind: "cron", schedule: "0 6 * * *" },
-      findingMode: "issue",
-      update: { command: "true", permissions: { contents: "write" } }
-    };
   }
 });
 
@@ -2875,6 +2835,74 @@ var init_review_stacks2 = __esm({
 // src/waves-workflow.ts
 import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
 import { dirname as dirname4, join as join4 } from "node:path";
+function wavesEngine(pipeline) {
+  const o = chantPipelineOptions({ ...pipeline.image ? { image: pipeline.image } : {}, ...pipeline.engineSetup ? { engineSetup: pipeline.engineSetup } : {} }, false);
+  return { ...o.image ? { image: o.image } : {}, ...o.beforeScript?.length ? { beforeScript: o.beforeScript } : {} };
+}
+function wavesSpecText(spec, engine2 = {}) {
+  const options = { ...engine2.image ? { image: engine2.image } : {}, ...engine2.beforeScript?.length ? { beforeScript: engine2.beforeScript } : {} };
+  return JSON.stringify(Object.keys(options).length ? { waves: spec, options } : spec, null, 2) + "\n";
+}
+function unwrapWavesSpec(doc) {
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return doc;
+  const inner = doc.waves;
+  if (Array.isArray(inner)) return doc;
+  return inner && typeof inner === "object" && Array.isArray(inner.waves) ? inner : doc;
+}
+function stepId(wave, target) {
+  return `${wave}-${target}`.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function upOpFile(spec) {
+  const s = spec ?? {};
+  const op = typeof s.op === "string" && s.op !== "" ? s.op : OP_NAME;
+  const taken = /* @__PURE__ */ new Set();
+  const phases = [];
+  for (const [i, w] of (s.waves ?? []).entries()) {
+    const name = typeof w.name === "string" && w.name !== "" ? w.name : `wave-${i + 1}`;
+    const steps = [];
+    for (const run of w.runs ?? []) {
+      const input = run.input ?? {};
+      if (typeof input.member !== "string" || typeof input.dir !== "string") continue;
+      let id = stepId(name, run.target);
+      for (let n = 2; taken.has(id); n++) id = `${stepId(name, run.target)}-${n}`;
+      taken.add(id);
+      const opts = [
+        `dir: ${JSON.stringify(input.dir)}`,
+        ...typeof input.stack === "string" ? [`stack: ${JSON.stringify(input.stack)}`] : [],
+        ...input.engine === "pulumi" || input.engine === "plunge" ? [`engine: ${JSON.stringify(input.engine)}`] : [],
+        `id: ${JSON.stringify(id)}`
+      ];
+      steps.push(`pulumiPreviewStep(${JSON.stringify(input.member)}, { ${opts.join(", ")} })`);
+    }
+    if (steps.length > 0) phases.push(`    phase(${JSON.stringify(name)}, [${steps.join(", ")}]),`);
+  }
+  return [
+    `// Written by '${PRODUCT} init' and '${PRODUCT} ci' from .chant/op-waves/${OP_NAME}.spec.json, and written again on each run: edit plywood.yml, not this file.`,
+    `// The waves workflow runs under this Op's name: each wave job previews and updates its stacks through the spec's`,
+    `// pulumi-up step and records the runs under ${op}. chant's generator needs the Op to exist. Run by hand`,
+    `// (npx chant run ${op}), it previews each stack in wave order and changes nothing.`,
+    `import { Op, phase } from "@intentius/chant/op";`,
+    `import { pulumiPreviewStep } from "@intentius/chant-lexicon-pulumi";`,
+    "",
+    "export default Op({",
+    `  name: ${JSON.stringify(op)},`,
+    `  overview: "The stacks ${PRODUCT}'s waves update on merge, previewed in wave order",`,
+    `  labels: { Surface: "${PRODUCT}-up" },`,
+    "  phases: [",
+    ...phases,
+    "  ],",
+    "});",
+    ""
+  ].join("\n");
+}
+function writeUpOp(cwd, spec) {
+  const path = join4(cwd, UP_OP_FILE);
+  const text = upOpFile(spec);
+  if (existsSync4(path) && readFileSync4(path, "utf8") === text) return false;
+  mkdirSync2(dirname4(path), { recursive: true });
+  writeFileSync2(path, text);
+  return true;
+}
 function binLines(waves, bin) {
   const binArgs = bin.split(/\s+/).filter(Boolean);
   return waves.jobs.map((job) => {
@@ -2894,15 +2922,16 @@ function generatedFor(dir, specFile) {
   if (!existsSync4(dir)) return [];
   return readdirSync2(dir).filter((f) => /\.ya?ml$/.test(f)).map((f) => join4(dir, f)).filter((p) => (readFileSync4(p, "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${specFile}`));
 }
-async function writeWaveJobs(chant, forge, waves, words, table, io) {
+async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}) {
   const specPath = join4(io.cwd, waves.specFile);
-  const specText = JSON.stringify(waves.spec, null, 2) + "\n";
+  const specText = wavesSpecText(waves.spec, engine2);
   const before = existsSync4(specPath) ? readFileSync4(specPath, "utf8") : void 0;
   if (before !== specText) {
     mkdirSync2(dirname4(specPath), { recursive: true });
     writeFileSync2(specPath, specText);
     io.err(`${PRODUCT} ci: wrote ${waves.specFile} with plywood's op and gates; commit it with the workflow`);
   }
+  if (writeUpOp(io.cwd, waves.spec)) io.err(`${PRODUCT} ci: wrote ${UP_OP_FILE}, the Op the waves spec names; commit it with the workflow`);
   const outDir = WAVES_OUTPUT_DIR[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", waves.specFile, "--output", outDir], words);
   if (code !== table.done) return code;
@@ -2925,17 +2954,19 @@ async function writeWaveJobs(chant, forge, waves, words, table, io) {
   }
   return table.done;
 }
-var WAVES_OUTPUT_DIR;
+var WAVES_OUTPUT_DIR, UP_OP_FILE;
 var init_waves_workflow = __esm({
   "src/waves-workflow.ts"() {
     "use strict";
     init_chant_product();
+    init_images();
     init_words();
     WAVES_OUTPUT_DIR = {
       github: ".github/workflows",
       forgejo: ".forgejo/workflows",
       gitlab: "."
