@intentius/plywood 0.0.0 → 0.2.0

package/dist/plywood.mjs

@@ -380,7 +380,7 @@ var init_chant_keys = __esm({
 
 // src/words.ts
 function wordsForJobs(jobs2) {
-  const commands = Object.fromEntries(Object.entries(PRODUCT_WORDS.commands).filter(([, c]) => jobs2.includes(c)));
+  const commands = Object.fromEntries(Object.entries({ ...PRODUCT_WORDS.commands, ...ACTION_COMMAND }).filter(([, c]) => jobs2.includes(c)));
   return { ...PRODUCT_WORDS, commands };
 }
 function driftOpName(stack) {
@@ -417,7 +417,7 @@ function driftIssueBody(input) {
 function driftClearedComment(stack, observedAt2) {
   return `plywood's drift check at ${observedAt2} found ${stack} matching its state, so this issue is closed.`;
 }
-var PRODUCT, TAGLINE, OP_NAME, PR_GATE, VERBS, BIN, NOTIFY_WORDS, PRODUCT_WORDS, POLICY_RULE_FORMS, CLOUD_NAMES, NO_IDENTITY, STACK_OP_WORDS, DRIFT_OP_PREFIX, LOCK_GRAIN_WORDS, PLUNGE_TIMING_ATTRIBUTES;
+var PRODUCT, TAGLINE, OP_NAME, PR_GATE, VERBS, BIN, NOTIFY_WORDS, PRODUCT_WORDS, ACTION_COMMAND, POLICY_RULE_FORMS, CLOUD_NAMES, NO_IDENTITY, TEMPLATE_REQUEST_WORDS, STACK_OP_WORDS, DRIFT_OP_PREFIX, LOCK_GRAIN_WORDS, PLUNGE_TIMING_ATTRIBUTES;
 var init_words = __esm({
   "src/words.ts"() {
     "use strict";
@@ -450,18 +450,27 @@ var init_words = __esm({
       bin: BIN,
       notify: NOTIFY_WORDS
     });
+    ACTION_COMMAND = Object.freeze({ action: "action" });
     POLICY_RULE_FORMS = "a CrossGuard rule is crossguard.<pack>.<policy>, a Rego rule <package>.<rule>";
     CLOUD_NAMES = { aws: "AWS", gcp: "GCP", azure: "Azure", pulumi: "Pulumi Cloud" };
     NO_IDENTITY = "the job's own credentials (no OIDC trade)";
+    TEMPLATE_REQUEST_WORDS = {
+      tool: "request_from_template",
+      refusal: "Pulumi templates are not available yet: request_from_template opens a pull request for an app from a template once plywood has a template registry and catalog, and the plywood request command that opens the same pull request for a person. Until then it refuses every call and opens nothing. To change a stack now, open a pull request with the change."
+    };
     STACK_OP_WORDS = {
       usage: {
         export: `${PRODUCT} export <project/stack> --out <file>`,
         cancel: `${PRODUCT} cancel <project/stack> [--lock <id>]`,
         move: `${PRODUCT} move <urn>... --from <project/stack> --to <project/stack>, or ${PRODUCT} move <project/stack> --onto plunge`,
-        rollback: `${PRODUCT} rollback <project/stack> [--digest <sha256:...>], or ${PRODUCT} rollback --release <name> --env <env>`
+        rollback: `${PRODUCT} rollback <project/stack> [--digest <sha256:...>], or ${PRODUCT} rollback --release <name> --env <env>`,
+        action: `${PRODUCT} action <project/stack> <name> [--anew], or ${PRODUCT} action --from-event`
       },
       waiting: (verb, approve2) => `The ${verb} waits for a second person's approval, and your own does not count. They run '${approve2}', then you run this command again to carry it out.`,
-      spent: (verb) => `This ${verb} ran once already under its approval, and a request runs once. Run the command again to ask for a new one.`,
+      spent: (verb) => verb === "action" ? "This action ran once already under its approval, and a request runs once. Run the command again with --anew to ask for a new run." : `This ${verb} ran once already under its approval, and a request runs once. Run the command again to ask for a new one.`,
+      acted: (stack, name, r) => `Ran action ${name} on ${stack}: ${r.engine} replaced ${r.urn}.${r.tail ? `
+${r.tail}` : ""}`,
+      noAction: (stack, name, declared) => declared.length ? `${stack} has no action ${name} in plywood.yml; its actions are ${declared.join(", ")}` : `${stack} declares no actions in plywood.yml; add one under stacks.${stack}.actions with a name and the URN of a command resource`,
       exported: (stack, r) => `Exported ${stack} to ${r.file} (${r.resources} resources, ${r.bytes} bytes, sha256 ${r.sha256}). The file is readable by you alone; the ledger keeps its digest and size, never its content.`,
       cancelled: (stack, lock, checked) => `Released lock ${lock} on ${stack}.${checked ? "" : " The backend's lock could not be read, so it was not checked against the approved one first."}`,
       moved: (from, to, r) => `Moved ${r.moved.length} resource${r.moved.length === 1 ? "" : "s"} from ${from} to ${to} on ${r.engine}. Both stacks preview no change.`,
@@ -578,10 +587,13 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.0.0";
+    version = "0.2.0";
     dependencies = {
-      "@intentius/chant": "0.124.55",
-      "@intentius/chant-lexicon-pulumi": "0.124.55"
+      "@intentius/chant": "0.124.58",
+      "@intentius/chant-lexicon-forgejo": "0.124.58",
+      "@intentius/chant-lexicon-github": "0.124.58",
+      "@intentius/chant-lexicon-gitlab": "0.124.58",
+      "@intentius/chant-lexicon-pulumi": "0.124.58"
     };
   }
 });
@@ -590,7 +602,10 @@ var init_package = __esm({
 var image_digests_default;
 var init_image_digests = __esm({
   "src/image-digests.json"() {
-    image_digests_default = {};
+    image_digests_default = {
+      "ghcr.io/intentius/plywood-pulumi:0.2.0-pulumi3.272.0": "sha256:ea268f1dd2fa15f80ddcedd5c3498d24b79cc2b8a590177c5499e2db3f686f18",
+      "ghcr.io/intentius/plywood-plunge:0.2.0-plunge0.1.0": "sha256:6a862ad23e39081a32fe8b2331b095ed2de44e527f2719416201b0affa46a1eb"
+    };
   }
 });
 
@@ -917,12 +932,58 @@ var init_images2 = __esm({
 });
 
 // src/config/stacks.ts
+function parseUrn(urn) {
+  if (!urn.startsWith("urn:pulumi:")) return void 0;
+  const parts = urn.slice("urn:pulumi:".length).split("::");
+  if (parts.length < 4 || parts.slice(0, 4).some((p) => p === "")) return void 0;
+  return { stack: parts[0], project: parts[1], type: parts[2].split("$").at(-1) };
+}
+function actionUrnProblem(stackKey, urn) {
+  const parsed = parseUrn(urn);
+  if (!parsed) return `is not a resource URN (urn:pulumi:<stack>::<project>::<type>::<name>)`;
+  const stack = stackKey.split("/").at(-1);
+  if (parsed.stack !== stack) return `names stack ${parsed.stack}, and the action is under ${stackKey}`;
+  if (!parsed.type.startsWith(ACTION_TYPE_PREFIX)) {
+    return `is a ${parsed.type}, and an action is a command resource (command:local:Command or command:remote:Command), whose replacement runs it`;
+  }
+  return void 0;
+}
+function actionsOf(doc, key) {
+  const a = stacksOf(doc)[key]?.actions;
+  return Array.isArray(a) ? a : [];
+}
+function hasActions(doc) {
+  return Object.keys(stacksOf(doc)).some((k) => actionsOf(doc, k).length > 0);
+}
 function wavesMappingOf(doc) {
   return isObject(doc.waves) ? doc.waves : {};
 }
 function stacksOf(doc) {
   return isObject(doc.stacks) ? doc.stacks : {};
 }
+function actionProblems(stackKey, actions, key) {
+  if (!Array.isArray(actions)) return [error(key, "must be a list of actions, each with a name and a urn")];
+  const out = [];
+  const seen = /* @__PURE__ */ new Map();
+  actions.forEach((a, i) => {
+    const at = `${key}[${i}]`;
+    if (!isObject(a)) {
+      out.push(error(at, "must be a mapping with a name and a urn"));
+      return;
+    }
+    out.push(...onlyKeys(a, ACTION_KEYS, at));
+    if (typeof a.name !== "string" || !ACTION_NAME.test(a.name)) out.push(error(`${at}.name`, "must be a name of letters, digits, _, . and -"));
+    else if (seen.has(a.name)) out.push(error(`${at}.name`, `${a.name} is the name of actions[${seen.get(a.name)}] too; each action's name is unique in its stack`));
+    else seen.set(a.name, i);
+    if (typeof a.urn !== "string") out.push(error(`${at}.urn`, "must be the URN of a command resource in the stack"));
+    else {
+      const problem = actionUrnProblem(stackKey, a.urn);
+      if (problem) out.push(error(`${at}.urn`, `${a.urn} ${problem}`));
+    }
+    if (a.description !== void 0 && typeof a.description !== "string") out.push(error(`${at}.description`, "must be a string"));
+  });
+  return out;
+}
 function wavesMappingProblems(w, listed) {
   const out = [...onlyKeys(w, WAVES_KEYS, "waves")];
   const known = (s, key) => {
@@ -976,15 +1037,18 @@ function afterCycle(after) {
   }
   return void 0;
 }
-var STACK_KEYS, WAVES_KEYS, STACK_NAME, stacks;
+var STACK_KEYS, ACTION_KEYS, WAVES_KEYS, STACK_NAME, ACTION_NAME, ACTION_TYPE_PREFIX, stacks;
 var init_stacks = __esm({
   "src/config/stacks.ts"() {
     "use strict";
     init_approval();
     init_types();
-    STACK_KEYS = ["dir", "paths", "gate", "backend"];
+    STACK_KEYS = ["dir", "paths", "gate", "backend", "actions"];
+    ACTION_KEYS = ["name", "urn", "description"];
     WAVES_KEYS = ["canary", "after"];
     STACK_NAME = /^[^/\s]+\/[^/\s]+$/;
+    ACTION_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/;
+    ACTION_TYPE_PREFIX = "command:";
     stacks = {
       name: "stacks",
       keys: ["stacks", "waves"],
@@ -1000,7 +1064,21 @@ var init_stacks = __esm({
               dir: { type: "string", description: "The directory holding the stack's Pulumi.yaml." },
               paths: { type: "array", items: { type: "string" }, description: "Paths whose change previews the stack, beside its directory." },
               gate: { type: "string", enum: ["always", "on-destructive", "never"], description: "The stack's gate, in place of the top-level gate." },
-              backend: BACKEND_SCHEMA
+              backend: BACKEND_SCHEMA,
+              actions: {
+                type: "array",
+                description: "The stack's day-2 actions, each run by plywood action <stack> <name> under a second person's approval.",
+                items: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["name", "urn"],
+                  properties: {
+                    name: { type: "string", pattern: ACTION_NAME.source, description: "The action's name, unique in the stack." },
+                    urn: { type: "string", pattern: "^urn:pulumi:", description: "The URN of a command:local:Command or command:remote:Command resource in the stack, replaced to run the action." },
+                    description: { type: "string", description: "What the action does, for people and agents." }
+                  }
+                }
+              }
             }
           }
         },
@@ -1038,6 +1116,7 @@ var init_stacks = __esm({
           if (s.dir !== void 0 && typeof s.dir !== "string") out.push(error(`${key}.dir`, "must be a string"));
           if (s.backend !== void 0 && typeof s.backend !== "string") out.push(error(`${key}.backend`, "must be a URL string"));
           out.push(...stringList(s.paths, `${key}.paths`), ...oneOf(s.gate, GATES, `${key}.gate`));
+          if (s.actions !== void 0) out.push(...actionProblems(name, s.actions, `${key}.actions`));
         }
         if (isObject(doc.waves)) {
           out.push(...wavesMappingProblems(doc.waves, isObject(doc.stacks) ? listed : void 0));
@@ -2348,227 +2427,6 @@ var init_config_check = __esm({
   }
 });
 
-// src/init/detect.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
-import { basename, dirname as dirname2, join as join2, relative, sep } from "node:path";
-import { parseYAML as parseYAML2 } from "@intentius/chant/yaml";
-function repoRoot(dir) {
-  let cur = dir;
-  for (let i = 0; i < 64; i++) {
-    if (existsSync2(join2(cur, ".git"))) return cur;
-    const parent = dirname2(cur);
-    if (parent === cur) return dir;
-    cur = parent;
-  }
-  return dir;
-}
-function posixRel(root, path) {
-  const rel = relative(root, path);
-  return rel === "" ? "." : rel.split(sep).join("/");
-}
-function readYamlFile(file) {
-  try {
-    const doc = parseYAML2(readFileSync2(file, "utf8"));
-    return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function findPulumiProjects(root) {
-  const out = [];
-  const walk = (dir, depth) => {
-    let entries;
-    try {
-      entries = readdirSync(dir).sort();
-    } catch {
-      return;
-    }
-    const file = ["Pulumi.yaml", "Pulumi.yml"].find((n) => entries.includes(n));
-    if (file) {
-      const project = readProject(root, dir, join2(dir, file));
-      if (project) out.push(project);
-    }
-    if (depth >= MAX_DEPTH) return;
-    for (const name of entries) {
-      if (SKIP.has(name) || name.startsWith(".")) continue;
-      const path = join2(dir, name);
-      try {
-        if (statSync(path).isDirectory()) walk(path, depth + 1);
-      } catch {
-      }
-    }
-  };
-  walk(root, 0);
-  return out;
-}
-function readProject(root, dir, file) {
-  const doc = readYamlFile(file);
-  if (!doc || typeof doc.name !== "string" || doc.name === "") return void 0;
-  const runtime = typeof doc.runtime === "string" ? doc.runtime : doc.runtime?.name;
-  const backend = doc.backend;
-  const configDir = typeof doc.stackConfigDir === "string" ? join2(dir, doc.stackConfigDir) : dir;
-  return {
-    name: doc.name,
-    dir: posixRel(root, dir),
-    ...typeof runtime === "string" ? { runtime } : {},
-    ...backend && typeof backend.url === "string" ? { backendUrl: backend.url } : {},
-    stacks: stackNames(configDir)
-  };
-}
-function stackNames(configDir) {
-  let entries;
-  try {
-    entries = readdirSync(configDir);
-  } catch {
-    return [];
-  }
-  const names = entries.map((n) => /^Pulumi\.(.+)\.ya?ml$/.exec(n)?.[1]).filter((s) => s !== void 0 && s !== "");
-  return [...new Set(names)].sort(byEnvironment);
-}
-function environmentOf(stack) {
-  const last = stack.split("/").pop().toLowerCase();
-  const head = last.split(/[-_.]/)[0];
-  return ENV_ORDER.includes(head) ? head : last;
-}
-function rank(stack) {
-  const env = environmentOf(stack);
-  const at = ENV_ORDER.indexOf(env);
-  return at >= 0 ? at : PROD_RANK - 0.5;
-}
-function byEnvironment(a, b) {
-  return rank(a) - rank(b) || a.localeCompare(b);
-}
-function stacksOf2(projects) {
-  const names = /* @__PURE__ */ new Map();
-  for (const p of projects) names.set(p.name, (names.get(p.name) ?? 0) + 1);
-  const out = [];
-  for (const p of projects) {
-    const project = (names.get(p.name) ?? 0) > 1 ? `${p.name}-${slug(p.dir)}` : p.name;
-    for (const stack of p.stacks) out.push({ key: `${project}/${stack}`, project: p.name, stack, dir: p.dir });
-  }
-  return out.sort((x, y) => byEnvironment(x.stack, y.stack) || x.key.localeCompare(y.key));
-}
-function slug(s) {
-  const out = s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return out === "" ? "root" : out;
-}
-function originUrl(root) {
-  const config2 = gitFile(root, "config");
-  if (!config2) return void 0;
-  let inOrigin = false;
-  for (const raw of config2.split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line.startsWith("[")) {
-      inOrigin = /^\[remote\s+"origin"\]$/.test(line);
-      continue;
-    }
-    const m = inOrigin ? /^url\s*=\s*(.+)$/.exec(line) : null;
-    if (m) return m[1].trim();
-  }
-  return void 0;
-}
-function gitFile(root, name) {
-  const dotGit = join2(root, ".git");
-  let gitDir = dotGit;
-  try {
-    if (statSync(dotGit).isFile()) {
-      const m = /^gitdir:\s*(.+)$/m.exec(readFileSync2(dotGit, "utf8"));
-      if (!m) return void 0;
-      gitDir = join2(root, m[1].trim());
-      const common = join2(gitDir, "commondir");
-      if (existsSync2(common) && !existsSync2(join2(gitDir, name))) gitDir = join2(gitDir, readFileSync2(common, "utf8").trim());
-    }
-    const path = join2(gitDir, name);
-    return existsSync2(path) ? readFileSync2(path, "utf8") : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function remoteHost(url) {
-  const scp = /^[^@/\s]+@([^:/\s]+):/.exec(url);
-  if (scp) return scp[1].toLowerCase();
-  try {
-    return new URL(url).hostname.toLowerCase() || void 0;
-  } catch {
-    return void 0;
-  }
-}
-function forgeOfRemote(url) {
-  const host = remoteHost(url);
-  if (!host) return void 0;
-  if (host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.")) return { kind: "github", because: `origin is on ${host}` };
-  if (host === "gitlab.com") return { kind: "gitlab", because: `origin is on ${host}` };
-  if (host === "codeberg.org") return { kind: "forgejo", because: `origin is on ${host}` };
-  if (/(^|[.-])gitlab([.-]|$)/.test(host)) return { kind: "gitlab", because: `origin is on ${host}`, url: `https://${host}` };
-  if (/(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return { kind: "forgejo", because: `origin is on ${host}`, url: `https://${host}` };
-  return void 0;
-}
-function detectForge(root) {
-  const url = originUrl(root);
-  const byRemote = url ? forgeOfRemote(url) : void 0;
-  if (byRemote) return byRemote;
-  if (existsSync2(join2(root, ".forgejo"))) return { kind: "forgejo", because: "the repository has .forgejo/" };
-  if (existsSync2(join2(root, ".gitlab-ci.yml"))) return { kind: "gitlab", because: "the repository has .gitlab-ci.yml" };
-  if (existsSync2(join2(root, ".github", "workflows"))) return { kind: "github", because: "the repository has .github/workflows/" };
-  return void 0;
-}
-function defaultBranch(root) {
-  const head = gitFile(root, "refs/remotes/origin/HEAD");
-  const remote = head && /ref:\s*refs\/remotes\/origin\/(.+)/.exec(head)?.[1];
-  if (remote) return remote.trim();
-  const local = gitFile(root, "HEAD");
-  const branch = local && /ref:\s*refs\/heads\/(.+)/.exec(local)?.[1];
-  return branch ? branch.trim() : "main";
-}
-function findPulumiActions(root) {
-  const out = [];
-  for (const d of WORKFLOW_DIRS) {
-    let names;
-    try {
-      names = readdirSync(join2(root, d)).sort();
-    } catch {
-      continue;
-    }
-    for (const n of names) {
-      if (!/\.ya?ml$/.test(n)) continue;
-      try {
-        if (/uses:\s*["']?pulumi\/actions@/.test(readFileSync2(join2(root, d, n), "utf8"))) out.push(`${d}/${n}`);
-      } catch {
-      }
-    }
-  }
-  return out;
-}
-function detect(cwd) {
-  const root = repoRoot(cwd);
-  const projects = findPulumiProjects(root);
-  const forge = detectForge(root);
-  const preCommit = [".pre-commit-config.yaml", ".pre-commit-config.yml"].find((n) => existsSync2(join2(root, n)));
-  return {
-    root,
-    projects,
-    stacks: stacksOf2(projects),
-    ...forge ? { forge } : {},
-    defaultBranch: defaultBranch(root),
-    pulumiActions: findPulumiActions(root),
-    ...preCommit ? { preCommit } : {}
-  };
-}
-function repoName(root) {
-  return slug(basename(root)).slice(0, 40).replace(/-+$/, "") || "plywood";
-}
-var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
-var init_detect = __esm({
-  "src/init/detect.ts"() {
-    "use strict";
-    SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
-    MAX_DEPTH = 8;
-    ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
-    PROD_RANK = ENV_ORDER.indexOf("prod");
-    WORKFLOW_DIRS = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
-  }
-});
-
 // src/chant-product.ts
 function hasChant4620(chant) {
   return typeof chant.prCommentPreviewJob === "function" && typeof chant.PR_PREVIEW_FLOOR === "string";
@@ -2600,44 +2458,11 @@ var init_chant_product = __esm({
   "src/chant-product.ts"() {
     "use strict";
     REQUIRED2 = ["assertProductWords", "productPipelineJobs", "approveLine", "runChantInProcess"];
-    BUILT_CHANT = true ? "0.124.55" : "unknown";
+    BUILT_CHANT = true ? "0.124.58" : "unknown";
   }
 });
 
 // src/chant-next.ts
-async function acceptsContentsWrite(load) {
-  try {
-    const m = await load();
-    if (typeof m.assertScheduledOpCloud !== "function") return false;
-    m.assertScheduledOpCloud(structuredClone(CONTENTS_WRITE_PROBE));
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function has(load, name, type = "function") {
-  try {
-    const m = await load();
-    return typeof m[name] === type;
-  } catch {
-    return false;
-  }
-}
-function chantNext() {
-  detected ??= (async () => ({
-    // @ts-ignore: the subpath is missing from chant 0.124.55 (chant#4624).
-    checkJob: await has(() => import("@intentius/chant/ci-job-guard"), "checkJob"),
-    planFlags: await has(() => import("@intentius/chant/components/capability"), "PLAN_FLAG_ARGS", "object"),
-    staleNotes: await has(() => import("@intentius/chant/pr-post"), "markStaleNotes"),
-    // @ts-ignore: the subpath is missing from chant 0.124.55 (chant#4631).
-    scheduledOpCloud: await has(() => import("@intentius/chant/scheduled-op-cloud"), "assertScheduledOpCloud"),
-    // @ts-ignore: the subpath is missing from chant 0.124.55 (chant#4631).
-    updateContentsWrite: await acceptsContentsWrite(() => import("@intentius/chant/scheduled-op-cloud")),
-    // @ts-ignore: the subpath is missing from chant 0.124.55 (chant#4636).
-    applyMerge: await has(() => import("@intentius/chant/pr-merge"), "mergeAfterApply")
-  }))();
-  return detected;
-}
 function hasChantRespond(chant) {
   return typeof chant?.CI_RESPOND_FLOOR === "string";
 }
@@ -2651,26 +2476,13 @@ function hasChantPullRequestApprovalStatus(chant) {
   return typeof chant?.APPROVAL_STATUS_PULL_REQUEST_FLOOR === "string";
 }
 function chantAudit() {
-  audit ??= (async () => {
-    try {
-      const m = await import("@intentius/chant/ci-audit");
-      return typeof m.attributeDrift === "function" && typeof m.routeAttributions === "function" && typeof m.parseAuditLogSetting === "function" ? m : void 0;
-    } catch {
-      return void 0;
-    }
-  })();
+  audit ??= import("@intentius/chant/ci-audit").then((m) => m);
   return audit;
 }
-var CONTENTS_WRITE_PROBE, detected, audit;
+var audit;
 var init_chant_next = __esm({
   "src/chant-next.ts"() {
     "use strict";
-    CONTENTS_WRITE_PROBE = {
-      name: "plywood-probe",
-      trigger: { kind: "cron", schedule: "0 6 * * *" },
-      findingMode: "issue",
-      update: { command: "true", permissions: { contents: "write" } }
-    };
   }
 });
 
@@ -2820,18 +2632,18 @@ var init_note_control = __esm({
 });
 
 // src/init/workflow.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
-import { dirname as dirname3, isAbsolute, join as join3 } from "node:path";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join2 } from "node:path";
 async function writeWorkflow(chant, input) {
-  const file = isAbsolute(input.output) ? input.output : join3(input.root, input.output);
-  const previous = existsSync3(file) ? readFileSync3(file, "utf8") : void 0;
-  mkdirSync(dirname3(file), { recursive: true });
+  const file = isAbsolute(input.output) ? input.output : join2(input.root, input.output);
+  const previous = existsSync2(file) ? readFileSync2(file, "utf8") : void 0;
+  mkdirSync(dirname2(file), { recursive: true });
   const code = await chant.runChantInProcess([...input.argv, "--output", file], input.words);
-  if (code !== 0 || !existsSync3(file)) {
+  if (code !== 0 || !existsSync2(file)) {
     if (previous !== void 0) writeFileSync(file, previous);
     return { code: code !== 0 ? code : 1, file, status: "failed", kept: [] };
   }
-  const generated = withNoteControl(readFileSync3(file, "utf8"), input.forge, input.noteControl);
+  const generated = withNoteControl(readFileSync2(file, "utf8"), input.forge, input.noteControl);
   const { text, kept } = keepOwnJobs(previous, generated, input.forge);
   writeFileSync(file, text);
   return { code, file, status: text === previous ? "unchanged" : "written", kept };
@@ -2873,8 +2685,76 @@ var init_review_stacks2 = __esm({
 });
 
