@intentius/plywood 0.1.0 → 0.2.0

package/dist/plywood.mjs

@@ -380,7 +380,7 @@ var init_chant_keys = __esm({
 
 // src/words.ts
 function wordsForJobs(jobs2) {
-  const commands = Object.fromEntries(Object.entries(PRODUCT_WORDS.commands).filter(([, c]) => jobs2.includes(c)));
+  const commands = Object.fromEntries(Object.entries({ ...PRODUCT_WORDS.commands, ...ACTION_COMMAND }).filter(([, c]) => jobs2.includes(c)));
   return { ...PRODUCT_WORDS, commands };
 }
 function driftOpName(stack) {
@@ -417,7 +417,7 @@ function driftIssueBody(input) {
 function driftClearedComment(stack, observedAt2) {
   return `plywood's drift check at ${observedAt2} found ${stack} matching its state, so this issue is closed.`;
 }
-var PRODUCT, TAGLINE, OP_NAME, PR_GATE, VERBS, BIN, NOTIFY_WORDS, PRODUCT_WORDS, POLICY_RULE_FORMS, CLOUD_NAMES, NO_IDENTITY, STACK_OP_WORDS, DRIFT_OP_PREFIX, LOCK_GRAIN_WORDS, PLUNGE_TIMING_ATTRIBUTES;
+var PRODUCT, TAGLINE, OP_NAME, PR_GATE, VERBS, BIN, NOTIFY_WORDS, PRODUCT_WORDS, ACTION_COMMAND, POLICY_RULE_FORMS, CLOUD_NAMES, NO_IDENTITY, TEMPLATE_REQUEST_WORDS, STACK_OP_WORDS, DRIFT_OP_PREFIX, LOCK_GRAIN_WORDS, PLUNGE_TIMING_ATTRIBUTES;
 var init_words = __esm({
   "src/words.ts"() {
     "use strict";
@@ -450,18 +450,27 @@ var init_words = __esm({
       bin: BIN,
       notify: NOTIFY_WORDS
     });
+    ACTION_COMMAND = Object.freeze({ action: "action" });
     POLICY_RULE_FORMS = "a CrossGuard rule is crossguard.<pack>.<policy>, a Rego rule <package>.<rule>";
     CLOUD_NAMES = { aws: "AWS", gcp: "GCP", azure: "Azure", pulumi: "Pulumi Cloud" };
     NO_IDENTITY = "the job's own credentials (no OIDC trade)";
+    TEMPLATE_REQUEST_WORDS = {
+      tool: "request_from_template",
+      refusal: "Pulumi templates are not available yet: request_from_template opens a pull request for an app from a template once plywood has a template registry and catalog, and the plywood request command that opens the same pull request for a person. Until then it refuses every call and opens nothing. To change a stack now, open a pull request with the change."
+    };
     STACK_OP_WORDS = {
       usage: {
         export: `${PRODUCT} export <project/stack> --out <file>`,
         cancel: `${PRODUCT} cancel <project/stack> [--lock <id>]`,
         move: `${PRODUCT} move <urn>... --from <project/stack> --to <project/stack>, or ${PRODUCT} move <project/stack> --onto plunge`,
-        rollback: `${PRODUCT} rollback <project/stack> [--digest <sha256:...>], or ${PRODUCT} rollback --release <name> --env <env>`
+        rollback: `${PRODUCT} rollback <project/stack> [--digest <sha256:...>], or ${PRODUCT} rollback --release <name> --env <env>`,
+        action: `${PRODUCT} action <project/stack> <name> [--anew], or ${PRODUCT} action --from-event`
       },
       waiting: (verb, approve2) => `The ${verb} waits for a second person's approval, and your own does not count. They run '${approve2}', then you run this command again to carry it out.`,
-      spent: (verb) => `This ${verb} ran once already under its approval, and a request runs once. Run the command again to ask for a new one.`,
+      spent: (verb) => verb === "action" ? "This action ran once already under its approval, and a request runs once. Run the command again with --anew to ask for a new run." : `This ${verb} ran once already under its approval, and a request runs once. Run the command again to ask for a new one.`,
+      acted: (stack, name, r) => `Ran action ${name} on ${stack}: ${r.engine} replaced ${r.urn}.${r.tail ? `
+${r.tail}` : ""}`,
+      noAction: (stack, name, declared) => declared.length ? `${stack} has no action ${name} in plywood.yml; its actions are ${declared.join(", ")}` : `${stack} declares no actions in plywood.yml; add one under stacks.${stack}.actions with a name and the URN of a command resource`,
       exported: (stack, r) => `Exported ${stack} to ${r.file} (${r.resources} resources, ${r.bytes} bytes, sha256 ${r.sha256}). The file is readable by you alone; the ledger keeps its digest and size, never its content.`,
       cancelled: (stack, lock, checked) => `Released lock ${lock} on ${stack}.${checked ? "" : " The backend's lock could not be read, so it was not checked against the approved one first."}`,
       moved: (from, to, r) => `Moved ${r.moved.length} resource${r.moved.length === 1 ? "" : "s"} from ${from} to ${to} on ${r.engine}. Both stacks preview no change.`,
@@ -578,13 +587,13 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.1.0";
+    version = "0.2.0";
     dependencies = {
-      "@intentius/chant": "0.124.57",
-      "@intentius/chant-lexicon-forgejo": "0.124.57",
-      "@intentius/chant-lexicon-github": "0.124.57",
-      "@intentius/chant-lexicon-gitlab": "0.124.57",
-      "@intentius/chant-lexicon-pulumi": "0.124.57"
+      "@intentius/chant": "0.124.58",
+      "@intentius/chant-lexicon-forgejo": "0.124.58",
+      "@intentius/chant-lexicon-github": "0.124.58",
+      "@intentius/chant-lexicon-gitlab": "0.124.58",
+      "@intentius/chant-lexicon-pulumi": "0.124.58"
     };
   }
 });
@@ -594,8 +603,8 @@ var image_digests_default;
 var init_image_digests = __esm({
   "src/image-digests.json"() {
     image_digests_default = {
-      "ghcr.io/intentius/plywood-pulumi:0.1.0-pulumi3.272.0": "sha256:730237bed59e0054e6839898658069a4bcbdab0ffb8f893487c864bc2f3436c8",
-      "ghcr.io/intentius/plywood-plunge:0.1.0-plunge0.1.0": "sha256:76a50f55cc2fd96c19e4ecb625a19863783374c9dc89d1606cc70a36635cc48d"
+      "ghcr.io/intentius/plywood-pulumi:0.2.0-pulumi3.272.0": "sha256:ea268f1dd2fa15f80ddcedd5c3498d24b79cc2b8a590177c5499e2db3f686f18",
+      "ghcr.io/intentius/plywood-plunge:0.2.0-plunge0.1.0": "sha256:6a862ad23e39081a32fe8b2331b095ed2de44e527f2719416201b0affa46a1eb"
     };
   }
 });
@@ -923,12 +932,58 @@ var init_images2 = __esm({
 });
 
 // src/config/stacks.ts
+function parseUrn(urn) {
+  if (!urn.startsWith("urn:pulumi:")) return void 0;
+  const parts = urn.slice("urn:pulumi:".length).split("::");
+  if (parts.length < 4 || parts.slice(0, 4).some((p) => p === "")) return void 0;
+  return { stack: parts[0], project: parts[1], type: parts[2].split("$").at(-1) };
+}
+function actionUrnProblem(stackKey, urn) {
+  const parsed = parseUrn(urn);
+  if (!parsed) return `is not a resource URN (urn:pulumi:<stack>::<project>::<type>::<name>)`;
+  const stack = stackKey.split("/").at(-1);
+  if (parsed.stack !== stack) return `names stack ${parsed.stack}, and the action is under ${stackKey}`;
+  if (!parsed.type.startsWith(ACTION_TYPE_PREFIX)) {
+    return `is a ${parsed.type}, and an action is a command resource (command:local:Command or command:remote:Command), whose replacement runs it`;
+  }
+  return void 0;
+}
+function actionsOf(doc, key) {
+  const a = stacksOf(doc)[key]?.actions;
+  return Array.isArray(a) ? a : [];
+}
+function hasActions(doc) {
+  return Object.keys(stacksOf(doc)).some((k) => actionsOf(doc, k).length > 0);
+}
 function wavesMappingOf(doc) {
   return isObject(doc.waves) ? doc.waves : {};
 }
 function stacksOf(doc) {
   return isObject(doc.stacks) ? doc.stacks : {};
 }
+function actionProblems(stackKey, actions, key) {
+  if (!Array.isArray(actions)) return [error(key, "must be a list of actions, each with a name and a urn")];
+  const out = [];
+  const seen = /* @__PURE__ */ new Map();
+  actions.forEach((a, i) => {
+    const at = `${key}[${i}]`;
+    if (!isObject(a)) {
+      out.push(error(at, "must be a mapping with a name and a urn"));
+      return;
+    }
+    out.push(...onlyKeys(a, ACTION_KEYS, at));
+    if (typeof a.name !== "string" || !ACTION_NAME.test(a.name)) out.push(error(`${at}.name`, "must be a name of letters, digits, _, . and -"));
+    else if (seen.has(a.name)) out.push(error(`${at}.name`, `${a.name} is the name of actions[${seen.get(a.name)}] too; each action's name is unique in its stack`));
+    else seen.set(a.name, i);
+    if (typeof a.urn !== "string") out.push(error(`${at}.urn`, "must be the URN of a command resource in the stack"));
+    else {
+      const problem = actionUrnProblem(stackKey, a.urn);
+      if (problem) out.push(error(`${at}.urn`, `${a.urn} ${problem}`));
+    }
+    if (a.description !== void 0 && typeof a.description !== "string") out.push(error(`${at}.description`, "must be a string"));
+  });
+  return out;
+}
 function wavesMappingProblems(w, listed) {
   const out = [...onlyKeys(w, WAVES_KEYS, "waves")];
   const known = (s, key) => {
@@ -982,15 +1037,18 @@ function afterCycle(after) {
   }
   return void 0;
 }
-var STACK_KEYS, WAVES_KEYS, STACK_NAME, stacks;
+var STACK_KEYS, ACTION_KEYS, WAVES_KEYS, STACK_NAME, ACTION_NAME, ACTION_TYPE_PREFIX, stacks;
 var init_stacks = __esm({
   "src/config/stacks.ts"() {
     "use strict";
     init_approval();
     init_types();
-    STACK_KEYS = ["dir", "paths", "gate", "backend"];
+    STACK_KEYS = ["dir", "paths", "gate", "backend", "actions"];
+    ACTION_KEYS = ["name", "urn", "description"];
     WAVES_KEYS = ["canary", "after"];
     STACK_NAME = /^[^/\s]+\/[^/\s]+$/;
+    ACTION_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,99}$/;
+    ACTION_TYPE_PREFIX = "command:";
     stacks = {
       name: "stacks",
       keys: ["stacks", "waves"],
@@ -1006,7 +1064,21 @@ var init_stacks = __esm({
               dir: { type: "string", description: "The directory holding the stack's Pulumi.yaml." },
               paths: { type: "array", items: { type: "string" }, description: "Paths whose change previews the stack, beside its directory." },
               gate: { type: "string", enum: ["always", "on-destructive", "never"], description: "The stack's gate, in place of the top-level gate." },
-              backend: BACKEND_SCHEMA
+              backend: BACKEND_SCHEMA,
+              actions: {
+                type: "array",
+                description: "The stack's day-2 actions, each run by plywood action <stack> <name> under a second person's approval.",
+                items: {
+                  type: "object",
+                  additionalProperties: false,
+                  required: ["name", "urn"],
+                  properties: {
+                    name: { type: "string", pattern: ACTION_NAME.source, description: "The action's name, unique in the stack." },
+                    urn: { type: "string", pattern: "^urn:pulumi:", description: "The URN of a command:local:Command or command:remote:Command resource in the stack, replaced to run the action." },
+                    description: { type: "string", description: "What the action does, for people and agents." }
+                  }
+                }
+              }
             }
           }
         },
@@ -1044,6 +1116,7 @@ var init_stacks = __esm({
           if (s.dir !== void 0 && typeof s.dir !== "string") out.push(error(`${key}.dir`, "must be a string"));
           if (s.backend !== void 0 && typeof s.backend !== "string") out.push(error(`${key}.backend`, "must be a URL string"));
           out.push(...stringList(s.paths, `${key}.paths`), ...oneOf(s.gate, GATES, `${key}.gate`));
+          if (s.actions !== void 0) out.push(...actionProblems(name, s.actions, `${key}.actions`));
         }
         if (isObject(doc.waves)) {
           out.push(...wavesMappingProblems(doc.waves, isObject(doc.stacks) ? listed : void 0));
@@ -2354,227 +2427,6 @@ var init_config_check = __esm({
   }
 });
 
-// src/init/detect.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
-import { basename, dirname as dirname2, join as join2, relative, sep } from "node:path";
-import { parseYAML as parseYAML2 } from "@intentius/chant/yaml";
-function repoRoot(dir) {
-  let cur = dir;
-  for (let i = 0; i < 64; i++) {
-    if (existsSync2(join2(cur, ".git"))) return cur;
-    const parent = dirname2(cur);
-    if (parent === cur) return dir;
-    cur = parent;
-  }
-  return dir;
-}
-function posixRel(root, path) {
-  const rel = relative(root, path);
-  return rel === "" ? "." : rel.split(sep).join("/");
-}
-function readYamlFile(file) {
-  try {
-    const doc = parseYAML2(readFileSync2(file, "utf8"));
-    return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function findPulumiProjects(root) {
-  const out = [];
-  const walk = (dir, depth) => {
-    let entries;
-    try {
-      entries = readdirSync(dir).sort();
-    } catch {
-      return;
-    }
-    const file = ["Pulumi.yaml", "Pulumi.yml"].find((n) => entries.includes(n));
-    if (file) {
-      const project = readProject(root, dir, join2(dir, file));
-      if (project) out.push(project);
-    }
-    if (depth >= MAX_DEPTH) return;
-    for (const name of entries) {
-      if (SKIP.has(name) || name.startsWith(".")) continue;
-      const path = join2(dir, name);
-      try {
-        if (statSync(path).isDirectory()) walk(path, depth + 1);
-      } catch {
-      }
-    }
-  };
-  walk(root, 0);
-  return out;
-}
-function readProject(root, dir, file) {
-  const doc = readYamlFile(file);
-  if (!doc || typeof doc.name !== "string" || doc.name === "") return void 0;
-  const runtime = typeof doc.runtime === "string" ? doc.runtime : doc.runtime?.name;
-  const backend = doc.backend;
-  const configDir = typeof doc.stackConfigDir === "string" ? join2(dir, doc.stackConfigDir) : dir;
-  return {
-    name: doc.name,
-    dir: posixRel(root, dir),
-    ...typeof runtime === "string" ? { runtime } : {},
-    ...backend && typeof backend.url === "string" ? { backendUrl: backend.url } : {},
-    stacks: stackNames(configDir)
-  };
-}
-function stackNames(configDir) {
-  let entries;
-  try {
-    entries = readdirSync(configDir);
-  } catch {
-    return [];
-  }
-  const names = entries.map((n) => /^Pulumi\.(.+)\.ya?ml$/.exec(n)?.[1]).filter((s) => s !== void 0 && s !== "");
-  return [...new Set(names)].sort(byEnvironment);
-}
-function environmentOf(stack) {
-  const last = stack.split("/").pop().toLowerCase();
-  const head = last.split(/[-_.]/)[0];
-  return ENV_ORDER.includes(head) ? head : last;
-}
-function rank(stack) {
-  const env = environmentOf(stack);
-  const at = ENV_ORDER.indexOf(env);
-  return at >= 0 ? at : PROD_RANK - 0.5;
-}
-function byEnvironment(a, b) {
-  return rank(a) - rank(b) || a.localeCompare(b);
-}
-function stacksOf2(projects) {
-  const names = /* @__PURE__ */ new Map();
-  for (const p of projects) names.set(p.name, (names.get(p.name) ?? 0) + 1);
-  const out = [];
-  for (const p of projects) {
-    const project = (names.get(p.name) ?? 0) > 1 ? `${p.name}-${slug(p.dir)}` : p.name;
-    for (const stack of p.stacks) out.push({ key: `${project}/${stack}`, project: p.name, stack, dir: p.dir });
-  }
-  return out.sort((x, y) => byEnvironment(x.stack, y.stack) || x.key.localeCompare(y.key));
-}
-function slug(s) {
-  const out = s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return out === "" ? "root" : out;
-}
-function originUrl(root) {
-  const config2 = gitFile(root, "config");
-  if (!config2) return void 0;
-  let inOrigin = false;
-  for (const raw of config2.split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line.startsWith("[")) {
-      inOrigin = /^\[remote\s+"origin"\]$/.test(line);
-      continue;
-    }
-    const m = inOrigin ? /^url\s*=\s*(.+)$/.exec(line) : null;
-    if (m) return m[1].trim();
-  }
-  return void 0;
-}
-function gitFile(root, name) {
-  const dotGit = join2(root, ".git");
-  let gitDir = dotGit;
-  try {
-    if (statSync(dotGit).isFile()) {
-      const m = /^gitdir:\s*(.+)$/m.exec(readFileSync2(dotGit, "utf8"));
-      if (!m) return void 0;
-      gitDir = join2(root, m[1].trim());
-      const common = join2(gitDir, "commondir");
-      if (existsSync2(common) && !existsSync2(join2(gitDir, name))) gitDir = join2(gitDir, readFileSync2(common, "utf8").trim());
-    }
-    const path = join2(gitDir, name);
-    return existsSync2(path) ? readFileSync2(path, "utf8") : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function remoteHost(url) {
-  const scp = /^[^@/\s]+@([^:/\s]+):/.exec(url);
-  if (scp) return scp[1].toLowerCase();
-  try {
-    return new URL(url).hostname.toLowerCase() || void 0;
-  } catch {
-    return void 0;
-  }
-}
-function forgeOfRemote(url) {
-  const host = remoteHost(url);
-  if (!host) return void 0;
-  if (host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.")) return { kind: "github", because: `origin is on ${host}` };
-  if (host === "gitlab.com") return { kind: "gitlab", because: `origin is on ${host}` };
-  if (host === "codeberg.org") return { kind: "forgejo", because: `origin is on ${host}` };
-  if (/(^|[.-])gitlab([.-]|$)/.test(host)) return { kind: "gitlab", because: `origin is on ${host}`, url: `https://${host}` };
-  if (/(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return { kind: "forgejo", because: `origin is on ${host}`, url: `https://${host}` };
-  return void 0;
-}
-function detectForge(root) {
-  const url = originUrl(root);
-  const byRemote = url ? forgeOfRemote(url) : void 0;
-  if (byRemote) return byRemote;
-  if (existsSync2(join2(root, ".forgejo"))) return { kind: "forgejo", because: "the repository has .forgejo/" };
-  if (existsSync2(join2(root, ".gitlab-ci.yml"))) return { kind: "gitlab", because: "the repository has .gitlab-ci.yml" };
-  if (existsSync2(join2(root, ".github", "workflows"))) return { kind: "github", because: "the repository has .github/workflows/" };
-  return void 0;
-}
-function defaultBranch(root) {
-  const head = gitFile(root, "refs/remotes/origin/HEAD");
-  const remote = head && /ref:\s*refs\/remotes\/origin\/(.+)/.exec(head)?.[1];
-  if (remote) return remote.trim();
-  const local = gitFile(root, "HEAD");
-  const branch = local && /ref:\s*refs\/heads\/(.+)/.exec(local)?.[1];
-  return branch ? branch.trim() : "main";
-}
-function findPulumiActions(root) {
-  const out = [];
-  for (const d of WORKFLOW_DIRS) {
-    let names;
-    try {
-      names = readdirSync(join2(root, d)).sort();
-    } catch {
-      continue;
-    }
-    for (const n of names) {
-      if (!/\.ya?ml$/.test(n)) continue;
-      try {
-        if (/uses:\s*["']?pulumi\/actions@/.test(readFileSync2(join2(root, d, n), "utf8"))) out.push(`${d}/${n}`);
-      } catch {
-      }
-    }
-  }
-  return out;
-}
-function detect(cwd) {
-  const root = repoRoot(cwd);
-  const projects = findPulumiProjects(root);
-  const forge = detectForge(root);
-  const preCommit = [".pre-commit-config.yaml", ".pre-commit-config.yml"].find((n) => existsSync2(join2(root, n)));
-  return {
-    root,
-    projects,
-    stacks: stacksOf2(projects),
-    ...forge ? { forge } : {},
-    defaultBranch: defaultBranch(root),
-    pulumiActions: findPulumiActions(root),
-    ...preCommit ? { preCommit } : {}
-  };
-}
-function repoName(root) {
-  return slug(basename(root)).slice(0, 40).replace(/-+$/, "") || "plywood";
-}
-var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
-var init_detect = __esm({
-  "src/init/detect.ts"() {
-    "use strict";
-    SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
-    MAX_DEPTH = 8;
-    ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
-    PROD_RANK = ENV_ORDER.indexOf("prod");
-    WORKFLOW_DIRS = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
-  }
-});
-
 // src/chant-product.ts
 function hasChant4620(chant) {
   return typeof chant.prCommentPreviewJob === "function" && typeof chant.PR_PREVIEW_FLOOR === "string";
@@ -2606,7 +2458,7 @@ var init_chant_product = __esm({
   "src/chant-product.ts"() {
     "use strict";
     REQUIRED2 = ["assertProductWords", "productPipelineJobs", "approveLine", "runChantInProcess"];
-    BUILT_CHANT = true ? "0.124.57" : "unknown";
+    BUILT_CHANT = true ? "0.124.58" : "unknown";
   }
 });
 