     };
+    UP_OP_FILE = "ops/pulumi-up.op.ts";
   }
 });
 
@@ -3116,7 +3147,7 @@ __export(jobs_exports, {
   withJobSettings: () => withJobSettings
 });
 function hasChant4625() {
-  detected2 ??= (async () => {
+  detected ??= (async () => {
     try {
       const m = await import("@intentius/chant/parallelism");
       return typeof m.mapLimited === "function" && typeof m.parallelismProblem === "function";
@@ -3124,10 +3155,10 @@ function hasChant4625() {
       return false;
     }
   })();
-  return detected2;
+  return detected;
 }
-function setChant4625ForTests(has2) {
-  detected2 = has2 === "reset" ? void 0 : Promise.resolve(has2);
+function setChant4625ForTests(has) {
+  detected = has === "reset" ? void 0 : Promise.resolve(has);
 }
 function secretReference(forge, secret) {
   return forge === "gitlab" ? `$${secret}` : `\${{ secrets.${secret} }}`;
@@ -3228,7 +3259,7 @@ async function prJobsFor(pipeline) {
   const { flags, notes } = prLoopJobFlags(pipeline.jobs, pipeline.runner);
   return { options: prLoopJobOptions(pipeline.jobs, pipeline.runner), flags, notes };
 }
-var detected2, JOBS_NEED_CHANT, GROUP_NAME;
+var detected, JOBS_NEED_CHANT, GROUP_NAME;
 var init_jobs2 = __esm({
   "src/jobs.ts"() {
     "use strict";
@@ -3362,7 +3393,7 @@ function wavesSpecAt(cwd, file = WAVES_SPEC_FILE) {
   const path = join6(cwd, file);
   if (!existsSync6(path)) return void 0;
   try {
-    const spec = JSON.parse(readFileSync6(path, "utf8"));
+    const spec = unwrapWavesSpec(JSON.parse(readFileSync6(path, "utf8")));
     return spec && typeof spec === "object" && !Array.isArray(spec) ? spec : void 0;
   } catch {
     return void 0;
@@ -3450,7 +3481,7 @@ function readUpSpec(cwd, file = WAVES_SPEC_FILE) {
   if (!existsSync6(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
   let spec;
   try {
-    spec = JSON.parse(readFileSync6(path, "utf8"));
+    spec = unwrapWavesSpec(JSON.parse(readFileSync6(path, "utf8")));
   } catch (e) {
     return { error: `${file}: ${e.message}` };
   }
@@ -3549,20 +3580,15 @@ async function upBeforeMerge(number, args, json, table, io) {
       "--forge",
       forge,
       ...requiresArgv(chant, config2.doc),
-      ...await mergeArgv(config2.doc, io),
+      ...mergeArgv(config2.doc),
       ...json ? ["--json"] : []
     ];
     return explainRefusal(await chant.runChantInProcess(argv, PRODUCT_WORDS), table, io.err, { pr: number });
   });
 }
-async function mergeArgv(doc, io) {
+function mergeArgv(doc) {
   const merge = applyMergeOf(doc);
-  if (!merge) return [];
-  if (!(await chantNext()).applyMerge) {
-    io.err(`${PRODUCT}: ${APPLY_MERGE_NEEDS_CHANT}`);
-    return [];
-  }
-  return applyMergeArgv(merge);
+  return merge ? applyMergeArgv(merge) : [];
 }
 async function resume(args, json, table, io) {
   const op = takeFlag(args, "--op");
@@ -3597,6 +3623,7 @@ var init_up = __esm({
     init_review_stacks2();
     init_stages();
     init_words();
+    init_waves_workflow();
     OVERRIDE_OP = "policy-override";
     WAVES_SPEC_FILE = `.chant/op-waves/${OP_NAME}.spec.json`;
     UP_STEP_KIND = "pulumi-up";
@@ -3769,12 +3796,7 @@ async function readStack(chant, stack, dir, opts) {
 async function attributionFor(doc, io) {
   const logs = driftSettingsOf(doc).auditLogs;
   if (!logs) return void 0;
-  const audit3 = await chantAudit();
-  if (!audit3) {
-    io.err(`${PRODUCT} drift: ${ATTRIBUTION_NEEDS_CHANT}`);
-    return void 0;
-  }
-  return { audit: audit3, logs };
+  return { audit: await chantAudit(), logs };
 }
 function auditLogFor(logs, stack) {
   return Object.entries(logs).find(([glob]) => glob === "*" || glob === "**" || globMatches(glob, stack))?.[1];
@@ -3882,9 +3904,8 @@ async function writeDriftJobs(chant, forge, doc, words, table, io, env = "produc
     io.err(`${PRODUCT} ci: drift.schedule is set and plywood.yml lists no stacks, so no drift job was written`);
     return table.done;
   }
-  const next = await chantNext();
   if (writeIfChanged2(io.cwd, DRIFT_OP_FILE, driftOpFile(doc, settings.stacks, settings.schedule))) io.err(`${PRODUCT} ci: wrote ${DRIFT_OP_FILE}; commit it with the workflow`);
-  if (writeIfChanged2(io.cwd, DRIFT_SPEC_FILE, JSON.stringify(driftOpSpec(doc, forge, settings.stacks, settings.schedule, chant, { cloud: next.scheduledOpCloud, contentsWrite: next.updateContentsWrite, env }), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${DRIFT_SPEC_FILE}`);
+  if (writeIfChanged2(io.cwd, DRIFT_SPEC_FILE, JSON.stringify(driftOpSpec(doc, forge, settings.stacks, settings.schedule, chant, { cloud: true, contentsWrite: true, env }), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${DRIFT_SPEC_FILE}`);
   const outDir = OP_OUTPUT_DIR2[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", DRIFT_SPEC_FILE, "--output", outDir], words);
   if (code !== table.done) return code;
@@ -3894,7 +3915,7 @@ async function writeDriftJobs(chant, forge, doc, words, table, io, env = "produc
   if (files.length && forge === "gitlab") io.err(`${PRODUCT} ci: GitLab runs the drift job from a pipeline schedule; include the file from .gitlab-ci.yml and add a schedule`);
   return table.done;
 }
-var DRIFT_OP_FILE, DRIFT_SPEC_FILE, SNAPSHOTS_REF, SNAPSHOTS_FETCH, DRIFT_STATUSES, forgeOverride, notifyFetch, ATTRIBUTION_NEEDS_CHANT, OP_OUTPUT_DIR2;
+var DRIFT_OP_FILE, DRIFT_SPEC_FILE, SNAPSHOTS_REF, SNAPSHOTS_FETCH, DRIFT_STATUSES, forgeOverride, notifyFetch, OP_OUTPUT_DIR2;
 var init_drift2 = __esm({
   "src/drift.ts"() {
     "use strict";
@@ -3918,7 +3939,6 @@ var init_drift2 = __esm({
     SNAPSHOTS_REF = "refs/chant/snapshots";
     SNAPSHOTS_FETCH = `git fetch --no-tags origin '+${SNAPSHOTS_REF}:${SNAPSHOTS_REF}' || true`;
     DRIFT_STATUSES = ["drifted", "missing"];
-    ATTRIBUTION_NEEDS_CHANT = "drift.audit_log is set, and the installed chant has no audit-log reads (chant#4632), so no drifted attribute was attributed";
     OP_OUTPUT_DIR2 = { github: ".github/workflows", forgejo: ".forgejo/workflows", gitlab: "." };
   }
 });
@@ -4325,7 +4345,7 @@ function adoptLines(previews, chant) {
     }
     const count = `${v.resources.length} resource${v.resources.length === 1 ? "" : "s"}`;
     if (v.status === "refused") {
-      out.push(`  ${p.key}: plunge refuses to adopt it:`);