 // src/waves-workflow.ts
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname4, join as join4 } from "node:path";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
+function wavesEngine(pipeline) {
+  const o = chantPipelineOptions({ ...pipeline.image ? { image: pipeline.image } : {}, ...pipeline.engineSetup ? { engineSetup: pipeline.engineSetup } : {} }, false);
+  return { ...o.image ? { image: o.image } : {}, ...o.beforeScript?.length ? { beforeScript: o.beforeScript } : {} };
+}
+function wavesSpecText(spec, engine2 = {}) {
+  const options = { ...engine2.image ? { image: engine2.image } : {}, ...engine2.beforeScript?.length ? { beforeScript: engine2.beforeScript } : {} };
+  return JSON.stringify(Object.keys(options).length ? { waves: spec, options } : spec, null, 2) + "\n";
+}
+function unwrapWavesSpec(doc) {
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return doc;
+  const inner = doc.waves;
+  if (Array.isArray(inner)) return doc;
+  return inner && typeof inner === "object" && Array.isArray(inner.waves) ? inner : doc;
+}
+function stepId(wave, target) {
+  return `${wave}-${target}`.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function upOpFile(spec) {
+  const s = spec ?? {};
+  const op = typeof s.op === "string" && s.op !== "" ? s.op : OP_NAME;
+  const taken = /* @__PURE__ */ new Set();
+  const phases = [];
+  for (const [i, w] of (s.waves ?? []).entries()) {
+    const name = typeof w.name === "string" && w.name !== "" ? w.name : `wave-${i + 1}`;
+    const steps = [];
+    for (const run of w.runs ?? []) {
+      const input = run.input ?? {};
+      if (typeof input.member !== "string" || typeof input.dir !== "string") continue;
+      let id = stepId(name, run.target);
+      for (let n = 2; taken.has(id); n++) id = `${stepId(name, run.target)}-${n}`;
+      taken.add(id);
+      const opts = [
+        `dir: ${JSON.stringify(input.dir)}`,
+        ...typeof input.stack === "string" ? [`stack: ${JSON.stringify(input.stack)}`] : [],
+        ...input.engine === "pulumi" || input.engine === "plunge" ? [`engine: ${JSON.stringify(input.engine)}`] : [],
+        `id: ${JSON.stringify(id)}`
+      ];
+      steps.push(`pulumiPreviewStep(${JSON.stringify(input.member)}, { ${opts.join(", ")} })`);
+    }
+    if (steps.length > 0) phases.push(`    phase(${JSON.stringify(name)}, [${steps.join(", ")}]),`);
+  }
+  return [
+    `// Written by '${PRODUCT} init' and '${PRODUCT} ci' from .chant/op-waves/${OP_NAME}.spec.json, and written again on each run: edit plywood.yml, not this file.`,
+    `// The waves workflow runs under this Op's name: each wave job previews and updates its stacks through the spec's`,
+    `// pulumi-up step and records the runs under ${op}. chant's generator needs the Op to exist. Run by hand`,
+    `// (npx chant run ${op}), it previews each stack in wave order and changes nothing.`,
+    `import { Op, phase } from "@intentius/chant/op";`,
+    `import { pulumiPreviewStep } from "@intentius/chant-lexicon-pulumi";`,
+    "",
+    "export default Op({",
+    `  name: ${JSON.stringify(op)},`,
+    `  overview: "The stacks ${PRODUCT}'s waves update on merge, previewed in wave order",`,
+    `  labels: { Surface: "${PRODUCT}-up" },`,
+    "  phases: [",
+    ...phases,
+    "  ],",
+    "});",
+    ""
+  ].join("\n");
+}
+function writeUpOp(cwd, spec) {
+  const path = join3(cwd, UP_OP_FILE);
+  const text = upOpFile(spec);
+  if (existsSync3(path) && readFileSync3(path, "utf8") === text) return false;
+  mkdirSync2(dirname3(path), { recursive: true });
+  writeFileSync2(path, text);
+  return true;
+}
 function binLines(waves, bin) {
   const binArgs = bin.split(/\s+/).filter(Boolean);
   return waves.jobs.map((job) => {
@@ -2891,22 +2771,23 @@ function withBinLines(text, lines2) {
   });
 }
 function generatedFor(dir, specFile) {
-  if (!existsSync4(dir)) return [];
-  return readdirSync2(dir).filter((f) => /\.ya?ml$/.test(f)).map((f) => join4(dir, f)).filter((p) => (readFileSync4(p, "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${specFile}`));
+  if (!existsSync3(dir)) return [];
+  return readdirSync(dir).filter((f) => /\.ya?ml$/.test(f)).map((f) => join3(dir, f)).filter((p) => (readFileSync3(p, "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${specFile}`));
 }
-async function writeWaveJobs(chant, forge, waves, words, table, io) {
-  const specPath = join4(io.cwd, waves.specFile);
-  const specText = JSON.stringify(waves.spec, null, 2) + "\n";
-  const before = existsSync4(specPath) ? readFileSync4(specPath, "utf8") : void 0;
+async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}) {
+  const specPath = join3(io.cwd, waves.specFile);
+  const specText = wavesSpecText(waves.spec, engine2);
+  const before = existsSync3(specPath) ? readFileSync3(specPath, "utf8") : void 0;
   if (before !== specText) {
-    mkdirSync2(dirname4(specPath), { recursive: true });
+    mkdirSync2(dirname3(specPath), { recursive: true });
     writeFileSync2(specPath, specText);
     io.err(`${PRODUCT} ci: wrote ${waves.specFile} with plywood's op and gates; commit it with the workflow`);
   }
+  if (writeUpOp(io.cwd, waves.spec)) io.err(`${PRODUCT} ci: wrote ${UP_OP_FILE}, the Op the waves spec names; commit it with the workflow`);
   const outDir = WAVES_OUTPUT_DIR[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", waves.specFile, "--output", outDir], words);
   if (code !== table.done) return code;
-  const files = generatedFor(join4(io.cwd, outDir), waves.specFile);
+  const files = generatedFor(join3(io.cwd, outDir), waves.specFile);
   if (files.length === 0) {
     io.err(`${PRODUCT} ci: chant wrote no waves workflow for ${waves.specFile} under ${outDir}`);
     return table.failed;
@@ -2914,7 +2795,7 @@ async function writeWaveJobs(chant, forge, waves, words, table, io) {
   const lines2 = hasChant4607(chant) ? void 0 : binLines(waves, words.bin);
   for (const file of files) {
     if (lines2) {
-      const text = readFileSync4(file, "utf8");
+      const text = readFileSync3(file, "utf8");
       const next = withBinLines(text, lines2);
       if (next !== text) writeFileSync2(file, next);
     }
@@ -2925,23 +2806,25 @@ async function writeWaveJobs(chant, forge, waves, words, table, io) {
   }
   return table.done;
 }
-var WAVES_OUTPUT_DIR;
+var WAVES_OUTPUT_DIR, UP_OP_FILE;
 var init_waves_workflow = __esm({
   "src/waves-workflow.ts"() {
     "use strict";
     init_chant_product();
+    init_images();
     init_words();
     WAVES_OUTPUT_DIR = {
       github: ".github/workflows",
       forgejo: ".forgejo/workflows",
       gitlab: "."
     };
+    UP_OP_FILE = "ops/pulumi-up.op.ts";
   }
 });
 
 // src/agent-jobs.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname5, join as join5 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join4 } from "node:path";
 function hasChantAgent(chant) {
   return typeof chant?.CI_AGENT_FLOOR === "string";
 }
@@ -2987,9 +2870,9 @@ function agentOpSpec(spec, doc) {
   };
 }
 function writeIfChanged(cwd, file, text) {
-  const path = join5(cwd, file);
-  if (existsSync5(path) && readFileSync5(path, "utf8") === text) return false;
-  mkdirSync3(dirname5(path), { recursive: true });
+  const path = join4(cwd, file);
+  if (existsSync4(path) && readFileSync4(path, "utf8") === text) return false;
+  mkdirSync3(dirname4(path), { recursive: true });
   writeFileSync3(path, text);
   return true;
 }
@@ -3016,9 +2899,9 @@ async function writeAgentJobs(chant, forge, env, doc, words, table, io) {
   const outDir = OP_OUTPUT_DIR[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", AGENT_SPEC_FILE, "--output", outDir], agentWords);
   if (code !== table.done) return code;
-  const dir = join5(io.cwd, outDir);
-  const files = existsSync5(dir) ? readdirSync3(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync5(join5(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${AGENT_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: agent jobs at ${join5(outDir, f).replace(/^\.\//, "")}, answering /${PRODUCT} agent <ask>`);
+  const dir = join4(io.cwd, outDir);
+  const files = existsSync4(dir) ? readdirSync2(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync4(join4(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${AGENT_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: agent jobs at ${join4(outDir, f).replace(/^\.\//, "")}, answering /${PRODUCT} agent <ask>`);
   io.err(`${PRODUCT} ci: the agent job reads the model's key from ${a.keyEnv}; set it from a secret${a.maxRuns === void 0 ? ", and set agent.max_runs to limit how often it runs" : ""}`);
   if (forge === "github" && a.tokenEnv === void 0) io.err(`${PRODUCT} ci: the push job pushes with the job token, which starts no workflow on GitHub, so the agent's commit gets no preview; set agent.token_env to a secret holding a user's or app's token`);
   else if (a.tokenEnv !== void 0) io.err(`${PRODUCT} ci: the push job pushes with ${a.tokenEnv}; set it from a secret`);
@@ -3116,7 +2999,7 @@ __export(jobs_exports, {
   withJobSettings: () => withJobSettings
 });
 function hasChant4625() {
-  detected2 ??= (async () => {
+  detected ??= (async () => {
     try {
       const m = await import("@intentius/chant/parallelism");
       return typeof m.mapLimited === "function" && typeof m.parallelismProblem === "function";
@@ -3124,10 +3007,10 @@ function hasChant4625() {
       return false;
     }
   })();
-  return detected2;
+  return detected;
 }
-function setChant4625ForTests(has2) {
-  detected2 = has2 === "reset" ? void 0 : Promise.resolve(has2);
+function setChant4625ForTests(has) {
+  detected = has === "reset" ? void 0 : Promise.resolve(has);
 }
 function secretReference(forge, secret) {
   return forge === "gitlab" ? `$${secret}` : `\${{ secrets.${secret} }}`;
@@ -3228,7 +3111,7 @@ async function prJobsFor(pipeline) {
   const { flags, notes } = prLoopJobFlags(pipeline.jobs, pipeline.runner);
   return { options: prLoopJobOptions(pipeline.jobs, pipeline.runner), flags, notes };
 }
-var detected2, JOBS_NEED_CHANT, GROUP_NAME;
+var detected, JOBS_NEED_CHANT, GROUP_NAME;
 var init_jobs2 = __esm({
   "src/jobs.ts"() {
     "use strict";
@@ -3277,8 +3160,8 @@ var init_refusals = __esm({
 });
 
 // src/up.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
 function approveTarget(gate, opts) {
   if (opts.op) return { op: opts.op, gate };
   if (PR_OP.test(gate)) return { op: gate, gate: PR_GATE };
@@ -3359,10 +3242,10 @@ async function approve(args, json, table, io) {
   });
 }
 function wavesSpecAt(cwd, file = WAVES_SPEC_FILE) {
-  const path = join6(cwd, file);
-  if (!existsSync6(path)) return void 0;
+  const path = join5(cwd, file);
+  if (!existsSync5(path)) return void 0;
   try {
-    const spec = JSON.parse(readFileSync6(path, "utf8"));
+    const spec = unwrapWavesSpec(JSON.parse(readFileSync5(path, "utf8")));
     return spec && typeof spec === "object" && !Array.isArray(spec) ? spec : void 0;
   } catch {
     return void 0;
@@ -3446,11 +3329,11 @@ async function override(args, json, table, io) {
   return withChant(`${PRODUCT} override`, table, io, async (chant) => explainRefusal(await chant.runChantInProcess(argv, PRODUCT_WORDS), table, io.err));
 }
 function readUpSpec(cwd, file = WAVES_SPEC_FILE) {
-  const path = join6(cwd, file);
-  if (!existsSync6(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
+  const path = join5(cwd, file);
+  if (!existsSync5(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
   let spec;
   try {
-    spec = JSON.parse(readFileSync6(path, "utf8"));
+    spec = unwrapWavesSpec(JSON.parse(readFileSync5(path, "utf8")));
   } catch (e) {
     return { error: `${file}: ${e.message}` };
   }
@@ -3549,20 +3432,15 @@ async function upBeforeMerge(number, args, json, table, io) {
       "--forge",
       forge,
       ...requiresArgv(chant, config2.doc),
-      ...await mergeArgv(config2.doc, io),
+      ...mergeArgv(config2.doc),
       ...json ? ["--json"] : []
     ];
     return explainRefusal(await chant.runChantInProcess(argv, PRODUCT_WORDS), table, io.err, { pr: number });
   });
 }
-async function mergeArgv(doc, io) {
+function mergeArgv(doc) {
   const merge = applyMergeOf(doc);
-  if (!merge) return [];
-  if (!(await chantNext()).applyMerge) {
-    io.err(`${PRODUCT}: ${APPLY_MERGE_NEEDS_CHANT}`);
-    return [];
-  }
-  return applyMergeArgv(merge);
+  return merge ? applyMergeArgv(merge) : [];
 }
 async function resume(args, json, table, io) {
   const op = takeFlag(args, "--op");
@@ -3597,6 +3475,7 @@ var init_up = __esm({
     init_review_stacks2();
     init_stages();
     init_words();
+    init_waves_workflow();
     OVERRIDE_OP = "policy-override";
     WAVES_SPEC_FILE = `.chant/op-waves/${OP_NAME}.spec.json`;
     UP_STEP_KIND = "pulumi-up";
@@ -3609,9 +3488,9 @@ var init_up = __esm({
 // src/drift.ts
 import { createHash as createHash2 } from "node:crypto";
 import { resolveTargetCloudIdentity } from "@intentius/chant/ci-identity";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname6, join as join7 } from "node:path";
+import { dirname as dirname5, join as join6 } from "node:path";
 function driftRows(doc) {
   return (doc.records ?? []).filter((r) => DRIFT_STATUSES.includes(r.status)).map((r) => ({ urn: r.address, status: r.status, attributes: (r.attributes ?? []).map((a) => a.path).sort() })).sort((a, b) => a.urn < b.urn ? -1 : a.urn > b.urn ? 1 : 0);
 }
@@ -3670,7 +3549,7 @@ async function drift2(args, json, table, io) {
   const respond = respondFlag.value ?? driftResponseOf(doc);
   const forge = forgeFlag.value;
   return withChant(`${PRODUCT} drift`, table, io, async (chant) => {
-    const dir = mkdtempSync(join7(tmpdir(), "plywood-drift-"));
+    const dir = mkdtempSync(join6(tmpdir(), "plywood-drift-"));
     const results = [];
     try {
       const attribute = await attributionFor(doc, io);
@@ -3750,12 +3629,12 @@ async function driftNotice(chant, doc, results, environment, io) {
   });
 }
 async function readStack(chant, stack, dir, opts) {
-  const file = join7(dir, `${driftOpName(stack)}.json`);
+  const file = join6(dir, `${driftOpName(stack)}.json`);
   const argv = ["workspace", "drift", "--member", stack, ...opts.resource ? ["--resource", opts.resource] : [], ...opts.env ? ["--env", opts.env] : [], "-o", file];
   const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
   let doc;
   try {
-    if (existsSync7(file)) doc = JSON.parse(readFileSync7(file, "utf8"));
+    if (existsSync6(file)) doc = JSON.parse(readFileSync6(file, "utf8"));
   } catch (e) {
     return { stack, ok: false, drifted: 0, rows: [], error: `chant wrote a drift document plywood cannot read: ${e.message}` };
   }
@@ -3769,12 +3648,7 @@ async function readStack(chant, stack, dir, opts) {
 async function attributionFor(doc, io) {
   const logs = driftSettingsOf(doc).auditLogs;
   if (!logs) return void 0;
-  const audit3 = await chantAudit();
-  if (!audit3) {
-    io.err(`${PRODUCT} drift: ${ATTRIBUTION_NEEDS_CHANT}`);
-    return void 0;
-  }
-  return { audit: audit3, logs };
+  return { audit: await chantAudit(), logs };
 }
 function auditLogFor(logs, stack) {
   return Object.entries(logs).find(([glob]) => glob === "*" || glob === "**" || globMatches(glob, stack))?.[1];
@@ -3793,7 +3667,7 @@ async function attributeStack(a, stack, doc) {
 }
 function specHasUpdate(cwd, op) {
   try {
-    const spec = JSON.parse(readFileSync7(join7(cwd, DRIFT_SPEC_FILE), "utf8"));
+    const spec = JSON.parse(readFileSync6(join6(cwd, DRIFT_SPEC_FILE), "utf8"));
     return (spec.ops ?? []).some((o) => o.name === op && o.update !== void 0);
   } catch {
     return false;
@@ -3869,9 +3743,9 @@ function withNotifyVariables(fields, notify2) {
   return { ...fields, variables: { ...notify2, ...fields.variables ?? {} } };
 }
 function writeIfChanged2(cwd, file, text) {
-  const path = join7(cwd, file);
-  if (existsSync7(path) && readFileSync7(path, "utf8") === text) return false;
-  mkdirSync4(dirname6(path), { recursive: true });
+  const path = join6(cwd, file);
+  if (existsSync6(path) && readFileSync6(path, "utf8") === text) return false;
+  mkdirSync4(dirname5(path), { recursive: true });
   writeFileSync4(path, text);
   return true;
 }
@@ -3882,19 +3756,18 @@ async function writeDriftJobs(chant, forge, doc, words, table, io, env = "produc
     io.err(`${PRODUCT} ci: drift.schedule is set and plywood.yml lists no stacks, so no drift job was written`);
     return table.done;
   }
-  const next = await chantNext();
   if (writeIfChanged2(io.cwd, DRIFT_OP_FILE, driftOpFile(doc, settings.stacks, settings.schedule))) io.err(`${PRODUCT} ci: wrote ${DRIFT_OP_FILE}; commit it with the workflow`);
-  if (writeIfChanged2(io.cwd, DRIFT_SPEC_FILE, JSON.stringify(driftOpSpec(doc, forge, settings.stacks, settings.schedule, chant, { cloud: next.scheduledOpCloud, contentsWrite: next.updateContentsWrite, env }), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${DRIFT_SPEC_FILE}`);
+  if (writeIfChanged2(io.cwd, DRIFT_SPEC_FILE, JSON.stringify(driftOpSpec(doc, forge, settings.stacks, settings.schedule, chant, { cloud: true, contentsWrite: true, env }), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${DRIFT_SPEC_FILE}`);
   const outDir = OP_OUTPUT_DIR2[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", DRIFT_SPEC_FILE, "--output", outDir], words);
   if (code !== table.done) return code;
-  const dir = join7(io.cwd, outDir);
-  const files = existsSync7(dir) ? readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync7(join7(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${DRIFT_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: drift job at ${join7(outDir, f).replace(/^\.\//, "")} on ${settings.schedule}`);
+  const dir = join6(io.cwd, outDir);
+  const files = existsSync6(dir) ? readdirSync3(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync6(join6(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${DRIFT_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: drift job at ${join6(outDir, f).replace(/^\.\//, "")} on ${settings.schedule}`);
   if (files.length && forge === "gitlab") io.err(`${PRODUCT} ci: GitLab runs the drift job from a pipeline schedule; include the file from .gitlab-ci.yml and add a schedule`);
   return table.done;
 }
-var DRIFT_OP_FILE, DRIFT_SPEC_FILE, SNAPSHOTS_REF, SNAPSHOTS_FETCH, DRIFT_STATUSES, forgeOverride, notifyFetch, ATTRIBUTION_NEEDS_CHANT, OP_OUTPUT_DIR2;
+var DRIFT_OP_FILE, DRIFT_SPEC_FILE, SNAPSHOTS_REF, SNAPSHOTS_FETCH, DRIFT_STATUSES, forgeOverride, notifyFetch, OP_OUTPUT_DIR2;
 var init_drift2 = __esm({
   "src/drift.ts"() {
     "use strict";
@@ -3918,7 +3791,6 @@ var init_drift2 = __esm({
     SNAPSHOTS_REF = "refs/chant/snapshots";
     SNAPSHOTS_FETCH = `git fetch --no-tags origin '+${SNAPSHOTS_REF}:${SNAPSHOTS_REF}' || true`;
     DRIFT_STATUSES = ["drifted", "missing"];
-    ATTRIBUTION_NEEDS_CHANT = "drift.audit_log is set, and the installed chant has no audit-log reads (chant#4632), so no drifted attribute was attributed";
     OP_OUTPUT_DIR2 = { github: ".github/workflows", forgejo: ".forgejo/workflows", gitlab: "." };
   }
 });
@@ -3965,8 +3837,8 @@ var init_tips = __esm({
 });
 
 // src/agents.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname7, join as join8 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname6, join as join7 } from "node:path";
 function plywoodMcpTools(ctx) {
   const none = { type: "object", properties: {} };
   const doc = () => {
@@ -3976,7 +3848,7 @@ function plywoodMcpTools(ctx) {
   return [
     {
       name: "stacks",
-      description: "The stacks plywood.yml lists, each with its directory, gate and backend, and the waves they update in.",
+      description: "The stacks plywood.yml lists, each with its directory, gate, backend and actions, and the waves they update in.",
       inputSchema: none,
       readOnly: true,
       handler: async () => {
@@ -4010,24 +3882,51 @@ function plywoodMcpTools(ctx) {
     }
   ];
 }
-function plywoodMcpHook(reportUrl) {
+function plywoodProposeTools() {
+  return [
+    {
+      name: TEMPLATE_REQUEST_WORDS.tool,
+      description: `Open a pull request for an app from a template, reviewed and gated like a person's. ${TEMPLATE_REQUEST_WORDS.refusal}`,
+      inputSchema: {
+        type: "object",
+        properties: {
+          template: { type: "string", description: "The template's name in the catalog." },
+          version: { type: "string", description: "The template's version; the newest when left out." },
+          name: { type: "string", description: "The app's name, which names its directory and the request branch." },
+          app: { type: "string", description: "The app an add-on template joins." },
+          inputs: { type: "object", description: "The template's inputs, by name." }
+        },
+        required: ["template", "name", "inputs"]
+      },
+      forgeWrite: true,
+      handler: async () => {
+        throw new Error(TEMPLATE_REQUEST_WORDS.refusal);
+      }
+    }
+  ];
+}
+function plywoodMcpHook(reportUrl, propose = false) {
   return {
     product: PRODUCT,
-    tools: (ctx) => plywoodMcpTools(ctx),
+    // A read-only server without the tier refuses to start with a forgeWrite tool, so they go only where chant says it serves them.
+    tools: (ctx) => [...plywoodMcpTools(ctx), ...propose && ctx.propose === true ? plywoodProposeTools() : []],
     readOnly: true,
+    ...propose ? { propose: true } : {},
     ...reportUrl ? { reportUrl } : {},
-    instructions: `${PRODUCT} (${TAGLINE}) serves read tools only. To change a stack, open a pull request: ${PRODUCT} previews it, and its update runs after a person approves the digest.`
+    instructions: propose ? `${PRODUCT} (${TAGLINE}) serves read tools and ${TEMPLATE_REQUEST_WORDS.tool}, which may open a pull request and nothing else. Pulumi templates are not available yet, so ${TEMPLATE_REQUEST_WORDS.tool} refuses every call. ${READ_INSTRUCTIONS}` : `${PRODUCT} (${TAGLINE}) serves read tools only. ${READ_INSTRUCTIONS}`
   };
 }
 async function mcp(args, _json, table, io) {
-  const report = takeFlag(args, "--report-url");
+  const propose = args.includes("--propose");
+  const report = takeFlag(args.filter((a) => a !== "--propose"), "--report-url");
   if (report.missing) return usage("--report-url takes a URL", table, io);
   if (report.rest.length) return usage(`mcp does not take ${report.rest.join(" ")}`, table, io);
   return withChant(`${PRODUCT} mcp`, table, io, (chant) => {
     if (typeof chant.PRODUCT_MCP_HOOK_FLOOR !== "string") {
       io.err(`${PRODUCT} mcp: this chant has no product tool hook (chant#4555), so the server serves chant's read tools and none of ${PRODUCT}'s`);
     }
-    return chant.runChantInProcess(["serve", "mcp", "--read-only"], PRODUCT_WORDS, { mcp: plywoodMcpHook(report.value) });
+    const argv = ["serve", "mcp", "--read-only", ...propose ? ["--propose"] : []];
+    return chant.runChantInProcess(argv, PRODUCT_WORDS, { mcp: plywoodMcpHook(report.value, propose) });
   });
 }
 function reviewOpFile(doc) {
@@ -4079,9 +3978,9 @@ function reviewOpSpec(doc) {
   };
 }
 function writeIfChanged3(cwd, file, text) {
-  const path = join8(cwd, file);
-  if (existsSync8(path) && readFileSync8(path, "utf8") === text) return false;
-  mkdirSync5(dirname7(path), { recursive: true });
+  const path = join7(cwd, file);
+  if (existsSync7(path) && readFileSync7(path, "utf8") === text) return false;
+  mkdirSync5(dirname6(path), { recursive: true });
   writeFileSync5(path, text);
   return true;
 }
@@ -4092,15 +3991,15 @@ async function writeReviewJobs(chant, forge, doc, words, table, io) {
   const outDir = OP_OUTPUT_DIR3[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", REVIEW_SPEC_FILE, "--output", outDir], words);
   if (code !== table.done) return code;
-  const dir = join8(io.cwd, outDir);
-  const files = existsSync8(dir) ? readdirSync5(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync8(join8(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${REVIEW_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: review jobs at ${join8(outDir, f).replace(/^\.\//, "")}`);
+  const dir = join7(io.cwd, outDir);
+  const files = existsSync7(dir) ? readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync7(join7(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${REVIEW_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: review jobs at ${join7(outDir, f).replace(/^\.\//, "")}`);
   const r = reviewOf(doc);
   io.err(`${PRODUCT} ci: the review job reads the model's key from ${r.keyEnv}; set it from a secret`);
   if (forge === "gitlab") io.err(`${PRODUCT} ci: on GitLab the note job runs on the default branch with CHANT_REVIEW_NOTES=1 from a pipeline schedule, and posts with a protected CHANT_FORGE_TOKEN`);
   return table.done;
 }
-var PERSON_VERBS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE, REVIEW_CHANGE_SET, REVIEW_PREVIEW_LINE, OP_OUTPUT_DIR3;
+var PERSON_VERBS, READ_INSTRUCTIONS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE, REVIEW_CHANGE_SET, REVIEW_PREVIEW_LINE, OP_OUTPUT_DIR3;
 var init_agents2 = __esm({
   "src/agents.ts"() {
     "use strict";
@@ -4114,6 +4013,7 @@ var init_agents2 = __esm({
     init_tips();
     init_words();
     PERSON_VERBS = ["up", "approve", "override"];
+    READ_INSTRUCTIONS = `To change a stack, open a pull request: ${PRODUCT} previews it, and its update runs after a person approves the digest.`;
     REVIEW_OP = "plywood-review";
     REVIEW_OP_FILE = "ops/plywood-review.op.ts";
     REVIEW_SPEC_FILE = ".chant/ops/plywood-review.spec.json";
@@ -4123,6 +4023,227 @@ var init_agents2 = __esm({
   }
 });
 