@@ -2780,18 +2632,18 @@ var init_note_control = __esm({
 });
 
 // src/init/workflow.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
-import { dirname as dirname3, isAbsolute, join as join3 } from "node:path";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { dirname as dirname2, isAbsolute, join as join2 } from "node:path";
 async function writeWorkflow(chant, input) {
-  const file = isAbsolute(input.output) ? input.output : join3(input.root, input.output);
-  const previous = existsSync3(file) ? readFileSync3(file, "utf8") : void 0;
-  mkdirSync(dirname3(file), { recursive: true });
+  const file = isAbsolute(input.output) ? input.output : join2(input.root, input.output);
+  const previous = existsSync2(file) ? readFileSync2(file, "utf8") : void 0;
+  mkdirSync(dirname2(file), { recursive: true });
   const code = await chant.runChantInProcess([...input.argv, "--output", file], input.words);
-  if (code !== 0 || !existsSync3(file)) {
+  if (code !== 0 || !existsSync2(file)) {
     if (previous !== void 0) writeFileSync(file, previous);
     return { code: code !== 0 ? code : 1, file, status: "failed", kept: [] };
   }
-  const generated = withNoteControl(readFileSync3(file, "utf8"), input.forge, input.noteControl);
+  const generated = withNoteControl(readFileSync2(file, "utf8"), input.forge, input.noteControl);
   const { text, kept } = keepOwnJobs(previous, generated, input.forge);
   writeFileSync(file, text);
   return { code, file, status: text === previous ? "unchanged" : "written", kept };
@@ -2833,8 +2685,8 @@ var init_review_stacks2 = __esm({
 });
 
 // src/waves-workflow.ts
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname4, join as join4 } from "node:path";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { dirname as dirname3, join as join3 } from "node:path";
 function wavesEngine(pipeline) {
   const o = chantPipelineOptions({ ...pipeline.image ? { image: pipeline.image } : {}, ...pipeline.engineSetup ? { engineSetup: pipeline.engineSetup } : {} }, false);
   return { ...o.image ? { image: o.image } : {}, ...o.beforeScript?.length ? { beforeScript: o.beforeScript } : {} };
@@ -2896,10 +2748,10 @@ function upOpFile(spec) {
   ].join("\n");
 }
 function writeUpOp(cwd, spec) {
-  const path = join4(cwd, UP_OP_FILE);
+  const path = join3(cwd, UP_OP_FILE);
   const text = upOpFile(spec);
-  if (existsSync4(path) && readFileSync4(path, "utf8") === text) return false;
-  mkdirSync2(dirname4(path), { recursive: true });
+  if (existsSync3(path) && readFileSync3(path, "utf8") === text) return false;
+  mkdirSync2(dirname3(path), { recursive: true });
   writeFileSync2(path, text);
   return true;
 }
@@ -2919,15 +2771,15 @@ function withBinLines(text, lines2) {
   });
 }
 function generatedFor(dir, specFile) {
-  if (!existsSync4(dir)) return [];
-  return readdirSync2(dir).filter((f) => /\.ya?ml$/.test(f)).map((f) => join4(dir, f)).filter((p) => (readFileSync4(p, "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${specFile}`));
+  if (!existsSync3(dir)) return [];
+  return readdirSync(dir).filter((f) => /\.ya?ml$/.test(f)).map((f) => join3(dir, f)).filter((p) => (readFileSync3(p, "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${specFile}`));
 }
 async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}) {
-  const specPath = join4(io.cwd, waves.specFile);
+  const specPath = join3(io.cwd, waves.specFile);
   const specText = wavesSpecText(waves.spec, engine2);
-  const before = existsSync4(specPath) ? readFileSync4(specPath, "utf8") : void 0;
+  const before = existsSync3(specPath) ? readFileSync3(specPath, "utf8") : void 0;
   if (before !== specText) {
-    mkdirSync2(dirname4(specPath), { recursive: true });
+    mkdirSync2(dirname3(specPath), { recursive: true });
     writeFileSync2(specPath, specText);
     io.err(`${PRODUCT} ci: wrote ${waves.specFile} with plywood's op and gates; commit it with the workflow`);
   }
@@ -2935,7 +2787,7 @@ async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}
   const outDir = WAVES_OUTPUT_DIR[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", waves.specFile, "--output", outDir], words);
   if (code !== table.done) return code;
-  const files = generatedFor(join4(io.cwd, outDir), waves.specFile);
+  const files = generatedFor(join3(io.cwd, outDir), waves.specFile);
   if (files.length === 0) {
     io.err(`${PRODUCT} ci: chant wrote no waves workflow for ${waves.specFile} under ${outDir}`);
     return table.failed;
@@ -2943,7 +2795,7 @@ async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}
   const lines2 = hasChant4607(chant) ? void 0 : binLines(waves, words.bin);
   for (const file of files) {
     if (lines2) {
-      const text = readFileSync4(file, "utf8");
+      const text = readFileSync3(file, "utf8");
       const next = withBinLines(text, lines2);
       if (next !== text) writeFileSync2(file, next);
     }
@@ -2971,8 +2823,8 @@ var init_waves_workflow = __esm({
 });
 
 // src/agent-jobs.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname5, join as join5 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join4 } from "node:path";
 function hasChantAgent(chant) {
   return typeof chant?.CI_AGENT_FLOOR === "string";
 }
@@ -3018,9 +2870,9 @@ function agentOpSpec(spec, doc) {
   };
 }
 function writeIfChanged(cwd, file, text) {
-  const path = join5(cwd, file);
-  if (existsSync5(path) && readFileSync5(path, "utf8") === text) return false;
-  mkdirSync3(dirname5(path), { recursive: true });
+  const path = join4(cwd, file);
+  if (existsSync4(path) && readFileSync4(path, "utf8") === text) return false;
+  mkdirSync3(dirname4(path), { recursive: true });
   writeFileSync3(path, text);
   return true;
 }
@@ -3047,9 +2899,9 @@ async function writeAgentJobs(chant, forge, env, doc, words, table, io) {
   const outDir = OP_OUTPUT_DIR[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", AGENT_SPEC_FILE, "--output", outDir], agentWords);
   if (code !== table.done) return code;
-  const dir = join5(io.cwd, outDir);
-  const files = existsSync5(dir) ? readdirSync3(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync5(join5(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${AGENT_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: agent jobs at ${join5(outDir, f).replace(/^\.\//, "")}, answering /${PRODUCT} agent <ask>`);
+  const dir = join4(io.cwd, outDir);
+  const files = existsSync4(dir) ? readdirSync2(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync4(join4(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${AGENT_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: agent jobs at ${join4(outDir, f).replace(/^\.\//, "")}, answering /${PRODUCT} agent <ask>`);
   io.err(`${PRODUCT} ci: the agent job reads the model's key from ${a.keyEnv}; set it from a secret${a.maxRuns === void 0 ? ", and set agent.max_runs to limit how often it runs" : ""}`);
   if (forge === "github" && a.tokenEnv === void 0) io.err(`${PRODUCT} ci: the push job pushes with the job token, which starts no workflow on GitHub, so the agent's commit gets no preview; set agent.token_env to a secret holding a user's or app's token`);
   else if (a.tokenEnv !== void 0) io.err(`${PRODUCT} ci: the push job pushes with ${a.tokenEnv}; set it from a secret`);
@@ -3308,8 +3160,8 @@ var init_refusals = __esm({
 });
 
 // src/up.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "node:fs";
-import { join as join6 } from "node:path";
+import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
 function approveTarget(gate, opts) {
   if (opts.op) return { op: opts.op, gate };
   if (PR_OP.test(gate)) return { op: gate, gate: PR_GATE };
@@ -3390,10 +3242,10 @@ async function approve(args, json, table, io) {
   });
 }
 function wavesSpecAt(cwd, file = WAVES_SPEC_FILE) {
-  const path = join6(cwd, file);
-  if (!existsSync6(path)) return void 0;
+  const path = join5(cwd, file);
+  if (!existsSync5(path)) return void 0;
   try {
-    const spec = unwrapWavesSpec(JSON.parse(readFileSync6(path, "utf8")));
+    const spec = unwrapWavesSpec(JSON.parse(readFileSync5(path, "utf8")));
     return spec && typeof spec === "object" && !Array.isArray(spec) ? spec : void 0;
   } catch {
     return void 0;
@@ -3477,11 +3329,11 @@ async function override(args, json, table, io) {
   return withChant(`${PRODUCT} override`, table, io, async (chant) => explainRefusal(await chant.runChantInProcess(argv, PRODUCT_WORDS), table, io.err));
 }
 function readUpSpec(cwd, file = WAVES_SPEC_FILE) {
-  const path = join6(cwd, file);
-  if (!existsSync6(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
+  const path = join5(cwd, file);
+  if (!existsSync5(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
   let spec;
   try {
-    spec = unwrapWavesSpec(JSON.parse(readFileSync6(path, "utf8")));
+    spec = unwrapWavesSpec(JSON.parse(readFileSync5(path, "utf8")));
   } catch (e) {
     return { error: `${file}: ${e.message}` };
   }
@@ -3636,9 +3488,9 @@ var init_up = __esm({
 // src/drift.ts
 import { createHash as createHash2 } from "node:crypto";
 import { resolveTargetCloudIdentity } from "@intentius/chant/ci-identity";
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync7, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname6, join as join7 } from "node:path";
+import { dirname as dirname5, join as join6 } from "node:path";
 function driftRows(doc) {
   return (doc.records ?? []).filter((r) => DRIFT_STATUSES.includes(r.status)).map((r) => ({ urn: r.address, status: r.status, attributes: (r.attributes ?? []).map((a) => a.path).sort() })).sort((a, b) => a.urn < b.urn ? -1 : a.urn > b.urn ? 1 : 0);
 }
@@ -3697,7 +3549,7 @@ async function drift2(args, json, table, io) {
   const respond = respondFlag.value ?? driftResponseOf(doc);
   const forge = forgeFlag.value;
   return withChant(`${PRODUCT} drift`, table, io, async (chant) => {
-    const dir = mkdtempSync(join7(tmpdir(), "plywood-drift-"));
+    const dir = mkdtempSync(join6(tmpdir(), "plywood-drift-"));
     const results = [];
     try {
       const attribute = await attributionFor(doc, io);
@@ -3777,12 +3629,12 @@ async function driftNotice(chant, doc, results, environment, io) {
   });
 }
 async function readStack(chant, stack, dir, opts) {
-  const file = join7(dir, `${driftOpName(stack)}.json`);
+  const file = join6(dir, `${driftOpName(stack)}.json`);
   const argv = ["workspace", "drift", "--member", stack, ...opts.resource ? ["--resource", opts.resource] : [], ...opts.env ? ["--env", opts.env] : [], "-o", file];
   const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
   let doc;
   try {
-    if (existsSync7(file)) doc = JSON.parse(readFileSync7(file, "utf8"));
+    if (existsSync6(file)) doc = JSON.parse(readFileSync6(file, "utf8"));
   } catch (e) {
     return { stack, ok: false, drifted: 0, rows: [], error: `chant wrote a drift document plywood cannot read: ${e.message}` };
   }
@@ -3815,7 +3667,7 @@ async function attributeStack(a, stack, doc) {
 }
 function specHasUpdate(cwd, op) {
   try {
-    const spec = JSON.parse(readFileSync7(join7(cwd, DRIFT_SPEC_FILE), "utf8"));
+    const spec = JSON.parse(readFileSync6(join6(cwd, DRIFT_SPEC_FILE), "utf8"));
     return (spec.ops ?? []).some((o) => o.name === op && o.update !== void 0);
   } catch {
     return false;
@@ -3891,9 +3743,9 @@ function withNotifyVariables(fields, notify2) {
   return { ...fields, variables: { ...notify2, ...fields.variables ?? {} } };
 }
 function writeIfChanged2(cwd, file, text) {
-  const path = join7(cwd, file);
-  if (existsSync7(path) && readFileSync7(path, "utf8") === text) return false;
-  mkdirSync4(dirname6(path), { recursive: true });
+  const path = join6(cwd, file);
+  if (existsSync6(path) && readFileSync6(path, "utf8") === text) return false;
+  mkdirSync4(dirname5(path), { recursive: true });
   writeFileSync4(path, text);
   return true;
 }
@@ -3909,9 +3761,9 @@ async function writeDriftJobs(chant, forge, doc, words, table, io, env = "produc
   const outDir = OP_OUTPUT_DIR2[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", DRIFT_SPEC_FILE, "--output", outDir], words);
   if (code !== table.done) return code;
-  const dir = join7(io.cwd, outDir);
-  const files = existsSync7(dir) ? readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync7(join7(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${DRIFT_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: drift job at ${join7(outDir, f).replace(/^\.\//, "")} on ${settings.schedule}`);
+  const dir = join6(io.cwd, outDir);
+  const files = existsSync6(dir) ? readdirSync3(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync6(join6(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${DRIFT_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: drift job at ${join6(outDir, f).replace(/^\.\//, "")} on ${settings.schedule}`);
   if (files.length && forge === "gitlab") io.err(`${PRODUCT} ci: GitLab runs the drift job from a pipeline schedule; include the file from .gitlab-ci.yml and add a schedule`);
   return table.done;
 }
@@ -3985,8 +3837,8 @@ var init_tips = __esm({
 });
 
 // src/agents.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname7, join as join8 } from "node:path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname6, join as join7 } from "node:path";
 function plywoodMcpTools(ctx) {
   const none = { type: "object", properties: {} };
   const doc = () => {
@@ -3996,7 +3848,7 @@ function plywoodMcpTools(ctx) {
   return [
     {
       name: "stacks",
-      description: "The stacks plywood.yml lists, each with its directory, gate and backend, and the waves they update in.",
+      description: "The stacks plywood.yml lists, each with its directory, gate, backend and actions, and the waves they update in.",
       inputSchema: none,
       readOnly: true,
       handler: async () => {
@@ -4030,24 +3882,51 @@ function plywoodMcpTools(ctx) {
     }
   ];
 }
-function plywoodMcpHook(reportUrl) {
+function plywoodProposeTools() {
+  return [
+    {
+      name: TEMPLATE_REQUEST_WORDS.tool,
+      description: `Open a pull request for an app from a template, reviewed and gated like a person's. ${TEMPLATE_REQUEST_WORDS.refusal}`,
+      inputSchema: {
+        type: "object",
+        properties: {
+          template: { type: "string", description: "The template's name in the catalog." },
+          version: { type: "string", description: "The template's version; the newest when left out." },
+          name: { type: "string", description: "The app's name, which names its directory and the request branch." },
+          app: { type: "string", description: "The app an add-on template joins." },
+          inputs: { type: "object", description: "The template's inputs, by name." }
+        },
+        required: ["template", "name", "inputs"]
+      },
+      forgeWrite: true,
+      handler: async () => {
+        throw new Error(TEMPLATE_REQUEST_WORDS.refusal);
+      }
+    }
+  ];
+}
+function plywoodMcpHook(reportUrl, propose = false) {
   return {
     product: PRODUCT,
-    tools: (ctx) => plywoodMcpTools(ctx),
+    // A read-only server without the tier refuses to start with a forgeWrite tool, so they go only where chant says it serves them.
+    tools: (ctx) => [...plywoodMcpTools(ctx), ...propose && ctx.propose === true ? plywoodProposeTools() : []],
     readOnly: true,
+    ...propose ? { propose: true } : {},
     ...reportUrl ? { reportUrl } : {},
-    instructions: `${PRODUCT} (${TAGLINE}) serves read tools only. To change a stack, open a pull request: ${PRODUCT} previews it, and its update runs after a person approves the digest.`
+    instructions: propose ? `${PRODUCT} (${TAGLINE}) serves read tools and ${TEMPLATE_REQUEST_WORDS.tool}, which may open a pull request and nothing else. Pulumi templates are not available yet, so ${TEMPLATE_REQUEST_WORDS.tool} refuses every call. ${READ_INSTRUCTIONS}` : `${PRODUCT} (${TAGLINE}) serves read tools only. ${READ_INSTRUCTIONS}`
   };
 }
 async function mcp(args, _json, table, io) {
-  const report = takeFlag(args, "--report-url");
+  const propose = args.includes("--propose");
+  const report = takeFlag(args.filter((a) => a !== "--propose"), "--report-url");
   if (report.missing) return usage("--report-url takes a URL", table, io);
   if (report.rest.length) return usage(`mcp does not take ${report.rest.join(" ")}`, table, io);
   return withChant(`${PRODUCT} mcp`, table, io, (chant) => {
     if (typeof chant.PRODUCT_MCP_HOOK_FLOOR !== "string") {
       io.err(`${PRODUCT} mcp: this chant has no product tool hook (chant#4555), so the server serves chant's read tools and none of ${PRODUCT}'s`);
     }
-    return chant.runChantInProcess(["serve", "mcp", "--read-only"], PRODUCT_WORDS, { mcp: plywoodMcpHook(report.value) });
+    const argv = ["serve", "mcp", "--read-only", ...propose ? ["--propose"] : []];
+    return chant.runChantInProcess(argv, PRODUCT_WORDS, { mcp: plywoodMcpHook(report.value, propose) });
   });
 }
 function reviewOpFile(doc) {
@@ -4099,9 +3978,9 @@ function reviewOpSpec(doc) {
   };
 }
 function writeIfChanged3(cwd, file, text) {
-  const path = join8(cwd, file);
-  if (existsSync8(path) && readFileSync8(path, "utf8") === text) return false;
-  mkdirSync5(dirname7(path), { recursive: true });
+  const path = join7(cwd, file);
+  if (existsSync7(path) && readFileSync7(path, "utf8") === text) return false;
+  mkdirSync5(dirname6(path), { recursive: true });
   writeFileSync5(path, text);
   return true;
 }
@@ -4112,15 +3991,15 @@ async function writeReviewJobs(chant, forge, doc, words, table, io) {
   const outDir = OP_OUTPUT_DIR3[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", REVIEW_SPEC_FILE, "--output", outDir], words);
   if (code !== table.done) return code;
-  const dir = join8(io.cwd, outDir);
-  const files = existsSync8(dir) ? readdirSync5(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync8(join8(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${REVIEW_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: review jobs at ${join8(outDir, f).replace(/^\.\//, "")}`);
+  const dir = join7(io.cwd, outDir);
+  const files = existsSync7(dir) ? readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync7(join7(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${REVIEW_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: review jobs at ${join7(outDir, f).replace(/^\.\//, "")}`);
   const r = reviewOf(doc);
   io.err(`${PRODUCT} ci: the review job reads the model's key from ${r.keyEnv}; set it from a secret`);
   if (forge === "gitlab") io.err(`${PRODUCT} ci: on GitLab the note job runs on the default branch with CHANT_REVIEW_NOTES=1 from a pipeline schedule, and posts with a protected CHANT_FORGE_TOKEN`);
   return table.done;
 }
-var PERSON_VERBS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE, REVIEW_CHANGE_SET, REVIEW_PREVIEW_LINE, OP_OUTPUT_DIR3;
+var PERSON_VERBS, READ_INSTRUCTIONS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE, REVIEW_CHANGE_SET, REVIEW_PREVIEW_LINE, OP_OUTPUT_DIR3;
 var init_agents2 = __esm({
   "src/agents.ts"() {
     "use strict";
@@ -4134,6 +4013,7 @@ var init_agents2 = __esm({
     init_tips();
     init_words();
     PERSON_VERBS = ["up", "approve", "override"];
+    READ_INSTRUCTIONS = `To change a stack, open a pull request: ${PRODUCT} previews it, and its update runs after a person approves the digest.`;
     REVIEW_OP = "plywood-review";
     REVIEW_OP_FILE = "ops/plywood-review.op.ts";
     REVIEW_SPEC_FILE = ".chant/ops/plywood-review.spec.json";
@@ -4143,19 +4023,240 @@ var init_agents2 = __esm({
   }
 });
 