+      out.push(`  ${p.key}: plunge refuses to adopt it, so the adopt Op leaves it out:`);
       for (const r of v.refusals) out.push(`    ${r.code}: ${r.reason}${r.urn ? ` (${r.urn})` : ""}`);
     } else if (v.status === "already-adopted") {
       out.push(`  ${p.key}: already on plunge's records (${count})`);
@@ -4338,7 +4358,10 @@ function adoptLines(previews, chant) {
   return out;
 }
 function stacksToAdopt(stacks2, previews) {
-  return stacks2.filter((s) => previews.find((p) => p.key === s.key)?.view?.status !== "already-adopted");
+  return stacks2.filter((s) => {
+    const status = previews.find((p) => p.key === s.key)?.view?.status;
+    return status !== "already-adopted" && status !== "refused";
+  });
 }
 function adoptGate(member, stack, single) {
   return single ? `approve-${ADOPT_OP}` : `approve-${ADOPT_OP}-${member}-${stack}`;
@@ -4401,9 +4424,9 @@ function plungeUrlOf(url) {
   const scheme = url.split("://")[0];
   return { pointer: `is on ${url}, and plunge has no plunge+ form for ${scheme}. Move it to a file, s3, azblob or gs backend first: ${MOVE_A_STACK_GUIDE}` };
 }
-function plungeStacks(detected3, env) {
-  return detected3.stacks.map((s) => {
-    const project = detected3.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+function plungeStacks(detected2, env) {
+  return detected2.stacks.map((s) => {
+    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const b = backendOf(project, {}, env);
     const to = plungeUrlOf(b.url);
     return {
@@ -4534,6 +4557,7 @@ function stepInput(s) {
     stack: s.stack,
     member: s.project,
     ...s.engine ? { engine: s.engine } : {},
+    ...s.backend ? { backend: s.backend } : {},
     ...s.engineVersion ? { engineVersion: s.engineVersion, ...s.engineRoot ? { engineRoot: s.engineRoot } : {} } : {},
     ...s.lockGrain ? { lockGrain: s.lockGrain } : {},
     ...s.policyPacks?.length ? { policyPacks: s.policyPacks } : {}
@@ -4774,9 +4798,9 @@ function repoJoin(...parts) {
   const out = posix2.normalize(parts.filter((p) => p !== "" && p !== ".").join("/") || ".").replace(/^\.\//, "").replace(/\/+$/, "");
   return out === "" ? "." : out;
 }
-function projectAt(detected3, dir) {
+function projectAt(detected2, dir) {
   const want = repoJoin(dir);
-  return detected3.projects.find((p) => repoJoin(p.dir) === want);
+  return detected2.projects.find((p) => repoJoin(p.dir) === want);
 }
 function stackEntry(keys, key) {
   const stacks2 = isObject(keys.stacks) ? keys.stacks : keys.stacks = {};
@@ -4819,10 +4843,10 @@ var init_types2 = __esm({
 // src/import/deployments.ts
 import { readdirSync as readdirSync6 } from "node:fs";
 import { basename as basename2, dirname as dirname8, join as join11 } from "node:path";
-function deploymentFiles(root, detected3, named) {
+function deploymentFiles(root, detected2, named) {
   if (named.length) return [...named];
   const out = [];
-  for (const p of detected3.projects) {
+  for (const p of detected2.projects) {
     let names;
     try {
       names = readdirSync6(join11(root, p.dir)).sort();
@@ -4852,7 +4876,7 @@ var init_deployments = __esm({
       "gitHub.deployPullRequest": "set apply.when: pull-request and update with /plywood up",
       "gitHub.repository": "plywood runs in the repository it is set up in"
     };
-    importDeployments = (root, detected3, named) => {
+    importDeployments = (root, detected2, named) => {
       let keys = {};
       const unsupported = [];
       const notes = [];
@@ -4860,7 +4884,7 @@ var init_deployments = __esm({
       const not = (file, setting, why) => {
         unsupported.push({ file, setting, why: why ?? NOT_CARRIED[setting] ?? "plywood has no setting for it" });
       };
-      for (const file of deploymentFiles(root, detected3, named)) {
+      for (const file of deploymentFiles(root, detected2, named)) {
         const m = SETTINGS_FILE.exec(basename2(file));
         if (!m) {
           not(file, "(file)", "names no stack: call it Pulumi.<stack>.deploy.yaml (or .json) beside the project's Pulumi.yaml");
@@ -4879,7 +4903,7 @@ var init_deployments = __esm({
         const fileDir = repoJoin(posixRel(root, dirname8(join11(root, file))));
         const source = isObject(settings.sourceContext) && isObject(settings.sourceContext.git) ? settings.sourceContext.git : {};
         const dir = typeof source.repoDir === "string" ? repoJoin(source.repoDir) : fileDir;
-        const project = projectAt(detected3, dir)?.name ?? projectAt(detected3, fileDir)?.name;
+        const project = projectAt(detected2, dir)?.name ?? projectAt(detected2, fileDir)?.name;
         if (!project) {
           not(file, "sourceContext.git.repoDir", `${dir} holds no Pulumi.yaml`);
           continue;
@@ -4934,9 +4958,9 @@ var init_deployments = __esm({
 });
 
 // src/import/env0.ts
-function stackFor(detected3, names) {
+function stackFor(detected2, names) {
   for (const n of names) {
-    const hits = detected3.stacks.filter((s) => s.key === n || s.stack === n || detected3.stacks.filter((x) => x.project === s.project).length === 1 && s.project === n);
+    const hits = detected2.stacks.filter((s) => s.key === n || s.stack === n || detected2.stacks.filter((x) => x.project === s.project).length === 1 && s.project === n);
     if (hits.length === 1) return hits[0].key;
   }
   return void 0;
@@ -4949,7 +4973,7 @@ var init_env0 = __esm({
     init_types2();
     ENV0_WORKFLOW_FILES = ["env0.workflow.yml", "env0.workflow.yaml"];
     ENV0_FLOW_FILES = ["env0.yml", "env0.yaml"];
-    importEnv0 = (root, detected3, named) => {
+    importEnv0 = (root, detected2, named) => {
       const keys = {};
       const unsupported = [];
       const notes = [];
@@ -4967,7 +4991,7 @@ var init_env0 = __esm({
         for (const [id, raw] of Object.entries(envs)) {
           const e = isObject(raw) ? raw : {};
           const names = [id, ...typeof e.name === "string" ? [e.name] : [], ...typeof e.templateName === "string" ? [e.templateName] : []];
-          const key = stackFor(detected3, names);
+          const key = stackFor(detected2, names);
           if (key) stackOf.set(id, key);
           else unsupported.push({ file: workflow, setting: `environments.${id}`, why: `names no stack of this repository (${names.join(", ")}); list it under stacks and waves.after by hand` });