+// src/init/detect.ts
+import { existsSync as existsSync8, readdirSync as readdirSync5, readFileSync as readFileSync8, statSync } from "node:fs";
+import { basename, dirname as dirname7, join as join8, relative, sep } from "node:path";
+import { parseYAML as parseYAML2 } from "@intentius/chant/yaml";
+function repoRoot(dir) {
+  let cur = dir;
+  for (let i = 0; i < 64; i++) {
+    if (existsSync8(join8(cur, ".git"))) return cur;
+    const parent = dirname7(cur);
+    if (parent === cur) return dir;
+    cur = parent;
+  }
+  return dir;
+}
+function posixRel(root, path) {
+  const rel = relative(root, path);
+  return rel === "" ? "." : rel.split(sep).join("/");
+}
+function readYamlFile(file) {
+  try {
+    const doc = parseYAML2(readFileSync8(file, "utf8"));
+    return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function findPulumiProjects(root) {
+  const out = [];
+  const walk = (dir, depth) => {
+    let entries;
+    try {
+      entries = readdirSync5(dir).sort();
+    } catch {
+      return;
+    }
+    const file = ["Pulumi.yaml", "Pulumi.yml"].find((n) => entries.includes(n));
+    if (file) {
+      const project = readProject(root, dir, join8(dir, file));
+      if (project) out.push(project);
+    }
+    if (depth >= MAX_DEPTH) return;
+    for (const name of entries) {
+      if (SKIP.has(name) || name.startsWith(".")) continue;
+      const path = join8(dir, name);
+      try {
+        if (statSync(path).isDirectory()) walk(path, depth + 1);
+      } catch {
+      }
+    }
+  };
+  walk(root, 0);
+  return out;
+}
+function readProject(root, dir, file) {
+  const doc = readYamlFile(file);
+  if (!doc || typeof doc.name !== "string" || doc.name === "") return void 0;
+  const runtime = typeof doc.runtime === "string" ? doc.runtime : doc.runtime?.name;
+  const backend = doc.backend;
+  const configDir = typeof doc.stackConfigDir === "string" ? join8(dir, doc.stackConfigDir) : dir;
+  return {
+    name: doc.name,
+    dir: posixRel(root, dir),
+    ...typeof runtime === "string" ? { runtime } : {},
+    ...backend && typeof backend.url === "string" ? { backendUrl: backend.url } : {},
+    stacks: stackNames(configDir)
+  };
+}
+function stackNames(configDir) {
+  let entries;
+  try {
+    entries = readdirSync5(configDir);
+  } catch {
+    return [];
+  }
+  const names = entries.map((n) => /^Pulumi\.(.+)\.ya?ml$/.exec(n)?.[1]).filter((s) => s !== void 0 && s !== "");
+  return [...new Set(names)].sort(byEnvironment);
+}
+function environmentOf(stack) {
+  const last = stack.split("/").pop().toLowerCase();
+  const head = last.split(/[-_.]/)[0];
+  return ENV_ORDER.includes(head) ? head : last;
+}
+function rank(stack) {
+  const env = environmentOf(stack);
+  const at = ENV_ORDER.indexOf(env);
+  return at >= 0 ? at : PROD_RANK - 0.5;
+}
+function byEnvironment(a, b) {
+  return rank(a) - rank(b) || a.localeCompare(b);
+}
+function stacksOf2(projects) {
+  const names = /* @__PURE__ */ new Map();
+  for (const p of projects) names.set(p.name, (names.get(p.name) ?? 0) + 1);
+  const out = [];
+  for (const p of projects) {
+    const project = (names.get(p.name) ?? 0) > 1 ? `${p.name}-${slug(p.dir)}` : p.name;
+    for (const stack of p.stacks) out.push({ key: `${project}/${stack}`, project: p.name, stack, dir: p.dir });
+  }
+  return out.sort((x, y) => byEnvironment(x.stack, y.stack) || x.key.localeCompare(y.key));
+}
+function slug(s) {
+  const out = s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return out === "" ? "root" : out;
+}
+function originUrl(root) {
+  const config2 = gitFile(root, "config");
+  if (!config2) return void 0;
+  let inOrigin = false;
+  for (const raw of config2.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line.startsWith("[")) {
+      inOrigin = /^\[remote\s+"origin"\]$/.test(line);
+      continue;
+    }
+    const m = inOrigin ? /^url\s*=\s*(.+)$/.exec(line) : null;
+    if (m) return m[1].trim();
+  }
+  return void 0;
+}
+function gitFile(root, name) {
+  const dotGit = join8(root, ".git");
+  let gitDir = dotGit;
+  try {
+    if (statSync(dotGit).isFile()) {
+      const m = /^gitdir:\s*(.+)$/m.exec(readFileSync8(dotGit, "utf8"));
+      if (!m) return void 0;
+      gitDir = join8(root, m[1].trim());
+      const common = join8(gitDir, "commondir");
+      if (existsSync8(common) && !existsSync8(join8(gitDir, name))) gitDir = join8(gitDir, readFileSync8(common, "utf8").trim());
+    }
+    const path = join8(gitDir, name);
+    return existsSync8(path) ? readFileSync8(path, "utf8") : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function remoteHost(url) {
+  const scp = /^[^@/\s]+@([^:/\s]+):/.exec(url);
+  if (scp) return scp[1].toLowerCase();
+  try {
+    return new URL(url).hostname.toLowerCase() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function forgeOfRemote(url) {
+  const host = remoteHost(url);
+  if (!host) return void 0;
+  if (host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.")) return { kind: "github", because: `origin is on ${host}` };
+  if (host === "gitlab.com") return { kind: "gitlab", because: `origin is on ${host}` };
+  if (host === "codeberg.org") return { kind: "forgejo", because: `origin is on ${host}` };
+  if (/(^|[.-])gitlab([.-]|$)/.test(host)) return { kind: "gitlab", because: `origin is on ${host}`, url: `https://${host}` };
+  if (/(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return { kind: "forgejo", because: `origin is on ${host}`, url: `https://${host}` };
+  return void 0;
+}
+function detectForge(root) {
+  const url = originUrl(root);
+  const byRemote = url ? forgeOfRemote(url) : void 0;
+  if (byRemote) return byRemote;
+  if (existsSync8(join8(root, ".forgejo"))) return { kind: "forgejo", because: "the repository has .forgejo/" };
+  if (existsSync8(join8(root, ".gitlab-ci.yml"))) return { kind: "gitlab", because: "the repository has .gitlab-ci.yml" };
+  if (existsSync8(join8(root, ".github", "workflows"))) return { kind: "github", because: "the repository has .github/workflows/" };
+  return void 0;
+}
+function defaultBranch(root) {
+  const head = gitFile(root, "refs/remotes/origin/HEAD");
+  const remote = head && /ref:\s*refs\/remotes\/origin\/(.+)/.exec(head)?.[1];
+  if (remote) return remote.trim();
+  const local = gitFile(root, "HEAD");
+  const branch = local && /ref:\s*refs\/heads\/(.+)/.exec(local)?.[1];
+  return branch ? branch.trim() : "main";
+}
+function findPulumiActions(root) {
+  const out = [];
+  for (const d of WORKFLOW_DIRS) {
+    let names;
+    try {
+      names = readdirSync5(join8(root, d)).sort();
+    } catch {
+      continue;
+    }
+    for (const n of names) {
+      if (!/\.ya?ml$/.test(n)) continue;
+      try {
+        if (/uses:\s*["']?pulumi\/actions@/.test(readFileSync8(join8(root, d, n), "utf8"))) out.push(`${d}/${n}`);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function detect(cwd) {
+  const root = repoRoot(cwd);
+  const projects = findPulumiProjects(root);
+  const forge = detectForge(root);
+  const preCommit = [".pre-commit-config.yaml", ".pre-commit-config.yml"].find((n) => existsSync8(join8(root, n)));
+  return {
+    root,
+    projects,
+    stacks: stacksOf2(projects),
+    ...forge ? { forge } : {},
+    defaultBranch: defaultBranch(root),
+    pulumiActions: findPulumiActions(root),
+    ...preCommit ? { preCommit } : {}
+  };
+}
+function repoName(root) {
+  return slug(basename(root)).slice(0, 40).replace(/-+$/, "") || "plywood";
+}
+var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
+var init_detect = __esm({
+  "src/init/detect.ts"() {
+    "use strict";
+    SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
+    MAX_DEPTH = 8;
+    ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
+    PROD_RANK = ENV_ORDER.indexOf("prod");
+    WORKFLOW_DIRS = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
+  }
+});
+
 // src/policy-presets.ts
 import { readFileSync as readFileSync9 } from "node:fs";
 function providersRego(allowed, namespace = "main") {
@@ -4325,7 +4446,7 @@ function adoptLines(previews, chant) {
     }
     const count = `${v.resources.length} resource${v.resources.length === 1 ? "" : "s"}`;
     if (v.status === "refused") {
-      out.push(`  ${p.key}: plunge refuses to adopt it:`);
+      out.push(`  ${p.key}: plunge refuses to adopt it, so the adopt Op leaves it out:`);
       for (const r of v.refusals) out.push(`    ${r.code}: ${r.reason}${r.urn ? ` (${r.urn})` : ""}`);
     } else if (v.status === "already-adopted") {
       out.push(`  ${p.key}: already on plunge's records (${count})`);
@@ -4338,7 +4459,10 @@ function adoptLines(previews, chant) {
   return out;
 }
 function stacksToAdopt(stacks2, previews) {
-  return stacks2.filter((s) => previews.find((p) => p.key === s.key)?.view?.status !== "already-adopted");
+  return stacks2.filter((s) => {
+    const status = previews.find((p) => p.key === s.key)?.view?.status;
+    return status !== "already-adopted" && status !== "refused";
+  });
 }
 function adoptGate(member, stack, single) {
   return single ? `approve-${ADOPT_OP}` : `approve-${ADOPT_OP}-${member}-${stack}`;
@@ -4401,9 +4525,9 @@ function plungeUrlOf(url) {
   const scheme = url.split("://")[0];
   return { pointer: `is on ${url}, and plunge has no plunge+ form for ${scheme}. Move it to a file, s3, azblob or gs backend first: ${MOVE_A_STACK_GUIDE}` };
 }
-function plungeStacks(detected3, env) {
-  return detected3.stacks.map((s) => {
-    const project = detected3.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+function plungeStacks(detected2, env) {
+  return detected2.stacks.map((s) => {
+    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const b = backendOf(project, {}, env);
     const to = plungeUrlOf(b.url);
     return {
@@ -4534,6 +4658,7 @@ function stepInput(s) {
     stack: s.stack,
     member: s.project,
     ...s.engine ? { engine: s.engine } : {},
+    ...s.backend ? { backend: s.backend } : {},
     ...s.engineVersion ? { engineVersion: s.engineVersion, ...s.engineRoot ? { engineRoot: s.engineRoot } : {} } : {},
     ...s.lockGrain ? { lockGrain: s.lockGrain } : {},
     ...s.policyPacks?.length ? { policyPacks: s.policyPacks } : {}
@@ -4774,9 +4899,9 @@ function repoJoin(...parts) {
   const out = posix2.normalize(parts.filter((p) => p !== "" && p !== ".").join("/") || ".").replace(/^\.\//, "").replace(/\/+$/, "");
   return out === "" ? "." : out;
 }
-function projectAt(detected3, dir) {
+function projectAt(detected2, dir) {
   const want = repoJoin(dir);
-  return detected3.projects.find((p) => repoJoin(p.dir) === want);
+  return detected2.projects.find((p) => repoJoin(p.dir) === want);
 }
 function stackEntry(keys, key) {
   const stacks2 = isObject(keys.stacks) ? keys.stacks : keys.stacks = {};
@@ -4819,10 +4944,10 @@ var init_types2 = __esm({
 // src/import/deployments.ts
 import { readdirSync as readdirSync6 } from "node:fs";
 import { basename as basename2, dirname as dirname8, join as join11 } from "node:path";
-function deploymentFiles(root, detected3, named) {
+function deploymentFiles(root, detected2, named) {
   if (named.length) return [...named];
   const out = [];
-  for (const p of detected3.projects) {
+  for (const p of detected2.projects) {
     let names;
     try {
       names = readdirSync6(join11(root, p.dir)).sort();
@@ -4852,7 +4977,7 @@ var init_deployments = __esm({
       "gitHub.deployPullRequest": "set apply.when: pull-request and update with /plywood up",
       "gitHub.repository": "plywood runs in the repository it is set up in"
     };
-    importDeployments = (root, detected3, named) => {
+    importDeployments = (root, detected2, named) => {
       let keys = {};
       const unsupported = [];
       const notes = [];
@@ -4860,7 +4985,7 @@ var init_deployments = __esm({
       const not = (file, setting, why) => {
         unsupported.push({ file, setting, why: why ?? NOT_CARRIED[setting] ?? "plywood has no setting for it" });
       };
-      for (const file of deploymentFiles(root, detected3, named)) {
+      for (const file of deploymentFiles(root, detected2, named)) {
         const m = SETTINGS_FILE.exec(basename2(file));
         if (!m) {
           not(file, "(file)", "names no stack: call it Pulumi.<stack>.deploy.yaml (or .json) beside the project's Pulumi.yaml");
@@ -4879,7 +5004,7 @@ var init_deployments = __esm({
         const fileDir = repoJoin(posixRel(root, dirname8(join11(root, file))));
         const source = isObject(settings.sourceContext) && isObject(settings.sourceContext.git) ? settings.sourceContext.git : {};
         const dir = typeof source.repoDir === "string" ? repoJoin(source.repoDir) : fileDir;
-        const project = projectAt(detected3, dir)?.name ?? projectAt(detected3, fileDir)?.name;
+        const project = projectAt(detected2, dir)?.name ?? projectAt(detected2, fileDir)?.name;
         if (!project) {
           not(file, "sourceContext.git.repoDir", `${dir} holds no Pulumi.yaml`);
           continue;
@@ -4934,9 +5059,9 @@ var init_deployments = __esm({
 });
 