-// src/policy-presets.ts
-import { readFileSync as readFileSync9 } from "node:fs";
-function providersRego(allowed, namespace = "main") {
-  const set = allowed.length ? `{${[...new Set(allowed)].sort().map((p) => JSON.stringify(p)).join(", ")}}` : "set()";
-  return preset("plywood_providers.rego.tmpl").replace("{{namespace}}", namespace).replace("{{allowed}}", set);
-}
-function providersPackFiles() {
-  return Object.fromEntries(["index.ts", "PulumiPolicy.yaml", "package.json"].map((f) => [f, preset(`plywood-providers/${f}`)]));
-}
-function providersPackConfig(allowed) {
-  return JSON.stringify({ [PROVIDERS_POLICY]: { allowed: [...new Set(allowed)].sort() } }, null, 2) + "\n";
-}
-var PROVIDERS_PACK_DIR, PROVIDERS_PACK_CONFIG, PROVIDERS_REGO_FILE, PROVIDERS_POLICY, preset;
+// src/init/detect.ts
+import { existsSync as existsSync8, readdirSync as readdirSync5, readFileSync as readFileSync8, statSync } from "node:fs";
+import { basename, dirname as dirname7, join as join8, relative, sep } from "node:path";
+import { parseYAML as parseYAML2 } from "@intentius/chant/yaml";
+function repoRoot(dir) {
+  let cur = dir;
+  for (let i = 0; i < 64; i++) {
+    if (existsSync8(join8(cur, ".git"))) return cur;
+    const parent = dirname7(cur);
+    if (parent === cur) return dir;
+    cur = parent;
+  }
+  return dir;
+}
+function posixRel(root, path) {
+  const rel = relative(root, path);
+  return rel === "" ? "." : rel.split(sep).join("/");
+}
+function readYamlFile(file) {
+  try {
+    const doc = parseYAML2(readFileSync8(file, "utf8"));
+    return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function findPulumiProjects(root) {
+  const out = [];
+  const walk = (dir, depth) => {
+    let entries;
+    try {
+      entries = readdirSync5(dir).sort();
+    } catch {
+      return;
+    }
+    const file = ["Pulumi.yaml", "Pulumi.yml"].find((n) => entries.includes(n));
+    if (file) {
+      const project = readProject(root, dir, join8(dir, file));
+      if (project) out.push(project);
+    }
+    if (depth >= MAX_DEPTH) return;
+    for (const name of entries) {
+      if (SKIP.has(name) || name.startsWith(".")) continue;
+      const path = join8(dir, name);
+      try {
+        if (statSync(path).isDirectory()) walk(path, depth + 1);
+      } catch {
+      }
+    }
+  };
+  walk(root, 0);
+  return out;
+}
+function readProject(root, dir, file) {
+  const doc = readYamlFile(file);
+  if (!doc || typeof doc.name !== "string" || doc.name === "") return void 0;
+  const runtime = typeof doc.runtime === "string" ? doc.runtime : doc.runtime?.name;
+  const backend = doc.backend;
+  const configDir = typeof doc.stackConfigDir === "string" ? join8(dir, doc.stackConfigDir) : dir;
+  return {
+    name: doc.name,
+    dir: posixRel(root, dir),
+    ...typeof runtime === "string" ? { runtime } : {},
+    ...backend && typeof backend.url === "string" ? { backendUrl: backend.url } : {},
+    stacks: stackNames(configDir)
+  };
+}
+function stackNames(configDir) {
+  let entries;
+  try {
+    entries = readdirSync5(configDir);
+  } catch {
+    return [];
+  }
+  const names = entries.map((n) => /^Pulumi\.(.+)\.ya?ml$/.exec(n)?.[1]).filter((s) => s !== void 0 && s !== "");
+  return [...new Set(names)].sort(byEnvironment);
+}
+function environmentOf(stack) {
+  const last = stack.split("/").pop().toLowerCase();
+  const head = last.split(/[-_.]/)[0];
+  return ENV_ORDER.includes(head) ? head : last;
+}
+function rank(stack) {
+  const env = environmentOf(stack);
+  const at = ENV_ORDER.indexOf(env);
+  return at >= 0 ? at : PROD_RANK - 0.5;
+}
+function byEnvironment(a, b) {
+  return rank(a) - rank(b) || a.localeCompare(b);
+}
+function stacksOf2(projects) {
+  const names = /* @__PURE__ */ new Map();
+  for (const p of projects) names.set(p.name, (names.get(p.name) ?? 0) + 1);
+  const out = [];
+  for (const p of projects) {
+    const project = (names.get(p.name) ?? 0) > 1 ? `${p.name}-${slug(p.dir)}` : p.name;
+    for (const stack of p.stacks) out.push({ key: `${project}/${stack}`, project: p.name, stack, dir: p.dir });
+  }
+  return out.sort((x, y) => byEnvironment(x.stack, y.stack) || x.key.localeCompare(y.key));
+}
+function slug(s) {
+  const out = s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return out === "" ? "root" : out;
+}
+function originUrl(root) {
+  const config2 = gitFile(root, "config");
+  if (!config2) return void 0;
+  let inOrigin = false;
+  for (const raw of config2.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line.startsWith("[")) {
+      inOrigin = /^\[remote\s+"origin"\]$/.test(line);
+      continue;
+    }
+    const m = inOrigin ? /^url\s*=\s*(.+)$/.exec(line) : null;
+    if (m) return m[1].trim();
+  }
+  return void 0;
+}
+function gitFile(root, name) {
+  const dotGit = join8(root, ".git");
+  let gitDir = dotGit;
+  try {
+    if (statSync(dotGit).isFile()) {
+      const m = /^gitdir:\s*(.+)$/m.exec(readFileSync8(dotGit, "utf8"));
+      if (!m) return void 0;
+      gitDir = join8(root, m[1].trim());
+      const common = join8(gitDir, "commondir");
+      if (existsSync8(common) && !existsSync8(join8(gitDir, name))) gitDir = join8(gitDir, readFileSync8(common, "utf8").trim());
+    }
+    const path = join8(gitDir, name);
+    return existsSync8(path) ? readFileSync8(path, "utf8") : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function remoteHost(url) {
+  const scp = /^[^@/\s]+@([^:/\s]+):/.exec(url);
+  if (scp) return scp[1].toLowerCase();
+  try {
+    return new URL(url).hostname.toLowerCase() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function forgeOfRemote(url) {
+  const host = remoteHost(url);
+  if (!host) return void 0;
+  if (host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.")) return { kind: "github", because: `origin is on ${host}` };
+  if (host === "gitlab.com") return { kind: "gitlab", because: `origin is on ${host}` };
+  if (host === "codeberg.org") return { kind: "forgejo", because: `origin is on ${host}` };
+  if (/(^|[.-])gitlab([.-]|$)/.test(host)) return { kind: "gitlab", because: `origin is on ${host}`, url: `https://${host}` };
+  if (/(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return { kind: "forgejo", because: `origin is on ${host}`, url: `https://${host}` };
+  return void 0;
+}
+function detectForge(root) {
+  const url = originUrl(root);
+  const byRemote = url ? forgeOfRemote(url) : void 0;
+  if (byRemote) return byRemote;
+  if (existsSync8(join8(root, ".forgejo"))) return { kind: "forgejo", because: "the repository has .forgejo/" };
+  if (existsSync8(join8(root, ".gitlab-ci.yml"))) return { kind: "gitlab", because: "the repository has .gitlab-ci.yml" };
+  if (existsSync8(join8(root, ".github", "workflows"))) return { kind: "github", because: "the repository has .github/workflows/" };
+  return void 0;
+}
+function defaultBranch(root) {
+  const head = gitFile(root, "refs/remotes/origin/HEAD");
+  const remote = head && /ref:\s*refs\/remotes\/origin\/(.+)/.exec(head)?.[1];
+  if (remote) return remote.trim();
+  const local = gitFile(root, "HEAD");
+  const branch = local && /ref:\s*refs\/heads\/(.+)/.exec(local)?.[1];
+  return branch ? branch.trim() : "main";
+}
+function findPulumiActions(root) {
+  const out = [];
+  for (const d of WORKFLOW_DIRS) {
+    let names;
+    try {
+      names = readdirSync5(join8(root, d)).sort();
+    } catch {
+      continue;
+    }
+    for (const n of names) {
+      if (!/\.ya?ml$/.test(n)) continue;
+      try {
+        if (/uses:\s*["']?pulumi\/actions@/.test(readFileSync8(join8(root, d, n), "utf8"))) out.push(`${d}/${n}`);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function detect(cwd) {
+  const root = repoRoot(cwd);
+  const projects = findPulumiProjects(root);
+  const forge = detectForge(root);
+  const preCommit = [".pre-commit-config.yaml", ".pre-commit-config.yml"].find((n) => existsSync8(join8(root, n)));
+  return {
+    root,
+    projects,
+    stacks: stacksOf2(projects),
+    ...forge ? { forge } : {},
+    defaultBranch: defaultBranch(root),
+    pulumiActions: findPulumiActions(root),
+    ...preCommit ? { preCommit } : {}
+  };
+}
+function repoName(root) {
+  return slug(basename(root)).slice(0, 40).replace(/-+$/, "") || "plywood";
+}
+var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
+var init_detect = __esm({
+  "src/init/detect.ts"() {
+    "use strict";
+    SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
+    MAX_DEPTH = 8;
+    ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
+    PROD_RANK = ENV_ORDER.indexOf("prod");
+    WORKFLOW_DIRS = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
+  }
+});
+
+// src/policy-presets.ts
+import { readFileSync as readFileSync9 } from "node:fs";
+function providersRego(allowed, namespace = "main") {
+  const set = allowed.length ? `{${[...new Set(allowed)].sort().map((p) => JSON.stringify(p)).join(", ")}}` : "set()";
+  return preset("plywood_providers.rego.tmpl").replace("{{namespace}}", namespace).replace("{{allowed}}", set);
+}
+function providersPackFiles() {
+  return Object.fromEntries(["index.ts", "PulumiPolicy.yaml", "package.json"].map((f) => [f, preset(`plywood-providers/${f}`)]));
+}
+function providersPackConfig(allowed) {
+  return JSON.stringify({ [PROVIDERS_POLICY]: { allowed: [...new Set(allowed)].sort() } }, null, 2) + "\n";
+}
+var PROVIDERS_PACK_DIR, PROVIDERS_PACK_CONFIG, PROVIDERS_REGO_FILE, PROVIDERS_POLICY, preset;
 var init_policy_presets = __esm({
   "src/policy-presets.ts"() {
     "use strict";
@@ -6277,7 +6378,8 @@ async function ci(args, json, table, io) {
       ...jobs2.applyBeforeMerge ? { applyBeforeMerge: jobs2.applyBeforeMerge.command } : {},
       comments: jobs2.comments,
       ...jobs2.waves ? { waves: { specFile: jobs2.waves.specFile, jobs: jobs2.waves.jobs.map((j) => j.command.join(" ")) } } : {},
-      ..."control" in control3 ? { control: control3.repo } : {}
+      ..."control" in control3 ? { control: control3.repo } : {},
+      ...jobs2.action ? { action: { command: jobs2.action.command, comment: jobs2.action.comment, inputs: jobs2.action.inputs } } : {}
     };
     if (json && dryRun) io.out(JSON.stringify({ command: "ci", ok: true, exitCode: table.done, dryRun, ...summary }));
     else if (!json) {
@@ -6290,6 +6392,7 @@ async function ci(args, json, table, io) {
       for (const [command, line] of Object.entries(jobs2.comments)) io.err(`  comment   ${line} (${command})`);
       for (const job of summary.waves?.jobs ?? []) io.err(`  wave      ${job}`);
       if (jobs2.stale) io.err(`  stale     ${jobs2.stale.command} (on each push to the target branch)`);
+      if (jobs2.action) io.err(`  action    ${jobs2.action.command} (${jobs2.action.comment} <stack> <name>, or a dispatch with inputs ${jobs2.action.inputs.member} and ${jobs2.action.inputs.action})`);
     }
     if (!json && "control" in control3) io.err(`  control   after the last wave, tells ${control3.repo} how the waves ended`);
     else if (!json && "missing" in control3) io.err(`  control   the waves workflow sends no dispatch: ${control3.missing}; a job of your own after the last wave runs '${PRODUCT} control dispatch'`);
@@ -6322,7 +6425,9 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
   const respond = respondOptions(chant, pipeline, shape.applyBeforeMerge, notes);
   const applyMerge = shape.applyBeforeMerge ? pipeline.applyMerge : void 0;
   if (approvalOf(doc) === "pr-review" && shape.waves && hasChantApprovalStatus(chant) && !hasChantPullRequestApprovalStatus(chant)) notes.push(APPROVAL_STATUS_NOTE);
-  const words = wordsForJobs(shape.jobs);
+  const actionJob = actionJobFor(doc, forge, notes);
+  const jobsWanted = actionJob ? [...shape.jobs, "action"] : shape.jobs;
+  const words = wordsForJobs(jobsWanted);
   const requires = shape.applyBeforeMerge ? requiresArgv(chant, doc) : [];
   const previewComment = hasChant4620(chant);
   const jobs2 = chant.productPipelineJobs(forge, env, {
@@ -6339,9 +6444,10 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     // chant#4628: the note names the target commit it was previewed against, and a push marks older notes stale.
     staleNotes: true,
     ...respond.options,
-    ...applyMerge ? { applyMerge } : {}
+    ...applyMerge ? { applyMerge } : {},
+    ...actionJob ? { actionJob: true } : {}
   });
-  const prWords = shape.applyBeforeMerge ? words : wordsForJobs(shape.jobs.filter((j) => j !== "apply"));
+  const prWords = shape.applyBeforeMerge ? words : wordsForJobs(jobsWanted.filter((j) => j !== "apply"));
   const argv = [
     "build",
     ".",
@@ -6358,6 +6464,7 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     ...respond.argv,
     ...previewComment ? ["--preview-comment"] : [],
     "--stale-notes",
+    ...actionJob ? ["--action-job"] : [],
     // Review stacks (plywood#15): chant's pr-env jobs, only once the pulumi lexicon can remove what they create.
     ...doc.review_stacks !== void 0 && opts.reviewStacks ? ["--pr-env"] : [],
     ...opts.prJobs?.flags ?? [],
@@ -6365,6 +6472,11 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
   ];
   return { jobs: jobs2, words, prWords, argv, notes, ...applyMerge ? { applyMerge } : {} };
 }
+function actionJobFor(doc, forge, notes) {
+  if (!hasActions(doc)) return false;
+  if (forge === "gitlab") return notes.push(ACTIONS_NOT_ON_GITLAB), false;
+  return true;
+}
 function applyMergeArgv(m) {
   return ["--merge", "auto", "--merge-token-env", m.tokenEnv, ...m.method ? ["--merge-method", m.method] : []];
 }
@@ -6414,7 +6526,7 @@ function usage(message, table, io) {
   io.err(`${PRODUCT}: ${message}`);
   return table.failed;
 }
-var CHANT_PASSTHROUGH, VALUED, PREVIEW_TARGET_NEEDS_CHANT, WORKFLOW_FILE, APPROVAL_STATUS_NOTE, CHANT_RESPOND_DEFAULTS, DECIDE_LEFT_OFF;
+var CHANT_PASSTHROUGH, VALUED, PREVIEW_TARGET_NEEDS_CHANT, WORKFLOW_FILE, ACTIONS_NOT_ON_GITLAB, APPROVAL_STATUS_NOTE, CHANT_RESPOND_DEFAULTS, DECIDE_LEFT_OFF;
 var init_stages = __esm({
   "src/stages.ts"() {
     "use strict";
@@ -6426,6 +6538,7 @@ var init_stages = __esm({
     init_apply();
     init_config();
     init_locks();
+    init_stacks();
     init_routing();
     init_workflow();
     init_review_stacks2();
@@ -6442,6 +6555,7 @@ var init_stages = __esm({
       forgejo: ".forgejo/workflows/plywood.yml",
       gitlab: ".gitlab-ci.yml"
     };
+    ACTIONS_NOT_ON_GITLAB = "plywood.yml declares actions, and a GitLab pipeline starts on no comment or dispatch with inputs, so it has no action job; run 'plywood action <stack> <name>' from a pipeline of your own";
     APPROVAL_STATUS_NOTE = `approval is pr-review, and chant posts its approval status only for waves that wait on pr-review; plywood's waves wait on the pull request's own approval, so no ${PRODUCT}/approval status is posted before merge`;
     CHANT_RESPOND_DEFAULTS = Object.freeze({ "wave-refused": "diff", "apply-failed": "triage", description: "off" });
     DECIDE_LEFT_OFF = "decide is set and respond.description is not check, so plywood leaves the decide service off the pull request jobs";
@@ -6512,1100 +6626,1185 @@ function exitCodes() {
   return cached;
 }
 