           for (const k of Object.keys(e).filter((x) => !["name", "templateName", "needs"].includes(x))) {
@@ -5061,7 +5085,7 @@ var init_pulumi_actions = __esm({
       plan: "plywood's update applies the preview its approval names, through chant"
     };
     PULUMI_CLOUD = /^https:\/\/(?:app|api)\.pulumi\.com\/?$/;
-    importPulumiActions = (root, detected3, named) => {
+    importPulumiActions = (root, detected2, named) => {
       let keys = {};
       const unsupported = [];
       const notes = [];
@@ -5097,7 +5121,7 @@ var init_pulumi_actions = __esm({
             const dir = repoJoin(typeof w["work-dir"] === "string" ? w["work-dir"] : ".");
             const parts = stackName.split("/");
             const stack = parts[parts.length - 1];
-            const project = projectAt(detected3, dir)?.name ?? (parts.length === 3 ? parts[1] : void 0);
+            const project = projectAt(detected2, dir)?.name ?? (parts.length === 3 ? parts[1] : void 0);
             if (!project) {
               unsupported.push({ file, setting: `${where}.with.stack-name`, why: `${dir} holds no Pulumi.yaml, so ${stackName} names no project` });
               return;
@@ -5154,7 +5178,7 @@ var init_spacelift = __esm({
     init_types2();
     SPACELIFT_FILES = [".spacelift/config.yml", ".spacelift/config.yaml"];
     CARRIED2 = ["project_root", "runner_image"];
-    importSpacelift = (root, detected3, named) => {
+    importSpacelift = (root, detected2, named) => {
       const keys = {};
       const unsupported = [];
       const notes = [];
@@ -5181,7 +5205,7 @@ var init_spacelift = __esm({
         const own = isObject(raw) ? raw : {};
         const s = { ...defaults, ...own };
         const dir = repoJoin(typeof s.project_root === "string" ? s.project_root : ".");
-        const project = projectAt(detected3, dir);
+        const project = projectAt(detected2, dir);
         if (!project) {
           unsupported.push({ file, setting: `stacks.${id}.project_root`, why: `${dir} holds no Pulumi.yaml` });
           continue;
@@ -5230,9 +5254,9 @@ function parseFrom(value) {
   if (!source) return { error: `--from ${value} is not one of ${IMPORT_SOURCES.join(", ")}, and its path names none; give <source>=${value}` };
   return { source, files: [file] };
 }
-function runImport(root, detected3, from) {
+function runImport(root, detected2, from) {
   try {
-    return IMPORTERS[from.source](root, detected3, from.files);
+    return IMPORTERS[from.source](root, detected2, from.files);
   } catch (e) {
     const file = from.files[0] ?? "(its files)";
     return { source: from.source, files: [], keys: {}, unsupported: [{ file, setting: "(file)", why: `could not be read: ${e.message}` }], notes: [] };
@@ -5327,7 +5351,7 @@ function put(root, rel, text, dryRun, note) {
 function existingConfig(root) {
   return CONFIG_NAMES.find((n) => existsSync10(join13(root, n)));
 }
-async function newConfigKeys(detected3, opts, io) {
+async function newConfigKeys(detected2, opts, io) {
   const notes = [];
   let presetName = opts.preset;
   if (!presetName && io.ask && !opts.yes) {
@@ -5337,31 +5361,31 @@ async function newConfigKeys(detected3, opts, io) {
   const preset2 = presetByName(presetName ?? DEFAULT_PRESET);
   const keys = structuredClone(preset2.keys);
   if (opts.gate) keys.gate = opts.gate;
-  const engine2 = engineStep({ engine: opts.engine, detected: detected3, env: io.env });
+  const engine2 = engineStep({ engine: opts.engine, detected: detected2, env: io.env });
   Object.assign(keys, engine2.keys);
   notes.push(...engine2.notes);
   const engineBackends = engine2.keys.backend !== void 0 || engine2.keys.stacks !== void 0;
   let forge;
   if (opts.forge) {
     forge = { kind: opts.forge, because: "--forge" };
-    if (detected3.forge?.kind !== opts.forge) keys.forge = { kind: opts.forge };
-    else if (detected3.forge.url) keys.forge = { kind: opts.forge, url: detected3.forge.url };
-  } else if (detected3.forge) {
-    forge = { kind: detected3.forge.kind, because: detected3.forge.because };
-    if (detected3.forge.url) keys.forge = { kind: detected3.forge.kind, url: detected3.forge.url };
+    if (detected2.forge?.kind !== opts.forge) keys.forge = { kind: opts.forge };
+    else if (detected2.forge.url) keys.forge = { kind: opts.forge, url: detected2.forge.url };
+  } else if (detected2.forge) {
+    forge = { kind: detected2.forge.kind, because: detected2.forge.because };
+    if (detected2.forge.url) keys.forge = { kind: detected2.forge.kind, url: detected2.forge.url };
   } else {
     const kind = io.ask && !opts.yes ? await io.ask("Forge", FORGES, "github") : "github";
     forge = { kind, because: io.ask && !opts.yes ? "you chose it" : "origin names no forge init knows, so github; change forge.kind in plywood.yml" };
     keys.forge = { kind };
   }
   const fromEnv = io.env.PULUMI_BACKEND_URL?.trim();
-  if (fromEnv && !engineBackends && detected3.projects.some((p) => !p.backendUrl)) {
+  if (fromEnv && !engineBackends && detected2.projects.some((p) => !p.backendUrl)) {
     keys.backend = fromEnv;
     notes.push(`backend ${fromEnv} came from PULUMI_BACKEND_URL; it is in plywood.yml so the jobs use it too`);
   }
   return { keys, notes, forge };
 }
-function initStacks(detected3, doc, members = []) {
+function initStacks(detected2, doc, members = []) {
   const listed = stacksOf(doc);
   const pinned = new Map(members.filter((m) => m.engineBin && m.engineVersion).map((m) => [m.name, m]));
   const out = [];
@@ -5370,6 +5394,7 @@ function initStacks(detected3, doc, members = []) {
     const own = listed[key] ?? {};
     const backend = own.backend ?? (typeof doc.backend === "string" ? doc.backend : void 0);
     const engine2 = engineOf(doc, backend)?.engine;
+    const grain = lockGrainFor(doc, engine2);
     const stackDir = own.dir ?? dir;
     const packs = packsForStack(stepPolicyPacksOf(doc), stackDir);
     const pin = pinned.get(key);
@@ -5379,13 +5404,18 @@ function initStacks(detected3, doc, members = []) {
       stack,
       dir: stackDir,
       ...engine2 ? { engine: engine2 } : {},
+      // plywood#22: the step's backend, so a preview and an update read this stack's store, not the job's PULUMI_BACKEND_URL.