 // src/import/env0.ts
-function stackFor(detected3, names) {
+function stackFor(detected2, names) {
   for (const n of names) {
-    const hits = detected3.stacks.filter((s) => s.key === n || s.stack === n || detected3.stacks.filter((x) => x.project === s.project).length === 1 && s.project === n);
+    const hits = detected2.stacks.filter((s) => s.key === n || s.stack === n || detected2.stacks.filter((x) => x.project === s.project).length === 1 && s.project === n);
     if (hits.length === 1) return hits[0].key;
   }
   return void 0;
@@ -4949,7 +5074,7 @@ var init_env0 = __esm({
     init_types2();
     ENV0_WORKFLOW_FILES = ["env0.workflow.yml", "env0.workflow.yaml"];
     ENV0_FLOW_FILES = ["env0.yml", "env0.yaml"];
-    importEnv0 = (root, detected3, named) => {
+    importEnv0 = (root, detected2, named) => {
       const keys = {};
       const unsupported = [];
       const notes = [];
@@ -4967,7 +5092,7 @@ var init_env0 = __esm({
         for (const [id, raw] of Object.entries(envs)) {
           const e = isObject(raw) ? raw : {};
           const names = [id, ...typeof e.name === "string" ? [e.name] : [], ...typeof e.templateName === "string" ? [e.templateName] : []];
-          const key = stackFor(detected3, names);
+          const key = stackFor(detected2, names);
           if (key) stackOf.set(id, key);
           else unsupported.push({ file: workflow, setting: `environments.${id}`, why: `names no stack of this repository (${names.join(", ")}); list it under stacks and waves.after by hand` });
           for (const k of Object.keys(e).filter((x) => !["name", "templateName", "needs"].includes(x))) {
@@ -5061,7 +5186,7 @@ var init_pulumi_actions = __esm({
       plan: "plywood's update applies the preview its approval names, through chant"
     };
     PULUMI_CLOUD = /^https:\/\/(?:app|api)\.pulumi\.com\/?$/;
-    importPulumiActions = (root, detected3, named) => {
+    importPulumiActions = (root, detected2, named) => {
       let keys = {};
       const unsupported = [];
       const notes = [];
@@ -5097,7 +5222,7 @@ var init_pulumi_actions = __esm({
             const dir = repoJoin(typeof w["work-dir"] === "string" ? w["work-dir"] : ".");
             const parts = stackName.split("/");
             const stack = parts[parts.length - 1];
-            const project = projectAt(detected3, dir)?.name ?? (parts.length === 3 ? parts[1] : void 0);
+            const project = projectAt(detected2, dir)?.name ?? (parts.length === 3 ? parts[1] : void 0);
             if (!project) {
               unsupported.push({ file, setting: `${where}.with.stack-name`, why: `${dir} holds no Pulumi.yaml, so ${stackName} names no project` });
               return;
@@ -5154,7 +5279,7 @@ var init_spacelift = __esm({
     init_types2();
     SPACELIFT_FILES = [".spacelift/config.yml", ".spacelift/config.yaml"];
     CARRIED2 = ["project_root", "runner_image"];
-    importSpacelift = (root, detected3, named) => {
+    importSpacelift = (root, detected2, named) => {
       const keys = {};
       const unsupported = [];
       const notes = [];
@@ -5181,7 +5306,7 @@ var init_spacelift = __esm({
         const own = isObject(raw) ? raw : {};
         const s = { ...defaults, ...own };
         const dir = repoJoin(typeof s.project_root === "string" ? s.project_root : ".");
-        const project = projectAt(detected3, dir);
+        const project = projectAt(detected2, dir);
         if (!project) {
           unsupported.push({ file, setting: `stacks.${id}.project_root`, why: `${dir} holds no Pulumi.yaml` });
           continue;
@@ -5230,9 +5355,9 @@ function parseFrom(value) {
   if (!source) return { error: `--from ${value} is not one of ${IMPORT_SOURCES.join(", ")}, and its path names none; give <source>=${value}` };
   return { source, files: [file] };
 }
-function runImport(root, detected3, from) {
+function runImport(root, detected2, from) {
   try {
-    return IMPORTERS[from.source](root, detected3, from.files);
+    return IMPORTERS[from.source](root, detected2, from.files);
   } catch (e) {
     const file = from.files[0] ?? "(its files)";
     return { source: from.source, files: [], keys: {}, unsupported: [{ file, setting: "(file)", why: `could not be read: ${e.message}` }], notes: [] };
@@ -5327,7 +5452,7 @@ function put(root, rel, text, dryRun, note) {
 function existingConfig(root) {
   return CONFIG_NAMES.find((n) => existsSync10(join13(root, n)));
 }
-async function newConfigKeys(detected3, opts, io) {
+async function newConfigKeys(detected2, opts, io) {
   const notes = [];
   let presetName = opts.preset;
   if (!presetName && io.ask && !opts.yes) {
@@ -5337,31 +5462,31 @@ async function newConfigKeys(detected3, opts, io) {
   const preset2 = presetByName(presetName ?? DEFAULT_PRESET);
   const keys = structuredClone(preset2.keys);
   if (opts.gate) keys.gate = opts.gate;
-  const engine2 = engineStep({ engine: opts.engine, detected: detected3, env: io.env });
+  const engine2 = engineStep({ engine: opts.engine, detected: detected2, env: io.env });
   Object.assign(keys, engine2.keys);
   notes.push(...engine2.notes);
   const engineBackends = engine2.keys.backend !== void 0 || engine2.keys.stacks !== void 0;
   let forge;
   if (opts.forge) {
     forge = { kind: opts.forge, because: "--forge" };
-    if (detected3.forge?.kind !== opts.forge) keys.forge = { kind: opts.forge };
-    else if (detected3.forge.url) keys.forge = { kind: opts.forge, url: detected3.forge.url };
-  } else if (detected3.forge) {
-    forge = { kind: detected3.forge.kind, because: detected3.forge.because };
-    if (detected3.forge.url) keys.forge = { kind: detected3.forge.kind, url: detected3.forge.url };
+    if (detected2.forge?.kind !== opts.forge) keys.forge = { kind: opts.forge };
+    else if (detected2.forge.url) keys.forge = { kind: opts.forge, url: detected2.forge.url };
+  } else if (detected2.forge) {
+    forge = { kind: detected2.forge.kind, because: detected2.forge.because };
+    if (detected2.forge.url) keys.forge = { kind: detected2.forge.kind, url: detected2.forge.url };
   } else {
     const kind = io.ask && !opts.yes ? await io.ask("Forge", FORGES, "github") : "github";
     forge = { kind, because: io.ask && !opts.yes ? "you chose it" : "origin names no forge init knows, so github; change forge.kind in plywood.yml" };
     keys.forge = { kind };
   }
   const fromEnv = io.env.PULUMI_BACKEND_URL?.trim();
-  if (fromEnv && !engineBackends && detected3.projects.some((p) => !p.backendUrl)) {
+  if (fromEnv && !engineBackends && detected2.projects.some((p) => !p.backendUrl)) {
     keys.backend = fromEnv;
     notes.push(`backend ${fromEnv} came from PULUMI_BACKEND_URL; it is in plywood.yml so the jobs use it too`);
   }
   return { keys, notes, forge };
 }
-function initStacks(detected3, doc, members = []) {
+function initStacks(detected2, doc, members = []) {
   const listed = stacksOf(doc);
   const pinned = new Map(members.filter((m) => m.engineBin && m.engineVersion).map((m) => [m.name, m]));
   const out = [];
@@ -5370,6 +5495,7 @@ function initStacks(detected3, doc, members = []) {
     const own = listed[key] ?? {};
     const backend = own.backend ?? (typeof doc.backend === "string" ? doc.backend : void 0);
     const engine2 = engineOf(doc, backend)?.engine;
+    const grain = lockGrainFor(doc, engine2);
     const stackDir = own.dir ?? dir;
     const packs = packsForStack(stepPolicyPacksOf(doc), stackDir);
     const pin = pinned.get(key);
@@ -5379,13 +5505,18 @@ function initStacks(detected3, doc, members = []) {
       stack,
       dir: stackDir,
       ...engine2 ? { engine: engine2 } : {},
+      // plywood#22: the step's backend, so a preview and an update read this stack's store, not the job's PULUMI_BACKEND_URL.
+      ...backend ? { backend } : {},
       ...pin ? { engineVersion: pin.engineVersion, ...pin.engineRoot ? { engineRoot: pin.engineRoot } : {} } : {},
       ...own.gate ? { gate: own.gate } : {},
-      ...packs.length ? { policyPacks: packs } : {}
+      ...packs.length ? { policyPacks: packs } : {},
+      // chant's ledger lock (ruling for ci-products 2026-10-28): each stack's grain on its step, so a plunge stack on the
+      // resource grain leases its resource rows and never waits, and a stock stack (or locks.grain: stack) waits for its stack row.
+      ...grain !== "per-engine" ? { lockGrain: LOCK_GRAIN_OF[grain] } : {}
     });
     seen.add(key);
   };
-  for (const s of detected3.stacks) add(s.key, s.project, s.stack, s.dir);
+  for (const s of detected2.stacks) add(s.key, s.project, s.stack, s.dir);
   for (const [key, own] of Object.entries(listed)) {
     if (seen.has(key)) continue;
     const [project, stack] = key.split("/");
@@ -5393,11 +5524,11 @@ function initStacks(detected3, doc, members = []) {
   }
   return out;
 }
-function forgeFor2(doc, detected3, opts) {
+function forgeFor2(doc, detected2, opts) {
   if (opts.forge) return { kind: opts.forge, because: "--forge" };
   const kind = isObject(doc.forge) ? doc.forge.kind : void 0;
   if (kind) return { kind, because: "plywood.yml says forge.kind" };
-  if (detected3.forge) return { kind: detected3.forge.kind, because: detected3.forge.because };
+  if (detected2.forge) return { kind: detected2.forge.kind, because: detected2.forge.because };
   return { kind: "github", because: "origin names no forge init knows, so github" };
 }
 async function chantWriteCiHook() {
@@ -5409,14 +5540,14 @@ async function chantWriteCiHook() {
   }
 }
 async function runInit(opts, table, io) {
-  const detected3 = detect(io.cwd);
-  const { root } = detected3;
+  const detected2 = detect(io.cwd);
+  const { root } = detected2;
   const files = [];
   const notes = [];
   const todo = [];
   const buckets = [];
   const adopt = [];
-  const imported = opts.from ? runImport(root, detected3, opts.from) : void 0;
+  const imported = opts.from ? runImport(root, detected2, opts.from) : void 0;
   if (imported && imported.files.length === 0) notes.push(`--from ${imported.source} found no file to read${imported.notes.length ? `: ${imported.notes.join("; ")}` : ""}`);
   const fail = (message, forge2 = { kind: "github", because: "" }) => ({
     ok: false,
@@ -5431,8 +5562,8 @@ async function runInit(opts, table, io) {
     adopt,
     ...imported ? { imported } : {}
   });
-  if (detected3.projects.length === 0) return fail(`no Pulumi.yaml under ${root}; plywood init sets up a repository that has a Pulumi program`);
-  if (detected3.stacks.length === 0) notes.push("no Pulumi.<stack>.yaml beside any Pulumi.yaml, so no stack is set up; run pulumi stack init, then plywood init again");
+  if (detected2.projects.length === 0) return fail(`no Pulumi.yaml under ${root}; plywood init sets up a repository that has a Pulumi program`);
+  if (detected2.stacks.length === 0) notes.push("no Pulumi.<stack>.yaml beside any Pulumi.yaml, so no stack is set up; run pulumi stack init, then plywood init again");
   let config2;
   let forge;
   const kept = existingConfig(root);
@@ -5446,10 +5577,10 @@ async function runInit(opts, table, io) {
     const onPlunge = opts.engine === "plunge" && engineOf(config2.doc)?.engine === "plunge";
     const ignored = [opts.preset && "--preset", opts.gate && "--gate", opts.engine && !onPlunge && "--engine", imported && "--from"].filter(Boolean);
     if (ignored.length) notes.push(`${kept} is kept as it is, so ${ignored.join(", ")} changed nothing; set the keys there`);
-    if (opts.engine === "plunge" && !onPlunge) notes.push(...keptPlungeLines(kept, detected3, io.env));
-    forge = forgeFor2(config2.doc, detected3, opts);
+    if (opts.engine === "plunge" && !onPlunge) notes.push(...keptPlungeLines(kept, detected2, io.env));
+    forge = forgeFor2(config2.doc, detected2, opts);
   } else {
-    const made = await newConfigKeys(detected3, opts, io);
+    const made = await newConfigKeys(detected2, opts, io);
     notes.push(...made.notes);
     forge = made.forge;
     const text = plywoodYml(imported ? mergeKeys(made.keys, imported.keys) : made.keys);
@@ -5465,12 +5596,12 @@ async function runInit(opts, table, io) {
   const reviewStacks2 = config2.doc.review_stacks !== void 0 ? await chantReviewStacks() : false;
   if (settings.ci.prEnvironment && !reviewStacks2) delete settings.ci.prEnvironment;
   const reviewSuffix = reviewStacks2 ? reviewSuffixOf(settings.pipeline.reviewStackName) : void 0;
-  const stacks2 = initStacks(detected3, doc, settings.members);
+  const stacks2 = initStacks(detected2, doc, settings.members);
   const order = await stackOrder(root, stacks2, settings.pipeline.after);
   const ordered = orderWaves(wavesOf(stacks2, settings.pipeline.waves), order.edges, settings.pipeline.canary);
   const waves = ordered.waves;
   if (order.edges.length || order.outside.length || ordered.unmet.length || !order.reads && stacks2.length > 1) notes.push(...orderLines(order, ordered.unmet));
-  const declaration = declarationStep(root, detected3, settings, opts.dryRun);
+  const declaration = declarationStep(root, detected2, settings, opts.dryRun);
   files.push(declaration.file);
   if (existsSync10(join13(root, CHANT_CONFIG_FILE))) {
     const text = readFileSync12(join13(root, CHANT_CONFIG_FILE), "utf8");
@@ -5480,8 +5611,8 @@ async function runInit(opts, table, io) {
   } else files.push(put(root, CHANT_CONFIG_FILE, chantConfigTs(), opts.dryRun));
   files.push(put(root, COMPONENTS_FILE, componentsFile(stacks2, settings.pipeline.after, reviewSuffix ? { reviewSuffix } : {}), opts.dryRun));
   files.push(...providersPresetStep(root, doc, opts.dryRun, notes));
-  if (detected3.preCommit) files.push(await preCommitStep(root, detected3.preCommit, opts.dryRun));
-  for (const wf of detected3.pulumiActions) {
+  if (detected2.preCommit) files.push(await preCommitStep(root, detected2.preCommit, opts.dryRun));
+  for (const wf of detected2.pulumiActions) {
     notes.push(`${wf} runs pulumi/actions. init leaves it as it is; once plywood's previews and updates replace it, remove it, or keep it for the stacks plywood does not run`);
   }
   const chant = await chantProduct();
@@ -5489,7 +5620,7 @@ async function runInit(opts, table, io) {
     const message = needsChantMessage("Writing the waves spec and the workflow");
     files.push({ file: WAVES_SPEC_FILE2, status: "skipped", note: message }, { file: WORKFLOW_FILE[forge.kind], status: "skipped", note: "needs the same chant" });
   } else {
-    let spec = wavesSpecStep(chant, stacks2, doc, settings, detected3.defaultBranch, waves);
+    let spec = wavesSpecStep(chant, stacks2, doc, settings, detected2.defaultBranch, waves);
     if (settings.pipeline.jobs) {
       try {
         spec = withJobSettings(spec, settings.pipeline.jobs, forge.kind, { parallelism: await hasChant4625() });
@@ -5498,12 +5629,15 @@ async function runInit(opts, table, io) {
         spec = void 0;
       }
     }
-    if (spec && stacks2.length > 0) files.push(put(root, WAVES_SPEC_FILE2, jsonText(spec), opts.dryRun));
+    if (spec && stacks2.length > 0) {
+      files.push(put(root, WAVES_SPEC_FILE2, wavesSpecText(spec, wavesEngine(settings.pipeline)), opts.dryRun));
+      files.push(put(root, UP_OP_FILE, upOpFile(spec), opts.dryRun));
+    }
     if (spec) files.push(...await workflowStep(chant, root, doc, settings, forge.kind, opts, stacks2.length > 0 ? spec : void 0, table, io));
   }
-  if (opts.bucketCheck) notes.push(...await bucketStep(detected3, doc, io.env, buckets));
-  adopt.push(...await adoptStep(root, detected3, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
-  todo.push(...todoLines(detected3, doc, forge.kind, io.env));
+  if (opts.bucketCheck) notes.push(...await bucketStep(detected2, doc, io.env, buckets));
+  adopt.push(...await adoptStep(root, detected2, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
+  todo.push(...todoLines(detected2, doc, forge.kind, io.env));
   const failed = files.find((f) => f.status === "failed");
   return {
     ok: !failed,
@@ -5519,9 +5653,9 @@ async function runInit(opts, table, io) {
     ...imported ? { imported } : {}
   };
 }
-function declarationStep(root, detected3, settings, dryRun) {
+function declarationStep(root, detected2, settings, dryRun) {
   if (existsSync10(join13(root, "chant.workspace.jsonc"))) {
-    return { file: { file: "chant.workspace.jsonc", status: "kept", note: `add a member of kind pulumi for each of ${detected3.projects.map((p) => p.dir).join(", ")}, and pin ${PULUMI_LEXICON}@${CHANT_PIN}` } };
+    return { file: { file: "chant.workspace.jsonc", status: "kept", note: `add a member of kind pulumi for each of ${detected2.projects.map((p) => p.dir).join(", ")}, and pin ${PULUMI_LEXICON}@${CHANT_PIN}` } };
   }
   let existing;
   const file = join13(root, DECLARATION_FILE);
@@ -5534,7 +5668,7 @@ function declarationStep(root, detected3, settings, dryRun) {
       return { file: { file: DECLARATION_FILE, status: "failed", note: `is not JSON init can merge into (${e.message})` } };
     }
   }
-  const doc = workspaceDeclaration(existing, { name: repoName(root), projects: detected3.projects, ci: settings.ci, lexiconVersion: CHANT_PIN });
+  const doc = workspaceDeclaration(existing, { name: repoName(root), projects: detected2.projects, ci: settings.ci, lexiconVersion: CHANT_PIN });
   if (existing && JSON.stringify(existing) === JSON.stringify(doc)) return { file: { file: DECLARATION_FILE, status: "unchanged" }, doc };
   return { file: put(root, DECLARATION_FILE, jsonText(doc), dryRun), doc };
 }
@@ -5589,7 +5723,7 @@ async function workflowStep(chant, root, doc, settings, forge, opts, spec, table
   try {
     const { noteControlTarget: noteControlTarget2 } = await Promise.resolve().then(() => (init_control2(), control_exports));
     const control3 = await noteControlTarget2(doc, root);
-    plan = workflowPlan(chant, doc, forge, opts.env, spec, chantBuildFlags(chantPipelineOptions(settings.pipeline, false)), { reviewStacks: await chantReviewStacks(), prJobs, next: await chantNext(), ...control3 ? { control: control3 } : {} });
+    plan = workflowPlan(chant, doc, forge, opts.env, spec, chantBuildFlags(chantPipelineOptions(settings.pipeline, false)), { reviewStacks: await chantReviewStacks(), prJobs, ...control3 ? { control: control3 } : {} });
   } catch (e) {
     return [{ file: output, status: "failed", note: e.message }];
   }
@@ -5606,16 +5740,16 @@ async function workflowStep(chant, root, doc, settings, forge, opts, spec, table
   ];
   const out = [{ file: output, status: written.status, ...notes.length ? { note: notes.join("; ") } : {} }];
   if (plan.jobs.waves) {
-    const code = await writeWaveJobs(chant, forge, plan.jobs.waves, plan.words, table, { ...io, cwd: root });
+    const code = await writeWaveJobs(chant, forge, plan.jobs.waves, plan.words, table, { ...io, cwd: root }, wavesEngine(settings.pipeline));
     if (code !== table.done) out.push({ file: WAVES_OUTPUT_DIR[forge], status: "failed", note: `the waves workflow: chant exited ${code}` });
   }
   return out;
 }
-async function bucketStep(detected3, doc, env, reports) {
+async function bucketStep(detected2, doc, env, reports) {
   const listed = stacksOf(doc);
   const urls = /* @__PURE__ */ new Set();
-  for (const s of detected3.stacks) {
-    const project = detected3.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+  for (const s of detected2.stacks) {
+    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const b = backendOf(project, { ...listed[s.key]?.backend ? { stack: listed[s.key].backend } : {}, ...typeof doc.backend === "string" ? { all: doc.backend } : {} }, env);
     if (b.url && !isPulumiCloud(b.url)) urls.add(b.url);
   }
@@ -5639,12 +5773,12 @@ async function bucketStep(detected3, doc, env, reports) {
   }
   return lines2;
 }
-async function adoptStep(root, detected3, doc, env, declaration, dryRun, files, notes, todo) {
+async function adoptStep(root, detected2, doc, env, declaration, dryRun, files, notes, todo) {
   const listed = stacksOf(doc);
   const all = typeof doc.backend === "string" ? doc.backend : void 0;
   const targets = [];
-  for (const s of detected3.stacks) {
-    const project = detected3.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
+  for (const s of detected2.stacks) {
+    const project = detected2.projects.find((p) => p.dir === s.dir && p.name === s.project) ?? { backendUrl: void 0 };
     const own = listed[s.key];
     const b = backendOf(project, { ...own?.backend ? { stack: own.backend } : {}, ...all ? { all } : {} }, env);
     if (b.url && /^plunge\+/.test(b.url)) targets.push({ key: s.key, project: s.project, projectDir: s.dir, dir: own?.dir ?? s.dir, stack: s.stack, url: b.url });
@@ -5667,17 +5801,17 @@ async function adoptStep(root, detected3, doc, env, declaration, dryRun, files,
   todo.push(...adoptTodo(rows));
   return previews;
 }
-function keptPlungeLines(kept, detected3, env) {
-  const step = engineStep({ engine: "plunge", detected: detected3, env });
+function keptPlungeLines(kept, detected2, env) {
+  const step = engineStep({ engine: "plunge", detected: detected2, env });
   const entries = Object.entries(step.keys);
   if (entries.length === 0) return step.notes;
   const yaml = entries.map(([k, v]) => emitYAMLEntry2(k, v)).join("\n").split("\n").filter((l) => l !== "");
   return [...step.notes, `To move to plunge, set these keys in ${kept}:`, ...yaml.map((l) => `    ${l}`)];
 }
-function todoLines(detected3, doc, forge, env) {
+function todoLines(detected2, doc, forge, env) {
   const out = [];
   const all = typeof doc.backend === "string" ? doc.backend : void 0;
-  const cloud = detected3.projects.some((p) => isPulumiCloud(backendOf(p, all ? { all } : {}, env).url));
+  const cloud = detected2.projects.some((p) => isPulumiCloud(backendOf(p, all ? { all } : {}, env).url));
   const where = forge === "gitlab" ? "CI/CD variables" : "repository secrets";
   const traded = identityClouds(doc);
   if (cloud && traded.includes("pulumi")) {
@@ -5685,9 +5819,9 @@ function todoLines(detected3, doc, forge, env) {
   } else if (cloud) {
     out.push(`Set pulumi_cloud.org and identity.preview.pulumi and identity.up.pulumi in plywood.yml, so each job trades its OIDC token for its own Pulumi Cloud token, or add PULUMI_ACCESS_TOKEN_PREVIEW and PULUMI_ACCESS_TOKEN_UP to the ${where}`);
   }
-  if (traded.some((c) => c !== "pulumi")) out.push(`Let each role identity names trust this repository's OIDC tokens: the preview role for pull requests, the up role for ${detected3.defaultBranch} only`);
+  if (traded.some((c) => c !== "pulumi")) out.push(`Let each role identity names trust this repository's OIDC tokens: the preview role for pull requests, the up role for ${detected2.defaultBranch} only`);
   else if (!cloud) out.push("Give the preview job and the update job their cloud access, each its own role through OIDC (identity in plywood.yml); the backend bucket's read and write go with them");
-  out.push(`Make ${PRODUCT}/preview a required status on ${detected3.defaultBranch}`);
+  out.push(`Make ${PRODUCT}/preview a required status on ${detected2.defaultBranch}`);
   return out;
 }
 function initLines(r) {
@@ -5732,6 +5866,7 @@ var init_init = __esm({
     init_policy_presets();
     init_approval();
     init_engine();
+    init_locks();
     init_config();
     init_routing();
     init_stacks();
@@ -5748,7 +5883,6 @@ var init_init = __esm({
     init_review_stacks2();
     init_waves_workflow();
     init_stages();
-    init_chant_next();
     init_stack_order();
     init_import();
     init_templates();
@@ -6132,7 +6266,6 @@ async function check(args, json, table, io) {
 }
 async function preview(args, json, table, io) {
   const targeted = args.includes("--target");
-  const planFlags = ["--refresh", "--target-dependents"].filter((f) => args.includes(f));
   if (args.includes("--target-dependents") && !targeted) return usage("--target-dependents widens a --target preview to the resources that depend on the targets; give a --target", table, io);
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--target" && (args[i + 1] === void 0 || args[i + 1].startsWith("-"))) return usage("--target takes a resource's URN", table, io);
@@ -6155,16 +6288,12 @@ async function preview(args, json, table, io) {
   const argv = ["components", "pr-plan", "--base", at, "--pr", number, ...gate, ...stack ? ["--member", stack] : [], ...rest, ...json ? ["--json"] : []];
   return withChant(`${PRODUCT} preview`, table, io, async (chant) => {
     if (targeted && !hasChant4620(chant)) return usage(PREVIEW_TARGET_NEEDS_CHANT, table, io);
-    if (planFlags.length && !(await chantNext()).planFlags) return usage(previewFlagsNeedChant(planFlags), table, io);
     return chant.runChantInProcess(argv, PRODUCT_WORDS);
   });
 }
-function previewFlagsNeedChant(flags) {
-  return `${flags.join(" and ")} ${flags.length === 1 ? "needs" : "need"} a chant whose pr-plan passes ${flags.length === 1 ? "it" : "them"} to the pulumi-up step (chant#4627), which this chant lacks`;
-}
 function readWavesSpec(cwd) {
   const file = join15(cwd, ".chant/op-waves", `${OP_NAME}.spec.json`);
-  return existsSync12(file) ? JSON.parse(readFileSync14(file, "utf8")) : void 0;
+  return existsSync12(file) ? unwrapWavesSpec(JSON.parse(readFileSync14(file, "utf8"))) : void 0;
 }
 function pipelineShape(doc, forge, waves) {
   const applyBeforeMerge = applyWhenOf(doc) === "pull-request";
@@ -6225,7 +6354,7 @@ async function ci(args, json, table, io) {
     const noteControl = await noteControlTarget2(config2.doc, io.cwd);
     let plan;
     try {
-      plan = workflowPlan(chant, config2.doc, forge, env, waves, [], { reviewStacks: reviewStacks2, prJobs, next: await chantNext(), ...noteControl ? { control: noteControl } : {} });
+      plan = workflowPlan(chant, config2.doc, forge, env, waves, [], { reviewStacks: reviewStacks2, prJobs, ...noteControl ? { control: noteControl } : {} });
     } catch (e) {
       io.err(`${PRODUCT}: ${e.message}`);
       return table.failed;
@@ -6249,7 +6378,8 @@ async function ci(args, json, table, io) {
       ...jobs2.applyBeforeMerge ? { applyBeforeMerge: jobs2.applyBeforeMerge.command } : {},
       comments: jobs2.comments,
       ...jobs2.waves ? { waves: { specFile: jobs2.waves.specFile, jobs: jobs2.waves.jobs.map((j) => j.command.join(" ")) } } : {},
-      ..."control" in control3 ? { control: control3.repo } : {}
+      ..."control" in control3 ? { control: control3.repo } : {},
+      ...jobs2.action ? { action: { command: jobs2.action.command, comment: jobs2.action.comment, inputs: jobs2.action.inputs } } : {}
     };
     if (json && dryRun) io.out(JSON.stringify({ command: "ci", ok: true, exitCode: table.done, dryRun, ...summary }));
     else if (!json) {
@@ -6262,6 +6392,7 @@ async function ci(args, json, table, io) {
       for (const [command, line] of Object.entries(jobs2.comments)) io.err(`  comment   ${line} (${command})`);
       for (const job of summary.waves?.jobs ?? []) io.err(`  wave      ${job}`);
       if (jobs2.stale) io.err(`  stale     ${jobs2.stale.command} (on each push to the target branch)`);
+      if (jobs2.action) io.err(`  action    ${jobs2.action.command} (${jobs2.action.comment} <stack> <name>, or a dispatch with inputs ${jobs2.action.inputs.member} and ${jobs2.action.inputs.action})`);
     }
     if (!json && "control" in control3) io.err(`  control   after the last wave, tells ${control3.repo} how the waves ended`);
     else if (!json && "missing" in control3) io.err(`  control   the waves workflow sends no dispatch: ${control3.missing}; a job of your own after the last wave runs '${PRODUCT} control dispatch'`);
@@ -6274,7 +6405,7 @@ async function ci(args, json, table, io) {
       if (!json) io.err(`${PRODUCT} ci: chant's generator exited ${written.code} and wrote no ${output}; any file there before is back as it was`);
       return written.code;
     }
-    const wavesCode = waveJobs ? await writeWaveJobs(chant, forge, waveJobs, plan.words, table, io) : table.done;
+    const wavesCode = waveJobs ? await writeWaveJobs(chant, forge, waveJobs, plan.words, table, io, wavesEngine(toChantSettings(config2).pipeline)) : table.done;
     if (wavesCode !== table.done) return wavesCode;
     const driftCode = await writeDriftJobs(chant, forge, config2.doc, plan.words, table, io, env);
     if (driftCode !== table.done) return driftCode;
@@ -6289,14 +6420,14 @@ function writtenNotes(plan, file) {
 }
 function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
   const shape = pipelineShape(doc, forge, waves);
-  const next = opts.next;
   const notes = [];
   const pipeline = toChantSettings({ doc }).pipeline;
-  const staleNotes = next?.staleNotes === true;
   const respond = respondOptions(chant, pipeline, shape.applyBeforeMerge, notes);
-  const applyMerge = shape.applyBeforeMerge && pipeline.applyMerge ? next?.applyMerge ? pipeline.applyMerge : (notes.push(APPLY_MERGE_NEEDS_CHANT), void 0) : void 0;
+  const applyMerge = shape.applyBeforeMerge ? pipeline.applyMerge : void 0;
   if (approvalOf(doc) === "pr-review" && shape.waves && hasChantApprovalStatus(chant) && !hasChantPullRequestApprovalStatus(chant)) notes.push(APPROVAL_STATUS_NOTE);
-  const words = wordsForJobs(shape.jobs);
+  const actionJob = actionJobFor(doc, forge, notes);
+  const jobsWanted = actionJob ? [...shape.jobs, "action"] : shape.jobs;
+  const words = wordsForJobs(jobsWanted);
   const requires = shape.applyBeforeMerge ? requiresArgv(chant, doc) : [];
   const previewComment = hasChant4620(chant);
   const jobs2 = chant.productPipelineJobs(forge, env, {
@@ -6310,11 +6441,13 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     ...opts.control !== void 0 ? { control: { target: opts.control } } : {},
     // plywood#29: runners, env, pass and parallelism on the pull request jobs, with chant#4625 (src/jobs.ts).
     ...opts.prJobs?.options ?? {},
-    ...staleNotes ? { staleNotes: true } : {},
+    // chant#4628: the note names the target commit it was previewed against, and a push marks older notes stale.
+    staleNotes: true,
     ...respond.options,
-    ...applyMerge ? { applyMerge } : {}
+    ...applyMerge ? { applyMerge } : {},
+    ...actionJob ? { actionJob: true } : {}
   });
-  const prWords = shape.applyBeforeMerge ? words : wordsForJobs(shape.jobs.filter((j) => j !== "apply"));
+  const prWords = shape.applyBeforeMerge ? words : wordsForJobs(jobsWanted.filter((j) => j !== "apply"));
   const argv = [
     "build",
     ".",
@@ -6330,7 +6463,8 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     ...applyMerge ? applyMergeArgv(applyMerge) : [],
     ...respond.argv,
     ...previewComment ? ["--preview-comment"] : [],
-    ...staleNotes ? ["--stale-notes"] : [],
+    "--stale-notes",
+    ...actionJob ? ["--action-job"] : [],
     // Review stacks (plywood#15): chant's pr-env jobs, only once the pulumi lexicon can remove what they create.
     ...doc.review_stacks !== void 0 && opts.reviewStacks ? ["--pr-env"] : [],
     ...opts.prJobs?.flags ?? [],
@@ -6338,6 +6472,11 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
   ];
   return { jobs: jobs2, words, prWords, argv, notes, ...applyMerge ? { applyMerge } : {} };
 }
+function actionJobFor(doc, forge, notes) {
+  if (!hasActions(doc)) return false;
+  if (forge === "gitlab") return notes.push(ACTIONS_NOT_ON_GITLAB), false;
+  return true;
+}
 function applyMergeArgv(m) {
   return ["--merge", "auto", "--merge-token-env", m.tokenEnv, ...m.method ? ["--merge-method", m.method] : []];
 }
@@ -6387,7 +6526,7 @@ function usage(message, table, io) {
   io.err(`${PRODUCT}: ${message}`);
   return table.failed;
 }
-var CHANT_PASSTHROUGH, VALUED, PREVIEW_TARGET_NEEDS_CHANT, WORKFLOW_FILE, APPLY_MERGE_NEEDS_CHANT, APPROVAL_STATUS_NOTE, CHANT_RESPOND_DEFAULTS, DECIDE_LEFT_OFF;
+var CHANT_PASSTHROUGH, VALUED, PREVIEW_TARGET_NEEDS_CHANT, WORKFLOW_FILE, ACTIONS_NOT_ON_GITLAB, APPROVAL_STATUS_NOTE, CHANT_RESPOND_DEFAULTS, DECIDE_LEFT_OFF;
 var init_stages = __esm({
   "src/stages.ts"() {
     "use strict";
@@ -6399,6 +6538,7 @@ var init_stages = __esm({
     init_apply();
     init_config();
     init_locks();
+    init_stacks();
     init_routing();
     init_workflow();
     init_review_stacks2();
@@ -6415,13 +6555,38 @@ var init_stages = __esm({
       forgejo: ".forgejo/workflows/plywood.yml",
       gitlab: ".gitlab-ci.yml"
     };
-    APPLY_MERGE_NEEDS_CHANT = "apply.merge is auto, and the installed chant has no pr-apply --merge auto (chant#4636), so a person merges after each update before merge";
+    ACTIONS_NOT_ON_GITLAB = "plywood.yml declares actions, and a GitLab pipeline starts on no comment or dispatch with inputs, so it has no action job; run 'plywood action <stack> <name>' from a pipeline of your own";
     APPROVAL_STATUS_NOTE = `approval is pr-review, and chant posts its approval status only for waves that wait on pr-review; plywood's waves wait on the pull request's own approval, so no ${PRODUCT}/approval status is posted before merge`;
     CHANT_RESPOND_DEFAULTS = Object.freeze({ "wave-refused": "diff", "apply-failed": "triage", description: "off" });
     DECIDE_LEFT_OFF = "decide is set and respond.description is not check, so plywood leaves the decide service off the pull request jobs";
   }
 });
 
+// src/chant-resolve.ts
+import * as nodeModule from "node:module";
+var CHANT_SPECIFIER = /^@intentius\/chant(?:-lexicon-[a-z0-9-]+)?(?:\/|$)/;
+function chantResolveHook(from) {
+  return (specifier, context, next) => {
+    try {
+      return next(specifier, context);
+    } catch (err) {
+      const code = err.code;
+      if (!CHANT_SPECIFIER.test(specifier) || code !== "ERR_MODULE_NOT_FOUND" && code !== "MODULE_NOT_FOUND") throw err;
+      if (context.parentURL === from) throw err;
+      return next(specifier, { ...context, parentURL: from });
+    }
+  };
+}
+var installed = false;
+function installChantResolution(from = import.meta.url) {
+  if (installed) return true;
+  const register = nodeModule.registerHooks;
+  if (typeof register !== "function") return false;
+  register({ resolve: chantResolveHook(from) });
+  installed = true;
+  return true;
+}
+
 // src/cli.ts
 init_config_check();
 