-// src/audit.ts
+// src/actions.ts
+init_chant_product();
+init_stacks();
+init_stages();
+
+// src/stack-ops.ts
+init_chant_config();
+init_identity();
+init_config();
+init_stacks();
+init_adopt();
 init_detect();
+init_refusals();
 init_stages();
+init_chant_product();
 init_words();
-var AUDIT_TABLES = { approvals: "gates", updates: "applies", runs: "runs", "review-stacks": "pr_envs" };
-var DEFAULT_AUDIT_TABLE = "approvals";
-function auditTable(word) {
-  const w = word ?? DEFAULT_AUDIT_TABLE;
-  return AUDIT_TABLES[w] ?? w;
-}
-function auditMember(stack) {
-  const [project, name] = stack.split("/");
-  return project && name ? slug(project).slice(0, 36).replace(/-+$/, "") : void 0;
+import { existsSync as existsSync13 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute2, join as join16, resolve as resolve2 } from "node:path";
+var STACK_OPS_OP = "pulumi-stack-ops";
+var REQUIRED4 = ["gatedStackExport", "gatedStackCancel", "gatedStackMove"];
+var cachedLocks;
+function chantStackLockReader() {
+  cachedLocks ??= (async () => {
+    try {
+      const m = await import("@intentius/chant-lexicon-pulumi");
+      return typeof m.pulumiStackLockIds === "function" ? m.pulumiStackLockIds : void 0;
+    } catch {
+      return void 0;
+    }
+  })();
+  return cachedLocks;
 }
-function auditArgv(args, json) {
-  const stack = takeFlag(args, "--stack");
-  const since = takeFlag(stack.rest, "--since");
-  const at = takeFlag(since.rest, "--at");
-  for (const [flag, f] of [["--stack", stack], ["--since", since], ["--at", at]]) if (f.missing) return { error: `${flag} takes a value` };
-  const wheres = [];
-  const rest = [];
-  for (let i = 0; i < at.rest.length; i++) {
-    const a = at.rest[i];
-    if (a === "--where") {
-      const v = at.rest[i + 1];
-      if (v === void 0 || v.startsWith("--")) return { error: "--where takes <field><op><value>, such as gate=wave-2" };
-      wheres.push("--where", v);
-      i++;
-    } else rest.push(a);
-  }
-  const flags = rest.filter((a) => a.startsWith("-"));
-  if (flags.length) return { error: `audit does not take ${flags.join(" ")}` };
-  if (rest.length > 1) return { error: `audit reads one table: ${Object.keys(AUDIT_TABLES).join(", ")}, or a chant ledger table` };
-  let member;
-  if (stack.value !== void 0) {
-    member = auditMember(stack.value);
-    if (!member) return { error: `--stack takes project/stack, not '${stack.value}'` };
+async function lockToCancel(given, stack, env) {
+  if (given) return { lockId: given, read: false };
+  const reader = await chantStackLockReader();
+  if (!reader) return { error: STACK_OP_WORDS.needsLock };
+  let locks2;
+  try {
+    locks2 = await reader({ dir: stack.dir, stack: stack.stack, ...stack.project ? { project: stack.project } : {}, ...stack.engine ? { engine: stack.engine } : {}, env });
+  } catch (e) {
+    return { error: `${STACK_OP_WORDS.needsLock}. Reading the stack's lock failed: ${e.message}` };
   }
-  return [
-    "ledger",
-    auditTable(rest[0]),
-    ...member ? ["--member", member] : [],
-    ...since.value ? ["--since", since.value] : [],
-    ...wheres,
-    ...at.value ? ["--at", at.value] : [],
-    ...json ? ["--json"] : []
-  ];
-}
-async function audit2(args, json, table, io) {
-  const argv = auditArgv(args, json);
-  if ("error" in argv) return usage(argv.error, table, io);
-  return withChant(`${PRODUCT} audit`, table, io, (chant) => chant.runChantInProcess(argv, PRODUCT_WORDS));
+  if (!locks2.checked) return { error: STACK_OP_WORDS.lockNotListed(locks2.backend) };
+  if (locks2.ids.length === 0) return { error: STACK_OP_WORDS.noLock(stack.stack) };
+  if (locks2.ids.length > 1) return { error: STACK_OP_WORDS.manyLocks(stack.stack, locks2.ids) };
+  return { lockId: locks2.ids[0], read: true };
 }
-
-// src/cli.ts
-init_agents2();
-init_drift2();
-
-// src/estate.ts
-init_chant_product();
-init_chant_config();
-init_config();
-init_stages();
-init_words();
-import { dirname as dirname11 } from "node:path";
-var estateModule;
-function chantEstate() {
-  estateModule ??= (async () => {
+var cachedOps;
+var cachedRollback;
+function chantStackOps() {
+  cachedOps ??= (async () => {
     try {
-      const m = await import("@intentius/chant/ci-estate");
-      const r = await import("@intentius/chant/pr-report-url");
-      if (!["readEstateLedger", "buildLedgerEstate", "writeEstate"].every((f) => typeof m[f] === "function")) return void 0;
-      if (typeof r.parseReportUrl !== "function" || typeof r.reportPut !== "function") return void 0;
-      return { ...m, parseReportUrl: r.parseReportUrl, reportPut: r.reportPut };
+      const m = await import("@intentius/chant-lexicon-pulumi");
+      return REQUIRED4.every((name) => typeof m[name] === "function") ? m : void 0;
     } catch {
       return void 0;
     }
   })();
-  return estateModule;
-}
-var ESTATE_NEEDS_CHANT = `${PRODUCT} estate needs chant >= the release after 0.124.54, which carries @intentius/chant/ci-estate (chant#4612). Run '${PRODUCT} audit' for the ledger's rows on this chant.`;
-function estateSchedules(config2) {
-  const drift3 = toChantSettings(config2).pipeline.drift;
-  const driftOps = (drift3?.stacks ?? []).map(driftOpName);
-  const schedules = drift3?.schedule ? driftOps.map((op) => ({ op, cron: drift3.schedule })) : [];
-  return { schedules, driftOps };
+  return cachedOps;
 }
-async function estate(args, json, table, io) {
-  const failOverdue = args.includes("--fail-overdue");
-  let rest = args.filter((a) => a !== "--fail-overdue");
-  const flags = {};
-  for (const flag of ["--file", "--report-url", "--prefix"]) {
-    const f = takeFlag(rest, flag);
-    if (f.missing) return usage(`${flag} takes a value`, table, io);
-    flags[flag] = f.value;
-    rest = f.rest;
-  }
-  if (rest.length) return usage(`estate does not take ${rest.join(" ")}`, table, io);
-  const chant = await chantEstate();
-  if (!chant) {
-    if (json) io.out(JSON.stringify({ command: "estate", ok: false, exitCode: table.failed, error: ESTATE_NEEDS_CHANT }));
-    else io.err(`${PRODUCT}: ${ESTATE_NEEDS_CHANT}`);
-    return table.failed;
-  }
-  const path = flags["--file"] ?? findConfig(io.cwd);
-  let config2;
-  if (path) {
+function chantStackRollback() {
+  cachedRollback ??= (async () => {
     try {
-      config2 = loadConfig(path);
-    } catch (e) {
-      return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
-    }
-    const errors = checkConfig(config2).filter((p) => p.severity === "error");
-    if (errors.length) {
-      for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
-      return table.failed;
+      const m = await import("@intentius/chant-lexicon-pulumi");
+      if (typeof m.pulumiReleaseInputs !== "function") return false;
+      const copy2 = await import("@intentius/chant-lexicon-pulumi/release-copy");
+      return typeof copy2.prepareReleaseCopy === "function";
+    } catch {
+      return false;
     }
-  }
-  const { schedules, driftOps } = config2 ? estateSchedules(config2) : { schedules: [], driftOps: [] };
-  const product = await chantProduct();
-  const words = product ? product.assertProductWords(PRODUCT_WORDS) : PRODUCT_WORDS;
-  const root = path ? dirname11(path) : io.cwd;
-  const load = await chant.readEstateLedger(root);
-  const built = chant.buildLedgerEstate({ load, words, schedules, ...driftOps.length ? { driftOps } : {} });
-  const url = flags["--report-url"] ?? (config2 ? toChantSettings(config2).ci.reportUrl : void 0);
-  let written;
-  if (url) {
-    const target = chant.parseReportUrl(url, flags["--report-url"] ? "--report-url" : "reports.url");
-    if (target && typeof target === "object" && "error" in target) return usage(String(target.error), table, io);
-    written = await chant.writeEstate(built, { put: chant.reportPut(target), words, env: io.env, ...flags["--prefix"] ? { prefix: flags["--prefix"] } : {} });
-  }
-  const code = failOverdue && built.overdue.length > 0 ? table.failed : table.done;
-  if (json) {
-    io.out(JSON.stringify({ command: "estate", ok: code === table.done, exitCode: code, estate: built.estate, dora: built.dora, overdue: built.overdue, ...written ? { written } : {} }));
-    return code;
-  }
-  const totals = built.estate.totals ?? {};
-  io.out(`${PRODUCT} estate: ${Object.entries(totals).map(([k, v]) => `${v} ${k}`).join(", ") || "nothing on the ledger yet"}`);
-  for (const o of built.overdue) io.out(`  ${o.message}`);
-  if (written) io.out(`  wrote ${written.keys.join(", ")} under ${url}`);
-  else io.out(`  no report URL (reports.url or --report-url), so nothing was written`);
-  return code;
+  })();
+  return cachedRollback;
 }
-
-// src/notify.ts
-init_stages();
-init_words();
-var RELAY_NEEDS_CHANT = `${PRODUCT} notify relay needs chant >= the release after 0.124.54, which carries chant notify relay (chant#4611).`;
-async function notify(args, json, table, io) {
-  if (args[0] !== "relay") return usage(`unknown notify command '${args[0] ?? ""}'. Run '${PRODUCT} notify relay'.`, table, io);
-  return withChant(`${PRODUCT} notify relay`, table, io, (chant) => {
-    if (typeof chant.startRelayServer !== "function") {
-      if (json) io.out(JSON.stringify({ command: "notify relay", ok: false, exitCode: table.failed, error: RELAY_NEEDS_CHANT }));
-      else io.err(`${PRODUCT}: ${RELAY_NEEDS_CHANT}`);
-      return Promise.resolve(table.failed);
-    }
-    return chant.runChantInProcess(["notify", ...args], PRODUCT_WORDS);
-  });
+function needsStackOpsMessage(what, feature, after = "0.124.54") {
+  return `${what} needs @intentius/chant-lexicon-pulumi >= the release after ${after}, which carries ${feature}. This plywood was built with chant ${BUILT_CHANT}, which lacks it. Upgrade plywood once that chant is out, or build against a local chant with 'just chant-local'.`;
 }
-
-// src/cli.ts
-init_policy();
-
-// src/guard.ts
-init_stages();
-init_words();
-import { chmodSync, copyFileSync, existsSync as existsSync13, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
-import { join as join16 } from "node:path";
-var GUARDED = {
-  pulumi: ["up", "update", "destroy"],
-  plunge: ["up", "update", "destroy"]
-};
-var VALUED_GLOBALS = /* @__PURE__ */ new Set(["-C", "--cwd", "-s", "--stack", "--color", "--config-file", "--logflow", "-v", "--verbose", "--tracing", "--profiling", "--memprofilerate"]);
-var LAUNCHERS = /* @__PURE__ */ new Set(["env", "npx", "sudo", "command", "exec", "nohup", "time", "xargs"]);
-function segments(line) {
-  return line.split(/\|\||&&|[;|\n`]|\$\(|\)/).map((seg) => (seg.match(/'[^']*'|"[^"]*"|\S+/g) ?? []).map((t) => t.replace(/^['"]|['"]$/g, ""))).filter((t) => t.length > 0);
+function readConfig(cwd) {
+  const path = findConfig(cwd);
+  if (!path) return { error: `no plywood.yml in ${cwd} or above it; run '${PRODUCT} init' first` };
+  const config2 = loadConfig(path);
+  const errors = checkConfig(config2).filter((p) => p.severity === "error");
+  if (errors.length) return { error: errors.map((p) => `${path}: ${p.key} ${p.message}`).join("\n") };
+  return { config: config2, path };
 }
-function guardVerdict(line) {
-  for (const words of segments(line)) {
-    let i = 0;
-    while (i < words.length && (LAUNCHERS.has(words[i]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]) || words[i - 1] === "env" && words[i].startsWith("-"))) i++;
-    const bin = (words[i] ?? "").split("/").pop();
-    const refused = GUARDED[bin];
-    if (!refused) continue;
-    for (let j = i + 1; j < words.length; j++) {
-      const w = words[j];
-      if (w.startsWith("-")) {
-        if (VALUED_GLOBALS.has(w)) j++;
-        continue;
-      }
-      if (refused.includes(w)) {
-        return {
-          engine: bin,
-          subcommand: w,
-          message: `${PRODUCT} guard: an agent session does not run '${bin} ${w}'. Open a pull request; ${PRODUCT} previews it, and the update runs after a person approves the digest.`
-        };
-      }
-      break;
-    }
+function resolveStack(config2, path, key, dir) {
+  const [project, stack, extra] = key.split("/");
+  if (!project || !stack || extra !== void 0) return { error: `a stack is project/stack, as plywood.yml lists it, not '${key}'` };
+  const settings = toChantSettings(config2);
+  const listed = stacksOf(config2.doc);
+  const root = dirname11(path);
+  const member = settings.members.find((m) => m.name === key) ?? settings.memberDefaults;
+  if (dir === void 0 && Object.keys(listed).length > 0 && !(key in listed)) {
+    return { error: `${key} is not under stacks in ${path}; the stacks are ${Object.keys(listed).join(", ")} (or name its directory with --dir)` };
   }
-  return void 0;
+  const at = dir ?? listed[key]?.dir ?? ".";
+  return {
+    key,
+    project,
+    stack,
+    dir: isAbsolute2(at) ? at : resolve2(root, at),
+    ...member.engine ? { engine: member.engine } : {},
+    ...member.backend ? { backend: member.backend } : {}
+  };
 }
-var GUARD_TEMPLATES = new URL("../templates/agent-guard/", import.meta.url);
-var HOOK_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/plywood-guard.mjs"';
-function withGuardHook(settings) {
-  const hooks = typeof settings.hooks === "object" && settings.hooks !== null ? settings.hooks : {};
-  const pre = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
-  const has = JSON.stringify(pre).includes("plywood-guard.mjs");
-  if (!has) pre.push({ matcher: "Bash", hooks: [{ type: "command", command: HOOK_COMMAND }] });
-  return { ...settings, hooks: { ...hooks, PreToolUse: pre } };
+function requestRules(config2) {
+  const p = toChantSettings(config2).pipeline;
+  return { mode: p.approval ?? "ledger", ...p.quorum?.length ? { quorum: p.quorum } : {} };
 }
-async function guard(args, json, table, io) {
-  const [sub, ...rest] = args;
-  if (sub === "check") {
-    const line = (rest[0] === "--" ? rest.slice(1) : rest).join(" ");
-    if (!line.trim()) return usage("guard check takes the command line to check", table, io);
-    const v = guardVerdict(line);
-    if (json) io.out(JSON.stringify({ command: "guard check", ok: !v, exitCode: v ? table.denied : table.done, refused: v ?? null }));
-    else io.out(v ? v.message : `${PRODUCT} guard: '${line}' runs`);
-    return v ? table.denied : table.done;
-  }
-  if (sub === "install") {
-    const dirFlag = takeFlag(rest, "--dir");
-    if (dirFlag.missing) return usage("--dir takes a directory", table, io);
-    if (dirFlag.rest.length) return usage(`guard install does not take ${dirFlag.rest.join(" ")}`, table, io);
-    const root = dirFlag.value ? join16(io.cwd, dirFlag.value) : io.cwd;
-    const written = [];
-    const hookDir = join16(root, ".claude/hooks");
-    mkdirSync7(hookDir, { recursive: true });
-    copyFileSync(new URL("plywood-guard.mjs", GUARD_TEMPLATES), join16(hookDir, "plywood-guard.mjs"));
-    written.push(".claude/hooks/plywood-guard.mjs");
-    const settingsFile = join16(root, ".claude/settings.json");
-    let settings = {};
-    if (existsSync13(settingsFile)) {
-      try {
-        settings = JSON.parse(readFileSync15(settingsFile, "utf8"));
-      } catch (e) {
-        return usage(`.claude/settings.json is not JSON (${e.message}); fix it, then run this again`, table, io);
-      }
-    }
-    writeFileSync8(settingsFile, JSON.stringify(withGuardHook(settings), null, 2) + "\n");
-    written.push(".claude/settings.json");
-    const binDir = join16(root, ".plywood/agent-bin");
-    mkdirSync7(binDir, { recursive: true });
-    for (const name of Object.keys(GUARDED)) {
-      const to = join16(binDir, name);
-      copyFileSync(new URL(`bin/${name}`, GUARD_TEMPLATES), to);
-      chmodSync(to, 493);
-      written.push(`.plywood/agent-bin/${name}`);
-    }
-    if (json) io.out(JSON.stringify({ command: "guard install", ok: true, exitCode: table.done, written }));
-    else {
-      for (const f of written) io.err(`${PRODUCT} guard: wrote ${f}`);
-      io.err(`${PRODUCT} guard: an agent session that runs outside Claude Code puts .plywood/agent-bin first on PATH and sets PLYWOOD_AGENT_GUARD=1`);
-    }
-    return table.done;
-  }
-  return usage(`guard takes check <command line> or install [--dir <d>]`, table, io);
-}
-
-// src/identities.ts
-init_jobs2();
-init_chant_config();
-init_identity();
-init_config();
-init_stacks();
-init_stages();
-init_words();
-import { existsSync as existsSync14, readFileSync as readFileSync16 } from "node:fs";
-import { dirname as dirname12, join as join17 } from "node:path";
-import { targetGlobMatch } from "@intentius/chant/ci-identity";
-function identityRows(config2, env) {
-  const doc = config2.doc;
-  const out = [];
-  for (const stack of Object.keys(stacksOf(doc))) {
-    const ids = stackIdentities(doc, stack, env, targetGlobMatch);
-    for (const cloud of IDENTITY_CLOUDS) {
-      const id = ids[cloud];
-      if (id) out.push({ stack, cloud, preview: id.preview, up: id.up, rule: id.rule });
-    }
-  }
-  return out;
+function requesterOf(by, env) {
+  return by ?? env.GITHUB_ACTOR ?? env.GITLAB_USER_LOGIN ?? env.USER ?? "unknown";
 }
-function identityLines(config2, env, rows) {
-  const doc = config2.doc;
-  const block = chantIdentityOf(doc);
-  if (!block) return [`${config2.file ?? "plywood.yml"}: no identity; every job runs as ${NO_IDENTITY}`];
-  const lines2 = [`${config2.file ?? "plywood.yml"}: identities in environment ${env}`];
-  const clouds = Object.keys(block.cloud);
-  lines2.push(`  clouds  ${clouds.map((c) => CLOUD_NAMES[c]).join(", ")}`);
-  if (clouds.includes("pulumi")) {
-    const p = pulumiCloudOf(doc);
-    lines2.push(`  Pulumi Cloud  ${p.org}${p.apiUrl ? ` at ${p.apiUrl}` : ""}; ESC environments open with each job's own token`);
-  }
-  const stacks2 = Object.keys(stacksOf(doc));
-  if (stacks2.length === 0) lines2.push("  plywood.yml lists no stacks; the rules apply to each stack plywood init finds");
-  for (const stack of stacks2) {
-    lines2.push(`  ${stack}`);
-    for (const cloud of clouds) {
-      const r = rows.find((x) => x.stack === stack && x.cloud === cloud);
-      lines2.push(r ? `    ${CLOUD_NAMES[cloud].padEnd(12)} preview ${r.preview}, up ${r.up} (${r.rule})` : `    ${CLOUD_NAMES[cloud].padEnd(12)} ${NO_IDENTITY}`);
-    }
-  }
-  lines2.push("  The preview job trades its OIDC token before checkout, and no later step holds a forge token.");
-  return lines2;
+function destStackName(source, dest, config2) {
+  if (dest.project === source.project) return dest.stack;
+  const cloud = !dest.backend || /^https?:\/\//.test(dest.backend);
+  const org = cloud ? pulumiCloudOf(config2.doc).org : void 0;
+  return `${org ?? "organization"}/${dest.project}/${dest.stack}`;
 }
-function configIdentities(args, json, table, io) {
-  const file = takeFlag(args, "--file");
-  const env = takeFlag(file.rest, "--env");
-  if (file.missing || env.missing) return usage(`${file.missing ? "--file" : "--env"} takes a value`, table, io);
-  if (env.rest.length) return usage(`config identities does not take ${env.rest.join(" ")}`, table, io);
-  const path = file.value ?? findConfig(io.cwd);
-  if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init', or pass --file`, table, io);
-  let config2;
-  try {
-    config2 = loadConfig(path);
-  } catch (e) {
-    return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
-  }
-  const errors = checkConfig(config2).filter((p) => p.severity === "error");
-  if (errors.length) {
-    for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
-    if (json) io.out(JSON.stringify({ command: "config identities", ok: false, exitCode: table.failed, file: path, problems: errors }));
-    return table.failed;
-  }
-  const environment = env.value ?? "production";
-  const rows = identityRows(config2, environment);
-  if (json) io.out(JSON.stringify({ command: "config identities", ok: true, exitCode: table.done, file: path, env: environment, identity: toChantSettings(config2).ci.identity ?? null, stacks: rows }));
-  else for (const line of identityLines(config2, environment, rows)) io.out(line);
-  return table.done;
+function approveRequestLine(gate, digest, mode) {
+  return `${PRODUCT} approve ${gate} --op ${STACK_OPS_OP} --plan ${digest}${mode === "sealed" ? " --sign" : ""}`;
 }
-var FORGE_CHECK_MESSAGE = `${PRODUCT} forge check holds the identities next to the forge's environments, protected branches and each cloud's trust policy. The read is chant's (@intentius/chant/forge-check, chant#4608), and the installed chant lacks it; it comes with the chant release after 0.124.54. Run '${PRODUCT} config identities' for what the jobs will hold.`;
-var FORGES2 = ["github", "gitlab", "forgejo"];
-var FORGE_CHECK_FUNCTIONS = ["forgeCheck", "forgeCheckExit", "describeForgeCheck", "forgeCheckTarget", "pipelineContract"];
-var forgeCheckModule;
-function chantForgeCheck() {
-  forgeCheckModule ??= (async () => {
-    try {
-      const fc = await import("@intentius/chant/forge-check");
-      const id = await import("@intentius/chant/ci-identity");
-      if (!FORGE_CHECK_FUNCTIONS.every((f) => typeof fc[f] === "function") || typeof id.resolveCloudIdentity !== "function") return void 0;
-      return { ...fc, resolveCloudIdentity: id.resolveCloudIdentity };
-    } catch {
-      return void 0;
-    }
-  })();
-  return forgeCheckModule;
+function useBackend(stacks2, env) {
+  const named = [...new Set(stacks2.map((s) => s.backend).filter((b) => b !== void 0))];
+  if (named.length > 1) return `the stacks are on different backends (${named.join(", ")}); a move needs both on one backend`;
+  if (named[0] && !env.PULUMI_BACKEND_URL) env.PULUMI_BACKEND_URL = named[0];
+  return void 0;
 }
-function workspaceMembers(root) {
-  const file = join17(root, "chant.workspace.json");
-  if (!existsSync14(file)) return [];
-  try {
-    const doc = JSON.parse(readFileSync16(file, "utf8"));
-    return (doc.members ?? []).map((m) => m.name).filter((n) => typeof n === "string");
-  } catch {
-    return [];
+function reportOutcome(verb, outcome, gate, rules, done, json, table, io) {
+  const approveLine = outcome.status === "waiting" || outcome.status === "refused" ? approveRequestLine(gate, outcome.digest, rules.mode) : void 0;
+  let code;
+  let text;
+  switch (outcome.status) {
+    case "waiting":
+      code = table.waiting;
+      text = STACK_OP_WORDS.waiting(verb, approveLine);
+      break;
+    case "refused":
+      code = table.waiting;
+      text = `${outcome.reason}. ${STACK_OP_WORDS.waiting(verb, approveLine)}`;
+      break;
+    case "spent":
+      code = table.failed;
+      text = STACK_OP_WORDS.spent(verb);
+      break;
+    case "done":
+      code = table.done;
+      text = done(outcome.result);
+      break;
+    case "failed":
+      code = table.failed;
+      text = `${PRODUCT} ${verb}: ${outcome.error}`;
+      break;
   }
+  if (json) {
+    io.out(JSON.stringify({
+      command: verb,
+      ok: code === table.done,
+      exitCode: code,
+      status: outcome.status,
+      op: STACK_OPS_OP,
+      gate,
+      digest: outcome.digest,
+      ...approveLine ? { approve: approveLine } : {},
+      ...outcome.status === "done" ? { result: outcome.result } : {},
+      ...outcome.status === "failed" ? { error: outcome.error } : {},
+      ...outcome.status === "refused" ? { refusedBy: outcome.by, reason: outcome.reason } : {}
+    }));
+  } else (code === table.done ? io.out : io.err)(text);
+  return code;
 }
-function upRunner(runner) {
-  if (runner === void 0) return void 0;
-  const staged = typeof runner === "object" && !Array.isArray(runner) && !("group" in runner);
-  const spec = staged ? runner.up ?? runner.default : runner;
-  if (spec === void 0) return void 0;
-  if (typeof spec === "string") return { labels: [spec] };
-  if (Array.isArray(spec)) return { labels: spec.filter((l) => typeof l === "string") };
-  const g = spec;
-  return typeof g.group === "string" ? { labels: Array.isArray(g.labels) ? g.labels : [], group: g.group } : void 0;
-}
-function contractPipelines(fc, cloud, env, members, runner, jobs2) {
-  const applyRunner = upRunner(runner);
-  const list = members.length ? [...members] : [void 0];
-  return list.flatMap((member) => {
-    const identity2 = fc.resolveCloudIdentity(cloud, env, member);
-    const name = member ? `${member}/${env}` : env;
-    const forgeEnvironment = jobs2 ? environmentFor(name, jobs2)?.name : void 0;
-    return identity2 ? [{ name, identity: identity2, ...member ? { member } : {}, ...applyRunner ? { applyRunner } : {}, ...forgeEnvironment ? { forgeEnvironment } : {} }] : [];
-  });
-}
-async function forgeCheck(args, json, table, io) {
-  if (args[0] !== "check") return usage(`unknown forge command '${args[0] ?? ""}'. Run '${PRODUCT} forge check'.`, table, io);
-  const fc = await chantForgeCheck();
-  if (!fc) {
-    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, error: FORGE_CHECK_MESSAGE }));
-    else io.err(`${PRODUCT}: ${FORGE_CHECK_MESSAGE}`);
+async function runRequest(verb, json, table, io, call) {
+  const ops = await chantStackOps();
+  if (!ops) {