+      ...backend ? { backend } : {},
       ...pin ? { engineVersion: pin.engineVersion, ...pin.engineRoot ? { engineRoot: pin.engineRoot } : {} } : {},
       ...own.gate ? { gate: own.gate } : {},
-      ...packs.length ? { policyPacks: packs } : {}
+      ...packs.length ? { policyPacks: packs } : {},
+      // chant's ledger lock (ruling for ci-products 2026-10-28): each stack's grain on its step, so a plunge stack on the
+      // resource grain leases its resource rows and never waits, and a stock stack (or locks.grain: stack) waits for its stack row.
+      ...grain !== "per-engine" ? { lockGrain: LOCK_GRAIN_OF[grain] } : {}
     });
     seen.add(key);
   };
-  for (const s of detected3.stacks) add(s.key, s.project, s.stack, s.dir);
+  for (const s of detected2.stacks) add(s.key, s.project, s.stack, s.dir);
   for (const [key, own] of Object.entries(listed)) {
     if (seen.has(key)) continue;
     const [project, stack] = key.split("/");
@@ -5393,11 +5423,11 @@ function initStacks(detected3, doc, members = []) {
   }
   return out;
 }
-function forgeFor2(doc, detected3, opts) {
+function forgeFor2(doc, detected2, opts) {
   if (opts.forge) return { kind: opts.forge, because: "--forge" };
   const kind = isObject(doc.forge) ? doc.forge.kind : void 0;
   if (kind) return { kind, because: "plywood.yml says forge.kind" };
-  if (detected3.forge) return { kind: detected3.forge.kind, because: detected3.forge.because };
+  if (detected2.forge) return { kind: detected2.forge.kind, because: detected2.forge.because };
   return { kind: "github", because: "origin names no forge init knows, so github" };
 }
 async function chantWriteCiHook() {
@@ -5409,14 +5439,14 @@ async function chantWriteCiHook() {
   }
 }
 async function runInit(opts, table, io) {
-  const detected3 = detect(io.cwd);
-  const { root } = detected3;
+  const detected2 = detect(io.cwd);
+  const { root } = detected2;
   const files = [];
   const notes = [];
   const todo = [];
   const buckets = [];
   const adopt = [];
-  const imported = opts.from ? runImport(root, detected3, opts.from) : void 0;
+  const imported = opts.from ? runImport(root, detected2, opts.from) : void 0;
   if (imported && imported.files.length === 0) notes.push(`--from ${imported.source} found no file to read${imported.notes.length ? `: ${imported.notes.join("; ")}` : ""}`);
   const fail = (message, forge2 = { kind: "github", because: "" }) => ({
     ok: false,
@@ -5431,8 +5461,8 @@ async function runInit(opts, table, io) {
     adopt,
     ...imported ? { imported } : {}
   });
-  if (detected3.projects.length === 0) return fail(`no Pulumi.yaml under ${root}; plywood init sets up a repository that has a Pulumi program`);
-  if (detected3.stacks.length === 0) notes.push("no Pulumi.<stack>.yaml beside any Pulumi.yaml, so no stack is set up; run pulumi stack init, then plywood init again");
+  if (detected2.projects.length === 0) return fail(`no Pulumi.yaml under ${root}; plywood init sets up a repository that has a Pulumi program`);
+  if (detected2.stacks.length === 0) notes.push("no Pulumi.<stack>.yaml beside any Pulumi.yaml, so no stack is set up; run pulumi stack init, then plywood init again");
   let config2;
   let forge;
   const kept = existingConfig(root);
@@ -5446,10 +5476,10 @@ async function runInit(opts, table, io) {
     const onPlunge = opts.engine === "plunge" && engineOf(config2.doc)?.engine === "plunge";
     const ignored = [opts.preset && "--preset", opts.gate && "--gate", opts.engine && !onPlunge && "--engine", imported && "--from"].filter(Boolean);
     if (ignored.length) notes.push(`${kept} is kept as it is, so ${ignored.join(", ")} changed nothing; set the keys there`);
-    if (opts.engine === "plunge" && !onPlunge) notes.push(...keptPlungeLines(kept, detected3, io.env));
-    forge = forgeFor2(config2.doc, detected3, opts);
+    if (opts.engine === "plunge" && !onPlunge) notes.push(...keptPlungeLines(kept, detected2, io.env));
+    forge = forgeFor2(config2.doc, detected2, opts);
   } else {
-    const made = await newConfigKeys(detected3, opts, io);
+    const made = await newConfigKeys(detected2, opts, io);
     notes.push(...made.notes);
     forge = made.forge;
     const text = plywoodYml(imported ? mergeKeys(made.keys, imported.keys) : made.keys);
@@ -5465,12 +5495,12 @@ async function runInit(opts, table, io) {
   const reviewStacks2 = config2.doc.review_stacks !== void 0 ? await chantReviewStacks() : false;
   if (settings.ci.prEnvironment && !reviewStacks2) delete settings.ci.prEnvironment;
   const reviewSuffix = reviewStacks2 ? reviewSuffixOf(settings.pipeline.reviewStackName) : void 0;
-  const stacks2 = initStacks(detected3, doc, settings.members);
+  const stacks2 = initStacks(detected2, doc, settings.members);
   const order = await stackOrder(root, stacks2, settings.pipeline.after);
   const ordered = orderWaves(wavesOf(stacks2, settings.pipeline.waves), order.edges, settings.pipeline.canary);
   const waves = ordered.waves;
   if (order.edges.length || order.outside.length || ordered.unmet.length || !order.reads && stacks2.length > 1) notes.push(...orderLines(order, ordered.unmet));
-  const declaration = declarationStep(root, detected3, settings, opts.dryRun);
+  const declaration = declarationStep(root, detected2, settings, opts.dryRun);
   files.push(declaration.file);
   if (existsSync10(join13(root, CHANT_CONFIG_FILE))) {
     const text = readFileSync12(join13(root, CHANT_CONFIG_FILE), "utf8");
@@ -5480,8 +5510,8 @@ async function runInit(opts, table, io) {
   } else files.push(put(root, CHANT_CONFIG_FILE, chantConfigTs(), opts.dryRun));
   files.push(put(root, COMPONENTS_FILE, componentsFile(stacks2, settings.pipeline.after, reviewSuffix ? { reviewSuffix } : {}), opts.dryRun));
   files.push(...providersPresetStep(root, doc, opts.dryRun, notes));
-  if (detected3.preCommit) files.push(await preCommitStep(root, detected3.preCommit, opts.dryRun));
-  for (const wf of detected3.pulumiActions) {
+  if (detected2.preCommit) files.push(await preCommitStep(root, detected2.preCommit, opts.dryRun));
+  for (const wf of detected2.pulumiActions) {
     notes.push(`${wf} runs pulumi/actions. init leaves it as it is; once plywood's previews and updates replace it, remove it, or keep it for the stacks plywood does not run`);
   }
   const chant = await chantProduct();
@@ -5489,7 +5519,7 @@ async function runInit(opts, table, io) {
     const message = needsChantMessage("Writing the waves spec and the workflow");
     files.push({ file: WAVES_SPEC_FILE2, status: "skipped", note: message }, { file: WORKFLOW_FILE[forge.kind], status: "skipped", note: "needs the same chant" });
   } else {