@@ -6461,1100 +6626,1185 @@ function exitCodes() {
   return cached;
 }
 
-// src/audit.ts
+// src/actions.ts
+init_chant_product();
+init_stacks();
+init_stages();
+
+// src/stack-ops.ts
+init_chant_config();
+init_identity();
+init_config();
+init_stacks();
+init_adopt();
 init_detect();
+init_refusals();
 init_stages();
+init_chant_product();
 init_words();
-var AUDIT_TABLES = { approvals: "gates", updates: "applies", runs: "runs", "review-stacks": "pr_envs" };
-var DEFAULT_AUDIT_TABLE = "approvals";
-function auditTable(word) {
-  const w = word ?? DEFAULT_AUDIT_TABLE;
-  return AUDIT_TABLES[w] ?? w;
-}
-function auditMember(stack) {
-  const [project, name] = stack.split("/");
-  return project && name ? slug(project).slice(0, 36).replace(/-+$/, "") : void 0;
+import { existsSync as existsSync13 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute2, join as join16, resolve as resolve2 } from "node:path";
+var STACK_OPS_OP = "pulumi-stack-ops";
+var REQUIRED4 = ["gatedStackExport", "gatedStackCancel", "gatedStackMove"];
+var cachedLocks;
+function chantStackLockReader() {
+  cachedLocks ??= (async () => {
+    try {
+      const m = await import("@intentius/chant-lexicon-pulumi");
+      return typeof m.pulumiStackLockIds === "function" ? m.pulumiStackLockIds : void 0;
+    } catch {
+      return void 0;
+    }
+  })();
+  return cachedLocks;
 }
-function auditArgv(args, json) {
-  const stack = takeFlag(args, "--stack");
-  const since = takeFlag(stack.rest, "--since");
-  const at = takeFlag(since.rest, "--at");
-  for (const [flag, f] of [["--stack", stack], ["--since", since], ["--at", at]]) if (f.missing) return { error: `${flag} takes a value` };
-  const wheres = [];
-  const rest = [];
-  for (let i = 0; i < at.rest.length; i++) {
-    const a = at.rest[i];
-    if (a === "--where") {
-      const v = at.rest[i + 1];
-      if (v === void 0 || v.startsWith("--")) return { error: "--where takes <field><op><value>, such as gate=wave-2" };
-      wheres.push("--where", v);
-      i++;
-    } else rest.push(a);
-  }
-  const flags = rest.filter((a) => a.startsWith("-"));
-  if (flags.length) return { error: `audit does not take ${flags.join(" ")}` };
-  if (rest.length > 1) return { error: `audit reads one table: ${Object.keys(AUDIT_TABLES).join(", ")}, or a chant ledger table` };
-  let member;
-  if (stack.value !== void 0) {
-    member = auditMember(stack.value);
-    if (!member) return { error: `--stack takes project/stack, not '${stack.value}'` };
+async function lockToCancel(given, stack, env) {
+  if (given) return { lockId: given, read: false };
+  const reader = await chantStackLockReader();
+  if (!reader) return { error: STACK_OP_WORDS.needsLock };
+  let locks2;
+  try {
+    locks2 = await reader({ dir: stack.dir, stack: stack.stack, ...stack.project ? { project: stack.project } : {}, ...stack.engine ? { engine: stack.engine } : {}, env });
+  } catch (e) {
+    return { error: `${STACK_OP_WORDS.needsLock}. Reading the stack's lock failed: ${e.message}` };
   }
-  return [
-    "ledger",
-    auditTable(rest[0]),
-    ...member ? ["--member", member] : [],
-    ...since.value ? ["--since", since.value] : [],
-    ...wheres,
-    ...at.value ? ["--at", at.value] : [],
-    ...json ? ["--json"] : []
-  ];
-}
-async function audit2(args, json, table, io) {
-  const argv = auditArgv(args, json);
-  if ("error" in argv) return usage(argv.error, table, io);
-  return withChant(`${PRODUCT} audit`, table, io, (chant) => chant.runChantInProcess(argv, PRODUCT_WORDS));
+  if (!locks2.checked) return { error: STACK_OP_WORDS.lockNotListed(locks2.backend) };
+  if (locks2.ids.length === 0) return { error: STACK_OP_WORDS.noLock(stack.stack) };
+  if (locks2.ids.length > 1) return { error: STACK_OP_WORDS.manyLocks(stack.stack, locks2.ids) };
+  return { lockId: locks2.ids[0], read: true };
 }
-
-// src/cli.ts
-init_agents2();
-init_drift2();
-
-// src/estate.ts
-init_chant_product();
-init_chant_config();
-init_config();
-init_stages();
-init_words();
-import { dirname as dirname11 } from "node:path";
-var estateModule;
-function chantEstate() {
-  estateModule ??= (async () => {
+var cachedOps;
+var cachedRollback;
+function chantStackOps() {
+  cachedOps ??= (async () => {
     try {
-      const m = await import("@intentius/chant/ci-estate");
-      const r = await import("@intentius/chant/pr-report-url");
-      if (!["readEstateLedger", "buildLedgerEstate", "writeEstate"].every((f) => typeof m[f] === "function")) return void 0;
-      if (typeof r.parseReportUrl !== "function" || typeof r.reportPut !== "function") return void 0;
-      return { ...m, parseReportUrl: r.parseReportUrl, reportPut: r.reportPut };
+      const m = await import("@intentius/chant-lexicon-pulumi");
+      return REQUIRED4.every((name) => typeof m[name] === "function") ? m : void 0;
     } catch {
       return void 0;
     }
   })();
-  return estateModule;
-}
-var ESTATE_NEEDS_CHANT = `${PRODUCT} estate needs chant >= the release after 0.124.54, which carries @intentius/chant/ci-estate (chant#4612). Run '${PRODUCT} audit' for the ledger's rows on this chant.`;
-function estateSchedules(config2) {
-  const drift3 = toChantSettings(config2).pipeline.drift;
-  const driftOps = (drift3?.stacks ?? []).map(driftOpName);
-  const schedules = drift3?.schedule ? driftOps.map((op) => ({ op, cron: drift3.schedule })) : [];
-  return { schedules, driftOps };
+  return cachedOps;
 }
-async function estate(args, json, table, io) {
-  const failOverdue = args.includes("--fail-overdue");
-  let rest = args.filter((a) => a !== "--fail-overdue");
-  const flags = {};
-  for (const flag of ["--file", "--report-url", "--prefix"]) {
-    const f = takeFlag(rest, flag);
-    if (f.missing) return usage(`${flag} takes a value`, table, io);
-    flags[flag] = f.value;
-    rest = f.rest;
-  }
-  if (rest.length) return usage(`estate does not take ${rest.join(" ")}`, table, io);
-  const chant = await chantEstate();
-  if (!chant) {
-    if (json) io.out(JSON.stringify({ command: "estate", ok: false, exitCode: table.failed, error: ESTATE_NEEDS_CHANT }));
-    else io.err(`${PRODUCT}: ${ESTATE_NEEDS_CHANT}`);
-    return table.failed;
-  }
-  const path = flags["--file"] ?? findConfig(io.cwd);
-  let config2;
-  if (path) {
+function chantStackRollback() {
+  cachedRollback ??= (async () => {
     try {
-      config2 = loadConfig(path);
-    } catch (e) {
-      return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
-    }
-    const errors = checkConfig(config2).filter((p) => p.severity === "error");
-    if (errors.length) {
-      for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
-      return table.failed;
+      const m = await import("@intentius/chant-lexicon-pulumi");
+      if (typeof m.pulumiReleaseInputs !== "function") return false;
+      const copy2 = await import("@intentius/chant-lexicon-pulumi/release-copy");
+      return typeof copy2.prepareReleaseCopy === "function";
+    } catch {
+      return false;
     }
-  }
-  const { schedules, driftOps } = config2 ? estateSchedules(config2) : { schedules: [], driftOps: [] };
-  const product = await chantProduct();
-  const words = product ? product.assertProductWords(PRODUCT_WORDS) : PRODUCT_WORDS;
-  const root = path ? dirname11(path) : io.cwd;
-  const load = await chant.readEstateLedger(root);
-  const built = chant.buildLedgerEstate({ load, words, schedules, ...driftOps.length ? { driftOps } : {} });
-  const url = flags["--report-url"] ?? (config2 ? toChantSettings(config2).ci.reportUrl : void 0);
-  let written;
-  if (url) {
-    const target = chant.parseReportUrl(url, flags["--report-url"] ? "--report-url" : "reports.url");
-    if (target && typeof target === "object" && "error" in target) return usage(String(target.error), table, io);
-    written = await chant.writeEstate(built, { put: chant.reportPut(target), words, env: io.env, ...flags["--prefix"] ? { prefix: flags["--prefix"] } : {} });
-  }
-  const code = failOverdue && built.overdue.length > 0 ? table.failed : table.done;
-  if (json) {
-    io.out(JSON.stringify({ command: "estate", ok: code === table.done, exitCode: code, estate: built.estate, dora: built.dora, overdue: built.overdue, ...written ? { written } : {} }));
-    return code;
-  }
-  const totals = built.estate.totals ?? {};
-  io.out(`${PRODUCT} estate: ${Object.entries(totals).map(([k, v]) => `${v} ${k}`).join(", ") || "nothing on the ledger yet"}`);
-  for (const o of built.overdue) io.out(`  ${o.message}`);
-  if (written) io.out(`  wrote ${written.keys.join(", ")} under ${url}`);
-  else io.out(`  no report URL (reports.url or --report-url), so nothing was written`);
-  return code;
+  })();
+  return cachedRollback;
 }
-
-// src/notify.ts
-init_stages();
-init_words();
-var RELAY_NEEDS_CHANT = `${PRODUCT} notify relay needs chant >= the release after 0.124.54, which carries chant notify relay (chant#4611).`;
-async function notify(args, json, table, io) {
-  if (args[0] !== "relay") return usage(`unknown notify command '${args[0] ?? ""}'. Run '${PRODUCT} notify relay'.`, table, io);
-  return withChant(`${PRODUCT} notify relay`, table, io, (chant) => {
-    if (typeof chant.startRelayServer !== "function") {
-      if (json) io.out(JSON.stringify({ command: "notify relay", ok: false, exitCode: table.failed, error: RELAY_NEEDS_CHANT }));
-      else io.err(`${PRODUCT}: ${RELAY_NEEDS_CHANT}`);
-      return Promise.resolve(table.failed);
-    }
-    return chant.runChantInProcess(["notify", ...args], PRODUCT_WORDS);
-  });
+function needsStackOpsMessage(what, feature, after = "0.124.54") {
+  return `${what} needs @intentius/chant-lexicon-pulumi >= the release after ${after}, which carries ${feature}. This plywood was built with chant ${BUILT_CHANT}, which lacks it. Upgrade plywood once that chant is out, or build against a local chant with 'just chant-local'.`;
 }
-
-// src/cli.ts
-init_policy();
-
-// src/guard.ts
-init_stages();
-init_words();
-import { chmodSync, copyFileSync, existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join16 } from "node:path";
-var GUARDED = {
-  pulumi: ["up", "update", "destroy"],
-  plunge: ["up", "update", "destroy"]
-};
-var VALUED_GLOBALS = /* @__PURE__ */ new Set(["-C", "--cwd", "-s", "--stack", "--color", "--config-file", "--logflow", "-v", "--verbose", "--tracing", "--profiling", "--memprofilerate"]);
-var LAUNCHERS = /* @__PURE__ */ new Set(["env", "npx", "sudo", "command", "exec", "nohup", "time", "xargs"]);
-function segments(line) {
-  return line.split(/\|\||&&|[;|\n`]|\$\(|\)/).map((seg) => (seg.match(/'[^']*'|"[^"]*"|\S+/g) ?? []).map((t) => t.replace(/^['"]|['"]$/g, ""))).filter((t) => t.length > 0);
+function readConfig(cwd) {
+  const path = findConfig(cwd);
+  if (!path) return { error: `no plywood.yml in ${cwd} or above it; run '${PRODUCT} init' first` };
+  const config2 = loadConfig(path);
+  const errors = checkConfig(config2).filter((p) => p.severity === "error");
+  if (errors.length) return { error: errors.map((p) => `${path}: ${p.key} ${p.message}`).join("\n") };
+  return { config: config2, path };
 }
-function guardVerdict(line) {
-  for (const words of segments(line)) {
-    let i = 0;
-    while (i < words.length && (LAUNCHERS.has(words[i]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]) || words[i - 1] === "env" && words[i].startsWith("-"))) i++;
-    const bin = (words[i] ?? "").split("/").pop();
-    const refused = GUARDED[bin];
-    if (!refused) continue;
-    for (let j = i + 1; j < words.length; j++) {
-      const w = words[j];
-      if (w.startsWith("-")) {
-        if (VALUED_GLOBALS.has(w)) j++;
-        continue;
-      }
-      if (refused.includes(w)) {
-        return {
-          engine: bin,
-          subcommand: w,
-          message: `${PRODUCT} guard: an agent session does not run '${bin} ${w}'. Open a pull request; ${PRODUCT} previews it, and the update runs after a person approves the digest.`
-        };
-      }
-      break;
-    }
+function resolveStack(config2, path, key, dir) {
+  const [project, stack, extra] = key.split("/");
+  if (!project || !stack || extra !== void 0) return { error: `a stack is project/stack, as plywood.yml lists it, not '${key}'` };
+  const settings = toChantSettings(config2);
+  const listed = stacksOf(config2.doc);
+  const root = dirname11(path);
+  const member = settings.members.find((m) => m.name === key) ?? settings.memberDefaults;
+  if (dir === void 0 && Object.keys(listed).length > 0 && !(key in listed)) {
+    return { error: `${key} is not under stacks in ${path}; the stacks are ${Object.keys(listed).join(", ")} (or name its directory with --dir)` };
   }
-  return void 0;
+  const at = dir ?? listed[key]?.dir ?? ".";
+  return {
+    key,
+    project,
+    stack,
+    dir: isAbsolute2(at) ? at : resolve2(root, at),
+    ...member.engine ? { engine: member.engine } : {},
+    ...member.backend ? { backend: member.backend } : {}
+  };
 }
-var GUARD_TEMPLATES = new URL("../templates/agent-guard/", import.meta.url);
-var HOOK_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/plywood-guard.mjs"';
-function withGuardHook(settings) {
-  const hooks = typeof settings.hooks === "object" && settings.hooks !== null ? settings.hooks : {};
-  const pre = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
-  const has2 = JSON.stringify(pre).includes("plywood-guard.mjs");
-  if (!has2) pre.push({ matcher: "Bash", hooks: [{ type: "command", command: HOOK_COMMAND }] });
-  return { ...settings, hooks: { ...hooks, PreToolUse: pre } };
+function requestRules(config2) {
+  const p = toChantSettings(config2).pipeline;
+  return { mode: p.approval ?? "ledger", ...p.quorum?.length ? { quorum: p.quorum } : {} };
 }
-async function guard(args, json, table, io) {
-  const [sub, ...rest] = args;
-  if (sub === "check") {
-    const line = (rest[0] === "--" ? rest.slice(1) : rest).join(" ");
-    if (!line.trim()) return usage("guard check takes the command line to check", table, io);
-    const v = guardVerdict(line);
-    if (json) io.out(JSON.stringify({ command: "guard check", ok: !v, exitCode: v ? table.denied : table.done, refused: v ?? null }));
-    else io.out(v ? v.message : `${PRODUCT} guard: '${line}' runs`);
-    return v ? table.denied : table.done;
-  }
-  if (sub === "install") {
-    const dirFlag = takeFlag(rest, "--dir");
-    if (dirFlag.missing) return usage("--dir takes a directory", table, io);
-    if (dirFlag.rest.length) return usage(`guard install does not take ${dirFlag.rest.join(" ")}`, table, io);
-    const root = dirFlag.value ? join16(io.cwd, dirFlag.value) : io.cwd;
-    const written = [];
-    const hookDir = join16(root, ".claude/hooks");
-    mkdirSync7(hookDir, { recursive: true });
-    copyFileSync(new URL("plywood-guard.mjs", GUARD_TEMPLATES), join16(hookDir, "plywood-guard.mjs"));
-    written.push(".claude/hooks/plywood-guard.mjs");
-    const settingsFile = join16(root, ".claude/settings.json");
-    let settings = {};
-    if (existsSync13(settingsFile)) {
-      try {
-        settings = JSON.parse(readFileSync15(settingsFile, "utf8"));
-      } catch (e) {
-        return usage(`.claude/settings.json is not JSON (${e.message}); fix it, then run this again`, table, io);
-      }
-    }
-    writeFileSync8(settingsFile, JSON.stringify(withGuardHook(settings), null, 2) + "\n");
-    written.push(".claude/settings.json");
-    const binDir = join16(root, ".plywood/agent-bin");
-    mkdirSync7(binDir, { recursive: true });
-    for (const name of Object.keys(GUARDED)) {
-      const to = join16(binDir, name);
-      copyFileSync(new URL(`bin/${name}`, GUARD_TEMPLATES), to);
-      chmodSync(to, 493);
-      written.push(`.plywood/agent-bin/${name}`);
-    }
-    if (json) io.out(JSON.stringify({ command: "guard install", ok: true, exitCode: table.done, written }));
-    else {
-      for (const f of written) io.err(`${PRODUCT} guard: wrote ${f}`);
-      io.err(`${PRODUCT} guard: an agent session that runs outside Claude Code puts .plywood/agent-bin first on PATH and sets PLYWOOD_AGENT_GUARD=1`);
-    }
-    return table.done;
-  }
-  return usage(`guard takes check <command line> or install [--dir <d>]`, table, io);
-}
-
-// src/identities.ts
-init_jobs2();
-init_chant_config();
-init_identity();
-init_config();
-init_stacks();
-init_stages();
-init_words();
-import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
-import { dirname as dirname12, join as join17 } from "node:path";
-import { targetGlobMatch } from "@intentius/chant/ci-identity";
-function identityRows(config2, env) {
-  const doc = config2.doc;
-  const out = [];
-  for (const stack of Object.keys(stacksOf(doc))) {
-    const ids = stackIdentities(doc, stack, env, targetGlobMatch);
-    for (const cloud of IDENTITY_CLOUDS) {
-      const id = ids[cloud];
-      if (id) out.push({ stack, cloud, preview: id.preview, up: id.up, rule: id.rule });
-    }
-  }
-  return out;
+function requesterOf(by, env) {
+  return by ?? env.GITHUB_ACTOR ?? env.GITLAB_USER_LOGIN ?? env.USER ?? "unknown";
 }
-function identityLines(config2, env, rows) {
-  const doc = config2.doc;
-  const block = chantIdentityOf(doc);
-  if (!block) return [`${config2.file ?? "plywood.yml"}: no identity; every job runs as ${NO_IDENTITY}`];
-  const lines2 = [`${config2.file ?? "plywood.yml"}: identities in environment ${env}`];
-  const clouds = Object.keys(block.cloud);
-  lines2.push(`  clouds  ${clouds.map((c) => CLOUD_NAMES[c]).join(", ")}`);
-  if (clouds.includes("pulumi")) {
-    const p = pulumiCloudOf(doc);
-    lines2.push(`  Pulumi Cloud  ${p.org}${p.apiUrl ? ` at ${p.apiUrl}` : ""}; ESC environments open with each job's own token`);
-  }
-  const stacks2 = Object.keys(stacksOf(doc));
-  if (stacks2.length === 0) lines2.push("  plywood.yml lists no stacks; the rules apply to each stack plywood init finds");
-  for (const stack of stacks2) {
-    lines2.push(`  ${stack}`);
-    for (const cloud of clouds) {
-      const r = rows.find((x) => x.stack === stack && x.cloud === cloud);
-      lines2.push(r ? `    ${CLOUD_NAMES[cloud].padEnd(12)} preview ${r.preview}, up ${r.up} (${r.rule})` : `    ${CLOUD_NAMES[cloud].padEnd(12)} ${NO_IDENTITY}`);
-    }
-  }
-  lines2.push("  The preview job trades its OIDC token before checkout, and no later step holds a forge token.");
-  return lines2;
+function destStackName(source, dest, config2) {
+  if (dest.project === source.project) return dest.stack;
+  const cloud = !dest.backend || /^https?:\/\//.test(dest.backend);
+  const org = cloud ? pulumiCloudOf(config2.doc).org : void 0;
+  return `${org ?? "organization"}/${dest.project}/${dest.stack}`;
 }
-function configIdentities(args, json, table, io) {
-  const file = takeFlag(args, "--file");
-  const env = takeFlag(file.rest, "--env");
-  if (file.missing || env.missing) return usage(`${file.missing ? "--file" : "--env"} takes a value`, table, io);
-  if (env.rest.length) return usage(`config identities does not take ${env.rest.join(" ")}`, table, io);
-  const path = file.value ?? findConfig(io.cwd);
-  if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init', or pass --file`, table, io);
-  let config2;
-  try {
-    config2 = loadConfig(path);
-  } catch (e) {
-    return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
-  }
-  const errors = checkConfig(config2).filter((p) => p.severity === "error");
-  if (errors.length) {
-    for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
-    if (json) io.out(JSON.stringify({ command: "config identities", ok: false, exitCode: table.failed, file: path, problems: errors }));
-    return table.failed;
-  }
-  const environment = env.value ?? "production";
-  const rows = identityRows(config2, environment);
-  if (json) io.out(JSON.stringify({ command: "config identities", ok: true, exitCode: table.done, file: path, env: environment, identity: toChantSettings(config2).ci.identity ?? null, stacks: rows }));
-  else for (const line of identityLines(config2, environment, rows)) io.out(line);
-  return table.done;
+function approveRequestLine(gate, digest, mode) {
+  return `${PRODUCT} approve ${gate} --op ${STACK_OPS_OP} --plan ${digest}${mode === "sealed" ? " --sign" : ""}`;
 }
-var FORGE_CHECK_MESSAGE = `${PRODUCT} forge check holds the identities next to the forge's environments, protected branches and each cloud's trust policy. The read is chant's (@intentius/chant/forge-check, chant#4608), and the installed chant lacks it; it comes with the chant release after 0.124.54. Run '${PRODUCT} config identities' for what the jobs will hold.`;
-var FORGES2 = ["github", "gitlab", "forgejo"];
-var FORGE_CHECK_FUNCTIONS = ["forgeCheck", "forgeCheckExit", "describeForgeCheck", "forgeCheckTarget", "pipelineContract"];
-var forgeCheckModule;
-function chantForgeCheck() {
-  forgeCheckModule ??= (async () => {
-    try {
-      const fc = await import("@intentius/chant/forge-check");
-      const id = await import("@intentius/chant/ci-identity");
-      if (!FORGE_CHECK_FUNCTIONS.every((f) => typeof fc[f] === "function") || typeof id.resolveCloudIdentity !== "function") return void 0;
-      return { ...fc, resolveCloudIdentity: id.resolveCloudIdentity };
-    } catch {
-      return void 0;
-    }
-  })();
-  return forgeCheckModule;
+function useBackend(stacks2, env) {
+  const named = [...new Set(stacks2.map((s) => s.backend).filter((b) => b !== void 0))];
+  if (named.length > 1) return `the stacks are on different backends (${named.join(", ")}); a move needs both on one backend`;
+  if (named[0] && !env.PULUMI_BACKEND_URL) env.PULUMI_BACKEND_URL = named[0];
+  return void 0;
 }
-function workspaceMembers(root) {
-  const file = join17(root, "chant.workspace.json");
-  if (!existsSync14(file)) return [];
-  try {
-    const doc = JSON.parse(readFileSync16(file, "utf8"));
-    return (doc.members ?? []).map((m) => m.name).filter((n) => typeof n === "string");
-  } catch {
-    return [];
+function reportOutcome(verb, outcome, gate, rules, done, json, table, io) {
+  const approveLine = outcome.status === "waiting" || outcome.status === "refused" ? approveRequestLine(gate, outcome.digest, rules.mode) : void 0;
+  let code;
+  let text;
+  switch (outcome.status) {
+    case "waiting":
+      code = table.waiting;
+      text = STACK_OP_WORDS.waiting(verb, approveLine);
+      break;
+    case "refused":
+      code = table.waiting;
+      text = `${outcome.reason}. ${STACK_OP_WORDS.waiting(verb, approveLine)}`;
+      break;
+    case "spent":
+      code = table.failed;
+      text = STACK_OP_WORDS.spent(verb);
+      break;
+    case "done":
+      code = table.done;
+      text = done(outcome.result);
+      break;
+    case "failed":
+      code = table.failed;
+      text = `${PRODUCT} ${verb}: ${outcome.error}`;
+      break;
   }
+  if (json) {
+    io.out(JSON.stringify({
+      command: verb,
+      ok: code === table.done,
+      exitCode: code,
+      status: outcome.status,
+      op: STACK_OPS_OP,
+      gate,
+      digest: outcome.digest,
+      ...approveLine ? { approve: approveLine } : {},
+      ...outcome.status === "done" ? { result: outcome.result } : {},
+      ...outcome.status === "failed" ? { error: outcome.error } : {},
+      ...outcome.status === "refused" ? { refusedBy: outcome.by, reason: outcome.reason } : {}
+    }));
+  } else (code === table.done ? io.out : io.err)(text);
+  return code;
 }
-function upRunner(runner) {
-  if (runner === void 0) return void 0;
-  const staged = typeof runner === "object" && !Array.isArray(runner) && !("group" in runner);
-  const spec = staged ? runner.up ?? runner.default : runner;
-  if (spec === void 0) return void 0;
-  if (typeof spec === "string") return { labels: [spec] };
-  if (Array.isArray(spec)) return { labels: spec.filter((l) => typeof l === "string") };
-  const g = spec;
-  return typeof g.group === "string" ? { labels: Array.isArray(g.labels) ? g.labels : [], group: g.group } : void 0;
-}
-function contractPipelines(fc, cloud, env, members, runner, jobs2) {
-  const applyRunner = upRunner(runner);
-  const list = members.length ? [...members] : [void 0];
-  return list.flatMap((member) => {
-    const identity2 = fc.resolveCloudIdentity(cloud, env, member);
-    const name = member ? `${member}/${env}` : env;
-    const forgeEnvironment = jobs2 ? environmentFor(name, jobs2)?.name : void 0;
-    return identity2 ? [{ name, identity: identity2, ...member ? { member } : {}, ...applyRunner ? { applyRunner } : {}, ...forgeEnvironment ? { forgeEnvironment } : {} }] : [];
-  });
-}
-async function forgeCheck(args, json, table, io) {
-  if (args[0] !== "check") return usage(`unknown forge command '${args[0] ?? ""}'. Run '${PRODUCT} forge check'.`, table, io);
-  const fc = await chantForgeCheck();
-  if (!fc) {
-    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, error: FORGE_CHECK_MESSAGE }));
-    else io.err(`${PRODUCT}: ${FORGE_CHECK_MESSAGE}`);
+async function runRequest(verb, json, table, io, call) {
+  const ops = await chantStackOps();
+  if (!ops) {
+    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} ${verb}`, "the gated stack operations (chant#4578)")}`);
     return table.failed;
   }
-  const requireClouds = args.includes("--require-clouds");
-  let rest = args.slice(1).filter((a) => a !== "--require-clouds");
-  const flags = {};
-  for (const flag of ["--file", "--env", "--forge", "--repo", "--branch"]) {
-    const f = takeFlag(rest, flag);
-    if (f.missing) return usage(`${flag} takes a value`, table, io);
-    flags[flag] = f.value;
-    rest = f.rest;
-  }
-  if (rest.length) return usage(`forge check does not take ${rest.join(" ")}`, table, io);
-  const forgeFlag = flags["--forge"];
-  if (forgeFlag !== void 0 && !FORGES2.includes(forgeFlag)) return usage(`--forge is ${forgeFlag}; give github, gitlab or forgejo`, table, io);
-  const path = flags["--file"] ?? findConfig(io.cwd);
-  if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init', or pass --file`, table, io);
-  let config2;
   try {
-    config2 = loadConfig(path);
+    return await call(ops);
   } catch (e) {
-    return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
-  }
-  const errors = checkConfig(config2).filter((p) => p.severity === "error");
-  if (errors.length) {
-    for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
-    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, file: path, problems: errors }));
+    const message = e.message;
+    if (json) io.out(JSON.stringify({ command: verb, ok: false, exitCode: table.failed, error: message }));
+    else io.err(`${PRODUCT} ${verb}: ${message}`);
     return table.failed;
   }
-  const settings = toChantSettings(config2);
-  const kind = forgeFlag ?? settings.pipeline.forge?.kind;
-  let target;
-  try {
-    target = fc.forgeCheckTarget(io.env, { ...kind && FORGES2.includes(kind) ? { kind } : {}, ...flags["--repo"] ? { repo: flags["--repo"] } : {} });
-  } catch (e) {
-    return usage(e.message, table, io);
-  }
-  const env = flags["--env"] ?? "production";
-  const cloud = settings.ci.identity?.cloud;
-  const pipelines = contractPipelines(fc, cloud, env, workspaceMembers(dirname12(path)), settings.pipeline.runner, settings.pipeline.jobs);
-  const result = await fc.forgeCheck(
-    {
-      target,
-      words: PRODUCT_WORDS,
-      file: path,
-      ...requireClouds ? { requireClouds: true } : {},
-      contract: (live) => fc.pipelineContract({
-        forge: target.kind,
-        repository: {
-          host: target.host,
-          path: live.path ?? target.repo,
-          defaultBranch: flags["--branch"] ?? live.defaultBranch ?? "main",
-          ...live.ownerId ? { ownerId: live.ownerId } : {},
-          ...live.repoId ? { repoId: live.repoId } : {}
-        },
-        pipelines,
-        words: PRODUCT_WORDS
-      })
-    },
-    { fetch: globalThis.fetch, env: io.env }
-  );
-  if (json) io.out(JSON.stringify(result));
-  else io.out(fc.describeForgeCheck(result));
-  if (!cloud) io.err(`${PRODUCT} forge check: ${path} sets no identity, so no trust was checked`);
-  else if (pipelines.length === 0) io.err(`${PRODUCT} forge check: no identity rule covers environment ${env}, so no trust was checked`);
-  return fc.forgeCheckExit(result);
+}
+function commonFlags(args) {
+  const by = takeFlag(args, "--by");
+  const dir = takeFlag(by.rest, "--dir");
+  if (by.missing) return { rest: args, missing: "--by" };
+  if (dir.missing) return { rest: args, missing: "--dir" };
+  return { by: by.value, dir: dir.value, rest: dir.rest };
+}
+async function exportStack(args, json, table, io) {
+  const common = commonFlags(args);
+  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
+  const out = takeFlag(common.rest, "--out");
+  if (out.missing) return usage("--out takes a file path outside the repository", table, io);
+  const extra = out.rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`export does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(out.rest);
+  if (named.length !== 1) return usage(`export takes one stack: ${STACK_OP_WORDS.usage.export}`, table, io);
+  if (!out.value) return usage(`export needs --out <file>, a path on your machine outside every git working tree: ${STACK_OP_WORDS.usage.export}`, table, io);
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const stack = resolveStack(read.config, read.path, named[0], common.dir);
+  if ("error" in stack) return usage(stack.error, table, io);
+  useBackend([stack], io.env);
+  const rules = requestRules(read.config);
+  const outFile = resolve2(io.cwd, out.value);
+  return runRequest("export", json, table, io, async (ops) => {
+    const outcome = await ops.gatedStackExport({
+      by: requesterOf(common.by, io.env),
+      rules,
+      op: STACK_OPS_OP,
+      ledgerCwd: io.cwd,
+      env: io.env,
+      dir: stack.dir,
+      stack: stack.stack,
+      out: outFile,
+      ...stack.engine ? { engine: stack.engine } : {}
+    });
+    return reportOutcome("export", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.exported(stack.key, r), json, table, io);
+  });
+}
+async function cancelStack(args, json, table, io) {
+  const common = commonFlags(args);
+  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
+  const lock = takeFlag(common.rest, "--lock");
+  if (lock.missing) return usage("--lock takes the lock id", table, io);
+  const extra = lock.rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`cancel does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(lock.rest);
+  if (named.length !== 1) return usage(`cancel takes one stack: ${STACK_OP_WORDS.usage.cancel}`, table, io);
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const stack = resolveStack(read.config, read.path, named[0], common.dir);
+  if ("error" in stack) return usage(stack.error, table, io);
+  useBackend([stack], io.env);
+  const lockId = await lockToCancel(lock.value, stack, io.env);
+  if ("error" in lockId) return usage(lockId.error, table, io);
+  if (lockId.read && !json) io.err(`${PRODUCT} cancel: ${stack.key} holds lock ${lockId.lockId}`);
+  const rules = requestRules(read.config);
+  return runRequest("cancel", json, table, io, async (ops) => {
+    const outcome = await ops.gatedStackCancel({
+      by: requesterOf(common.by, io.env),
+      rules,
+      op: STACK_OPS_OP,
+      ledgerCwd: io.cwd,
+      env: io.env,
+      dir: stack.dir,
+      stack: stack.stack,
+      lockId: lockId.lockId,
+      project: stack.project,
+      ...stack.engine ? { engine: stack.engine } : {}
+    });
+    return reportOutcome("cancel", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.cancelled(stack.key, lockId.lockId, r.lockChecked), json, table, io);
+  });
+}
+async function moveStack(args, json, table, io) {
+  const onto = takeFlag(args, "--onto");
+  if (onto.missing) return usage("--onto takes plunge", table, io);
+  if (onto.value !== void 0) return moveOntoPlunge(onto.value, onto.rest, json, table, io);
+  const common = commonFlags(onto.rest);
+  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
+  const from = takeFlag(common.rest, "--from");
+  const to = takeFlag(from.rest, "--to");
+  if (from.missing || to.missing) return usage(`${from.missing ? "--from" : "--to"} takes a stack, as project/stack`, table, io);
+  const extra = to.rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`move does not take ${extra.join(" ")}`, table, io);
+  if (common.dir !== void 0) return usage("move reads each stack's directory from plywood.yml's stacks, so it does not take --dir", table, io);
+  const urns = positionals(to.rest);
+  if (!from.value || !to.value) return usage(`move needs --from and --to: ${STACK_OP_WORDS.usage.move}`, table, io);
+  if (urns.length === 0) return usage(`move names each resource it moves by URN: ${STACK_OP_WORDS.usage.move}`, table, io);
+  const bad = urns.filter((u) => !u.startsWith("urn:pulumi:"));
+  if (bad.length) return usage(`move takes URNs (urn:pulumi:...), not ${bad.join(", ")}; 'pulumi stack --show-urns' lists them`, table, io);
+  if (from.value === to.value) return usage(`--from and --to are both ${from.value}; a move is between two stacks`, table, io);
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const source = resolveStack(read.config, read.path, from.value, void 0);
+  if ("error" in source) return usage(source.error, table, io);
+  const dest = resolveStack(read.config, read.path, to.value, void 0);
+  if ("error" in dest) return usage(dest.error, table, io);
+  const backend = useBackend([source, dest], io.env);
+  if (backend) return usage(backend, table, io);
+  const rules = requestRules(read.config);
+  const destName = destStackName(source, dest, read.config);
+  const engine2 = source.engine ?? dest.engine;
+  return runRequest("move", json, table, io, async (ops) => {
+    const outcome = await ops.gatedStackMove({
+      by: requesterOf(common.by, io.env),
+      rules,
+      op: STACK_OPS_OP,
+      ledgerCwd: io.cwd,
+      env: io.env,
+      source: { member: source.key, dir: source.dir, stack: source.stack },
+      dest: { member: dest.key, dir: dest.dir, stack: destName },
+      urns,
+      ...engine2 ? { engine: engine2 } : {}
+    });
+    return reportOutcome("move", outcome, `move:${source.stack}:${destName}`, rules, (r) => STACK_OP_WORDS.moved(source.key, dest.key, r), json, table, io);
+  });
+}
+async function moveOntoPlunge(engine2, args, json, table, io) {
+  if (engine2 !== "plunge") return usage(`--onto takes plunge, not '${engine2}'; a move between backends is an export and an import (see '${PRODUCT} export')`, table, io);
+  const extra = args.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`move --onto does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(args);
+  if (named.length > 1) return usage(`move --onto plunge takes at most one stack`, table, io);
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const opFile = join16(dirname11(read.path), ADOPT_OP_FILE);
+  if (!existsSync13(opFile)) return usage(STACK_OP_WORDS.noAdoptOp(opFile), table, io);
+  if (named[0]) {
+    const stack = resolveStack(read.config, read.path, named[0], void 0);
+    if ("error" in stack) return usage(stack.error, table, io);
+    if (!json) io.err(STACK_OP_WORDS.adoptAll(stack.key));
+  }
+  const argv = ["run", ADOPT_OP, ...json ? ["--json"] : []];
+  return withChant(`${PRODUCT} move --onto plunge`, table, io, async (chant) => {
+    const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
+    if (code === table.waiting && !json) io.err(STACK_OP_WORDS.adoptWaiting);
+    return code === table.waiting ? code : explainRefusal(code, table, io.err);
+  });
+}
+async function rollbackStack(args, json, table, io) {
+  const release2 = takeFlag(args, "--release");
+  const env = takeFlag(release2.rest, "--env");
+  const digest = takeFlag(env.rest, "--digest");
+  const actor = takeFlag(digest.rest, "--actor");
+  for (const [flag, f] of [["--release", release2], ["--env", env], ["--digest", digest], ["--actor", actor]]) {
+    if (f.missing) return usage(`${flag} takes a value`, table, io);
+  }
+  const switches = actor.rest.filter((a) => a === "--dry-run" || a === "--events-json");
+  const rest = actor.rest.filter((a) => !switches.includes(a));
+  const extra = rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`rollback does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(rest);
+  if (named.length > 1) return usage(`rollback takes one stack: ${STACK_OP_WORDS.usage.rollback}`, table, io);
+  let argv;
+  if (release2.value !== void 0) {
+    if (named.length) return usage(STACK_OP_WORDS.releaseIsEnvWide(named[0], environmentOf(named[0])), table, io);
+    if (digest.value !== void 0) return usage("--release takes no --digest: the release names what each stack goes back to", table, io);
+    if (!env.value) return usage(`rollback --release needs --env <env>, the environment whose stacks go back: ${STACK_OP_WORDS.usage.rollback}`, table, io);
+    argv = ["components", "rollback", env.value, "--release", release2.value];
+  } else {
+    if (named.length !== 1) return usage(`rollback takes a stack, or --release <name> --env <env>: ${STACK_OP_WORDS.usage.rollback}`, table, io);
+    const read = readConfig(io.cwd);
+    if ("error" in read) return usage(read.error, table, io);
+    const stack = resolveStack(read.config, read.path, named[0], void 0);
+    if ("error" in stack) return usage(stack.error, table, io);
+    argv = ["components", "rollback", env.value ?? environmentOf(stack.stack), "--component", slug(stack.key), ...digest.value ? ["--digest", digest.value] : []];
+  }
+  argv.push(...actor.value ? ["--actor", actor.value] : [], ...switches, ...json ? ["--json"] : []);
+  if (!await chantStackRollback()) {
+    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} rollback`, "rollback by release for stacks (chant#4542)")}`);
+    return table.failed;
+  }
+  return withChant(`${PRODUCT} rollback`, table, io, async (chant) => {
+    const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
+    if (code === table.waiting && !json) io.err(STACK_OP_WORDS.rollbackWaiting);
+    return code === table.waiting ? code : explainRefusal(code, table, io.err);
+  });
 }
 