+    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} ${verb}`, "the gated stack operations (chant#4578)")}`);
     return table.failed;
   }
-  const requireClouds = args.includes("--require-clouds");
-  let rest = args.slice(1).filter((a) => a !== "--require-clouds");
-  const flags = {};
-  for (const flag of ["--file", "--env", "--forge", "--repo", "--branch"]) {
-    const f = takeFlag(rest, flag);
-    if (f.missing) return usage(`${flag} takes a value`, table, io);
-    flags[flag] = f.value;
-    rest = f.rest;
-  }
-  if (rest.length) return usage(`forge check does not take ${rest.join(" ")}`, table, io);
-  const forgeFlag = flags["--forge"];
-  if (forgeFlag !== void 0 && !FORGES2.includes(forgeFlag)) return usage(`--forge is ${forgeFlag}; give github, gitlab or forgejo`, table, io);
-  const path = flags["--file"] ?? findConfig(io.cwd);
-  if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init', or pass --file`, table, io);
-  let config2;
   try {
-    config2 = loadConfig(path);
+    return await call(ops);
   } catch (e) {
-    return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
-  }
-  const errors = checkConfig(config2).filter((p) => p.severity === "error");
-  if (errors.length) {
-    for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
-    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, file: path, problems: errors }));
+    const message = e.message;
+    if (json) io.out(JSON.stringify({ command: verb, ok: false, exitCode: table.failed, error: message }));
+    else io.err(`${PRODUCT} ${verb}: ${message}`);
     return table.failed;
   }
-  const settings = toChantSettings(config2);
-  const kind = forgeFlag ?? settings.pipeline.forge?.kind;
-  let target;
-  try {
-    target = fc.forgeCheckTarget(io.env, { ...kind && FORGES2.includes(kind) ? { kind } : {}, ...flags["--repo"] ? { repo: flags["--repo"] } : {} });
-  } catch (e) {
-    return usage(e.message, table, io);
-  }
-  const env = flags["--env"] ?? "production";
-  const cloud = settings.ci.identity?.cloud;
-  const pipelines = contractPipelines(fc, cloud, env, workspaceMembers(dirname12(path)), settings.pipeline.runner, settings.pipeline.jobs);
-  const result = await fc.forgeCheck(
-    {
-      target,
-      words: PRODUCT_WORDS,
-      file: path,
-      ...requireClouds ? { requireClouds: true } : {},
-      contract: (live) => fc.pipelineContract({
-        forge: target.kind,
-        repository: {
-          host: target.host,
-          path: live.path ?? target.repo,
-          defaultBranch: flags["--branch"] ?? live.defaultBranch ?? "main",
-          ...live.ownerId ? { ownerId: live.ownerId } : {},
-          ...live.repoId ? { repoId: live.repoId } : {}
-        },
-        pipelines,
-        words: PRODUCT_WORDS
-      })
-    },
-    { fetch: globalThis.fetch, env: io.env }
-  );
-  if (json) io.out(JSON.stringify(result));
-  else io.out(fc.describeForgeCheck(result));
-  if (!cloud) io.err(`${PRODUCT} forge check: ${path} sets no identity, so no trust was checked`);
-  else if (pipelines.length === 0) io.err(`${PRODUCT} forge check: no identity rule covers environment ${env}, so no trust was checked`);
-  return fc.forgeCheckExit(result);
 }
-
-// src/cli.ts
-init_control2();
-
-// src/telemetry.ts
-init_chant_product();
-init_observe();
-init_config();
-init_words();
-function telemetryEnv(doc, env) {
-  const t = telemetryOf(doc);
-  const out = {};
-  const set = (k, v) => {
-    if (v !== void 0 && v !== "" && env[k] === void 0) out[k] = v;
-  };
-  if (!t.traces) {
-    set("OTEL_TRACES_EXPORTER", "none");
-    return out;
+function commonFlags(args) {
+  const by = takeFlag(args, "--by");
+  const dir = takeFlag(by.rest, "--dir");
+  if (by.missing) return { rest: args, missing: "--by" };
+  if (dir.missing) return { rest: args, missing: "--dir" };
+  return { by: by.value, dir: dir.value, rest: dir.rest };
+}
+async function exportStack(args, json, table, io) {
+  const common = commonFlags(args);
+  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
+  const out = takeFlag(common.rest, "--out");
+  if (out.missing) return usage("--out takes a file path outside the repository", table, io);
+  const extra = out.rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`export does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(out.rest);
+  if (named.length !== 1) return usage(`export takes one stack: ${STACK_OP_WORDS.usage.export}`, table, io);
+  if (!out.value) return usage(`export needs --out <file>, a path on your machine outside every git working tree: ${STACK_OP_WORDS.usage.export}`, table, io);
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const stack = resolveStack(read.config, read.path, named[0], common.dir);
+  if ("error" in stack) return usage(stack.error, table, io);
+  useBackend([stack], io.env);
+  const rules = requestRules(read.config);
+  const outFile = resolve2(io.cwd, out.value);
+  return runRequest("export", json, table, io, async (ops) => {
+    const outcome = await ops.gatedStackExport({
+      by: requesterOf(common.by, io.env),
+      rules,
+      op: STACK_OPS_OP,
+      ledgerCwd: io.cwd,
+      env: io.env,
+      dir: stack.dir,
+      stack: stack.stack,
+      out: outFile,
+      ...stack.engine ? { engine: stack.engine } : {}
+    });
+    return reportOutcome("export", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.exported(stack.key, r), json, table, io);
+  });
+}
+async function cancelStack(args, json, table, io) {
+  const common = commonFlags(args);
+  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
+  const lock = takeFlag(common.rest, "--lock");
+  if (lock.missing) return usage("--lock takes the lock id", table, io);
+  const extra = lock.rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`cancel does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(lock.rest);
+  if (named.length !== 1) return usage(`cancel takes one stack: ${STACK_OP_WORDS.usage.cancel}`, table, io);
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const stack = resolveStack(read.config, read.path, named[0], common.dir);
+  if ("error" in stack) return usage(stack.error, table, io);
+  useBackend([stack], io.env);
+  const lockId = await lockToCancel(lock.value, stack, io.env);
+  if ("error" in lockId) return usage(lockId.error, table, io);
+  if (lockId.read && !json) io.err(`${PRODUCT} cancel: ${stack.key} holds lock ${lockId.lockId}`);
+  const rules = requestRules(read.config);
+  return runRequest("cancel", json, table, io, async (ops) => {
+    const outcome = await ops.gatedStackCancel({
+      by: requesterOf(common.by, io.env),
+      rules,
+      op: STACK_OPS_OP,
+      ledgerCwd: io.cwd,
+      env: io.env,
+      dir: stack.dir,
+      stack: stack.stack,
+      lockId: lockId.lockId,
+      project: stack.project,
+      ...stack.engine ? { engine: stack.engine } : {}
+    });
+    return reportOutcome("cancel", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.cancelled(stack.key, lockId.lockId, r.lockChecked), json, table, io);
+  });
+}
+async function moveStack(args, json, table, io) {
+  const onto = takeFlag(args, "--onto");
+  if (onto.missing) return usage("--onto takes plunge", table, io);
+  if (onto.value !== void 0) return moveOntoPlunge(onto.value, onto.rest, json, table, io);
+  const common = commonFlags(onto.rest);
+  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
+  const from = takeFlag(common.rest, "--from");
+  const to = takeFlag(from.rest, "--to");
+  if (from.missing || to.missing) return usage(`${from.missing ? "--from" : "--to"} takes a stack, as project/stack`, table, io);
+  const extra = to.rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`move does not take ${extra.join(" ")}`, table, io);
+  if (common.dir !== void 0) return usage("move reads each stack's directory from plywood.yml's stacks, so it does not take --dir", table, io);
+  const urns = positionals(to.rest);
+  if (!from.value || !to.value) return usage(`move needs --from and --to: ${STACK_OP_WORDS.usage.move}`, table, io);
+  if (urns.length === 0) return usage(`move names each resource it moves by URN: ${STACK_OP_WORDS.usage.move}`, table, io);
+  const bad = urns.filter((u) => !u.startsWith("urn:pulumi:"));
+  if (bad.length) return usage(`move takes URNs (urn:pulumi:...), not ${bad.join(", ")}; 'pulumi stack --show-urns' lists them`, table, io);
+  if (from.value === to.value) return usage(`--from and --to are both ${from.value}; a move is between two stacks`, table, io);
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const source = resolveStack(read.config, read.path, from.value, void 0);
+  if ("error" in source) return usage(source.error, table, io);
+  const dest = resolveStack(read.config, read.path, to.value, void 0);
+  if ("error" in dest) return usage(dest.error, table, io);
+  const backend = useBackend([source, dest], io.env);
+  if (backend) return usage(backend, table, io);
+  const rules = requestRules(read.config);
+  const destName = destStackName(source, dest, read.config);
+  const engine2 = source.engine ?? dest.engine;
+  return runRequest("move", json, table, io, async (ops) => {
+    const outcome = await ops.gatedStackMove({
+      by: requesterOf(common.by, io.env),
+      rules,
+      op: STACK_OPS_OP,
+      ledgerCwd: io.cwd,
+      env: io.env,
+      source: { member: source.key, dir: source.dir, stack: source.stack },
+      dest: { member: dest.key, dir: dest.dir, stack: destName },
+      urns,
+      ...engine2 ? { engine: engine2 } : {}
+    });
+    return reportOutcome("move", outcome, `move:${source.stack}:${destName}`, rules, (r) => STACK_OP_WORDS.moved(source.key, dest.key, r), json, table, io);
+  });
+}
+async function moveOntoPlunge(engine2, args, json, table, io) {
+  if (engine2 !== "plunge") return usage(`--onto takes plunge, not '${engine2}'; a move between backends is an export and an import (see '${PRODUCT} export')`, table, io);
+  const extra = args.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`move --onto does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(args);
+  if (named.length > 1) return usage(`move --onto plunge takes at most one stack`, table, io);
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const opFile = join16(dirname11(read.path), ADOPT_OP_FILE);
+  if (!existsSync13(opFile)) return usage(STACK_OP_WORDS.noAdoptOp(opFile), table, io);
+  if (named[0]) {
+    const stack = resolveStack(read.config, read.path, named[0], void 0);
+    if ("error" in stack) return usage(stack.error, table, io);
+    if (!json) io.err(STACK_OP_WORDS.adoptAll(stack.key));
   }
-  if (env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT === void 0) set("OTEL_EXPORTER_OTLP_ENDPOINT", t.endpoint);
-  if (t.headersEnv) set("OTEL_EXPORTER_OTLP_HEADERS", env[t.headersEnv]);
-  if (t.endpoint !== void 0 || env.OTEL_EXPORTER_OTLP_ENDPOINT !== void 0 || env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT !== void 0) set("OTEL_SERVICE_NAME", t.serviceName);
-  return out;
+  const argv = ["run", ADOPT_OP, ...json ? ["--json"] : []];
+  return withChant(`${PRODUCT} move --onto plunge`, table, io, async (chant) => {
+    const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
+    if (code === table.waiting && !json) io.err(STACK_OP_WORDS.adoptWaiting);
+    return code === table.waiting ? code : explainRefusal(code, table, io.err);
+  });
 }
-async function applyTelemetry(cwd, env = process.env) {
-  let added = {};
-  try {
-    const file = findConfig(cwd);
-    if (file) added = telemetryEnv(loadConfig(file).doc, env);
-  } catch {
-    return {};
+async function rollbackStack(args, json, table, io) {
+  const release2 = takeFlag(args, "--release");
+  const env = takeFlag(release2.rest, "--env");
+  const digest = takeFlag(env.rest, "--digest");
+  const actor = takeFlag(digest.rest, "--actor");
+  for (const [flag, f] of [["--release", release2], ["--env", env], ["--digest", digest], ["--actor", actor]]) {
+    if (f.missing) return usage(`${flag} takes a value`, table, io);
   }
-  Object.assign(env, added);
+  const switches = actor.rest.filter((a) => a === "--dry-run" || a === "--events-json");
+  const rest = actor.rest.filter((a) => !switches.includes(a));
+  const extra = rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`rollback does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(rest);
+  if (named.length > 1) return usage(`rollback takes one stack: ${STACK_OP_WORDS.usage.rollback}`, table, io);
+  let argv;
+  if (release2.value !== void 0) {
+    if (named.length) return usage(STACK_OP_WORDS.releaseIsEnvWide(named[0], environmentOf(named[0])), table, io);
+    if (digest.value !== void 0) return usage("--release takes no --digest: the release names what each stack goes back to", table, io);
+    if (!env.value) return usage(`rollback --release needs --env <env>, the environment whose stacks go back: ${STACK_OP_WORDS.usage.rollback}`, table, io);
+    argv = ["components", "rollback", env.value, "--release", release2.value];
+  } else {
+    if (named.length !== 1) return usage(`rollback takes a stack, or --release <name> --env <env>: ${STACK_OP_WORDS.usage.rollback}`, table, io);
+    const read = readConfig(io.cwd);
+    if ("error" in read) return usage(read.error, table, io);
+    const stack = resolveStack(read.config, read.path, named[0], void 0);
+    if ("error" in stack) return usage(stack.error, table, io);
+    argv = ["components", "rollback", env.value ?? environmentOf(stack.stack), "--component", slug(stack.key), ...digest.value ? ["--digest", digest.value] : []];
+  }
+  argv.push(...actor.value ? ["--actor", actor.value] : [], ...switches, ...json ? ["--json"] : []);
+  if (!await chantStackRollback()) {
+    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} rollback`, "rollback by release for stacks (chant#4542)")}`);
+    return table.failed;
+  }
+  return withChant(`${PRODUCT} rollback`, table, io, async (chant) => {
+    const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
+    if (code === table.waiting && !json) io.err(STACK_OP_WORDS.rollbackWaiting);
+    return code === table.waiting ? code : explainRefusal(code, table, io.err);
+  });
+}
+
+// src/actions.ts
+init_words();
+var actionSubject = (stack, name) => `action:${stack}:${name}`;
+var cachedAction;
+function chantStackAction() {
+  cachedAction ??= import("@intentius/chant-lexicon-pulumi").then((m) => m.gatedStackAction);
+  return cachedAction;
+}
+async function fromEvent(env) {
   const chant = await chantProduct();
-  if (chant && typeof chant.configureOtlp === "function") chant.configureOtlp({ prefix: PRODUCT, env });
-  return added;
+  if (!chant) return { error: `${PRODUCT} action --from-event reads the action job's comment or inputs through chant's productActionFromEnv, and chant's product entry did not load` };
+  const words = chant.assertProductWords({ ...PRODUCT_WORDS, commands: { ...PRODUCT_WORDS.commands, ...ACTION_COMMAND } });
+  const asked = chant.productActionFromEnv(words, env);
+  if (asked.kind === "refused") return { error: `the action job was asked for no action: ${asked.reason}` };
+  return { stack: asked.member, name: asked.address };
+}
+async function action(args, json, table, io) {
+  const event = args.includes("--from-event");
+  const anew = event || args.includes("--anew");
+  const common = commonFlags(args.filter((a) => a !== "--from-event" && a !== "--anew"));
+  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
+  const extra = common.rest.filter((a) => a.startsWith("-"));
+  if (extra.length) return usage(`action does not take ${extra.join(" ")}`, table, io);
+  const named = positionals(common.rest);
+  let key;
+  let name;
+  if (event) {
+    if (named.length) return usage(`action --from-event reads the stack and the action from the job's event, so it takes neither: ${STACK_OP_WORDS.usage.action}`, table, io);
+    const asked = await fromEvent(io.env);
+    if ("error" in asked) return usage(asked.error, table, io);
+    ({ stack: key, name } = asked);
+  } else {
+    if (named.length !== 2) return usage(`action takes a stack and an action's name: ${STACK_OP_WORDS.usage.action}`, table, io);
+    [key, name] = named;
+  }
+  const read = readConfig(io.cwd);
+  if ("error" in read) return usage(read.error, table, io);
+  const stack = resolveStack(read.config, read.path, key, common.dir);
+  if ("error" in stack) return usage(stack.error, table, io);
+  const declared = actionsOf(read.config.doc, stack.key);
+  const chosen = declared.find((a) => a.name === name);
+  if (!chosen) return usage(STACK_OP_WORDS.noAction(stack.key, name, declared.map((a) => a.name)), table, io);
+  const gated = await chantStackAction();
+  useBackend([stack], io.env);
+  const rules = requestRules(read.config);
+  try {
+    const outcome = await gated({
+      by: requesterOf(common.by, io.env),
+      rules,
+      op: STACK_OPS_OP,
+      ledgerCwd: io.cwd,
+      env: io.env,
+      dir: stack.dir,
+      stack: stack.stack,
+      urn: chosen.urn,
+      name: chosen.name,
+      ...stack.engine ? { engine: stack.engine } : {},
+      ...anew ? { anew: true } : {}
+    });
+    return reportOutcome("action", outcome, actionSubject(stack.stack, chosen.name), rules, (r) => STACK_OP_WORDS.acted(stack.key, chosen.name, r), json, table, io);
+  } catch (e) {
+    const err = e;
+    const refusal = typeof err.code === "string" && err.code.startsWith("action-") ? err.code : void 0;
+    const urns = Array.isArray(err.urns) ? err.urns : [];
+    if (json) {
+      io.out(JSON.stringify({
+        command: "action",
+        ok: false,
+        exitCode: table.failed,
+        op: STACK_OPS_OP,
+        gate: actionSubject(stack.stack, chosen.name),
+        error: err.message,
+        ...refusal ? { refusal } : {},
+        ...urns.length ? { urns } : {}
+      }));
+    } else io.err(`${PRODUCT} action: ${err.message}`);
+    return table.failed;
+  }
+}
+
+// src/audit.ts
+init_detect();
+init_stages();
+init_words();
+var AUDIT_TABLES = { approvals: "gates", updates: "applies", runs: "runs", "review-stacks": "pr_envs" };
+var DEFAULT_AUDIT_TABLE = "approvals";
+function auditTable(word) {
+  const w = word ?? DEFAULT_AUDIT_TABLE;
+  return AUDIT_TABLES[w] ?? w;
+}
+function auditMember(stack) {
+  const [project, name] = stack.split("/");
+  return project && name ? slug(project).slice(0, 36).replace(/-+$/, "") : void 0;
+}
+function auditArgv(args, json) {
+  const stack = takeFlag(args, "--stack");
+  const since = takeFlag(stack.rest, "--since");
+  const at = takeFlag(since.rest, "--at");
+  for (const [flag, f] of [["--stack", stack], ["--since", since], ["--at", at]]) if (f.missing) return { error: `${flag} takes a value` };
+  const wheres = [];
+  const rest = [];
+  for (let i = 0; i < at.rest.length; i++) {
+    const a = at.rest[i];
+    if (a === "--where") {
+      const v = at.rest[i + 1];
+      if (v === void 0 || v.startsWith("--")) return { error: "--where takes <field><op><value>, such as gate=wave-2" };
+      wheres.push("--where", v);
+      i++;
+    } else rest.push(a);
+  }
+  const flags = rest.filter((a) => a.startsWith("-"));
+  if (flags.length) return { error: `audit does not take ${flags.join(" ")}` };
+  if (rest.length > 1) return { error: `audit reads one table: ${Object.keys(AUDIT_TABLES).join(", ")}, or a chant ledger table` };
+  let member;
+  if (stack.value !== void 0) {
+    member = auditMember(stack.value);
+    if (!member) return { error: `--stack takes project/stack, not '${stack.value}'` };
+  }
+  return [
+    "ledger",
+    auditTable(rest[0]),
+    ...member ? ["--member", member] : [],
+    ...since.value ? ["--since", since.value] : [],
+    ...wheres,
+    ...at.value ? ["--at", at.value] : [],
+    ...json ? ["--json"] : []
+  ];
+}
+async function audit2(args, json, table, io) {
+  const argv = auditArgv(args, json);
+  if ("error" in argv) return usage(argv.error, table, io);
+  return withChant(`${PRODUCT} audit`, table, io, (chant) => chant.runChantInProcess(argv, PRODUCT_WORDS));
+}
+
+// src/cli.ts
+init_agents2();
+init_drift2();
+
+// src/estate.ts
+init_chant_product();
+init_chant_config();
+init_config();
+init_stages();
+init_words();
+import { dirname as dirname12 } from "node:path";
+var estateModule;
+function chantEstate() {
+  estateModule ??= (async () => {
+    try {
+      const m = await import("@intentius/chant/ci-estate");
+      const r = await import("@intentius/chant/pr-report-url");
+      if (!["readEstateLedger", "buildLedgerEstate", "writeEstate"].every((f) => typeof m[f] === "function")) return void 0;
+      if (typeof r.parseReportUrl !== "function" || typeof r.reportPut !== "function") return void 0;
+      return { ...m, parseReportUrl: r.parseReportUrl, reportPut: r.reportPut };
+    } catch {
+      return void 0;
+    }
+  })();
+  return estateModule;
+}
+var ESTATE_NEEDS_CHANT = `${PRODUCT} estate needs chant >= the release after 0.124.54, which carries @intentius/chant/ci-estate (chant#4612). Run '${PRODUCT} audit' for the ledger's rows on this chant.`;
+function estateSchedules(config2) {
+  const drift3 = toChantSettings(config2).pipeline.drift;
+  const driftOps = (drift3?.stacks ?? []).map(driftOpName);
+  const schedules = drift3?.schedule ? driftOps.map((op) => ({ op, cron: drift3.schedule })) : [];
+  return { schedules, driftOps };
+}
+async function estate(args, json, table, io) {
+  const failOverdue = args.includes("--fail-overdue");
+  let rest = args.filter((a) => a !== "--fail-overdue");
+  const flags = {};
+  for (const flag of ["--file", "--report-url", "--prefix"]) {
+    const f = takeFlag(rest, flag);
+    if (f.missing) return usage(`${flag} takes a value`, table, io);
+    flags[flag] = f.value;
+    rest = f.rest;
+  }
+  if (rest.length) return usage(`estate does not take ${rest.join(" ")}`, table, io);
+  const chant = await chantEstate();
+  if (!chant) {
+    if (json) io.out(JSON.stringify({ command: "estate", ok: false, exitCode: table.failed, error: ESTATE_NEEDS_CHANT }));
+    else io.err(`${PRODUCT}: ${ESTATE_NEEDS_CHANT}`);
+    return table.failed;
+  }
+  const path = flags["--file"] ?? findConfig(io.cwd);
+  let config2;
+  if (path) {
+    try {
+      config2 = loadConfig(path);
+    } catch (e) {
+      return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
+    }
+    const errors = checkConfig(config2).filter((p) => p.severity === "error");
+    if (errors.length) {
+      for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
+      return table.failed;
+    }
+  }
+  const { schedules, driftOps } = config2 ? estateSchedules(config2) : { schedules: [], driftOps: [] };
+  const product = await chantProduct();
+  const words = product ? product.assertProductWords(PRODUCT_WORDS) : PRODUCT_WORDS;
+  const root = path ? dirname12(path) : io.cwd;
+  const load = await chant.readEstateLedger(root);
+  const built = chant.buildLedgerEstate({ load, words, schedules, ...driftOps.length ? { driftOps } : {} });
+  const url = flags["--report-url"] ?? (config2 ? toChantSettings(config2).ci.reportUrl : void 0);
+  let written;
+  if (url) {
+    const target = chant.parseReportUrl(url, flags["--report-url"] ? "--report-url" : "reports.url");
+    if (target && typeof target === "object" && "error" in target) return usage(String(target.error), table, io);
+    written = await chant.writeEstate(built, { put: chant.reportPut(target), words, env: io.env, ...flags["--prefix"] ? { prefix: flags["--prefix"] } : {} });
+  }
+  const code = failOverdue && built.overdue.length > 0 ? table.failed : table.done;
+  if (json) {
+    io.out(JSON.stringify({ command: "estate", ok: code === table.done, exitCode: code, estate: built.estate, dora: built.dora, overdue: built.overdue, ...written ? { written } : {} }));
+    return code;
+  }
+  const totals = built.estate.totals ?? {};
+  io.out(`${PRODUCT} estate: ${Object.entries(totals).map(([k, v]) => `${v} ${k}`).join(", ") || "nothing on the ledger yet"}`);
+  for (const o of built.overdue) io.out(`  ${o.message}`);
+  if (written) io.out(`  wrote ${written.keys.join(", ")} under ${url}`);
+  else io.out(`  no report URL (reports.url or --report-url), so nothing was written`);
+  return code;
+}
+
+// src/notify.ts
+init_stages();
+init_words();
+var RELAY_NEEDS_CHANT = `${PRODUCT} notify relay needs chant >= the release after 0.124.54, which carries chant notify relay (chant#4611).`;
+async function notify(args, json, table, io) {
+  if (args[0] !== "relay") return usage(`unknown notify command '${args[0] ?? ""}'. Run '${PRODUCT} notify relay'.`, table, io);
+  return withChant(`${PRODUCT} notify relay`, table, io, (chant) => {
+    if (typeof chant.startRelayServer !== "function") {
+      if (json) io.out(JSON.stringify({ command: "notify relay", ok: false, exitCode: table.failed, error: RELAY_NEEDS_CHANT }));
+      else io.err(`${PRODUCT}: ${RELAY_NEEDS_CHANT}`);
+      return Promise.resolve(table.failed);
+    }
+    return chant.runChantInProcess(["notify", ...args], PRODUCT_WORDS);
+  });
 }
 