-    let spec = wavesSpecStep(chant, stacks2, doc, settings, detected3.defaultBranch, waves);
+    let spec = wavesSpecStep(chant, stacks2, doc, settings, detected2.defaultBranch, waves);
     if (settings.pipeline.jobs) {
       try {
         spec = withJobSettings(spec, settings.pipeline.jobs, forge.kind, { parallelism: await hasChant4625() });
@@ -5498,12 +5528,15 @@ async function runInit(opts, table, io) {
         spec = void 0;
       }
     }
-    if (spec && stacks2.length > 0) files.push(put(root, WAVES_SPEC_FILE2, jsonText(spec), opts.dryRun));
+    if (spec && stacks2.length > 0) {
+      files.push(put(root, WAVES_SPEC_FILE2, wavesSpecText(spec, wavesEngine(settings.pipeline)), opts.dryRun));
+      files.push(put(root, UP_OP_FILE, upOpFile(spec), opts.dryRun));
+    }
     if (spec) files.push(...await workflowStep(chant, root, doc, settings, forge.kind, opts, stacks2.length > 0 ? spec : void 0, table, io));
   }
-  if (opts.bucketCheck) notes.push(...await bucketStep(detected3, doc, io.env, buckets));
-  adopt.push(...await adoptStep(root, detected3, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
-  todo.push(...todoLines(detected3, doc, forge.kind, io.env));
+  if (opts.bucketCheck) notes.push(...await bucketStep(detected2, doc, io.env, buckets));
+  adopt.push(...await adoptStep(root, detected2, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
+  todo.push(...todoLines(detected2, doc, forge.kind, io.env));
   const failed = files.find((f) => f.status === "failed");
   return {
     ok: !failed,
@@ -5519,9 +5552,9 @@ async function runInit(opts, table, io) {
     ...imported ? { imported } : {}
   };
 }
-function declarationStep(root, detected3, settings, dryRun) {
+function declarationStep(root, detected2, settings, dryRun) {
   if (existsSync10(join13(root, "chant.workspace.jsonc"))) {
-    return { file: { file: "chant.workspace.jsonc", status: "kept", note: `add a member of kind pulumi for each of ${detected3.projects.map((p) => p.dir).join(", ")}, and pin ${PULUMI_LEXICON}@${CHANT_PIN}` } };
+    return { file: { file: "chant.workspace.jsonc", status: "kept", note: `add a member of kind pulumi for each of ${detected2.projects.map((p) => p.dir).join(", ")}, and pin ${PULUMI_LEXICON}@${CHANT_PIN}` } };
   }
   let existing;
   const file = join13(root, DECLARATION_FILE);
@@ -5534,7 +5567,7 @@ function declarationStep(root, detected3, settings, dryRun) {
       return { file: { file: DECLARATION_FILE, status: "failed", note: `is not JSON init can merge into (${e.message})` } };
     }
   }
-  const doc = workspaceDeclaration(existing, { name: repoName(root), projects: detected3.projects, ci: settings.ci, lexiconVersion: CHANT_PIN });
+  const doc = workspaceDeclaration(existing, { name: repoName(root), projects: detected2.projects, ci: settings.ci, lexiconVersion: CHANT_PIN });
   if (existing && JSON.stringify(existing) === JSON.stringify(doc)) return { file: { file: DECLARATION_FILE, status: "unchanged" }, doc };
   return { file: put(root, DECLARATION_FILE, jsonText(doc), dryRun), doc };
 }
@@ -5589,7 +5622,7 @@ async function workflowStep(chant, root, doc, settings, forge, opts, spec, table
   try {
     const { noteControlTarget: noteControlTarget2 } = await Promise.resolve().then(() => (init_control2(), control_exports));
     const control3 = await noteControlTarget2(doc, root);
-    plan = workflowPlan(chant, doc, forge, opts.env, spec, chantBuildFlags(chantPipelineOptions(settings.pipeline, false)), { reviewStacks: await chantReviewStacks(), prJobs, next: await chantNext(), ...control3 ? { control: control3 } : {} });
+    plan = workflowPlan(chant, doc, forge, opts.env, spec, chantBuildFlags(chantPipelineOptions(settings.pipeline, false)), { reviewStacks: await chantReviewStacks(), prJobs, ...control3 ? { control: control3 } : {} });
   } catch (e) {
     return [{ file: output, status: "failed", note: e.message }];
   }
@@ -5606,16 +5639,16 @@ async function workflowStep(chant, root, doc, settings, forge, opts, spec, table
   ];
   const out = [{ file: output, status: written.status, ...notes.length ? { note: notes.join("; ") } : {} }];
   if (plan.jobs.waves) {
-    const code = await writeWaveJobs(chant, forge, plan.jobs.waves, plan.words, table, { ...io, cwd: root });
+    const code = await writeWaveJobs(chant, forge, plan.jobs.waves, plan.words, table, { ...io, cwd: root }, wavesEngine(settings.pipeline));
     if (code !== table.done) out.push({ file: WAVES_OUTPUT_DIR[forge], status: "failed", note: `the waves workflow: chant exited ${code}` });
   }
   return out;
 }
-async function bucketStep(detected3, doc, env, reports) {
+async function bucketStep(detected2, doc, env, reports) {
   const listed = stacksOf(doc);
   const urls = /* @__PURE__ */ new Set();
-  for (const s of detected3.stacks) {
-    const project = detected3.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+  for (const s of detected2.stacks) {
+    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const b = backendOf(project, { ...listed[s.key]?.backend ? { stack: listed[s.key].backend } : {}, ...typeof doc.backend === "string" ? { all: doc.backend } : {} }, env);
     if (b.url && !isPulumiCloud(b.url)) urls.add(b.url);
   }
@@ -5639,12 +5672,12 @@ async function bucketStep(detected3, doc, env, reports) {
   }
   return lines2;
 }
-async function adoptStep(root, detected3, doc, env, declaration, dryRun, files, notes, todo) {
+async function adoptStep(root, detected2, doc, env, declaration, dryRun, files, notes, todo) {
   const listed = stacksOf(doc);
   const all = typeof doc.backend === "string" ? doc.backend : void 0;
   const targets = [];
-  for (const s of detected3.stacks) {
-    const project = detected3.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+  for (const s of detected2.stacks) {
+    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const own = listed[s.key];
     const b = backendOf(project, { ...own?.backend ? { stack: own.backend } : {}, ...all ? { all } : {} }, env);
     if (b.url && /^plunge\+/.test(b.url)) targets.push({ key: s.key, project: s.project, projectDir: s.dir, dir: own?.dir ?? s.dir, stack: s.stack, url: b.url });
@@ -5667,17 +5700,17 @@ async function adoptStep(root, detected3, doc, env, declaration, dryRun, files,
   todo.push(...adoptTodo(rows));
   return previews;
 }
-function keptPlungeLines(kept, detected3, env) {
-  const step = engineStep({ engine: "plunge", detected: detected3, env });
+function keptPlungeLines(kept, detected2, env) {
+  const step = engineStep({ engine: "plunge", detected: detected2, env });
   const entries = Object.entries(step.keys);
   if (entries.length === 0) return step.notes;