-// src/cli.ts
-init_control2();
-
-// src/telemetry.ts
-init_chant_product();
-init_observe();
-init_config();
+// src/actions.ts
 init_words();
-function telemetryEnv(doc, env) {
-  const t = telemetryOf(doc);
-  const out = {};
-  const set = (k, v) => {
-    if (v !== void 0 && v !== "" && env[k] === void 0) out[k] = v;
-  };
-  if (!t.traces) {
-    set("OTEL_TRACES_EXPORTER", "none");
-    return out;
-  }
-  if (env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT === void 0) set("OTEL_EXPORTER_OTLP_ENDPOINT", t.endpoint);
-  if (t.headersEnv) set("OTEL_EXPORTER_OTLP_HEADERS", env[t.headersEnv]);
-  if (t.endpoint !== void 0 || env.OTEL_EXPORTER_OTLP_ENDPOINT !== void 0 || env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT !== void 0) set("OTEL_SERVICE_NAME", t.serviceName);
-  return out;
+var actionSubject = (stack, name) => `action:${stack}:${name}`;
+var cachedAction;
+function chantStackAction() {
+  cachedAction ??= import("@intentius/chant-lexicon-pulumi").then((m) => m.gatedStackAction);
+  return cachedAction;
 }
-async function applyTelemetry(cwd, env = process.env) {
-  let added = {};
+async function fromEvent(env) {
+  const chant = await chantProduct();
+  if (!chant) return { error: `${PRODUCT} action --from-event reads the action job's comment or inputs through chant's productActionFromEnv, and chant's product entry did not load` };
+  const words = chant.assertProductWords({ ...PRODUCT_WORDS, commands: { ...PRODUCT_WORDS.commands, ...ACTION_COMMAND } });
+  const asked = chant.productActionFromEnv(words, env);
+  if (asked.kind === "refused") return { error: `the action job was asked for no action: ${asked.reason}` };
+  return { stack: asked.member, name: asked.address };
+}
+async function action(args, json, table, io) {
+  const event = args.includes("--from-event");
+  const anew = event || args.includes("--anew");
+  const common = commonFlags(args.filter((a) => a !== "--from-event" && a !== "--anew"));
+  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
+  const extra = common.rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`action does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(common.rest);
+  let key;
+  let name;
+  if (event) {
+    if (named.length) return usage(`action --from-event reads the stack and the action from the job's event, so it takes neither: ${STACK_OP_WORDS.usage.action}`, table, io);
+    const asked = await fromEvent(io.env);
+    if ("error" in asked) return usage(asked.error, table, io);
+    ({ stack: key, name } = asked);
+  } else {
+    if (named.length !== 2) return usage(`action takes a stack and an action's name: ${STACK_OP_WORDS.usage.action}`, table, io);
+    [key, name] = named;
+  }
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const stack = resolveStack(read.config, read.path, key, common.dir);
+  if ("error" in stack) return usage(stack.error, table, io);
+  const declared = actionsOf(read.config.doc, stack.key);
+  const chosen = declared.find((a) => a.name === name);
+  if (!chosen) return usage(STACK_OP_WORDS.noAction(stack.key, name, declared.map((a) => a.name)), table, io);
+  const gated = await chantStackAction();
+  useBackend([stack], io.env);
+  const rules = requestRules(read.config);
   try {
-    const file = findConfig(cwd);
-    if (file) added = telemetryEnv(loadConfig(file).doc, env);
-  } catch {
-    return {};
+    const outcome = await gated({
+      by: requesterOf(common.by, io.env),
+      rules,
+      op: STACK_OPS_OP,
+      ledgerCwd: io.cwd,
+      env: io.env,
+      dir: stack.dir,
+      stack: stack.stack,
+      urn: chosen.urn,
+      name: chosen.name,
+      ...stack.engine ? { engine: stack.engine } : {},
+      ...anew ? { anew: true } : {}
+    });
+    return reportOutcome("action", outcome, actionSubject(stack.stack, chosen.name), rules, (r) => STACK_OP_WORDS.acted(stack.key, chosen.name, r), json, table, io);
+  } catch (e) {
+    const err = e;
+    const refusal = typeof err.code === "string" && err.code.startsWith("action-") ? err.code : void 0;
+    const urns = Array.isArray(err.urns) ? err.urns : [];
+    if (json) {
+      io.out(JSON.stringify({
+        command: "action",
+        ok: false,
+        exitCode: table.failed,
+        op: STACK_OPS_OP,
+        gate: actionSubject(stack.stack, chosen.name),
+        error: err.message,
+        ...refusal ? { refusal } : {},
+        ...urns.length ? { urns } : {}
+      }));
+    } else io.err(`${PRODUCT} action: ${err.message}`);
+    return table.failed;
   }
-  Object.assign(env, added);
-  const chant = await chantProduct();
-  if (chant && typeof chant.configureOtlp === "function") chant.configureOtlp({ prefix: PRODUCT, env });
-  return added;
 }
 
-// src/cli.ts
-init_init();
-init_stages();
-init_tips();
-init_images();
-init_up();
-
-// src/upgrade.ts
-init_config();
-init_images();
+// src/audit.ts
+init_detect();
 init_stages();
 init_words();
-import { execFile } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname13, join as join18, relative as relative2, resolve as resolve2 } from "node:path";
-var PLYWOOD_PACKAGE = "@intentius/plywood";
-var CHANT_PACKAGE = "@intentius/chant";
-var CHANT_FAMILY = /^@intentius\/chant(?:-lexicon-[a-z0-9-]+)?$/;
-var VERSION2 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
-var DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies"];
-function parseUpgradeArgs(args) {
-  const chant = takeFlag(args, "--chant");
-  const forge = takeFlag(chant.rest, "--forge");
-  const env = takeFlag(forge.rest, "--env");
-  if (chant.missing || forge.missing || env.missing) return { error: "--chant, --forge and --env each take a value" };
-  const flags = /* @__PURE__ */ new Set(["--no-install", "--dry-run"]);
-  const unknown = env.rest.filter((a) => a.startsWith("-") && !flags.has(a));
-  if (unknown.length) return { error: `upgrade does not take ${unknown.join(" ")}` };
-  const words = env.rest.filter((a) => !a.startsWith("-"));
-  if (words.length > 1) return { error: `upgrade takes one version, not ${words.join(" ")}` };
-  const version2 = words[0]?.replace(/^v/, "");
-  if (version2 !== void 0 && !VERSION2.test(version2)) return { error: `${words[0]} is not a version: give it as MAJOR.MINOR.PATCH` };
-  if (chant.value !== void 0 && !VERSION2.test(chant.value)) return { error: `--chant ${chant.value} is not a version: give it as MAJOR.MINOR.PATCH` };
-  return {
-    ...version2 ? { version: version2 } : {},
-    ...chant.value ? { chant: chant.value } : {},
-    ...forge.value ? { forge: forge.value } : {},
-    ...env.value ? { env: env.value } : {},
-    install: !env.rest.includes("--no-install"),
-    dryRun: env.rest.includes("--dry-run")
-  };
+var AUDIT_TABLES = { approvals: "gates", updates: "applies", runs: "runs", "review-stacks": "pr_envs" };
+var DEFAULT_AUDIT_TABLE = "approvals";
+function auditTable(word) {
+  const w = word ?? DEFAULT_AUDIT_TABLE;
+  return AUDIT_TABLES[w] ?? w;
 }
-function findPlywoodPackage(dir) {
-  let cur = resolve2(dir);
-  for (let depth = 0; depth < 32; depth++) {
-    const file = join18(cur, "package.json");
-    if (existsSync15(file)) {
-      try {
-        const pkg = JSON.parse(readFileSync17(file, "utf8"));
-        if (DEP_FIELDS.some((f) => isObject2(pkg[f]) && typeof pkg[f][PLYWOOD_PACKAGE] === "string")) return file;
-      } catch {
-      }
-    }
-    const up2 = dirname13(cur);
-    if (up2 === cur) return void 0;
-    cur = up2;
+function auditMember(stack) {
+  const [project, name] = stack.split("/");
+  return project && name ? slug(project).slice(0, 36).replace(/-+$/, "") : void 0;
+}
+function auditArgv(args, json) {
+  const stack = takeFlag(args, "--stack");
+  const since = takeFlag(stack.rest, "--since");
+  const at = takeFlag(since.rest, "--at");
+  for (const [flag, f] of [["--stack", stack], ["--since", since], ["--at", at]]) if (f.missing) return { error: `${flag} takes a value` };
+  const wheres = [];
+  const rest = [];
+  for (let i = 0; i < at.rest.length; i++) {
+    const a = at.rest[i];
+    if (a === "--where") {
+      const v = at.rest[i + 1];
+      if (v === void 0 || v.startsWith("--")) return { error: "--where takes <field><op><value>, such as gate=wave-2" };
+      wheres.push("--where", v);
+      i++;
+    } else rest.push(a);
   }
-  return void 0;
+  const flags = rest.filter((a) => a.startsWith("-"));
+  if (flags.length) return { error: `audit does not take ${flags.join(" ")}` };
+  if (rest.length > 1) return { error: `audit reads one table: ${Object.keys(AUDIT_TABLES).join(", ")}, or a chant ledger table` };
+  let member;
+  if (stack.value !== void 0) {
+    member = auditMember(stack.value);
+    if (!member) return { error: `--stack takes project/stack, not '${stack.value}'` };
+  }
+  return [
+    "ledger",
+    auditTable(rest[0]),
+    ...member ? ["--member", member] : [],
+    ...since.value ? ["--since", since.value] : [],
+    ...wheres,
+    ...at.value ? ["--at", at.value] : [],
+    ...json ? ["--json"] : []
+  ];
 }
-function movedRange(range, version2) {
-  const m = /^([~^]?)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(range.trim());
-  if (!m) return void 0;
-  return `${m[1]}${version2}`;
+async function audit2(args, json, table, io) {
+  const argv = auditArgv(args, json);
+  if ("error" in argv) return usage(argv.error, table, io);
+  return withChant(`${PRODUCT} audit`, table, io, (chant) => chant.runChantInProcess(argv, PRODUCT_WORDS));
 }
-function movePackagePins(text, file, plywood, chant) {
-  const pkg = JSON.parse(text);
-  const moves = [];
-  const left = [];
-  for (const field of DEP_FIELDS) {
-    const deps = pkg[field];
-    if (!isObject2(deps)) continue;
-    for (const [name, range] of Object.entries(deps)) {
-      if (typeof range !== "string") continue;
-      const target = name === PLYWOOD_PACKAGE ? plywood : CHANT_FAMILY.test(name) ? chant : void 0;
-      if (target === void 0) continue;
-      const next = movedRange(range, target);
-      if (next === void 0) {
-        left.push(`${field}.${name} is '${range}'; move it to ${target} by hand`);
-        continue;
-      }
-      if (next === range) continue;
-      deps[name] = next;
-      moves.push({ file, name, from: range, to: next });
+
+// src/cli.ts
+init_agents2();
+init_drift2();
+
+// src/estate.ts
+init_chant_product();
+init_chant_config();
+init_config();
+init_stages();
+init_words();
+import { dirname as dirname12 } from "node:path";
+var estateModule;
+function chantEstate() {
+  estateModule ??= (async () => {
+    try {
+      const m = await import("@intentius/chant/ci-estate");
+      const r = await import("@intentius/chant/pr-report-url");
+      if (!["readEstateLedger", "buildLedgerEstate", "writeEstate"].every((f) => typeof m[f] === "function")) return void 0;
+      if (typeof r.parseReportUrl !== "function" || typeof r.reportPut !== "function") return void 0;
+      return { ...m, parseReportUrl: r.parseReportUrl, reportPut: r.reportPut };
+    } catch {
+      return void 0;
     }
-  }
-  return { text: moves.length ? jsonText2(pkg, text) : text, moves, left };
-}
-function moveDeclarationPins(text, file, chant) {
-  const doc = JSON.parse(text);
-  const moves = [];
-  const pins = Array.isArray(doc.pins) ? doc.pins : [];
-  for (const pin of pins) {
-    if (typeof pin.package !== "string" || !CHANT_FAMILY.test(pin.package) || typeof pin.version !== "string") continue;
-    if (pin.version === chant) continue;
-    moves.push({ file, name: pin.package, from: pin.version, to: chant });
-    pin.version = chant;
-  }
-  return { text: moves.length ? jsonText2(doc, text) : text, moves };
+  })();
+  return estateModule;
 }
-function imageNote(doc, version2) {
-  const image = doc.image;
-  const name = typeof image === "string" ? image : isObject2(image) && typeof image.name === "string" ? image.name : void 0;
-  if (name === void 0) return void 0;
-  const m = new RegExp(`^${REGISTRY.replace(/[.]/g, "\\.")}/plywood-(pulumi|plunge):([^@]+)`).exec(name);
-  if (m && m[2].startsWith(`${version2}-`)) return void 0;
-  if (m) return `plywood.yml's image is plywood's ${m[1]} image at ${m[2]}; name the ${version2} image in it (its tag starts ${version2}-), or drop the key to take the release's own`;
-  return `plywood.yml's image is your own (${name}); rebuild it FROM plywood's ${version2} image and name the new digest in it`;
+var ESTATE_NEEDS_CHANT = `${PRODUCT} estate needs chant >= the release after 0.124.54, which carries @intentius/chant/ci-estate (chant#4612). Run '${PRODUCT} audit' for the ledger's rows on this chant.`;
+function estateSchedules(config2) {
+  const drift3 = toChantSettings(config2).pipeline.drift;
+  const driftOps = (drift3?.stacks ?? []).map(driftOpName);
+  const schedules = drift3?.schedule ? driftOps.map((op) => ({ op, cron: drift3.schedule })) : [];
+  return { schedules, driftOps };
 }
-async function viewRelease(exec, cwd, env, version2) {
-  const spec = `${PLYWOOD_PACKAGE}@${version2 ?? "latest"}`;
-  const r = await exec("npm", ["view", spec, "version", "dependencies", "--json"], { cwd, env });
-  if (r.code !== 0) {
-    const notFound = /E404/.test(r.stderr + r.stdout);
-    return { error: notFound ? `npm has no ${spec}` : `npm view ${spec} failed: ${(r.stderr || r.stdout).trim().split("\n")[0] ?? ""}` };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(r.stdout);
-  } catch {
-    return { error: `npm view ${spec} printed no JSON` };
+async function estate(args, json, table, io) {
+  const failOverdue = args.includes("--fail-overdue");
+  let rest = args.filter((a) => a !== "--fail-overdue");
+  const flags = {};
+  for (const flag of ["--file", "--report-url", "--prefix"]) {
+    const f = takeFlag(rest, flag);
+    if (f.missing) return usage(`${flag} takes a value`, table, io);
+    flags[flag] = f.value;
+    rest = f.rest;
   }
-  const doc = Array.isArray(parsed) ? parsed[parsed.length - 1] : parsed;
-  if (!isObject2(doc) || typeof doc.version !== "string") return { error: `npm view ${spec} named no version` };
-  const deps = isObject2(doc.dependencies) ? doc.dependencies : {};
-  const chant = deps[CHANT_PACKAGE];
-  if (typeof chant !== "string" || !VERSION2.test(chant)) return { error: `${PLYWOOD_PACKAGE}@${doc.version} pins no exact ${CHANT_PACKAGE}` };
-  return { version: doc.version, chant };
-}
-async function upgrade(args, json, table, io) {
-  const opts = parseUpgradeArgs(args);
-  const fail = (message) => {
-    if (json) io.out(JSON.stringify({ command: "upgrade", ok: false, exitCode: table.failed, error: message }));
-    else io.err(`${PRODUCT}: ${message}`);
+  if (rest.length) return usage(`estate does not take ${rest.join(" ")}`, table, io);
+  const chant = await chantEstate();
+  if (!chant) {
+    if (json) io.out(JSON.stringify({ command: "estate", ok: false, exitCode: table.failed, error: ESTATE_NEEDS_CHANT }));
+    else io.err(`${PRODUCT}: ${ESTATE_NEEDS_CHANT}`);
     return table.failed;
-  };
-  if ("error" in opts) return fail(opts.error);
-  const exec = io.exec ?? execChild;
-  const pkgFile = findPlywoodPackage(io.cwd);
-  if (!pkgFile) return fail(`no package.json in ${io.cwd} or above it depends on ${PLYWOOD_PACKAGE}; install it with 'npm i -D ${PLYWOOD_PACKAGE}', then run '${PRODUCT} init'`);
-  const pkgDir = dirname13(pkgFile);
-  const configFile = findConfig(io.cwd);
-  const configDir = configFile ? dirname13(configFile) : pkgDir;
-  const rel = (f) => relative2(io.cwd, f) || f;
-  const release2 = await viewRelease(exec, pkgDir, io.env, opts.version);
-  if ("error" in release2) return fail(release2.error);
-  const chant = opts.chant ?? release2.chant;
-  const pkgText = readFileSync17(pkgFile, "utf8");
-  const pkgMove = movePackagePins(pkgText, rel(pkgFile), release2.version, chant);
-  const declFile = join18(configDir, "chant.workspace.json");
-  const declText = existsSync15(declFile) ? readFileSync17(declFile, "utf8") : void 0;
-  let declMove;
-  if (declText !== void 0) {
+  }
+  const path = flags["--file"] ?? findConfig(io.cwd);
+  let config2;
+  if (path) {
     try {
-      declMove = moveDeclarationPins(declText, rel(declFile), chant);
+      config2 = loadConfig(path);
     } catch (e) {
-      return fail(`${rel(declFile)} is not JSON upgrade can move pins in (${e.message})`);
+      return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
     }
-  }
-  const notes = [...pkgMove.left];
-  if (existsSync15(join18(configDir, "chant.workspace.jsonc"))) notes.push(`chant.workspace.jsonc is yours: move its @intentius/chant* pins to ${chant} by hand`);
-  if (configFile) {
-    try {
-      const note = imageNote(loadConfig(configFile).doc, release2.version);
-      if (note) notes.push(note);
-    } catch {
+    const errors = checkConfig(config2).filter((p) => p.severity === "error");
+    if (errors.length) {
+      for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
+      return table.failed;
     }
-  } else {
-    notes.push(`no plywood.yml, so there is no workflow to write again; run '${PRODUCT} init' after the install`);
-  }
-  const moves = [...pkgMove.moves, ...declMove?.moves ?? []];
-  const ciArgs = ["--no-install", PRODUCT, "ci", ...opts.forge ? ["--forge", opts.forge] : [], ...opts.env ? ["--env", opts.env] : []];
-  const steps = {
-    install: { cwd: rel(pkgDir) || ".", command: "npm install --no-audit --no-fund" },
-    ci: { cwd: rel(configDir) || ".", command: `npx ${ciArgs.join(" ")}` }
-  };
-  const envelope = { command: "upgrade", plywood: release2.version, chant, moves, notes, dryRun: opts.dryRun };
-  const say = (line) => {
-    if (!json) io.err(line);
-  };
-  say(`${PRODUCT} upgrade: ${PLYWOOD_PACKAGE} ${release2.version}, ${CHANT_PACKAGE} ${chant}`);
-  for (const m of moves) say(`  ${m.file}  ${m.name}  ${m.from} -> ${m.to}`);
-  if (moves.length === 0) say("  every pin is already there");
-  if (opts.dryRun) {
-    say(`  then: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
-    for (const n of notes) say(`  note: ${n}`);
-    if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, steps }));
-    return table.done;
-  }
-  if (pkgMove.text !== pkgText) writeFileSync9(pkgFile, pkgMove.text);
-  if (declMove && declText !== void 0 && declMove.text !== declText) writeFileSync9(declFile, declMove.text);
-  const files = [...new Set(moves.map((m) => m.file))];
-  if (!opts.install) {
-    say(`  left to run: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
-    for (const n of notes) say(`  note: ${n}`);
-    if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, files, steps }));
-    return table.done;
   }
-  say(`  $ ${steps.install.command}`);
-  const installed = await exec("npm", ["install", "--no-audit", "--no-fund"], { cwd: pkgDir, env: io.env });
-  if (installed.code !== 0) {
-    for (const n of notes) say(`  note: ${n}`);
-    return fail(`npm install failed (exit ${installed.code}); package.json is moved, so fix the install and run '${steps.ci.command}'
-${installed.stderr.trim()}`);
+  const { schedules, driftOps } = config2 ? estateSchedules(config2) : { schedules: [], driftOps: [] };
+  const product = await chantProduct();
+  const words = product ? product.assertProductWords(PRODUCT_WORDS) : PRODUCT_WORDS;
+  const root = path ? dirname12(path) : io.cwd;
+  const load = await chant.readEstateLedger(root);
+  const built = chant.buildLedgerEstate({ load, words, schedules, ...driftOps.length ? { driftOps } : {} });
+  const url = flags["--report-url"] ?? (config2 ? toChantSettings(config2).ci.reportUrl : void 0);
+  let written;
+  if (url) {
+    const target = chant.parseReportUrl(url, flags["--report-url"] ? "--report-url" : "reports.url");
+    if (target && typeof target === "object" && "error" in target) return usage(String(target.error), table, io);
+    written = await chant.writeEstate(built, { put: chant.reportPut(target), words, env: io.env, ...flags["--prefix"] ? { prefix: flags["--prefix"] } : {} });
   }
-  const got = installedVersion(pkgDir);
-  if (got !== void 0 && got !== release2.version) notes.push(`node_modules holds ${PLYWOOD_PACKAGE} ${got}, not ${release2.version}; check the install`);
-  let ci2;
-  if (configFile) {
-    say(`  $ ${steps.ci.command}`);
-    ci2 = await exec("npx", ciArgs, { cwd: configDir, env: io.env });
-    if (!json && ci2.stderr.trim()) io.err(ci2.stderr.trimEnd());
+  const code = failOverdue && built.overdue.length > 0 ? table.failed : table.done;
+  if (json) {
+    io.out(JSON.stringify({ command: "estate", ok: code === table.done, exitCode: code, estate: built.estate, dora: built.dora, overdue: built.overdue, ...written ? { written } : {} }));
+    return code;
   }
-  for (const n of notes) say(`  note: ${n}`);
-  const ok = ci2 === void 0 || ci2.code === 0;
-  const lockFile = join18(pkgDir, "package-lock.json");
-  const changed = [...files, ...existsSync15(lockFile) ? [rel(lockFile)] : []];
-  if (ok) say(`  Open one pull request with ${changed.join(", ")} and the files ${PRODUCT} ci wrote.`);
-  else say(`  ${PRODUCT} ci failed (exit ${ci2?.code}); the pins are moved and installed, so fix plywood.yml and run '${steps.ci.command}'`);
-  const code = ok ? table.done : ci2?.code ?? table.failed;
-  if (json) io.out(JSON.stringify({ ...envelope, ok, exitCode: code, files: changed, ...ci2 ? { ci: { exitCode: ci2.code } } : {} }));
+  const totals = built.estate.totals ?? {};
+  io.out(`${PRODUCT} estate: ${Object.entries(totals).map(([k, v]) => `${v} ${k}`).join(", ") || "nothing on the ledger yet"}`);
+  for (const o of built.overdue) io.out(`  ${o.message}`);
+  if (written) io.out(`  wrote ${written.keys.join(", ")} under ${url}`);
+  else io.out(`  no report URL (reports.url or --report-url), so nothing was written`);
   return code;
 }
-function installedVersion(dir) {
-  try {
-    const pkg = JSON.parse(readFileSync17(join18(dir, "node_modules", PLYWOOD_PACKAGE, "package.json"), "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : void 0;
-  } catch {
-    return void 0;
+
+// src/notify.ts
+init_stages();
+init_words();
+var RELAY_NEEDS_CHANT = `${PRODUCT} notify relay needs chant >= the release after 0.124.54, which carries chant notify relay (chant#4611).`;
+async function notify(args, json, table, io) {
+  if (args[0] !== "relay") return usage(`unknown notify command '${args[0] ?? ""}'. Run '${PRODUCT} notify relay'.`, table, io);
+  return withChant(`${PRODUCT} notify relay`, table, io, (chant) => {
+    if (typeof chant.startRelayServer !== "function") {
+      if (json) io.out(JSON.stringify({ command: "notify relay", ok: false, exitCode: table.failed, error: RELAY_NEEDS_CHANT }));
+      else io.err(`${PRODUCT}: ${RELAY_NEEDS_CHANT}`);
+      return Promise.resolve(table.failed);
+    }
+    return chant.runChantInProcess(["notify", ...args], PRODUCT_WORDS);
+  });
+}
+
+// src/cli.ts
+init_policy();
+
+// src/guard.ts
+init_stages();
+init_words();
+import { chmodSync, copyFileSync, existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join17 } from "node:path";
+var GUARDED = {
+  pulumi: ["up", "update", "destroy"],
+  plunge: ["up", "update", "destroy"]
+};
+var VALUED_GLOBALS = /* @__PURE__ */ new Set(["-C", "--cwd", "-s", "--stack", "--color", "--config-file", "--logflow", "-v", "--verbose", "--tracing", "--profiling", "--memprofilerate"]);
+var LAUNCHERS = /* @__PURE__ */ new Set(["env", "npx", "sudo", "command", "exec", "nohup", "time", "xargs"]);
+function segments(line) {
+  return line.split(/\|\||&&|[;|\n`]|\$\(|\)/).map((seg) => (seg.match(/'[^']*'|"[^"]*"|\S+/g) ?? []).map((t) => t.replace(/^['"]|['"]$/g, ""))).filter((t) => t.length > 0);
+}
+function guardVerdict(line) {
+  for (const words of segments(line)) {
+    let i = 0;
+    while (i < words.length && (LAUNCHERS.has(words[i]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]) || words[i - 1] === "env" && words[i].startsWith("-"))) i++;
+    const bin = (words[i] ?? "").split("/").pop();
+    const refused = GUARDED[bin];
+    if (!refused) continue;
+    for (let j = i + 1; j < words.length; j++) {
+      const w = words[j];
+      if (w.startsWith("-")) {
+        if (VALUED_GLOBALS.has(w)) j++;
+        continue;
+      }
+      if (refused.includes(w)) {
+        return {
+          engine: bin,
+          subcommand: w,
+          message: `${PRODUCT} guard: an agent session does not run '${bin} ${w}'. Open a pull request; ${PRODUCT} previews it, and the update runs after a person approves the digest.`
+        };
+      }
+      break;
+    }
   }
+  return void 0;
 }
-function jsonText2(value, original) {
-  const indent = /^[{[]\r?\n([ \t]+)/.exec(original)?.[1] ?? "  ";
-  return `${JSON.stringify(value, null, indent)}
-`;
+var GUARD_TEMPLATES = new URL("../templates/agent-guard/", import.meta.url);
+var HOOK_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/plywood-guard.mjs"';
+function withGuardHook(settings) {
+  const hooks = typeof settings.hooks === "object" && settings.hooks !== null ? settings.hooks : {};
+  const pre = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
+  const has = JSON.stringify(pre).includes("plywood-guard.mjs");
+  if (!has) pre.push({ matcher: "Bash", hooks: [{ type: "command", command: HOOK_COMMAND }] });
+  return { ...settings, hooks: { ...hooks, PreToolUse: pre } };
 }
-function isObject2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
+async function guard(args, json, table, io) {
+  const [sub, ...rest] = args;
+  if (sub === "check") {
+    const line = (rest[0] === "--" ? rest.slice(1) : rest).join(" ");
+    if (!line.trim()) return usage("guard check takes the command line to check", table, io);
+    const v = guardVerdict(line);
+    if (json) io.out(JSON.stringify({ command: "guard check", ok: !v, exitCode: v ? table.denied : table.done, refused: v ?? null }));
+    else io.out(v ? v.message : `${PRODUCT} guard: '${line}' runs`);
+    return v ? table.denied : table.done;
+  }
+  if (sub === "install") {
+    const dirFlag = takeFlag(rest, "--dir");
+    if (dirFlag.missing) return usage("--dir takes a directory", table, io);
+    if (dirFlag.rest.length) return usage(`guard install does not take ${dirFlag.rest.join(" ")}`, table, io);
+    const root = dirFlag.value ? join17(io.cwd, dirFlag.value) : io.cwd;
+    const written = [];
+    const hookDir = join17(root, ".claude/hooks");
+    mkdirSync7(hookDir, { recursive: true });
+    copyFileSync(new URL("plywood-guard.mjs", GUARD_TEMPLATES), join17(hookDir, "plywood-guard.mjs"));
+    written.push(".claude/hooks/plywood-guard.mjs");
+    const settingsFile = join17(root, ".claude/settings.json");
+    let settings = {};
+    if (existsSync14(settingsFile)) {
+      try {
+        settings = JSON.parse(readFileSync15(settingsFile, "utf8"));
+      } catch (e) {
+        return usage(`.claude/settings.json is not JSON (${e.message}); fix it, then run this again`, table, io);
+      }
+    }
+    writeFileSync8(settingsFile, JSON.stringify(withGuardHook(settings), null, 2) + "\n");
+    written.push(".claude/settings.json");
+    const binDir = join17(root, ".plywood/agent-bin");
+    mkdirSync7(binDir, { recursive: true });
+    for (const name of Object.keys(GUARDED)) {
+      const to = join17(binDir, name);
+      copyFileSync(new URL(`bin/${name}`, GUARD_TEMPLATES), to);
+      chmodSync(to, 493);
+      written.push(`.plywood/agent-bin/${name}`);
+    }
+    if (json) io.out(JSON.stringify({ command: "guard install", ok: true, exitCode: table.done, written }));
+    else {
+      for (const f of written) io.err(`${PRODUCT} guard: wrote ${f}`);
+      io.err(`${PRODUCT} guard: an agent session that runs outside Claude Code puts .plywood/agent-bin first on PATH and sets PLYWOOD_AGENT_GUARD=1`);
+    }
+    return table.done;
+  }
+  return usage(`guard takes check <command line> or install [--dir <d>]`, table, io);
 }
-var execChild = (bin, args, opts) => new Promise((done) => {
-  execFile(bin, args, { cwd: opts.cwd, env: opts.env, maxBuffer: 64 * 1024 * 1024, shell: process.platform === "win32" }, (error2, stdout, stderr) => {
-    const code = error2 ? typeof error2.code === "number" ? error2.code : 1 : 0;
-    done({ code, stdout: String(stdout), stderr: String(stderr) });
-  });
-});
 