 // src/cli.ts
-init_init();
-init_stages();
-init_tips();
-init_images();
-init_up();
+init_policy();
 
-// src/upgrade.ts
-init_config();
-init_images();
+// src/guard.ts
 init_stages();
 init_words();
-import { execFile } from "node:child_process";
-import { existsSync as existsSync15, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname13, join as join18, relative as relative2, resolve as resolve2 } from "node:path";
-var PLYWOOD_PACKAGE = "@intentius/plywood";
-var CHANT_PACKAGE = "@intentius/chant";
-var CHANT_FAMILY = /^@intentius\/chant(?:-lexicon-[a-z0-9-]+)?$/;
-var VERSION2 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
-var DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies"];
-function parseUpgradeArgs(args) {
-  const chant = takeFlag(args, "--chant");
-  const forge = takeFlag(chant.rest, "--forge");
-  const env = takeFlag(forge.rest, "--env");
-  if (chant.missing || forge.missing || env.missing) return { error: "--chant, --forge and --env each take a value" };
-  const flags = /* @__PURE__ */ new Set(["--no-install", "--dry-run"]);
-  const unknown = env.rest.filter((a) => a.startsWith("-") && !flags.has(a));
-  if (unknown.length) return { error: `upgrade does not take ${unknown.join(" ")}` };
-  const words = env.rest.filter((a) => !a.startsWith("-"));
-  if (words.length > 1) return { error: `upgrade takes one version, not ${words.join(" ")}` };
-  const version2 = words[0]?.replace(/^v/, "");
-  if (version2 !== void 0 && !VERSION2.test(version2)) return { error: `${words[0]} is not a version: give it as MAJOR.MINOR.PATCH` };
-  if (chant.value !== void 0 && !VERSION2.test(chant.value)) return { error: `--chant ${chant.value} is not a version: give it as MAJOR.MINOR.PATCH` };
-  return {
-    ...version2 ? { version: version2 } : {},
-    ...chant.value ? { chant: chant.value } : {},
-    ...forge.value ? { forge: forge.value } : {},
-    ...env.value ? { env: env.value } : {},
-    install: !env.rest.includes("--no-install"),
-    dryRun: env.rest.includes("--dry-run")
-  };
-}
-function findPlywoodPackage(dir) {
-  let cur = resolve2(dir);
-  for (let depth = 0; depth < 32; depth++) {
-    const file = join18(cur, "package.json");
-    if (existsSync15(file)) {
-      try {
-        const pkg = JSON.parse(readFileSync17(file, "utf8"));
-        if (DEP_FIELDS.some((f) => isObject2(pkg[f]) && typeof pkg[f][PLYWOOD_PACKAGE] === "string")) return file;
-      } catch {
-      }
-    }
-    const up2 = dirname13(cur);
-    if (up2 === cur) return void 0;
-    cur = up2;
-  }
-  return void 0;
-}
-function movedRange(range, version2) {
-  const m = /^([~^]?)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(range.trim());
-  if (!m) return void 0;
-  return `${m[1]}${version2}`;
+import { chmodSync, copyFileSync, existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join17 } from "node:path";
+var GUARDED = {
+  pulumi: ["up", "update", "destroy"],
+  plunge: ["up", "update", "destroy"]
+};
+var VALUED_GLOBALS = /* @__PURE__ */ new Set(["-C", "--cwd", "-s", "--stack", "--color", "--config-file", "--logflow", "-v", "--verbose", "--tracing", "--profiling", "--memprofilerate"]);
+var LAUNCHERS = /* @__PURE__ */ new Set(["env", "npx", "sudo", "command", "exec", "nohup", "time", "xargs"]);
+function segments(line) {
+  return line.split(/\|\||&&|[;|\n`]|\$\(|\)/).map((seg) => (seg.match(/'[^']*'|"[^"]*"|\S+/g) ?? []).map((t) => t.replace(/^['"]|['"]$/g, ""))).filter((t) => t.length > 0);
 }
-function movePackagePins(text, file, plywood, chant) {
-  const pkg = JSON.parse(text);
-  const moves = [];
-  const left = [];
-  for (const field of DEP_FIELDS) {
-    const deps = pkg[field];
-    if (!isObject2(deps)) continue;
-    for (const [name, range] of Object.entries(deps)) {
-      if (typeof range !== "string") continue;
-      const target = name === PLYWOOD_PACKAGE ? plywood : CHANT_FAMILY.test(name) ? chant : void 0;
-      if (target === void 0) continue;
-      const next = movedRange(range, target);
-      if (next === void 0) {
-        left.push(`${field}.${name} is '${range}'; move it to ${target} by hand`);
+function guardVerdict(line) {
+  for (const words of segments(line)) {
+    let i = 0;
+    while (i < words.length && (LAUNCHERS.has(words[i]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i]) || words[i - 1] === "env" && words[i].startsWith("-"))) i++;
+    const bin = (words[i] ?? "").split("/").pop();
+    const refused = GUARDED[bin];
+    if (!refused) continue;
+    for (let j = i + 1; j < words.length; j++) {
+      const w = words[j];
+      if (w.startsWith("-")) {
+        if (VALUED_GLOBALS.has(w)) j++;
         continue;
       }
-      if (next === range) continue;
-      deps[name] = next;
-      moves.push({ file, name, from: range, to: next });
+      if (refused.includes(w)) {
+        return {
+          engine: bin,
+          subcommand: w,
+          message: `${PRODUCT} guard: an agent session does not run '${bin} ${w}'. Open a pull request; ${PRODUCT} previews it, and the update runs after a person approves the digest.`
+        };
+      }
+      break;
     }
   }
-  return { text: moves.length ? jsonText2(pkg, text) : text, moves, left };
-}
-function moveDeclarationPins(text, file, chant) {
-  const doc = JSON.parse(text);
-  const moves = [];
-  const pins = Array.isArray(doc.pins) ? doc.pins : [];
-  for (const pin of pins) {
-    if (typeof pin.package !== "string" || !CHANT_FAMILY.test(pin.package) || typeof pin.version !== "string") continue;
-    if (pin.version === chant) continue;
-    moves.push({ file, name: pin.package, from: pin.version, to: chant });
-    pin.version = chant;
-  }
-  return { text: moves.length ? jsonText2(doc, text) : text, moves };
+  return void 0;
 }
-function imageNote(doc, version2) {
-  const image = doc.image;
-  const name = typeof image === "string" ? image : isObject2(image) && typeof image.name === "string" ? image.name : void 0;
-  if (name === void 0) return void 0;
-  const m = new RegExp(`^${REGISTRY.replace(/[.]/g, "\\.")}/plywood-(pulumi|plunge):([^@]+)`).exec(name);
-  if (m && m[2].startsWith(`${version2}-`)) return void 0;
-  if (m) return `plywood.yml's image is plywood's ${m[1]} image at ${m[2]}; name the ${version2} image in it (its tag starts ${version2}-), or drop the key to take the release's own`;
-  return `plywood.yml's image is your own (${name}); rebuild it FROM plywood's ${version2} image and name the new digest in it`;
+var GUARD_TEMPLATES = new URL("../templates/agent-guard/", import.meta.url);
+var HOOK_COMMAND = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/plywood-guard.mjs"';
+function withGuardHook(settings) {
+  const hooks = typeof settings.hooks === "object" && settings.hooks !== null ? settings.hooks : {};
+  const pre = Array.isArray(hooks.PreToolUse) ? [...hooks.PreToolUse] : [];
+  const has = JSON.stringify(pre).includes("plywood-guard.mjs");
+  if (!has) pre.push({ matcher: "Bash", hooks: [{ type: "command", command: HOOK_COMMAND }] });
+  return { ...settings, hooks: { ...hooks, PreToolUse: pre } };
 }
-async function viewRelease(exec, cwd, env, version2) {
-  const spec = `${PLYWOOD_PACKAGE}@${version2 ?? "latest"}`;
-  const r = await exec("npm", ["view", spec, "version", "dependencies", "--json"], { cwd, env });
-  if (r.code !== 0) {
-    const notFound = /E404/.test(r.stderr + r.stdout);
-    return { error: notFound ? `npm has no ${spec}` : `npm view ${spec} failed: ${(r.stderr || r.stdout).trim().split("\n")[0] ?? ""}` };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(r.stdout);
-  } catch {
-    return { error: `npm view ${spec} printed no JSON` };
+async function guard(args, json, table, io) {
+  const [sub, ...rest] = args;
+  if (sub === "check") {
+    const line = (rest[0] === "--" ? rest.slice(1) : rest).join(" ");
+    if (!line.trim()) return usage("guard check takes the command line to check", table, io);
+    const v = guardVerdict(line);
+    if (json) io.out(JSON.stringify({ command: "guard check", ok: !v, exitCode: v ? table.denied : table.done, refused: v ?? null }));
+    else io.out(v ? v.message : `${PRODUCT} guard: '${line}' runs`);
+    return v ? table.denied : table.done;
   }
-  const doc = Array.isArray(parsed) ? parsed[parsed.length - 1] : parsed;
-  if (!isObject2(doc) || typeof doc.version !== "string") return { error: `npm view ${spec} named no version` };
-  const deps = isObject2(doc.dependencies) ? doc.dependencies : {};
-  const chant = deps[CHANT_PACKAGE];
-  if (typeof chant !== "string" || !VERSION2.test(chant)) return { error: `${PLYWOOD_PACKAGE}@${doc.version} pins no exact ${CHANT_PACKAGE}` };
-  return { version: doc.version, chant };
-}
-async function upgrade(args, json, table, io) {
-  const opts = parseUpgradeArgs(args);
-  const fail = (message) => {
-    if (json) io.out(JSON.stringify({ command: "upgrade", ok: false, exitCode: table.failed, error: message }));
-    else io.err(`${PRODUCT}: ${message}`);
-    return table.failed;
-  };
-  if ("error" in opts) return fail(opts.error);
-  const exec = io.exec ?? execChild;
-  const pkgFile = findPlywoodPackage(io.cwd);
-  if (!pkgFile) return fail(`no package.json in ${io.cwd} or above it depends on ${PLYWOOD_PACKAGE}; install it with 'npm i -D ${PLYWOOD_PACKAGE}', then run '${PRODUCT} init'`);
-  const pkgDir = dirname13(pkgFile);
-  const configFile = findConfig(io.cwd);
-  const configDir = configFile ? dirname13(configFile) : pkgDir;
-  const rel = (f) => relative2(io.cwd, f) || f;
-  const release2 = await viewRelease(exec, pkgDir, io.env, opts.version);
-  if ("error" in release2) return fail(release2.error);
-  const chant = opts.chant ?? release2.chant;
-  const pkgText = readFileSync17(pkgFile, "utf8");
-  const pkgMove = movePackagePins(pkgText, rel(pkgFile), release2.version, chant);
-  const declFile = join18(configDir, "chant.workspace.json");
-  const declText = existsSync15(declFile) ? readFileSync17(declFile, "utf8") : void 0;
-  let declMove;
-  if (declText !== void 0) {
-    try {
-      declMove = moveDeclarationPins(declText, rel(declFile), chant);
-    } catch (e) {
-      return fail(`${rel(declFile)} is not JSON upgrade can move pins in (${e.message})`);
+  if (sub === "install") {
+    const dirFlag = takeFlag(rest, "--dir");
+    if (dirFlag.missing) return usage("--dir takes a directory", table, io);
+    if (dirFlag.rest.length) return usage(`guard install does not take ${dirFlag.rest.join(" ")}`, table, io);
+    const root = dirFlag.value ? join17(io.cwd, dirFlag.value) : io.cwd;
+    const written = [];
+    const hookDir = join17(root, ".claude/hooks");
+    mkdirSync7(hookDir, { recursive: true });
+    copyFileSync(new URL("plywood-guard.mjs", GUARD_TEMPLATES), join17(hookDir, "plywood-guard.mjs"));
+    written.push(".claude/hooks/plywood-guard.mjs");
+    const settingsFile = join17(root, ".claude/settings.json");
+    let settings = {};
+    if (existsSync14(settingsFile)) {
+      try {
+        settings = JSON.parse(readFileSync15(settingsFile, "utf8"));
+      } catch (e) {
+        return usage(`.claude/settings.json is not JSON (${e.message}); fix it, then run this again`, table, io);
+      }
     }
-  }
-  const notes = [...pkgMove.left];
-  if (existsSync15(join18(configDir, "chant.workspace.jsonc"))) notes.push(`chant.workspace.jsonc is yours: move its @intentius/chant* pins to ${chant} by hand`);
-  if (configFile) {
-    try {
-      const note = imageNote(loadConfig(configFile).doc, release2.version);
-      if (note) notes.push(note);
-    } catch {
+    writeFileSync8(settingsFile, JSON.stringify(withGuardHook(settings), null, 2) + "\n");
+    written.push(".claude/settings.json");
+    const binDir = join17(root, ".plywood/agent-bin");
+    mkdirSync7(binDir, { recursive: true });
+    for (const name of Object.keys(GUARDED)) {
+      const to = join17(binDir, name);
+      copyFileSync(new URL(`bin/${name}`, GUARD_TEMPLATES), to);
+      chmodSync(to, 493);
+      written.push(`.plywood/agent-bin/${name}`);
+    }
+    if (json) io.out(JSON.stringify({ command: "guard install", ok: true, exitCode: table.done, written }));
+    else {
+      for (const f of written) io.err(`${PRODUCT} guard: wrote ${f}`);
+      io.err(`${PRODUCT} guard: an agent session that runs outside Claude Code puts .plywood/agent-bin first on PATH and sets PLYWOOD_AGENT_GUARD=1`);
     }
-  } else {
-    notes.push(`no plywood.yml, so there is no workflow to write again; run '${PRODUCT} init' after the install`);
-  }
-  const moves = [...pkgMove.moves, ...declMove?.moves ?? []];
-  const ciArgs = ["--no-install", PRODUCT, "ci", ...opts.forge ? ["--forge", opts.forge] : [], ...opts.env ? ["--env", opts.env] : []];
-  const steps = {
-    install: { cwd: rel(pkgDir) || ".", command: "npm install --no-audit --no-fund" },
-    ci: { cwd: rel(configDir) || ".", command: `npx ${ciArgs.join(" ")}` }
-  };
-  const envelope = { command: "upgrade", plywood: release2.version, chant, moves, notes, dryRun: opts.dryRun };
-  const say = (line) => {
-    if (!json) io.err(line);
-  };
-  say(`${PRODUCT} upgrade: ${PLYWOOD_PACKAGE} ${release2.version}, ${CHANT_PACKAGE} ${chant}`);
-  for (const m of moves) say(`  ${m.file}  ${m.name}  ${m.from} -> ${m.to}`);
-  if (moves.length === 0) say("  every pin is already there");
-  if (opts.dryRun) {
-    say(`  then: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
-    for (const n of notes) say(`  note: ${n}`);
-    if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, steps }));
-    return table.done;
-  }
-  if (pkgMove.text !== pkgText) writeFileSync9(pkgFile, pkgMove.text);
-  if (declMove && declText !== void 0 && declMove.text !== declText) writeFileSync9(declFile, declMove.text);
-  const files = [...new Set(moves.map((m) => m.file))];
-  if (!opts.install) {
-    say(`  left to run: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
-    for (const n of notes) say(`  note: ${n}`);
-    if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, files, steps }));
     return table.done;
   }
-  say(`  $ ${steps.install.command}`);
-  const installed2 = await exec("npm", ["install", "--no-audit", "--no-fund"], { cwd: pkgDir, env: io.env });
-  if (installed2.code !== 0) {
-    for (const n of notes) say(`  note: ${n}`);
-    return fail(`npm install failed (exit ${installed2.code}); package.json is moved, so fix the install and run '${steps.ci.command}'
-${installed2.stderr.trim()}`);
-  }
-  const got = installedVersion(pkgDir);
-  if (got !== void 0 && got !== release2.version) notes.push(`node_modules holds ${PLYWOOD_PACKAGE} ${got}, not ${release2.version}; check the install`);
-  let ci2;
-  if (configFile) {
-    say(`  $ ${steps.ci.command}`);
-    ci2 = await exec("npx", ciArgs, { cwd: configDir, env: io.env });
-    if (!json && ci2.stderr.trim()) io.err(ci2.stderr.trimEnd());
-  }
-  for (const n of notes) say(`  note: ${n}`);
-  const ok = ci2 === void 0 || ci2.code === 0;
-  const lockFile = join18(pkgDir, "package-lock.json");
-  const changed = [...files, ...existsSync15(lockFile) ? [rel(lockFile)] : []];
-  if (ok) say(`  Open one pull request with ${changed.join(", ")} and the files ${PRODUCT} ci wrote.`);
-  else say(`  ${PRODUCT} ci failed (exit ${ci2?.code}); the pins are moved and installed, so fix plywood.yml and run '${steps.ci.command}'`);
-  const code = ok ? table.done : ci2?.code ?? table.failed;
-  if (json) io.out(JSON.stringify({ ...envelope, ok, exitCode: code, files: changed, ...ci2 ? { ci: { exitCode: ci2.code } } : {} }));
-  return code;
-}
-function installedVersion(dir) {
-  try {
-    const pkg = JSON.parse(readFileSync17(join18(dir, "node_modules", PLYWOOD_PACKAGE, "package.json"), "utf8"));
-    return typeof pkg.version === "string" ? pkg.version : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function jsonText2(value, original) {
-  const indent = /^[{[]\r?\n([ \t]+)/.exec(original)?.[1] ?? "  ";
-  return `${JSON.stringify(value, null, indent)}
-`;
-}
-function isObject2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
+  return usage(`guard takes check <command line> or install [--dir <d>]`, table, io);
 }
-var execChild = (bin, args, opts) => new Promise((done) => {
-  execFile(bin, args, { cwd: opts.cwd, env: opts.env, maxBuffer: 64 * 1024 * 1024, shell: process.platform === "win32" }, (error2, stdout, stderr) => {
-    const code = error2 ? typeof error2.code === "number" ? error2.code : 1 : 0;
-    done({ code, stdout: String(stdout), stderr: String(stderr) });
-  });
-});
 