   const yaml = entries.map(([k, v]) => emitYAMLEntry2(k, v)).join("\n").split("\n").filter((l) => l !== "");
   return [...step.notes, `To move to plunge, set these keys in ${kept}:`, ...yaml.map((l) => `    ${l}`)];
 }
-function todoLines(detected3, doc, forge, env) {
+function todoLines(detected2, doc, forge, env) {
   const out = [];
   const all = typeof doc.backend === "string" ? doc.backend : void 0;
-  const cloud = detected3.projects.some((p) => isPulumiCloud(backendOf(p, all ? { all } : {}, env).url));
+  const cloud = detected2.projects.some((p) => isPulumiCloud(backendOf(p, all ? { all } : {}, env).url));
   const where = forge === "gitlab" ? "CI/CD variables" : "repository secrets";
   const traded = identityClouds(doc);
   if (cloud && traded.includes("pulumi")) {
@@ -5685,9 +5718,9 @@ function todoLines(detected3, doc, forge, env) {
   } else if (cloud) {
     out.push(`Set pulumi_cloud.org and identity.preview.pulumi and identity.up.pulumi in plywood.yml, so each job trades its OIDC token for its own Pulumi Cloud token, or add PULUMI_ACCESS_TOKEN_PREVIEW and PULUMI_ACCESS_TOKEN_UP to the ${where}`);
   }
-  if (traded.some((c) => c !== "pulumi")) out.push(`Let each role identity names trust this repository's OIDC tokens: the preview role for pull requests, the up role for ${detected3.defaultBranch} only`);
+  if (traded.some((c) => c !== "pulumi")) out.push(`Let each role identity names trust this repository's OIDC tokens: the preview role for pull requests, the up role for ${detected2.defaultBranch} only`);
   else if (!cloud) out.push("Give the preview job and the update job their cloud access, each its own role through OIDC (identity in plywood.yml); the backend bucket's read and write go with them");
-  out.push(`Make ${PRODUCT}/preview a required status on ${detected3.defaultBranch}`);
+  out.push(`Make ${PRODUCT}/preview a required status on ${detected2.defaultBranch}`);
   return out;
 }
 function initLines(r) {
@@ -5732,6 +5765,7 @@ var init_init = __esm({
     init_policy_presets();
     init_approval();
     init_engine();
+    init_locks();
     init_config();
     init_routing();
     init_stacks();
@@ -5748,7 +5782,6 @@ var init_init = __esm({
     init_review_stacks2();
     init_waves_workflow();
     init_stages();
-    init_chant_next();
     init_stack_order();
     init_import();
     init_templates();
@@ -6132,7 +6165,6 @@ async function check(args, json, table, io) {
 }
 async function preview(args, json, table, io) {
   const targeted = args.includes("--target");
-  const planFlags = ["--refresh", "--target-dependents"].filter((f) => args.includes(f));
   if (args.includes("--target-dependents") && !targeted) return usage("--target-dependents widens a --target preview to the resources that depend on the targets; give a --target", table, io);
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--target" && (args[i + 1] === void 0 || args[i + 1].startsWith("-"))) return usage("--target takes a resource's URN", table, io);
@@ -6155,16 +6187,12 @@ async function preview(args, json, table, io) {
   const argv = ["components", "pr-plan", "--base", at, "--pr", number, ...gate, ...stack ? ["--member", stack] : [], ...rest, ...json ? ["--json"] : []];
   return withChant(`${PRODUCT} preview`, table, io, async (chant) => {
     if (targeted && !hasChant4620(chant)) return usage(PREVIEW_TARGET_NEEDS_CHANT, table, io);
-    if (planFlags.length && !(await chantNext()).planFlags) return usage(previewFlagsNeedChant(planFlags), table, io);
     return chant.runChantInProcess(argv, PRODUCT_WORDS);
   });
 }
-function previewFlagsNeedChant(flags) {
-  return `${flags.join(" and ")} ${flags.length === 1 ? "needs" : "need"} a chant whose pr-plan passes ${flags.length === 1 ? "it" : "them"} to the pulumi-up step (chant#4627), which this chant lacks`;
-}
 function readWavesSpec(cwd) {
   const file = join15(cwd, ".chant/op-waves", `${OP_NAME}.spec.json`);
-  return existsSync12(file) ? JSON.parse(readFileSync14(file, "utf8")) : void 0;
+  return existsSync12(file) ? unwrapWavesSpec(JSON.parse(readFileSync14(file, "utf8"))) : void 0;
 }
 function pipelineShape(doc, forge, waves) {
   const applyBeforeMerge = applyWhenOf(doc) === "pull-request";
@@ -6225,7 +6253,7 @@ async function ci(args, json, table, io) {
     const noteControl = await noteControlTarget2(config2.doc, io.cwd);
     let plan;
     try {
-      plan = workflowPlan(chant, config2.doc, forge, env, waves, [], { reviewStacks: reviewStacks2, prJobs, next: await chantNext(), ...noteControl ? { control: noteControl } : {} });
+      plan = workflowPlan(chant, config2.doc, forge, env, waves, [], { reviewStacks: reviewStacks2, prJobs, ...noteControl ? { control: noteControl } : {} });
     } catch (e) {
       io.err(`${PRODUCT}: ${e.message}`);
       return table.failed;
@@ -6274,7 +6302,7 @@ async function ci(args, json, table, io) {
       if (!json) io.err(`${PRODUCT} ci: chant's generator exited ${written.code} and wrote no ${output}; any file there before is back as it was`);
       return written.code;
     }
-    const wavesCode = waveJobs ? await writeWaveJobs(chant, forge, waveJobs, plan.words, table, io) : table.done;
+    const wavesCode = waveJobs ? await writeWaveJobs(chant, forge, waveJobs, plan.words, table, io, wavesEngine(toChantSettings(config2).pipeline)) : table.done;
     if (wavesCode !== table.done) return wavesCode;
     const driftCode = await writeDriftJobs(chant, forge, config2.doc, plan.words, table, io, env);
     if (driftCode !== table.done) return driftCode;
@@ -6289,12 +6317,10 @@ function writtenNotes(plan, file) {
 }
 function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
   const shape = pipelineShape(doc, forge, waves);
-  const next = opts.next;
   const notes = [];
   const pipeline = toChantSettings({ doc }).pipeline;
-  const staleNotes = next?.staleNotes === true;
   const respond = respondOptions(chant, pipeline, shape.applyBeforeMerge, notes);
-  const applyMerge = shape.applyBeforeMerge && pipeline.applyMerge ? next?.applyMerge ? pipeline.applyMerge : (notes.push(APPLY_MERGE_NEEDS_CHANT), void 0) : void 0;
+  const applyMerge = shape.applyBeforeMerge ? pipeline.applyMerge : void 0;
   if (approvalOf(doc) === "pr-review" && shape.waves && hasChantApprovalStatus(chant) && !hasChantPullRequestApprovalStatus(chant)) notes.push(APPROVAL_STATUS_NOTE);
   const words = wordsForJobs(shape.jobs);
   const requires = shape.applyBeforeMerge ? requiresArgv(chant, doc) : [];
@@ -6310,7 +6336,8 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     ...opts.control !== void 0 ? { control: { target: opts.control } } : {},
     // plywood#29: runners, env, pass and parallelism on the pull request jobs, with chant#4625 (src/jobs.ts).