-// src/stack-ops.ts
+// src/identities.ts
+init_jobs2();
 init_chant_config();
 init_identity();
 init_config();
 init_stacks();
-init_adopt();
-init_detect();
-init_refusals();
 init_stages();
-init_chant_product();
 init_words();
-import { existsSync as existsSync16 } from "node:fs";
-import { dirname as dirname14, isAbsolute as isAbsolute2, join as join19, resolve as resolve3 } from "node:path";
-var STACK_OPS_OP = "pulumi-stack-ops";
-var REQUIRED4 = ["gatedStackExport", "gatedStackCancel", "gatedStackMove"];
-var cachedLocks;
-function chantStackLockReader() {
-  cachedLocks ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      return typeof m.pulumiStackLockIds === "function" ? m.pulumiStackLockIds : void 0;
-    } catch {
-      return void 0;
+import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { dirname as dirname13, join as join18 } from "node:path";
+import { targetGlobMatch } from "@intentius/chant/ci-identity";
+function identityRows(config2, env) {
+  const doc = config2.doc;
+  const out = [];
+  for (const stack of Object.keys(stacksOf(doc))) {
+    const ids = stackIdentities(doc, stack, env, targetGlobMatch);
+    for (const cloud of IDENTITY_CLOUDS) {
+      const id = ids[cloud];
+      if (id) out.push({ stack, cloud, preview: id.preview, up: id.up, rule: id.rule });
     }
-  })();
-  return cachedLocks;
+  }
+  return out;
 }
-async function lockToCancel(given, stack, env) {
-  if (given) return { lockId: given, read: false };
-  const reader = await chantStackLockReader();
-  if (!reader) return { error: STACK_OP_WORDS.needsLock };
-  let locks2;
+function identityLines(config2, env, rows) {
+  const doc = config2.doc;
+  const block = chantIdentityOf(doc);
+  if (!block) return [`${config2.file ?? "plywood.yml"}: no identity; every job runs as ${NO_IDENTITY}`];
+  const lines2 = [`${config2.file ?? "plywood.yml"}: identities in environment ${env}`];
+  const clouds = Object.keys(block.cloud);
+  lines2.push(`  clouds  ${clouds.map((c) => CLOUD_NAMES[c]).join(", ")}`);
+  if (clouds.includes("pulumi")) {
+    const p = pulumiCloudOf(doc);
+    lines2.push(`  Pulumi Cloud  ${p.org}${p.apiUrl ? ` at ${p.apiUrl}` : ""}; ESC environments open with each job's own token`);
+  }
+  const stacks2 = Object.keys(stacksOf(doc));
+  if (stacks2.length === 0) lines2.push("  plywood.yml lists no stacks; the rules apply to each stack plywood init finds");
+  for (const stack of stacks2) {
+    lines2.push(`  ${stack}`);
+    for (const cloud of clouds) {
+      const r = rows.find((x) => x.stack === stack && x.cloud === cloud);
+      lines2.push(r ? `    ${CLOUD_NAMES[cloud].padEnd(12)} preview ${r.preview}, up ${r.up} (${r.rule})` : `    ${CLOUD_NAMES[cloud].padEnd(12)} ${NO_IDENTITY}`);
+    }
+  }
+  lines2.push("  The preview job trades its OIDC token before checkout, and no later step holds a forge token.");
+  return lines2;
+}
+function configIdentities(args, json, table, io) {
+  const file = takeFlag(args, "--file");
+  const env = takeFlag(file.rest, "--env");
+  if (file.missing || env.missing) return usage(`${file.missing ? "--file" : "--env"} takes a value`, table, io);
+  if (env.rest.length) return usage(`config identities does not take ${env.rest.join(" ")}`, table, io);
+  const path = file.value ?? findConfig(io.cwd);
+  if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init', or pass --file`, table, io);
+  let config2;
   try {
-    locks2 = await reader({ dir: stack.dir, stack: stack.stack, ...stack.project ? { project: stack.project } : {}, ...stack.engine ? { engine: stack.engine } : {}, env });
+    config2 = loadConfig(path);
   } catch (e) {
-    return { error: `${STACK_OP_WORDS.needsLock}. Reading the stack's lock failed: ${e.message}` };
+    return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
   }
-  if (!locks2.checked) return { error: STACK_OP_WORDS.lockNotListed(locks2.backend) };
-  if (locks2.ids.length === 0) return { error: STACK_OP_WORDS.noLock(stack.stack) };
-  if (locks2.ids.length > 1) return { error: STACK_OP_WORDS.manyLocks(stack.stack, locks2.ids) };
-  return { lockId: locks2.ids[0], read: true };
+  const errors = checkConfig(config2).filter((p) => p.severity === "error");
+  if (errors.length) {
+    for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
+    if (json) io.out(JSON.stringify({ command: "config identities", ok: false, exitCode: table.failed, file: path, problems: errors }));
+    return table.failed;
+  }
+  const environment = env.value ?? "production";
+  const rows = identityRows(config2, environment);
+  if (json) io.out(JSON.stringify({ command: "config identities", ok: true, exitCode: table.done, file: path, env: environment, identity: toChantSettings(config2).ci.identity ?? null, stacks: rows }));
+  else for (const line of identityLines(config2, environment, rows)) io.out(line);
+  return table.done;
 }
-var cachedOps;
-var cachedRollback;
-function chantStackOps() {
-  cachedOps ??= (async () => {
+var FORGE_CHECK_MESSAGE = `${PRODUCT} forge check holds the identities next to the forge's environments, protected branches and each cloud's trust policy. The read is chant's (@intentius/chant/forge-check, chant#4608), and the installed chant lacks it; it comes with the chant release after 0.124.54. Run '${PRODUCT} config identities' for what the jobs will hold.`;
+var FORGES2 = ["github", "gitlab", "forgejo"];
+var FORGE_CHECK_FUNCTIONS = ["forgeCheck", "forgeCheckExit", "describeForgeCheck", "forgeCheckTarget", "pipelineContract"];
+var forgeCheckModule;
+function chantForgeCheck() {
+  forgeCheckModule ??= (async () => {
     try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      return REQUIRED4.every((name) => typeof m[name] === "function") ? m : void 0;
+      const fc = await import("@intentius/chant/forge-check");
+      const id = await import("@intentius/chant/ci-identity");
+      if (!FORGE_CHECK_FUNCTIONS.every((f) => typeof fc[f] === "function") || typeof id.resolveCloudIdentity !== "function") return void 0;
+      return { ...fc, resolveCloudIdentity: id.resolveCloudIdentity };
     } catch {
       return void 0;
     }
   })();
-  return cachedOps;
+  return forgeCheckModule;
 }
-function chantStackRollback() {
-  cachedRollback ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      if (typeof m.pulumiReleaseInputs !== "function") return false;
-      const copy2 = await import("@intentius/chant-lexicon-pulumi/release-copy");
-      return typeof copy2.prepareReleaseCopy === "function";
-    } catch {
-      return false;
-    }
-  })();
-  return cachedRollback;
-}
-function needsStackOpsMessage(what, feature) {
-  return `${what} needs @intentius/chant-lexicon-pulumi >= the release after 0.124.54, which carries ${feature}. This plywood was built with chant ${BUILT_CHANT}, which lacks it. Upgrade plywood once that chant is out, or build against a local chant with 'just chant-local'.`;
-}
-function readConfig(cwd) {
-  const path = findConfig(cwd);
-  if (!path) return { error: `no plywood.yml in ${cwd} or above it; run '${PRODUCT} init' first` };
-  const config2 = loadConfig(path);
-  const errors = checkConfig(config2).filter((p) => p.severity === "error");
-  if (errors.length) return { error: errors.map((p) => `${path}: ${p.key} ${p.message}`).join("\n") };
-  return { config: config2, path };
-}
-function resolveStack(config2, path, key, dir) {
-  const [project, stack, extra] = key.split("/");
-  if (!project || !stack || extra !== void 0) return { error: `a stack is project/stack, as plywood.yml lists it, not '${key}'` };
-  const settings = toChantSettings(config2);
-  const listed = stacksOf(config2.doc);
-  const root = dirname14(path);
-  const member = settings.members.find((m) => m.name === key) ?? settings.memberDefaults;
-  if (dir === void 0 && Object.keys(listed).length > 0 && !(key in listed)) {
-    return { error: `${key} is not under stacks in ${path}; the stacks are ${Object.keys(listed).join(", ")} (or name its directory with --dir)` };
+function workspaceMembers(root) {
+  const file = join18(root, "chant.workspace.json");
+  if (!existsSync15(file)) return [];
+  try {
+    const doc = JSON.parse(readFileSync16(file, "utf8"));
+    return (doc.members ?? []).map((m) => m.name).filter((n) => typeof n === "string");
+  } catch {
+    return [];
   }
-  const at = dir ?? listed[key]?.dir ?? ".";
-  return {
-    key,
-    project,
-    stack,
-    dir: isAbsolute2(at) ? at : resolve3(root, at),
-    ...member.engine ? { engine: member.engine } : {},
-    ...member.backend ? { backend: member.backend } : {}
-  };
-}
-function requestRules(config2) {
-  const p = toChantSettings(config2).pipeline;
-  return { mode: p.approval ?? "ledger", ...p.quorum?.length ? { quorum: p.quorum } : {} };
 }
-function requesterOf(by, env) {
-  return by ?? env.GITHUB_ACTOR ?? env.GITLAB_USER_LOGIN ?? env.USER ?? "unknown";
-}
-function destStackName(source, dest, config2) {
-  if (dest.project === source.project) return dest.stack;
-  const cloud = !dest.backend || /^https?:\/\//.test(dest.backend);
-  const org = cloud ? pulumiCloudOf(config2.doc).org : void 0;
-  return `${org ?? "organization"}/${dest.project}/${dest.stack}`;
-}
-function approveRequestLine(gate, digest, mode) {
-  return `${PRODUCT} approve ${gate} --op ${STACK_OPS_OP} --plan ${digest}${mode === "sealed" ? " --sign" : ""}`;
-}
-function useBackend(stacks2, env) {
-  const named = [...new Set(stacks2.map((s) => s.backend).filter((b) => b !== void 0))];
-  if (named.length > 1) return `the stacks are on different backends (${named.join(", ")}); a move needs both on one backend`;
-  if (named[0] && !env.PULUMI_BACKEND_URL) env.PULUMI_BACKEND_URL = named[0];
-  return void 0;
+function upRunner(runner) {
+  if (runner === void 0) return void 0;
+  const staged = typeof runner === "object" && !Array.isArray(runner) && !("group" in runner);
+  const spec = staged ? runner.up ?? runner.default : runner;
+  if (spec === void 0) return void 0;
+  if (typeof spec === "string") return { labels: [spec] };
+  if (Array.isArray(spec)) return { labels: spec.filter((l) => typeof l === "string") };
+  const g = spec;
+  return typeof g.group === "string" ? { labels: Array.isArray(g.labels) ? g.labels : [], group: g.group } : void 0;
 }
-function reportOutcome(verb, outcome, gate, rules, done, json, table, io) {
-  const approveLine = outcome.status === "waiting" || outcome.status === "refused" ? approveRequestLine(gate, outcome.digest, rules.mode) : void 0;
-  let code;
-  let text;
-  switch (outcome.status) {
-    case "waiting":
-      code = table.waiting;
-      text = STACK_OP_WORDS.waiting(verb, approveLine);
-      break;
-    case "refused":
-      code = table.waiting;
-      text = `${outcome.reason}. ${STACK_OP_WORDS.waiting(verb, approveLine)}`;
-      break;
-    case "spent":
-      code = table.failed;
-      text = STACK_OP_WORDS.spent(verb);
-      break;
-    case "done":
-      code = table.done;
-      text = done(outcome.result);
-      break;
-    case "failed":
-      code = table.failed;
-      text = `${PRODUCT} ${verb}: ${outcome.error}`;
-      break;
-  }
-  if (json) {
-    io.out(JSON.stringify({
-      command: verb,
-      ok: code === table.done,
-      exitCode: code,
-      status: outcome.status,
-      op: STACK_OPS_OP,
-      gate,
-      digest: outcome.digest,
-      ...approveLine ? { approve: approveLine } : {},
-      ...outcome.status === "done" ? { result: outcome.result } : {},
-      ...outcome.status === "failed" ? { error: outcome.error } : {},
-      ...outcome.status === "refused" ? { refusedBy: outcome.by, reason: outcome.reason } : {}
-    }));
-  } else (code === table.done ? io.out : io.err)(text);
-  return code;
+function contractPipelines(fc, cloud, env, members, runner, jobs2) {
+  const applyRunner = upRunner(runner);
+  const list = members.length ? [...members] : [void 0];
+  return list.flatMap((member) => {
+    const identity2 = fc.resolveCloudIdentity(cloud, env, member);
+    const name = member ? `${member}/${env}` : env;
+    const forgeEnvironment = jobs2 ? environmentFor(name, jobs2)?.name : void 0;
+    return identity2 ? [{ name, identity: identity2, ...member ? { member } : {}, ...applyRunner ? { applyRunner } : {}, ...forgeEnvironment ? { forgeEnvironment } : {} }] : [];
+  });
 }
-async function runRequest(verb, json, table, io, call) {
-  const ops = await chantStackOps();
-  if (!ops) {
-    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} ${verb}`, "the gated stack operations (chant#4578)")}`);
+async function forgeCheck(args, json, table, io) {
+  if (args[0] !== "check") return usage(`unknown forge command '${args[0] ?? ""}'. Run '${PRODUCT} forge check'.`, table, io);
+  const fc = await chantForgeCheck();
+  if (!fc) {
+    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, error: FORGE_CHECK_MESSAGE }));
+    else io.err(`${PRODUCT}: ${FORGE_CHECK_MESSAGE}`);
     return table.failed;
   }
+  const requireClouds = args.includes("--require-clouds");
+  let rest = args.slice(1).filter((a) => a !== "--require-clouds");
+  const flags = {};
+  for (const flag of ["--file", "--env", "--forge", "--repo", "--branch"]) {
+    const f = takeFlag(rest, flag);
+    if (f.missing) return usage(`${flag} takes a value`, table, io);
+    flags[flag] = f.value;
+    rest = f.rest;
+  }
+  if (rest.length) return usage(`forge check does not take ${rest.join(" ")}`, table, io);
+  const forgeFlag = flags["--forge"];
+  if (forgeFlag !== void 0 && !FORGES2.includes(forgeFlag)) return usage(`--forge is ${forgeFlag}; give github, gitlab or forgejo`, table, io);
+  const path = flags["--file"] ?? findConfig(io.cwd);
+  if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init', or pass --file`, table, io);
+  let config2;
   try {
-    return await call(ops);
+    config2 = loadConfig(path);
   } catch (e) {
-    const message = e.message;
-    if (json) io.out(JSON.stringify({ command: verb, ok: false, exitCode: table.failed, error: message }));
-    else io.err(`${PRODUCT} ${verb}: ${message}`);
+    return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
+  }
+  const errors = checkConfig(config2).filter((p) => p.severity === "error");
+  if (errors.length) {
+    for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
+    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, file: path, problems: errors }));
     return table.failed;
   }
+  const settings = toChantSettings(config2);
+  const kind = forgeFlag ?? settings.pipeline.forge?.kind;
+  let target;
+  try {
+    target = fc.forgeCheckTarget(io.env, { ...kind && FORGES2.includes(kind) ? { kind } : {}, ...flags["--repo"] ? { repo: flags["--repo"] } : {} });
+  } catch (e) {
+    return usage(e.message, table, io);
+  }
+  const env = flags["--env"] ?? "production";
+  const cloud = settings.ci.identity?.cloud;
+  const pipelines = contractPipelines(fc, cloud, env, workspaceMembers(dirname13(path)), settings.pipeline.runner, settings.pipeline.jobs);
+  const result = await fc.forgeCheck(
+    {
+      target,
+      words: PRODUCT_WORDS,
+      file: path,
+      ...requireClouds ? { requireClouds: true } : {},
+      contract: (live) => fc.pipelineContract({
+        forge: target.kind,
+        repository: {
+          host: target.host,
+          path: live.path ?? target.repo,
+          defaultBranch: flags["--branch"] ?? live.defaultBranch ?? "main",
+          ...live.ownerId ? { ownerId: live.ownerId } : {},
+          ...live.repoId ? { repoId: live.repoId } : {}
+        },
+        pipelines,
+        words: PRODUCT_WORDS
+      })
+    },
+    { fetch: globalThis.fetch, env: io.env }
+  );
+  if (json) io.out(JSON.stringify(result));
+  else io.out(fc.describeForgeCheck(result));
+  if (!cloud) io.err(`${PRODUCT} forge check: ${path} sets no identity, so no trust was checked`);
+  else if (pipelines.length === 0) io.err(`${PRODUCT} forge check: no identity rule covers environment ${env}, so no trust was checked`);
+  return fc.forgeCheckExit(result);
 }
-function commonFlags(args) {
-  const by = takeFlag(args, "--by");
-  const dir = takeFlag(by.rest, "--dir");
-  if (by.missing) return { rest: args, missing: "--by" };
-  if (dir.missing) return { rest: args, missing: "--dir" };
-  return { by: by.value, dir: dir.value, rest: dir.rest };
+
+// src/cli.ts
+init_control2();
+
+// src/telemetry.ts
+init_chant_product();
+init_observe();
+init_config();
+init_words();
+function telemetryEnv(doc, env) {
+  const t = telemetryOf(doc);
+  const out = {};
+  const set = (k, v) => {
+    if (v !== void 0 && v !== "" && env[k] === void 0) out[k] = v;
+  };
+  if (!t.traces) {
+    set("OTEL_TRACES_EXPORTER", "none");
+    return out;
+  }
+  if (env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT === void 0) set("OTEL_EXPORTER_OTLP_ENDPOINT", t.endpoint);
+  if (t.headersEnv) set("OTEL_EXPORTER_OTLP_HEADERS", env[t.headersEnv]);
+  if (t.endpoint !== void 0 || env.OTEL_EXPORTER_OTLP_ENDPOINT !== void 0 || env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT !== void 0) set("OTEL_SERVICE_NAME", t.serviceName);
+  return out;
 }
-async function exportStack(args, json, table, io) {
-  const common = commonFlags(args);
-  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
-  const out = takeFlag(common.rest, "--out");
-  if (out.missing) return usage("--out takes a file path outside the repository", table, io);
-  const extra = out.rest.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`export does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(out.rest);
-  if (named.length !== 1) return usage(`export takes one stack: ${STACK_OP_WORDS.usage.export}`, table, io);
-  if (!out.value) return usage(`export needs --out <file>, a path on your machine outside every git working tree: ${STACK_OP_WORDS.usage.export}`, table, io);
-  const read = readConfig(io.cwd);
-  if ("error" in read) return usage(read.error, table, io);
-  const stack = resolveStack(read.config, read.path, named[0], common.dir);
-  if ("error" in stack) return usage(stack.error, table, io);
-  useBackend([stack], io.env);
-  const rules = requestRules(read.config);
-  const outFile = resolve3(io.cwd, out.value);
-  return runRequest("export", json, table, io, async (ops) => {
-    const outcome = await ops.gatedStackExport({
-      by: requesterOf(common.by, io.env),
-      rules,
-      op: STACK_OPS_OP,
-      ledgerCwd: io.cwd,
-      env: io.env,
-      dir: stack.dir,
-      stack: stack.stack,
-      out: outFile,
-      ...stack.engine ? { engine: stack.engine } : {}
-    });
-    return reportOutcome("export", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.exported(stack.key, r), json, table, io);
-  });
+async function applyTelemetry(cwd, env = process.env) {
+  let added = {};
+  try {
+    const file = findConfig(cwd);
+    if (file) added = telemetryEnv(loadConfig(file).doc, env);
+  } catch {
+    return {};
+  }
+  Object.assign(env, added);
+  const chant = await chantProduct();
+  if (chant && typeof chant.configureOtlp === "function") chant.configureOtlp({ prefix: PRODUCT, env });
+  return added;
 }
-async function cancelStack(args, json, table, io) {
-  const common = commonFlags(args);
-  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
-  const lock = takeFlag(common.rest, "--lock");
-  if (lock.missing) return usage("--lock takes the lock id", table, io);
-  const extra = lock.rest.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`cancel does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(lock.rest);
-  if (named.length !== 1) return usage(`cancel takes one stack: ${STACK_OP_WORDS.usage.cancel}`, table, io);
-  const read = readConfig(io.cwd);
-  if ("error" in read) return usage(read.error, table, io);
-  const stack = resolveStack(read.config, read.path, named[0], common.dir);
-  if ("error" in stack) return usage(stack.error, table, io);
-  useBackend([stack], io.env);
-  const lockId = await lockToCancel(lock.value, stack, io.env);
-  if ("error" in lockId) return usage(lockId.error, table, io);
-  if (lockId.read && !json) io.err(`${PRODUCT} cancel: ${stack.key} holds lock ${lockId.lockId}`);
-  const rules = requestRules(read.config);
-  return runRequest("cancel", json, table, io, async (ops) => {
-    const outcome = await ops.gatedStackCancel({
-      by: requesterOf(common.by, io.env),
-      rules,
-      op: STACK_OPS_OP,
-      ledgerCwd: io.cwd,
-      env: io.env,
-      dir: stack.dir,
-      stack: stack.stack,
-      lockId: lockId.lockId,
-      project: stack.project,
-      ...stack.engine ? { engine: stack.engine } : {}
-    });
-    return reportOutcome("cancel", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.cancelled(stack.key, lockId.lockId, r.lockChecked), json, table, io);