-// src/stack-ops.ts
+// src/identities.ts
+init_jobs2();
 init_chant_config();
 init_identity();
 init_config();
 init_stacks();
-init_adopt();
-init_detect();
-init_refusals();
 init_stages();
-init_chant_product();
 init_words();
-import { existsSync as existsSync16 } from "node:fs";
-import { dirname as dirname14, isAbsolute as isAbsolute2, join as join19, resolve as resolve3 } from "node:path";
-var STACK_OPS_OP = "pulumi-stack-ops";
-var REQUIRED4 = ["gatedStackExport", "gatedStackCancel", "gatedStackMove"];
-var cachedLocks;
-function chantStackLockReader() {
-  cachedLocks ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      return typeof m.pulumiStackLockIds === "function" ? m.pulumiStackLockIds : void 0;
-    } catch {
-      return void 0;
+import { existsSync as existsSync15, readFileSync as readFileSync16 } from "node:fs";
+import { dirname as dirname13, join as join18 } from "node:path";
+import { targetGlobMatch } from "@intentius/chant/ci-identity";
+function identityRows(config2, env) {
+  const doc = config2.doc;
+  const out = [];
+  for (const stack of Object.keys(stacksOf(doc))) {
+    const ids = stackIdentities(doc, stack, env, targetGlobMatch);
+    for (const cloud of IDENTITY_CLOUDS) {
+      const id = ids[cloud];
+      if (id) out.push({ stack, cloud, preview: id.preview, up: id.up, rule: id.rule });
     }
-  })();
-  return cachedLocks;
+  }
+  return out;
 }
-async function lockToCancel(given, stack, env) {
-  if (given) return { lockId: given, read: false };
-  const reader = await chantStackLockReader();
-  if (!reader) return { error: STACK_OP_WORDS.needsLock };
-  let locks2;
+function identityLines(config2, env, rows) {
+  const doc = config2.doc;
+  const block = chantIdentityOf(doc);
+  if (!block) return [`${config2.file ?? "plywood.yml"}: no identity; every job runs as ${NO_IDENTITY}`];
+  const lines2 = [`${config2.file ?? "plywood.yml"}: identities in environment ${env}`];
+  const clouds = Object.keys(block.cloud);
+  lines2.push(`  clouds  ${clouds.map((c) => CLOUD_NAMES[c]).join(", ")}`);
+  if (clouds.includes("pulumi")) {
+    const p = pulumiCloudOf(doc);
+    lines2.push(`  Pulumi Cloud  ${p.org}${p.apiUrl ? ` at ${p.apiUrl}` : ""}; ESC environments open with each job's own token`);
+  }
+  const stacks2 = Object.keys(stacksOf(doc));
+  if (stacks2.length === 0) lines2.push("  plywood.yml lists no stacks; the rules apply to each stack plywood init finds");
+  for (const stack of stacks2) {
+    lines2.push(`  ${stack}`);
+    for (const cloud of clouds) {
+      const r = rows.find((x) => x.stack === stack && x.cloud === cloud);
+      lines2.push(r ? `    ${CLOUD_NAMES[cloud].padEnd(12)} preview ${r.preview}, up ${r.up} (${r.rule})` : `    ${CLOUD_NAMES[cloud].padEnd(12)} ${NO_IDENTITY}`);
+    }
+  }
+  lines2.push("  The preview job trades its OIDC token before checkout, and no later step holds a forge token.");
+  return lines2;
+}
+function configIdentities(args, json, table, io) {
+  const file = takeFlag(args, "--file");
+  const env = takeFlag(file.rest, "--env");
+  if (file.missing || env.missing) return usage(`${file.missing ? "--file" : "--env"} takes a value`, table, io);
+  if (env.rest.length) return usage(`config identities does not take ${env.rest.join(" ")}`, table, io);
+  const path = file.value ?? findConfig(io.cwd);
+  if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init', or pass --file`, table, io);
+  let config2;
   try {
-    locks2 = await reader({ dir: stack.dir, stack: stack.stack, ...stack.project ? { project: stack.project } : {}, ...stack.engine ? { engine: stack.engine } : {}, env });
+    config2 = loadConfig(path);
   } catch (e) {
-    return { error: `${STACK_OP_WORDS.needsLock}. Reading the stack's lock failed: ${e.message}` };
+    return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
   }
-  if (!locks2.checked) return { error: STACK_OP_WORDS.lockNotListed(locks2.backend) };
-  if (locks2.ids.length === 0) return { error: STACK_OP_WORDS.noLock(stack.stack) };
-  if (locks2.ids.length > 1) return { error: STACK_OP_WORDS.manyLocks(stack.stack, locks2.ids) };
-  return { lockId: locks2.ids[0], read: true };
+  const errors = checkConfig(config2).filter((p) => p.severity === "error");
+  if (errors.length) {
+    for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
+    if (json) io.out(JSON.stringify({ command: "config identities", ok: false, exitCode: table.failed, file: path, problems: errors }));
+    return table.failed;
+  }
+  const environment = env.value ?? "production";
+  const rows = identityRows(config2, environment);
+  if (json) io.out(JSON.stringify({ command: "config identities", ok: true, exitCode: table.done, file: path, env: environment, identity: toChantSettings(config2).ci.identity ?? null, stacks: rows }));
+  else for (const line of identityLines(config2, environment, rows)) io.out(line);
+  return table.done;
 }
-var cachedOps;
-var cachedRollback;
-function chantStackOps() {
-  cachedOps ??= (async () => {
+var FORGE_CHECK_MESSAGE = `${PRODUCT} forge check holds the identities next to the forge's environments, protected branches and each cloud's trust policy. The read is chant's (@intentius/chant/forge-check, chant#4608), and the installed chant lacks it; it comes with the chant release after 0.124.54. Run '${PRODUCT} config identities' for what the jobs will hold.`;
+var FORGES2 = ["github", "gitlab", "forgejo"];
+var FORGE_CHECK_FUNCTIONS = ["forgeCheck", "forgeCheckExit", "describeForgeCheck", "forgeCheckTarget", "pipelineContract"];
+var forgeCheckModule;
+function chantForgeCheck() {
+  forgeCheckModule ??= (async () => {
     try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      return REQUIRED4.every((name) => typeof m[name] === "function") ? m : void 0;
+      const fc = await import("@intentius/chant/forge-check");
+      const id = await import("@intentius/chant/ci-identity");
+      if (!FORGE_CHECK_FUNCTIONS.every((f) => typeof fc[f] === "function") || typeof id.resolveCloudIdentity !== "function") return void 0;
+      return { ...fc, resolveCloudIdentity: id.resolveCloudIdentity };
     } catch {
       return void 0;
     }
   })();
-  return cachedOps;
-}
-function chantStackRollback() {
-  cachedRollback ??= (async () => {
-    try {
-      const m = await import("@intentius/chant-lexicon-pulumi");
-      if (typeof m.pulumiReleaseInputs !== "function") return false;
-      const copy2 = await import("@intentius/chant-lexicon-pulumi/release-copy");
-      return typeof copy2.prepareReleaseCopy === "function";
-    } catch {
-      return false;
-    }
-  })();
-  return cachedRollback;
-}
-function needsStackOpsMessage(what, feature) {
-  return `${what} needs @intentius/chant-lexicon-pulumi >= the release after 0.124.54, which carries ${feature}. This plywood was built with chant ${BUILT_CHANT}, which lacks it. Upgrade plywood once that chant is out, or build against a local chant with 'just chant-local'.`;
-}
-function readConfig(cwd) {
-  const path = findConfig(cwd);
-  if (!path) return { error: `no plywood.yml in ${cwd} or above it; run '${PRODUCT} init' first` };
-  const config2 = loadConfig(path);
-  const errors = checkConfig(config2).filter((p) => p.severity === "error");
-  if (errors.length) return { error: errors.map((p) => `${path}: ${p.key} ${p.message}`).join("\n") };
-  return { config: config2, path };
+  return forgeCheckModule;
 }
-function resolveStack(config2, path, key, dir) {
-  const [project, stack, extra] = key.split("/");
-  if (!project || !stack || extra !== void 0) return { error: `a stack is project/stack, as plywood.yml lists it, not '${key}'` };
-  const settings = toChantSettings(config2);
-  const listed = stacksOf(config2.doc);
-  const root = dirname14(path);
-  const member = settings.members.find((m) => m.name === key) ?? settings.memberDefaults;
-  if (dir === void 0 && Object.keys(listed).length > 0 && !(key in listed)) {
-    return { error: `${key} is not under stacks in ${path}; the stacks are ${Object.keys(listed).join(", ")} (or name its directory with --dir)` };
+function workspaceMembers(root) {
+  const file = join18(root, "chant.workspace.json");
+  if (!existsSync15(file)) return [];
+  try {
+    const doc = JSON.parse(readFileSync16(file, "utf8"));
+    return (doc.members ?? []).map((m) => m.name).filter((n) => typeof n === "string");
+  } catch {
+    return [];
   }
-  const at = dir ?? listed[key]?.dir ?? ".";
-  return {
-    key,
-    project,
-    stack,
-    dir: isAbsolute2(at) ? at : resolve3(root, at),
-    ...member.engine ? { engine: member.engine } : {},
-    ...member.backend ? { backend: member.backend } : {}
-  };
 }
-function requestRules(config2) {
-  const p = toChantSettings(config2).pipeline;
-  return { mode: p.approval ?? "ledger", ...p.quorum?.length ? { quorum: p.quorum } : {} };
-}
-function requesterOf(by, env) {
-  return by ?? env.GITHUB_ACTOR ?? env.GITLAB_USER_LOGIN ?? env.USER ?? "unknown";
-}
-function destStackName(source, dest, config2) {
-  if (dest.project === source.project) return dest.stack;
-  const cloud = !dest.backend || /^https?:\/\//.test(dest.backend);
-  const org = cloud ? pulumiCloudOf(config2.doc).org : void 0;
-  return `${org ?? "organization"}/${dest.project}/${dest.stack}`;
-}
-function approveRequestLine(gate, digest, mode) {
-  return `${PRODUCT} approve ${gate} --op ${STACK_OPS_OP} --plan ${digest}${mode === "sealed" ? " --sign" : ""}`;
-}
-function useBackend(stacks2, env) {
-  const named = [...new Set(stacks2.map((s) => s.backend).filter((b) => b !== void 0))];
-  if (named.length > 1) return `the stacks are on different backends (${named.join(", ")}); a move needs both on one backend`;
-  if (named[0] && !env.PULUMI_BACKEND_URL) env.PULUMI_BACKEND_URL = named[0];
-  return void 0;
-}
-function reportOutcome(verb, outcome, gate, rules, done, json, table, io) {
-  const approveLine = outcome.status === "waiting" || outcome.status === "refused" ? approveRequestLine(gate, outcome.digest, rules.mode) : void 0;
-  let code;
-  let text;
-  switch (outcome.status) {
-    case "waiting":
-      code = table.waiting;
-      text = STACK_OP_WORDS.waiting(verb, approveLine);
-      break;
-    case "refused":
-      code = table.waiting;
-      text = `${outcome.reason}. ${STACK_OP_WORDS.waiting(verb, approveLine)}`;
-      break;
-    case "spent":
-      code = table.failed;
-      text = STACK_OP_WORDS.spent(verb);
-      break;
-    case "done":
-      code = table.done;
-      text = done(outcome.result);
-      break;
-    case "failed":
-      code = table.failed;
-      text = `${PRODUCT} ${verb}: ${outcome.error}`;
-      break;
-  }
-  if (json) {
-    io.out(JSON.stringify({
-      command: verb,
-      ok: code === table.done,
-      exitCode: code,
-      status: outcome.status,
-      op: STACK_OPS_OP,
-      gate,
-      digest: outcome.digest,
-      ...approveLine ? { approve: approveLine } : {},
-      ...outcome.status === "done" ? { result: outcome.result } : {},
-      ...outcome.status === "failed" ? { error: outcome.error } : {},
-      ...outcome.status === "refused" ? { refusedBy: outcome.by, reason: outcome.reason } : {}
-    }));
-  } else (code === table.done ? io.out : io.err)(text);
-  return code;
+function upRunner(runner) {
+  if (runner === void 0) return void 0;
+  const staged = typeof runner === "object" && !Array.isArray(runner) && !("group" in runner);
+  const spec = staged ? runner.up ?? runner.default : runner;
+  if (spec === void 0) return void 0;
+  if (typeof spec === "string") return { labels: [spec] };
+  if (Array.isArray(spec)) return { labels: spec.filter((l) => typeof l === "string") };
+  const g = spec;
+  return typeof g.group === "string" ? { labels: Array.isArray(g.labels) ? g.labels : [], group: g.group } : void 0;
 }
-async function runRequest(verb, json, table, io, call) {
-  const ops = await chantStackOps();
-  if (!ops) {
-    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} ${verb}`, "the gated stack operations (chant#4578)")}`);
+function contractPipelines(fc, cloud, env, members, runner, jobs2) {
+  const applyRunner = upRunner(runner);
+  const list = members.length ? [...members] : [void 0];
+  return list.flatMap((member) => {
+    const identity2 = fc.resolveCloudIdentity(cloud, env, member);
+    const name = member ? `${member}/${env}` : env;
+    const forgeEnvironment = jobs2 ? environmentFor(name, jobs2)?.name : void 0;
+    return identity2 ? [{ name, identity: identity2, ...member ? { member } : {}, ...applyRunner ? { applyRunner } : {}, ...forgeEnvironment ? { forgeEnvironment } : {} }] : [];
+  });
+}
+async function forgeCheck(args, json, table, io) {
+  if (args[0] !== "check") return usage(`unknown forge command '${args[0] ?? ""}'. Run '${PRODUCT} forge check'.`, table, io);
+  const fc = await chantForgeCheck();
+  if (!fc) {
+    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, error: FORGE_CHECK_MESSAGE }));
+    else io.err(`${PRODUCT}: ${FORGE_CHECK_MESSAGE}`);
     return table.failed;
   }
+  const requireClouds = args.includes("--require-clouds");
+  let rest = args.slice(1).filter((a) => a !== "--require-clouds");
+  const flags = {};
+  for (const flag of ["--file", "--env", "--forge", "--repo", "--branch"]) {
+    const f = takeFlag(rest, flag);
+    if (f.missing) return usage(`${flag} takes a value`, table, io);
+    flags[flag] = f.value;
+    rest = f.rest;
+  }
+  if (rest.length) return usage(`forge check does not take ${rest.join(" ")}`, table, io);
+  const forgeFlag = flags["--forge"];
+  if (forgeFlag !== void 0 && !FORGES2.includes(forgeFlag)) return usage(`--forge is ${forgeFlag}; give github, gitlab or forgejo`, table, io);
+  const path = flags["--file"] ?? findConfig(io.cwd);
+  if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init', or pass --file`, table, io);
+  let config2;
   try {
-    return await call(ops);
+    config2 = loadConfig(path);
   } catch (e) {
-    const message = e.message;
-    if (json) io.out(JSON.stringify({ command: verb, ok: false, exitCode: table.failed, error: message }));
-    else io.err(`${PRODUCT} ${verb}: ${message}`);
+    return usage(e instanceof ConfigError ? e.message : `${path}: ${e.message}`, table, io);
+  }
+  const errors = checkConfig(config2).filter((p) => p.severity === "error");
+  if (errors.length) {
+    for (const p of errors) io.err(`${path}: ${p.key} ${p.message}`);
+    if (json) io.out(JSON.stringify({ command: "forge check", ok: false, exitCode: table.failed, file: path, problems: errors }));
     return table.failed;
   }
+  const settings = toChantSettings(config2);
+  const kind = forgeFlag ?? settings.pipeline.forge?.kind;
+  let target;
+  try {
+    target = fc.forgeCheckTarget(io.env, { ...kind && FORGES2.includes(kind) ? { kind } : {}, ...flags["--repo"] ? { repo: flags["--repo"] } : {} });
+  } catch (e) {
+    return usage(e.message, table, io);
+  }
+  const env = flags["--env"] ?? "production";
+  const cloud = settings.ci.identity?.cloud;
+  const pipelines = contractPipelines(fc, cloud, env, workspaceMembers(dirname13(path)), settings.pipeline.runner, settings.pipeline.jobs);
+  const result = await fc.forgeCheck(
+    {
+      target,
+      words: PRODUCT_WORDS,
+      file: path,
+      ...requireClouds ? { requireClouds: true } : {},
+      contract: (live) => fc.pipelineContract({
+        forge: target.kind,
+        repository: {
+          host: target.host,
+          path: live.path ?? target.repo,
+          defaultBranch: flags["--branch"] ?? live.defaultBranch ?? "main",
+          ...live.ownerId ? { ownerId: live.ownerId } : {},
+          ...live.repoId ? { repoId: live.repoId } : {}
+        },
+        pipelines,
+        words: PRODUCT_WORDS
+      })
+    },
+    { fetch: globalThis.fetch, env: io.env }
+  );
+  if (json) io.out(JSON.stringify(result));
+  else io.out(fc.describeForgeCheck(result));
+  if (!cloud) io.err(`${PRODUCT} forge check: ${path} sets no identity, so no trust was checked`);
+  else if (pipelines.length === 0) io.err(`${PRODUCT} forge check: no identity rule covers environment ${env}, so no trust was checked`);
+  return fc.forgeCheckExit(result);
 }
-function commonFlags(args) {
-  const by = takeFlag(args, "--by");
-  const dir = takeFlag(by.rest, "--dir");
-  if (by.missing) return { rest: args, missing: "--by" };
-  if (dir.missing) return { rest: args, missing: "--dir" };
-  return { by: by.value, dir: dir.value, rest: dir.rest };
+
+// src/cli.ts
+init_control2();
+
+// src/telemetry.ts
+init_chant_product();
+init_observe();
+init_config();
+init_words();
+function telemetryEnv(doc, env) {
+  const t = telemetryOf(doc);
+  const out = {};
+  const set = (k, v) => {
+    if (v !== void 0 && v !== "" && env[k] === void 0) out[k] = v;
+  };
+  if (!t.traces) {
+    set("OTEL_TRACES_EXPORTER", "none");
+    return out;
+  }
+  if (env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT === void 0) set("OTEL_EXPORTER_OTLP_ENDPOINT", t.endpoint);
+  if (t.headersEnv) set("OTEL_EXPORTER_OTLP_HEADERS", env[t.headersEnv]);
+  if (t.endpoint !== void 0 || env.OTEL_EXPORTER_OTLP_ENDPOINT !== void 0 || env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT !== void 0) set("OTEL_SERVICE_NAME", t.serviceName);
+  return out;
 }
-async function exportStack(args, json, table, io) {
-  const common = commonFlags(args);
-  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
-  const out = takeFlag(common.rest, "--out");
-  if (out.missing) return usage("--out takes a file path outside the repository", table, io);
-  const extra = out.rest.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`export does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(out.rest);
-  if (named.length !== 1) return usage(`export takes one stack: ${STACK_OP_WORDS.usage.export}`, table, io);
-  if (!out.value) return usage(`export needs --out <file>, a path on your machine outside every git working tree: ${STACK_OP_WORDS.usage.export}`, table, io);
-  const read = readConfig(io.cwd);
-  if ("error" in read) return usage(read.error, table, io);
-  const stack = resolveStack(read.config, read.path, named[0], common.dir);
-  if ("error" in stack) return usage(stack.error, table, io);
-  useBackend([stack], io.env);
-  const rules = requestRules(read.config);
-  const outFile = resolve3(io.cwd, out.value);
-  return runRequest("export", json, table, io, async (ops) => {
-    const outcome = await ops.gatedStackExport({
-      by: requesterOf(common.by, io.env),
-      rules,
-      op: STACK_OPS_OP,
-      ledgerCwd: io.cwd,
-      env: io.env,
-      dir: stack.dir,
-      stack: stack.stack,
-      out: outFile,
-      ...stack.engine ? { engine: stack.engine } : {}
-    });
-    return reportOutcome("export", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.exported(stack.key, r), json, table, io);
-  });
+async function applyTelemetry(cwd, env = process.env) {
+  let added = {};
+  try {
+    const file = findConfig(cwd);
+    if (file) added = telemetryEnv(loadConfig(file).doc, env);
+  } catch {
+    return {};
+  }
+  Object.assign(env, added);
+  const chant = await chantProduct();
+  if (chant && typeof chant.configureOtlp === "function") chant.configureOtlp({ prefix: PRODUCT, env });
+  return added;
 }
-async function cancelStack(args, json, table, io) {
-  const common = commonFlags(args);
-  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
-  const lock = takeFlag(common.rest, "--lock");
-  if (lock.missing) return usage("--lock takes the lock id", table, io);
-  const extra = lock.rest.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`cancel does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(lock.rest);
-  if (named.length !== 1) return usage(`cancel takes one stack: ${STACK_OP_WORDS.usage.cancel}`, table, io);
-  const read = readConfig(io.cwd);
-  if ("error" in read) return usage(read.error, table, io);
-  const stack = resolveStack(read.config, read.path, named[0], common.dir);
-  if ("error" in stack) return usage(stack.error, table, io);
-  useBackend([stack], io.env);
-  const lockId = await lockToCancel(lock.value, stack, io.env);
-  if ("error" in lockId) return usage(lockId.error, table, io);
-  if (lockId.read && !json) io.err(`${PRODUCT} cancel: ${stack.key} holds lock ${lockId.lockId}`);
-  const rules = requestRules(read.config);
-  return runRequest("cancel", json, table, io, async (ops) => {
-    const outcome = await ops.gatedStackCancel({
-      by: requesterOf(common.by, io.env),
-      rules,
-      op: STACK_OPS_OP,
-      ledgerCwd: io.cwd,
-      env: io.env,
-      dir: stack.dir,
-      stack: stack.stack,
-      lockId: lockId.lockId,
-      project: stack.project,
-      ...stack.engine ? { engine: stack.engine } : {}
-    });