     ...opts.prJobs?.options ?? {},
-    ...staleNotes ? { staleNotes: true } : {},
+    // chant#4628: the note names the target commit it was previewed against, and a push marks older notes stale.
+    staleNotes: true,
     ...respond.options,
     ...applyMerge ? { applyMerge } : {}
   });
@@ -6330,7 +6357,7 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     ...applyMerge ? applyMergeArgv(applyMerge) : [],
     ...respond.argv,
     ...previewComment ? ["--preview-comment"] : [],
-    ...staleNotes ? ["--stale-notes"] : [],
+    "--stale-notes",
     // Review stacks (plywood#15): chant's pr-env jobs, only once the pulumi lexicon can remove what they create.
     ...doc.review_stacks !== void 0 && opts.reviewStacks ? ["--pr-env"] : [],
     ...opts.prJobs?.flags ?? [],
@@ -6387,7 +6414,7 @@ function usage(message, table, io) {
   io.err(`${PRODUCT}: ${message}`);
   return table.failed;
 }
-var CHANT_PASSTHROUGH, VALUED, PREVIEW_TARGET_NEEDS_CHANT, WORKFLOW_FILE, APPLY_MERGE_NEEDS_CHANT, APPROVAL_STATUS_NOTE, CHANT_RESPOND_DEFAULTS, DECIDE_LEFT_OFF;
+var CHANT_PASSTHROUGH, VALUED, PREVIEW_TARGET_NEEDS_CHANT, WORKFLOW_FILE, APPROVAL_STATUS_NOTE, CHANT_RESPOND_DEFAULTS, DECIDE_LEFT_OFF;
 var init_stages = __esm({
   "src/stages.ts"() {
     "use strict";
@@ -6415,13 +6442,37 @@ var init_stages = __esm({
       forgejo: ".forgejo/workflows/plywood.yml",
       gitlab: ".gitlab-ci.yml"
     };
-    APPLY_MERGE_NEEDS_CHANT = "apply.merge is auto, and the installed chant has no pr-apply --merge auto (chant#4636), so a person merges after each update before merge";
     APPROVAL_STATUS_NOTE = `approval is pr-review, and chant posts its approval status only for waves that wait on pr-review; plywood's waves wait on the pull request's own approval, so no ${PRODUCT}/approval status is posted before merge`;
     CHANT_RESPOND_DEFAULTS = Object.freeze({ "wave-refused": "diff", "apply-failed": "triage", description: "off" });
     DECIDE_LEFT_OFF = "decide is set and respond.description is not check, so plywood leaves the decide service off the pull request jobs";
   }
 });
 
+// src/chant-resolve.ts
+import * as nodeModule from "node:module";
+var CHANT_SPECIFIER = /^@intentius\/chant(?:-lexicon-[a-z0-9-]+)?(?:\/|$)/;
+function chantResolveHook(from) {
+  return (specifier, context, next) => {
+    try {
+      return next(specifier, context);
+    } catch (err) {
+      const code = err.code;
+      if (!CHANT_SPECIFIER.test(specifier) || code !== "ERR_MODULE_NOT_FOUND" && code !== "MODULE_NOT_FOUND") throw err;
+      if (context.parentURL === from) throw err;
+      return next(specifier, { ...context, parentURL: from });
+    }
+  };
+}
+var installed = false;
+function installChantResolution(from = import.meta.url) {
+  if (installed) return true;
+  const register = nodeModule.registerHooks;
+  if (typeof register !== "function") return false;
+  register({ resolve: chantResolveHook(from) });
+  installed = true;
+  return true;
+}
+
 // src/cli.ts
 init_config_check();
 
@@ -6668,8 +6719,8 @@ var HOOK_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/plywood-guard.mjs"';
 function withGuardHook(settings) {
   const hooks = typeof settings.hooks === "object" && settings.hooks !== null ? settings.hooks : {};
   const pre = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
-  const has2 = JSON.stringify(pre).includes("plywood-guard.mjs");
-  if (!has2) pre.push({ matcher: "Bash", hooks: [{ type: "command", command: HOOK_COMMAND }] });
+  const has = JSON.stringify(pre).includes("plywood-guard.mjs");
+  if (!has) pre.push({ matcher: "Bash", hooks: [{ type: "command", command: HOOK_COMMAND }] });
   return { ...settings, hooks: { ...hooks, PreToolUse: pre } };
 }
 async function guard(args, json, table, io) {
@@ -7147,11 +7198,11 @@ async function upgrade(args, json, table, io) {
     return table.done;
   }
   say(`  $ ${steps.install.command}`);
-  const installed = await exec("npm", ["install", "--no-audit", "--no-fund"], { cwd: pkgDir, env: io.env });
-  if (installed.code !== 0) {
+  const installed2 = await exec("npm", ["install", "--no-audit", "--no-fund"], { cwd: pkgDir, env: io.env });
+  if (installed2.code !== 0) {
     for (const n of notes) say(`  note: ${n}`);
-    return fail(`npm install failed (exit ${installed.code}); package.json is moved, so fix the install and run '${steps.ci.command}'
-${installed.stderr.trim()}`);
+    return fail(`npm install failed (exit ${installed2.code}); package.json is moved, so fix the install and run '${steps.ci.command}'
+${installed2.stderr.trim()}`);
   }
   const got = installedVersion(pkgDir);
   if (got !== void 0 && got !== release2.version) notes.push(`node_modules holds ${PLYWOOD_PACKAGE} ${got}, not ${release2.version}; check the install`);
@@ -7554,7 +7605,7 @@ async function rollbackStack(args, json, table, io) {
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.0.0" : "0.0.0-dev";
+var VERSION3 = true ? "0.1.0" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")
@@ -7750,5 +7801,6 @@ function config(args, table, emit) {
 }
 
 // src/bin.ts
+installChantResolution();
 process.exitCode = await main(process.argv.slice(2));
 //# sourceMappingURL=plywood.mjs.map