-  });
+
+// src/cli.ts
+init_init();
+init_stages();
+init_tips();
+init_images();
+init_up();
+
+// src/upgrade.ts
+init_config();
+init_images();
+init_stages();
+init_words();
+import { execFile } from "node:child_process";
+import { existsSync as existsSync16, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname14, join as join19, relative as relative2, resolve as resolve3 } from "node:path";
+var PLYWOOD_PACKAGE = "@intentius/plywood";
+var CHANT_PACKAGE = "@intentius/chant";
+var CHANT_FAMILY = /^@intentius\/chant(?:-lexicon-[a-z0-9-]+)?$/;
+var VERSION2 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+var DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies"];
+function parseUpgradeArgs(args) {
+  const chant = takeFlag(args, "--chant");
+  const forge = takeFlag(chant.rest, "--forge");
+  const env = takeFlag(forge.rest, "--env");
+  if (chant.missing || forge.missing || env.missing) return { error: "--chant, --forge and --env each take a value" };
+  const flags = /* @__PURE__ */ new Set(["--no-install", "--dry-run"]);
+  const unknown = env.rest.filter((a) => a.startsWith("-") && !flags.has(a));
+  if (unknown.length) return { error: `upgrade does not take ${unknown.join(" ")}` };
+  const words = env.rest.filter((a) => !a.startsWith("-"));
+  if (words.length > 1) return { error: `upgrade takes one version, not ${words.join(" ")}` };
+  const version2 = words[0]?.replace(/^v/, "");
+  if (version2 !== void 0 && !VERSION2.test(version2)) return { error: `${words[0]} is not a version: give it as MAJOR.MINOR.PATCH` };
+  if (chant.value !== void 0 && !VERSION2.test(chant.value)) return { error: `--chant ${chant.value} is not a version: give it as MAJOR.MINOR.PATCH` };
+  return {
+    ...version2 ? { version: version2 } : {},
+    ...chant.value ? { chant: chant.value } : {},
+    ...forge.value ? { forge: forge.value } : {},
+    ...env.value ? { env: env.value } : {},
+    install: !env.rest.includes("--no-install"),
+    dryRun: env.rest.includes("--dry-run")
+  };
 }
-async function moveStack(args, json, table, io) {
-  const onto = takeFlag(args, "--onto");
-  if (onto.missing) return usage("--onto takes plunge", table, io);
-  if (onto.value !== void 0) return moveOntoPlunge(onto.value, onto.rest, json, table, io);
-  const common = commonFlags(onto.rest);
-  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
-  const from = takeFlag(common.rest, "--from");
-  const to = takeFlag(from.rest, "--to");
-  if (from.missing || to.missing) return usage(`${from.missing ? "--from" : "--to"} takes a stack, as project/stack`, table, io);
-  const extra = to.rest.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`move does not take ${extra.join(" ")}`, table, io);
-  if (common.dir !== void 0) return usage("move reads each stack's directory from plywood.yml's stacks, so it does not take --dir", table, io);
-  const urns = positionals(to.rest);
-  if (!from.value || !to.value) return usage(`move needs --from and --to: ${STACK_OP_WORDS.usage.move}`, table, io);
-  if (urns.length === 0) return usage(`move names each resource it moves by URN: ${STACK_OP_WORDS.usage.move}`, table, io);
-  const bad = urns.filter((u) => !u.startsWith("urn:pulumi:"));
-  if (bad.length) return usage(`move takes URNs (urn:pulumi:...), not ${bad.join(", ")}; 'pulumi stack --show-urns' lists them`, table, io);
-  if (from.value === to.value) return usage(`--from and --to are both ${from.value}; a move is between two stacks`, table, io);
-  const read = readConfig(io.cwd);
-  if ("error" in read) return usage(read.error, table, io);
-  const source = resolveStack(read.config, read.path, from.value, void 0);
-  if ("error" in source) return usage(source.error, table, io);
-  const dest = resolveStack(read.config, read.path, to.value, void 0);
-  if ("error" in dest) return usage(dest.error, table, io);
-  const backend = useBackend([source, dest], io.env);
-  if (backend) return usage(backend, table, io);
-  const rules = requestRules(read.config);
-  const destName = destStackName(source, dest, read.config);
-  const engine2 = source.engine ?? dest.engine;
-  return runRequest("move", json, table, io, async (ops) => {
-    const outcome = await ops.gatedStackMove({
-      by: requesterOf(common.by, io.env),
-      rules,
-      op: STACK_OPS_OP,
-      ledgerCwd: io.cwd,
-      env: io.env,
-      source: { member: source.key, dir: source.dir, stack: source.stack },
-      dest: { member: dest.key, dir: dest.dir, stack: destName },
-      urns,
-      ...engine2 ? { engine: engine2 } : {}
-    });
-    return reportOutcome("move", outcome, `move:${source.stack}:${destName}`, rules, (r) => STACK_OP_WORDS.moved(source.key, dest.key, r), json, table, io);
-  });
+function findPlywoodPackage(dir) {
+  let cur = resolve3(dir);
+  for (let depth = 0; depth < 32; depth++) {
+    const file = join19(cur, "package.json");
+    if (existsSync16(file)) {
+      try {
+        const pkg = JSON.parse(readFileSync17(file, "utf8"));
+        if (DEP_FIELDS.some((f) => isObject2(pkg[f]) && typeof pkg[f][PLYWOOD_PACKAGE] === "string")) return file;
+      } catch {
+      }
+    }
+    const up2 = dirname14(cur);
+    if (up2 === cur) return void 0;
+    cur = up2;
+  }
+  return void 0;
 }
-async function moveOntoPlunge(engine2, args, json, table, io) {
-  if (engine2 !== "plunge") return usage(`--onto takes plunge, not '${engine2}'; a move between backends is an export and an import (see '${PRODUCT} export')`, table, io);
-  const extra = args.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`move --onto does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(args);
-  if (named.length > 1) return usage(`move --onto plunge takes at most one stack`, table, io);
-  const read = readConfig(io.cwd);
-  if ("error" in read) return usage(read.error, table, io);
-  const opFile = join19(dirname14(read.path), ADOPT_OP_FILE);
-  if (!existsSync16(opFile)) return usage(STACK_OP_WORDS.noAdoptOp(opFile), table, io);
-  if (named[0]) {
-    const stack = resolveStack(read.config, read.path, named[0], void 0);
-    if ("error" in stack) return usage(stack.error, table, io);
-    if (!json) io.err(STACK_OP_WORDS.adoptAll(stack.key));
+function movedRange(range, version2) {
+  const m = /^([~^]?)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(range.trim());
+  if (!m) return void 0;
+  return `${m[1]}${version2}`;
+}
+function movePackagePins(text, file, plywood, chant) {
+  const pkg = JSON.parse(text);
+  const moves = [];
+  const left = [];
+  for (const field of DEP_FIELDS) {
+    const deps = pkg[field];
+    if (!isObject2(deps)) continue;
+    for (const [name, range] of Object.entries(deps)) {
+      if (typeof range !== "string") continue;
+      const target = name === PLYWOOD_PACKAGE ? plywood : CHANT_FAMILY.test(name) ? chant : void 0;
+      if (target === void 0) continue;
+      const next = movedRange(range, target);
+      if (next === void 0) {
+        left.push(`${field}.${name} is '${range}'; move it to ${target} by hand`);
+        continue;
+      }
+      if (next === range) continue;
+      deps[name] = next;
+      moves.push({ file, name, from: range, to: next });
+    }
   }
-  const argv = ["run", ADOPT_OP, ...json ? ["--json"] : []];
-  return withChant(`${PRODUCT} move --onto plunge`, table, io, async (chant) => {
-    const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
-    if (code === table.waiting && !json) io.err(STACK_OP_WORDS.adoptWaiting);
-    return code === table.waiting ? code : explainRefusal(code, table, io.err);
-  });
+  return { text: moves.length ? jsonText2(pkg, text) : text, moves, left };
 }
-async function rollbackStack(args, json, table, io) {
-  const release2 = takeFlag(args, "--release");
-  const env = takeFlag(release2.rest, "--env");
-  const digest = takeFlag(env.rest, "--digest");
-  const actor = takeFlag(digest.rest, "--actor");
-  for (const [flag, f] of [["--release", release2], ["--env", env], ["--digest", digest], ["--actor", actor]]) {
-    if (f.missing) return usage(`${flag} takes a value`, table, io);
+function moveDeclarationPins(text, file, chant) {
+  const doc = JSON.parse(text);
+  const moves = [];
+  const pins = Array.isArray(doc.pins) ? doc.pins : [];
+  for (const pin of pins) {
+    if (typeof pin.package !== "string" || !CHANT_FAMILY.test(pin.package) || typeof pin.version !== "string") continue;
+    if (pin.version === chant) continue;
+    moves.push({ file, name: pin.package, from: pin.version, to: chant });
+    pin.version = chant;
   }
-  const switches = actor.rest.filter((a) => a === "--dry-run" || a === "--events-json");
-  const rest = actor.rest.filter((a) => !switches.includes(a));
-  const extra = rest.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`rollback does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(rest);
-  if (named.length > 1) return usage(`rollback takes one stack: ${STACK_OP_WORDS.usage.rollback}`, table, io);
-  let argv;
-  if (release2.value !== void 0) {
-    if (named.length) return usage(STACK_OP_WORDS.releaseIsEnvWide(named[0], environmentOf(named[0])), table, io);
-    if (digest.value !== void 0) return usage("--release takes no --digest: the release names what each stack goes back to", table, io);
-    if (!env.value) return usage(`rollback --release needs --env <env>, the environment whose stacks go back: ${STACK_OP_WORDS.usage.rollback}`, table, io);
-    argv = ["components", "rollback", env.value, "--release", release2.value];
-  } else {
-    if (named.length !== 1) return usage(`rollback takes a stack, or --release <name> --env <env>: ${STACK_OP_WORDS.usage.rollback}`, table, io);
-    const read = readConfig(io.cwd);
-    if ("error" in read) return usage(read.error, table, io);
-    const stack = resolveStack(read.config, read.path, named[0], void 0);
-    if ("error" in stack) return usage(stack.error, table, io);
-    argv = ["components", "rollback", env.value ?? environmentOf(stack.stack), "--component", slug(stack.key), ...digest.value ? ["--digest", digest.value] : []];
+  return { text: moves.length ? jsonText2(doc, text) : text, moves };
+}
+function imageNote(doc, version2) {
+  const image = doc.image;
+  const name = typeof image === "string" ? image : isObject2(image) && typeof image.name === "string" ? image.name : void 0;
+  if (name === void 0) return void 0;
+  const m = new RegExp(`^${REGISTRY.replace(/[.]/g, "\\.")}/plywood-(pulumi|plunge):([^@]+)`).exec(name);
+  if (m && m[2].startsWith(`${version2}-`)) return void 0;
+  if (m) return `plywood.yml's image is plywood's ${m[1]} image at ${m[2]}; name the ${version2} image in it (its tag starts ${version2}-), or drop the key to take the release's own`;
+  return `plywood.yml's image is your own (${name}); rebuild it FROM plywood's ${version2} image and name the new digest in it`;
+}
+async function viewRelease(exec, cwd, env, version2) {
+  const spec = `${PLYWOOD_PACKAGE}@${version2 ?? "latest"}`;
+  const r = await exec("npm", ["view", spec, "version", "dependencies", "--json"], { cwd, env });
+  if (r.code !== 0) {
+    const notFound = /E404/.test(r.stderr + r.stdout);
+    return { error: notFound ? `npm has no ${spec}` : `npm view ${spec} failed: ${(r.stderr || r.stdout).trim().split("\n")[0] ?? ""}` };
   }
-  argv.push(...actor.value ? ["--actor", actor.value] : [], ...switches, ...json ? ["--json"] : []);
-  if (!await chantStackRollback()) {
-    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} rollback`, "rollback by release for stacks (chant#4542)")}`);
+  let parsed;
+  try {
+    parsed = JSON.parse(r.stdout);
+  } catch {
+    return { error: `npm view ${spec} printed no JSON` };
+  }
+  const doc = Array.isArray(parsed) ? parsed[parsed.length - 1] : parsed;
+  if (!isObject2(doc) || typeof doc.version !== "string") return { error: `npm view ${spec} named no version` };
+  const deps = isObject2(doc.dependencies) ? doc.dependencies : {};
+  const chant = deps[CHANT_PACKAGE];
+  if (typeof chant !== "string" || !VERSION2.test(chant)) return { error: `${PLYWOOD_PACKAGE}@${doc.version} pins no exact ${CHANT_PACKAGE}` };
+  return { version: doc.version, chant };
+}
+async function upgrade(args, json, table, io) {
+  const opts = parseUpgradeArgs(args);
+  const fail = (message) => {
+    if (json) io.out(JSON.stringify({ command: "upgrade", ok: false, exitCode: table.failed, error: message }));
+    else io.err(`${PRODUCT}: ${message}`);
     return table.failed;
+  };
+  if ("error" in opts) return fail(opts.error);
+  const exec = io.exec ?? execChild;
+  const pkgFile = findPlywoodPackage(io.cwd);
+  if (!pkgFile) return fail(`no package.json in ${io.cwd} or above it depends on ${PLYWOOD_PACKAGE}; install it with 'npm i -D ${PLYWOOD_PACKAGE}', then run '${PRODUCT} init'`);
+  const pkgDir = dirname14(pkgFile);
+  const configFile = findConfig(io.cwd);
+  const configDir = configFile ? dirname14(configFile) : pkgDir;
+  const rel = (f) => relative2(io.cwd, f) || f;
+  const release2 = await viewRelease(exec, pkgDir, io.env, opts.version);
+  if ("error" in release2) return fail(release2.error);
+  const chant = opts.chant ?? release2.chant;
+  const pkgText = readFileSync17(pkgFile, "utf8");
+  const pkgMove = movePackagePins(pkgText, rel(pkgFile), release2.version, chant);
+  const declFile = join19(configDir, "chant.workspace.json");
+  const declText = existsSync16(declFile) ? readFileSync17(declFile, "utf8") : void 0;
+  let declMove;
+  if (declText !== void 0) {
+    try {
+      declMove = moveDeclarationPins(declText, rel(declFile), chant);
+    } catch (e) {
+      return fail(`${rel(declFile)} is not JSON upgrade can move pins in (${e.message})`);
+    }
   }
-  return withChant(`${PRODUCT} rollback`, table, io, async (chant) => {
-    const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
-    if (code === table.waiting && !json) io.err(STACK_OP_WORDS.rollbackWaiting);
-    return code === table.waiting ? code : explainRefusal(code, table, io.err);
-  });
+  const notes = [...pkgMove.left];
+  if (existsSync16(join19(configDir, "chant.workspace.jsonc"))) notes.push(`chant.workspace.jsonc is yours: move its @intentius/chant* pins to ${chant} by hand`);
+  if (configFile) {
+    try {
+      const note = imageNote(loadConfig(configFile).doc, release2.version);
+      if (note) notes.push(note);
+    } catch {
+    }
+  } else {
+    notes.push(`no plywood.yml, so there is no workflow to write again; run '${PRODUCT} init' after the install`);
+  }
+  const moves = [...pkgMove.moves, ...declMove?.moves ?? []];
+  const ciArgs = ["--no-install", PRODUCT, "ci", ...opts.forge ? ["--forge", opts.forge] : [], ...opts.env ? ["--env", opts.env] : []];
+  const steps = {
+    install: { cwd: rel(pkgDir) || ".", command: "npm install --no-audit --no-fund" },
+    ci: { cwd: rel(configDir) || ".", command: `npx ${ciArgs.join(" ")}` }
+  };
+  const envelope = { command: "upgrade", plywood: release2.version, chant, moves, notes, dryRun: opts.dryRun };
+  const say = (line) => {
+    if (!json) io.err(line);
+  };
+  say(`${PRODUCT} upgrade: ${PLYWOOD_PACKAGE} ${release2.version}, ${CHANT_PACKAGE} ${chant}`);
+  for (const m of moves) say(`  ${m.file}  ${m.name}  ${m.from} -> ${m.to}`);
+  if (moves.length === 0) say("  every pin is already there");
+  if (opts.dryRun) {
+    say(`  then: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
+    for (const n of notes) say(`  note: ${n}`);
+    if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, steps }));
+    return table.done;
+  }
+  if (pkgMove.text !== pkgText) writeFileSync9(pkgFile, pkgMove.text);
+  if (declMove && declText !== void 0 && declMove.text !== declText) writeFileSync9(declFile, declMove.text);
+  const files = [...new Set(moves.map((m) => m.file))];
+  if (!opts.install) {
+    say(`  left to run: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
+    for (const n of notes) say(`  note: ${n}`);
+    if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, files, steps }));
+    return table.done;
+  }
+  say(`  $ ${steps.install.command}`);
+  const installed2 = await exec("npm", ["install", "--no-audit", "--no-fund"], { cwd: pkgDir, env: io.env });
+  if (installed2.code !== 0) {
+    for (const n of notes) say(`  note: ${n}`);
+    return fail(`npm install failed (exit ${installed2.code}); package.json is moved, so fix the install and run '${steps.ci.command}'
+${installed2.stderr.trim()}`);
+  }
+  const got = installedVersion(pkgDir);
+  if (got !== void 0 && got !== release2.version) notes.push(`node_modules holds ${PLYWOOD_PACKAGE} ${got}, not ${release2.version}; check the install`);
+  let ci2;
+  if (configFile) {
+    say(`  $ ${steps.ci.command}`);
+    ci2 = await exec("npx", ciArgs, { cwd: configDir, env: io.env });
+    if (!json && ci2.stderr.trim()) io.err(ci2.stderr.trimEnd());
+  }
+  for (const n of notes) say(`  note: ${n}`);
+  const ok = ci2 === void 0 || ci2.code === 0;
+  const lockFile = join19(pkgDir, "package-lock.json");
+  const changed = [...files, ...existsSync16(lockFile) ? [rel(lockFile)] : []];
+  if (ok) say(`  Open one pull request with ${changed.join(", ")} and the files ${PRODUCT} ci wrote.`);
+  else say(`  ${PRODUCT} ci failed (exit ${ci2?.code}); the pins are moved and installed, so fix plywood.yml and run '${steps.ci.command}'`);
+  const code = ok ? table.done : ci2?.code ?? table.failed;
+  if (json) io.out(JSON.stringify({ ...envelope, ok, exitCode: code, files: changed, ...ci2 ? { ci: { exitCode: ci2.code } } : {} }));
+  return code;
+}
+function installedVersion(dir) {
+  try {
+    const pkg = JSON.parse(readFileSync17(join19(dir, "node_modules", PLYWOOD_PACKAGE, "package.json"), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function jsonText2(value, original) {
+  const indent = /^[{[]\r?\n([ \t]+)/.exec(original)?.[1] ?? "  ";
+  return `${JSON.stringify(value, null, indent)}
+`;
+}
+function isObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
 }
+var execChild = (bin, args, opts) => new Promise((done) => {
+  execFile(bin, args, { cwd: opts.cwd, env: opts.env, maxBuffer: 64 * 1024 * 1024, shell: process.platform === "win32" }, (error2, stdout, stderr) => {
+    const code = error2 ? typeof error2.code === "number" ? error2.code : 1 : 0;
+    done({ code, stdout: String(stdout), stderr: String(stderr) });
+  });
+});
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.0.0" : "0.0.0-dev";
+var VERSION3 = true ? "0.2.0" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")
@@ -7605,6 +7855,7 @@ function helpText() {
     "  move <stack> --onto plunge                          adopt the stacks onto plunge (plywood.adopt.op.ts)",
     "  rollback <stack> [--digest <d>] | --release <name> --env <env>",
     "                                                      preview a release's program, then update behind its gate",
+    "  action <stack> <name> [--anew]                      run an action plywood.yml declares: replace its command resource",
     "",
     "Ledger:",
     "  audit [approvals|updates|runs|review-stacks] [--stack <s>] [--since <t>] [--where <f>=<v>]...",
@@ -7625,7 +7876,8 @@ function helpText() {
     "  control dispatch [--sha <sha>]                      tell plywood.yml's control repo this commit applied",
     "",
     "Agents:",
-    "  mcp [--report-url <url>]                            chant's read-only MCP server over stdio, with plywood's read tools",
+    "  mcp [--report-url <url>] [--propose]                chant's read-only MCP server over stdio, with plywood's read tools;",
+    "                                                      --propose adds request_from_template, which refuses until Pulumi templates exist",
     "  guard check <command line>                          whether the agent guard refuses a command",
     "  guard install [--dir <d>]                           the Claude Code hook and the pulumi and plunge wrappers",
     "",
@@ -7686,6 +7938,7 @@ async function main(argv, io = stdio) {
   if (verb === "cancel") return cancelStack(args.slice(1), json, table, stageIo);
   if (verb === "move") return moveStack(args.slice(1), json, table, stageIo);
   if (verb === "rollback") return rollbackStack(args.slice(1), json, table, stageIo);
+  if (verb === "action") return action(args.slice(1), json, table, stageIo);
   if (verb === "drift") return drift2(args.slice(1), json, table, stageIo);
   if (verb === "mcp") return mcp(args.slice(1), json, table, stageIo);
   if (verb === "guard") return guard(args.slice(1), json, table, stageIo);
@@ -7750,5 +8003,6 @@ function config(args, table, emit) {
 }
 
 // src/bin.ts
+installChantResolution();
 process.exitCode = await main(process.argv.slice(2));
 //# sourceMappingURL=plywood.mjs.map