-    return reportOutcome("cancel", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.cancelled(stack.key, lockId.lockId, r.lockChecked), json, table, io);
-  });
+
+// src/cli.ts
+init_init();
+init_stages();
+init_tips();
+init_images();
+init_up();
+
+// src/upgrade.ts
+init_config();
+init_images();
+init_stages();
+init_words();
+import { execFile } from "node:child_process";
+import { existsSync as existsSync16, readFileSync as readFileSync17, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname14, join as join19, relative as relative2, resolve as resolve3 } from "node:path";
+var PLYWOOD_PACKAGE = "@intentius/plywood";
+var CHANT_PACKAGE = "@intentius/chant";
+var CHANT_FAMILY = /^@intentius\/chant(?:-lexicon-[a-z0-9-]+)?$/;
+var VERSION2 = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+var DEP_FIELDS = ["dependencies", "devDependencies", "optionalDependencies"];
+function parseUpgradeArgs(args) {
+  const chant = takeFlag(args, "--chant");
+  const forge = takeFlag(chant.rest, "--forge");
+  const env = takeFlag(forge.rest, "--env");
+  if (chant.missing || forge.missing || env.missing) return { error: "--chant, --forge and --env each take a value" };
+  const flags = /* @__PURE__ */ new Set(["--no-install", "--dry-run"]);
+  const unknown = env.rest.filter((a) => a.startsWith("-") && !flags.has(a));
+  if (unknown.length) return { error: `upgrade does not take ${unknown.join(" ")}` };
+  const words = env.rest.filter((a) => !a.startsWith("-"));
+  if (words.length > 1) return { error: `upgrade takes one version, not ${words.join(" ")}` };
+  const version2 = words[0]?.replace(/^v/, "");
+  if (version2 !== void 0 && !VERSION2.test(version2)) return { error: `${words[0]} is not a version: give it as MAJOR.MINOR.PATCH` };
+  if (chant.value !== void 0 && !VERSION2.test(chant.value)) return { error: `--chant ${chant.value} is not a version: give it as MAJOR.MINOR.PATCH` };
+  return {
+    ...version2 ? { version: version2 } : {},
+    ...chant.value ? { chant: chant.value } : {},
+    ...forge.value ? { forge: forge.value } : {},
+    ...env.value ? { env: env.value } : {},
+    install: !env.rest.includes("--no-install"),
+    dryRun: env.rest.includes("--dry-run")
+  };
+}
+function findPlywoodPackage(dir) {
+  let cur = resolve3(dir);
+  for (let depth = 0; depth < 32; depth++) {
+    const file = join19(cur, "package.json");
+    if (existsSync16(file)) {
+      try {
+        const pkg = JSON.parse(readFileSync17(file, "utf8"));
+        if (DEP_FIELDS.some((f) => isObject2(pkg[f]) && typeof pkg[f][PLYWOOD_PACKAGE] === "string")) return file;
+      } catch {
+      }
+    }
+    const up2 = dirname14(cur);
+    if (up2 === cur) return void 0;
+    cur = up2;
+  }
+  return void 0;
+}
+function movedRange(range, version2) {
+  const m = /^([~^]?)(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(range.trim());
+  if (!m) return void 0;
+  return `${m[1]}${version2}`;
+}
+function movePackagePins(text, file, plywood, chant) {
+  const pkg = JSON.parse(text);
+  const moves = [];
+  const left = [];
+  for (const field of DEP_FIELDS) {
+    const deps = pkg[field];
+    if (!isObject2(deps)) continue;
+    for (const [name, range] of Object.entries(deps)) {
+      if (typeof range !== "string") continue;
+      const target = name === PLYWOOD_PACKAGE ? plywood : CHANT_FAMILY.test(name) ? chant : void 0;
+      if (target === void 0) continue;
+      const next = movedRange(range, target);
+      if (next === void 0) {
+        left.push(`${field}.${name} is '${range}'; move it to ${target} by hand`);
+        continue;
+      }
+      if (next === range) continue;
+      deps[name] = next;
+      moves.push({ file, name, from: range, to: next });
+    }
+  }
+  return { text: moves.length ? jsonText2(pkg, text) : text, moves, left };
 }
-async function moveStack(args, json, table, io) {
-  const onto = takeFlag(args, "--onto");
-  if (onto.missing) return usage("--onto takes plunge", table, io);
-  if (onto.value !== void 0) return moveOntoPlunge(onto.value, onto.rest, json, table, io);
-  const common = commonFlags(onto.rest);
-  if (common.missing) return usage(`${common.missing} takes a value`, table, io);
-  const from = takeFlag(common.rest, "--from");
-  const to = takeFlag(from.rest, "--to");
-  if (from.missing || to.missing) return usage(`${from.missing ? "--from" : "--to"} takes a stack, as project/stack`, table, io);
-  const extra = to.rest.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`move does not take ${extra.join(" ")}`, table, io);
-  if (common.dir !== void 0) return usage("move reads each stack's directory from plywood.yml's stacks, so it does not take --dir", table, io);
-  const urns = positionals(to.rest);
-  if (!from.value || !to.value) return usage(`move needs --from and --to: ${STACK_OP_WORDS.usage.move}`, table, io);
-  if (urns.length === 0) return usage(`move names each resource it moves by URN: ${STACK_OP_WORDS.usage.move}`, table, io);
-  const bad = urns.filter((u) => !u.startsWith("urn:pulumi:"));
-  if (bad.length) return usage(`move takes URNs (urn:pulumi:...), not ${bad.join(", ")}; 'pulumi stack --show-urns' lists them`, table, io);
-  if (from.value === to.value) return usage(`--from and --to are both ${from.value}; a move is between two stacks`, table, io);
-  const read = readConfig(io.cwd);
-  if ("error" in read) return usage(read.error, table, io);
-  const source = resolveStack(read.config, read.path, from.value, void 0);
-  if ("error" in source) return usage(source.error, table, io);
-  const dest = resolveStack(read.config, read.path, to.value, void 0);
-  if ("error" in dest) return usage(dest.error, table, io);
-  const backend = useBackend([source, dest], io.env);
-  if (backend) return usage(backend, table, io);
-  const rules = requestRules(read.config);
-  const destName = destStackName(source, dest, read.config);
-  const engine2 = source.engine ?? dest.engine;
-  return runRequest("move", json, table, io, async (ops) => {
-    const outcome = await ops.gatedStackMove({
-      by: requesterOf(common.by, io.env),
-      rules,
-      op: STACK_OPS_OP,
-      ledgerCwd: io.cwd,
-      env: io.env,
-      source: { member: source.key, dir: source.dir, stack: source.stack },
-      dest: { member: dest.key, dir: dest.dir, stack: destName },
-      urns,
-      ...engine2 ? { engine: engine2 } : {}
-    });
-    return reportOutcome("move", outcome, `move:${source.stack}:${destName}`, rules, (r) => STACK_OP_WORDS.moved(source.key, dest.key, r), json, table, io);
-  });
+function moveDeclarationPins(text, file, chant) {
+  const doc = JSON.parse(text);
+  const moves = [];
+  const pins = Array.isArray(doc.pins) ? doc.pins : [];
+  for (const pin of pins) {
+    if (typeof pin.package !== "string" || !CHANT_FAMILY.test(pin.package) || typeof pin.version !== "string") continue;
+    if (pin.version === chant) continue;
+    moves.push({ file, name: pin.package, from: pin.version, to: chant });
+    pin.version = chant;
+  }
+  return { text: moves.length ? jsonText2(doc, text) : text, moves };
 }
-async function moveOntoPlunge(engine2, args, json, table, io) {
-  if (engine2 !== "plunge") return usage(`--onto takes plunge, not '${engine2}'; a move between backends is an export and an import (see '${PRODUCT} export')`, table, io);
-  const extra = args.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`move --onto does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(args);
-  if (named.length > 1) return usage(`move --onto plunge takes at most one stack`, table, io);
-  const read = readConfig(io.cwd);
-  if ("error" in read) return usage(read.error, table, io);
-  const opFile = join19(dirname14(read.path), ADOPT_OP_FILE);
-  if (!existsSync16(opFile)) return usage(STACK_OP_WORDS.noAdoptOp(opFile), table, io);
-  if (named[0]) {
-    const stack = resolveStack(read.config, read.path, named[0], void 0);
-    if ("error" in stack) return usage(stack.error, table, io);
-    if (!json) io.err(STACK_OP_WORDS.adoptAll(stack.key));
+function imageNote(doc, version2) {
+  const image = doc.image;
+  const name = typeof image === "string" ? image : isObject2(image) && typeof image.name === "string" ? image.name : void 0;
+  if (name === void 0) return void 0;
+  const m = new RegExp(`^${REGISTRY.replace(/[.]/g, "\\.")}/plywood-(pulumi|plunge):([^@]+)`).exec(name);
+  if (m && m[2].startsWith(`${version2}-`)) return void 0;
+  if (m) return `plywood.yml's image is plywood's ${m[1]} image at ${m[2]}; name the ${version2} image in it (its tag starts ${version2}-), or drop the key to take the release's own`;
+  return `plywood.yml's image is your own (${name}); rebuild it FROM plywood's ${version2} image and name the new digest in it`;
+}
+async function viewRelease(exec, cwd, env, version2) {
+  const spec = `${PLYWOOD_PACKAGE}@${version2 ?? "latest"}`;
+  const r = await exec("npm", ["view", spec, "version", "dependencies", "--json"], { cwd, env });
+  if (r.code !== 0) {
+    const notFound = /E404/.test(r.stderr + r.stdout);
+    return { error: notFound ? `npm has no ${spec}` : `npm view ${spec} failed: ${(r.stderr || r.stdout).trim().split("\n")[0] ?? ""}` };
   }
-  const argv = ["run", ADOPT_OP, ...json ? ["--json"] : []];
-  return withChant(`${PRODUCT} move --onto plunge`, table, io, async (chant) => {
-    const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
-    if (code === table.waiting && !json) io.err(STACK_OP_WORDS.adoptWaiting);
-    return code === table.waiting ? code : explainRefusal(code, table, io.err);
-  });
+  let parsed;
+  try {
+    parsed = JSON.parse(r.stdout);
+  } catch {
+    return { error: `npm view ${spec} printed no JSON` };
+  }
+  const doc = Array.isArray(parsed) ? parsed[parsed.length - 1] : parsed;
+  if (!isObject2(doc) || typeof doc.version !== "string") return { error: `npm view ${spec} named no version` };
+  const deps = isObject2(doc.dependencies) ? doc.dependencies : {};
+  const chant = deps[CHANT_PACKAGE];
+  if (typeof chant !== "string" || !VERSION2.test(chant)) return { error: `${PLYWOOD_PACKAGE}@${doc.version} pins no exact ${CHANT_PACKAGE}` };
+  return { version: doc.version, chant };
 }
-async function rollbackStack(args, json, table, io) {
-  const release2 = takeFlag(args, "--release");
-  const env = takeFlag(release2.rest, "--env");
-  const digest = takeFlag(env.rest, "--digest");
-  const actor = takeFlag(digest.rest, "--actor");
-  for (const [flag, f] of [["--release", release2], ["--env", env], ["--digest", digest], ["--actor", actor]]) {
-    if (f.missing) return usage(`${flag} takes a value`, table, io);
+async function upgrade(args, json, table, io) {
+  const opts = parseUpgradeArgs(args);
+  const fail = (message) => {
+    if (json) io.out(JSON.stringify({ command: "upgrade", ok: false, exitCode: table.failed, error: message }));
+    else io.err(`${PRODUCT}: ${message}`);
+    return table.failed;
+  };
+  if ("error" in opts) return fail(opts.error);
+  const exec = io.exec ?? execChild;
+  const pkgFile = findPlywoodPackage(io.cwd);
+  if (!pkgFile) return fail(`no package.json in ${io.cwd} or above it depends on ${PLYWOOD_PACKAGE}; install it with 'npm i -D ${PLYWOOD_PACKAGE}', then run '${PRODUCT} init'`);
+  const pkgDir = dirname14(pkgFile);
+  const configFile = findConfig(io.cwd);
+  const configDir = configFile ? dirname14(configFile) : pkgDir;
+  const rel = (f) => relative2(io.cwd, f) || f;
+  const release2 = await viewRelease(exec, pkgDir, io.env, opts.version);
+  if ("error" in release2) return fail(release2.error);
+  const chant = opts.chant ?? release2.chant;
+  const pkgText = readFileSync17(pkgFile, "utf8");
+  const pkgMove = movePackagePins(pkgText, rel(pkgFile), release2.version, chant);
+  const declFile = join19(configDir, "chant.workspace.json");
+  const declText = existsSync16(declFile) ? readFileSync17(declFile, "utf8") : void 0;
+  let declMove;
+  if (declText !== void 0) {
+    try {
+      declMove = moveDeclarationPins(declText, rel(declFile), chant);
+    } catch (e) {
+      return fail(`${rel(declFile)} is not JSON upgrade can move pins in (${e.message})`);
+    }
   }
-  const switches = actor.rest.filter((a) => a === "--dry-run" || a === "--events-json");
-  const rest = actor.rest.filter((a) => !switches.includes(a));
-  const extra = rest.filter((a) => a.startsWith("-"));
-  if (extra.length) return usage(`rollback does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(rest);
-  if (named.length > 1) return usage(`rollback takes one stack: ${STACK_OP_WORDS.usage.rollback}`, table, io);
-  let argv;
-  if (release2.value !== void 0) {
-    if (named.length) return usage(STACK_OP_WORDS.releaseIsEnvWide(named[0], environmentOf(named[0])), table, io);
-    if (digest.value !== void 0) return usage("--release takes no --digest: the release names what each stack goes back to", table, io);
-    if (!env.value) return usage(`rollback --release needs --env <env>, the environment whose stacks go back: ${STACK_OP_WORDS.usage.rollback}`, table, io);
-    argv = ["components", "rollback", env.value, "--release", release2.value];
+  const notes = [...pkgMove.left];
+  if (existsSync16(join19(configDir, "chant.workspace.jsonc"))) notes.push(`chant.workspace.jsonc is yours: move its @intentius/chant* pins to ${chant} by hand`);
+  if (configFile) {
+    try {
+      const note = imageNote(loadConfig(configFile).doc, release2.version);
+      if (note) notes.push(note);
+    } catch {
+    }
   } else {
-    if (named.length !== 1) return usage(`rollback takes a stack, or --release <name> --env <env>: ${STACK_OP_WORDS.usage.rollback}`, table, io);
-    const read = readConfig(io.cwd);
-    if ("error" in read) return usage(read.error, table, io);
-    const stack = resolveStack(read.config, read.path, named[0], void 0);
-    if ("error" in stack) return usage(stack.error, table, io);
-    argv = ["components", "rollback", env.value ?? environmentOf(stack.stack), "--component", slug(stack.key), ...digest.value ? ["--digest", digest.value] : []];
+    notes.push(`no plywood.yml, so there is no workflow to write again; run '${PRODUCT} init' after the install`);
   }
-  argv.push(...actor.value ? ["--actor", actor.value] : [], ...switches, ...json ? ["--json"] : []);
-  if (!await chantStackRollback()) {
-    io.err(`${PRODUCT}: ${needsStackOpsMessage(`${PRODUCT} rollback`, "rollback by release for stacks (chant#4542)")}`);
-    return table.failed;
+  const moves = [...pkgMove.moves, ...declMove?.moves ?? []];
+  const ciArgs = ["--no-install", PRODUCT, "ci", ...opts.forge ? ["--forge", opts.forge] : [], ...opts.env ? ["--env", opts.env] : []];
+  const steps = {
+    install: { cwd: rel(pkgDir) || ".", command: "npm install --no-audit --no-fund" },
+    ci: { cwd: rel(configDir) || ".", command: `npx ${ciArgs.join(" ")}` }
+  };
+  const envelope = { command: "upgrade", plywood: release2.version, chant, moves, notes, dryRun: opts.dryRun };
+  const say = (line) => {
+    if (!json) io.err(line);
+  };
+  say(`${PRODUCT} upgrade: ${PLYWOOD_PACKAGE} ${release2.version}, ${CHANT_PACKAGE} ${chant}`);
+  for (const m of moves) say(`  ${m.file}  ${m.name}  ${m.from} -> ${m.to}`);
+  if (moves.length === 0) say("  every pin is already there");
+  if (opts.dryRun) {
+    say(`  then: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
+    for (const n of notes) say(`  note: ${n}`);
+    if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, steps }));
+    return table.done;
   }
-  return withChant(`${PRODUCT} rollback`, table, io, async (chant) => {
-    const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
-    if (code === table.waiting && !json) io.err(STACK_OP_WORDS.rollbackWaiting);
-    return code === table.waiting ? code : explainRefusal(code, table, io.err);
-  });
+  if (pkgMove.text !== pkgText) writeFileSync9(pkgFile, pkgMove.text);
+  if (declMove && declText !== void 0 && declMove.text !== declText) writeFileSync9(declFile, declMove.text);
+  const files = [...new Set(moves.map((m) => m.file))];
+  if (!opts.install) {
+    say(`  left to run: ${steps.install.command} (in ${steps.install.cwd}), then ${steps.ci.command} (in ${steps.ci.cwd})`);
+    for (const n of notes) say(`  note: ${n}`);
+    if (json) io.out(JSON.stringify({ ...envelope, ok: true, exitCode: table.done, files, steps }));
+    return table.done;
+  }
+  say(`  $ ${steps.install.command}`);
+  const installed2 = await exec("npm", ["install", "--no-audit", "--no-fund"], { cwd: pkgDir, env: io.env });
+  if (installed2.code !== 0) {
+    for (const n of notes) say(`  note: ${n}`);
+    return fail(`npm install failed (exit ${installed2.code}); package.json is moved, so fix the install and run '${steps.ci.command}'
+${installed2.stderr.trim()}`);
+  }
+  const got = installedVersion(pkgDir);
+  if (got !== void 0 && got !== release2.version) notes.push(`node_modules holds ${PLYWOOD_PACKAGE} ${got}, not ${release2.version}; check the install`);
+  let ci2;
+  if (configFile) {
+    say(`  $ ${steps.ci.command}`);
+    ci2 = await exec("npx", ciArgs, { cwd: configDir, env: io.env });
+    if (!json && ci2.stderr.trim()) io.err(ci2.stderr.trimEnd());
+  }
+  for (const n of notes) say(`  note: ${n}`);
+  const ok = ci2 === void 0 || ci2.code === 0;
+  const lockFile = join19(pkgDir, "package-lock.json");
+  const changed = [...files, ...existsSync16(lockFile) ? [rel(lockFile)] : []];
+  if (ok) say(`  Open one pull request with ${changed.join(", ")} and the files ${PRODUCT} ci wrote.`);
+  else say(`  ${PRODUCT} ci failed (exit ${ci2?.code}); the pins are moved and installed, so fix plywood.yml and run '${steps.ci.command}'`);
+  const code = ok ? table.done : ci2?.code ?? table.failed;
+  if (json) io.out(JSON.stringify({ ...envelope, ok, exitCode: code, files: changed, ...ci2 ? { ci: { exitCode: ci2.code } } : {} }));
+  return code;
+}
+function installedVersion(dir) {
+  try {
+    const pkg = JSON.parse(readFileSync17(join19(dir, "node_modules", PLYWOOD_PACKAGE, "package.json"), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function jsonText2(value, original) {
+  const indent = /^[{[]\r?\n([ \t]+)/.exec(original)?.[1] ?? "  ";
+  return `${JSON.stringify(value, null, indent)}
+`;
+}
+function isObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
 }
+var execChild = (bin, args, opts) => new Promise((done) => {
+  execFile(bin, args, { cwd: opts.cwd, env: opts.env, maxBuffer: 64 * 1024 * 1024, shell: process.platform === "win32" }, (error2, stdout, stderr) => {
+    const code = error2 ? typeof error2.code === "number" ? error2.code : 1 : 0;
+    done({ code, stdout: String(stdout), stderr: String(stderr) });
+  });
+});
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.1.0" : "0.0.0-dev";
+var VERSION3 = true ? "0.2.0" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")
@@ -7656,6 +7855,7 @@ function helpText() {
     "  move <stack> --onto plunge                          adopt the stacks onto plunge (plywood.adopt.op.ts)",
     "  rollback <stack> [--digest <d>] | --release <name> --env <env>",
     "                                                      preview a release's program, then update behind its gate",
+    "  action <stack> <name> [--anew]                      run an action plywood.yml declares: replace its command resource",
     "",
     "Ledger:",
     "  audit [approvals|updates|runs|review-stacks] [--stack <s>] [--since <t>] [--where <f>=<v>]...",
@@ -7676,7 +7876,8 @@ function helpText() {
     "  control dispatch [--sha <sha>]                      tell plywood.yml's control repo this commit applied",
     "",
     "Agents:",
-    "  mcp [--report-url <url>]                            chant's read-only MCP server over stdio, with plywood's read tools",
+    "  mcp [--report-url <url>] [--propose]                chant's read-only MCP server over stdio, with plywood's read tools;",
+    "                                                      --propose adds request_from_template, which refuses until Pulumi templates exist",
     "  guard check <command line>                          whether the agent guard refuses a command",
     "  guard install [--dir <d>]                           the Claude Code hook and the pulumi and plunge wrappers",
     "",
@@ -7737,6 +7938,7 @@ async function main(argv, io = stdio) {
   if (verb === "cancel") return cancelStack(args.slice(1), json, table, stageIo);
   if (verb === "move") return moveStack(args.slice(1), json, table, stageIo);
   if (verb === "rollback") return rollbackStack(args.slice(1), json, table, stageIo);
+  if (verb === "action") return action(args.slice(1), json, table, stageIo);
   if (verb === "drift") return drift2(args.slice(1), json, table, stageIo);
   if (verb === "mcp") return mcp(args.slice(1), json, table, stageIo);
   if (verb === "guard") return guard(args.slice(1), json, table, stageIo);