@intentius/plywood 0.2.0 → 0.3.0

package/dist/plywood.mjs

@@ -422,7 +422,7 @@ var init_words = __esm({
   "src/words.ts"() {
     "use strict";
     PRODUCT = "plywood";
-    TAGLINE = "CI Automation for Pulumi";
+    TAGLINE = "Sophisticated automation for Pulumi.";
     OP_NAME = "pulumi-up";
     PR_GATE = "up";
     VERBS = [
@@ -587,13 +587,13 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.2.0";
+    version = "0.3.0";
     dependencies = {
-      "@intentius/chant": "0.124.58",
-      "@intentius/chant-lexicon-forgejo": "0.124.58",
-      "@intentius/chant-lexicon-github": "0.124.58",
-      "@intentius/chant-lexicon-gitlab": "0.124.58",
-      "@intentius/chant-lexicon-pulumi": "0.124.58"
+      "@intentius/chant": "0.124.59",
+      "@intentius/chant-lexicon-forgejo": "0.124.59",
+      "@intentius/chant-lexicon-github": "0.124.59",
+      "@intentius/chant-lexicon-gitlab": "0.124.59",
+      "@intentius/chant-lexicon-pulumi": "0.124.59"
     };
   }
 });
@@ -603,8 +603,8 @@ var image_digests_default;
 var init_image_digests = __esm({
   "src/image-digests.json"() {
     image_digests_default = {
-      "ghcr.io/intentius/plywood-pulumi:0.2.0-pulumi3.272.0": "sha256:ea268f1dd2fa15f80ddcedd5c3498d24b79cc2b8a590177c5499e2db3f686f18",
-      "ghcr.io/intentius/plywood-plunge:0.2.0-plunge0.1.0": "sha256:6a862ad23e39081a32fe8b2331b095ed2de44e527f2719416201b0affa46a1eb"
+      "ghcr.io/intentius/plywood-pulumi:0.3.0-pulumi3.272.0": "sha256:39fc85f67be6a281aa5f01b02239aa1f02c492f40f1fb0d145c848cc608aaecd",
+      "ghcr.io/intentius/plywood-plunge:0.3.0-plunge0.2.0": "sha256:6647f67defb1719395b29d1a6c9d977b6900e228547c4569563962e4234847e3"
     };
   }
 });
@@ -741,14 +741,14 @@ var init_images = __esm({
     TOOL_VERSIONS = {
       pulumi: "3.272.0",
       /** A plunge release (INTENTIUS/plunge, tag plunge-v<ver>), not the Pulumi version it is built from. */
-      plunge: "0.1.0"
+      plunge: "0.2.0"
     };
     ARCHES = ["x64", "arm64"];
     PINNED_SHA256 = {
       "pulumi-v3.272.0-linux-x64.tar.gz": "58d545f2b98761051922008ebd381ecef95484d7f7a5ff7faa15d7a780ea84f6",
       "pulumi-v3.272.0-linux-arm64.tar.gz": "4f0741901b8982c4326b702dabf483c63d2cf77c88ac42dd752b72541284a534",
-      "plunge-v0.1.0-linux-x64.tar.gz": "22b89da39ab7dc11268c7b625fec3d99c0793c9c47bf8d031fa94e6967ee8187",
-      "plunge-v0.1.0-linux-arm64.tar.gz": "6855611b8cf8381d73f5ddf0b5c0a0d83bdc2a5bd8c50d415e52bb05a4574f83"
+      "plunge-v0.2.0-linux-x64.tar.gz": "c9c73d05cca9ad214b7f44230a6162cdcb6ad64bbfc725bc94688b997b191495",
+      "plunge-v0.2.0-linux-arm64.tar.gz": "c176a82f038164085aa19c8ad6530d6022e560e124050e535dbe364ae0473357"
     };
     ENGINE_ROOT = "/opt/plywood";
     JOB_ARCH = `"$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/')"`;
@@ -2458,7 +2458,7 @@ var init_chant_product = __esm({
   "src/chant-product.ts"() {
     "use strict";
     REQUIRED2 = ["assertProductWords", "productPipelineJobs", "approveLine", "runChantInProcess"];
-    BUILT_CHANT = true ? "0.124.58" : "unknown";
+    BUILT_CHANT = true ? "0.124.59" : "unknown";
   }
 });
 
@@ -2475,14 +2475,37 @@ function hasChantApprovalStatus(chant) {
 function hasChantPullRequestApprovalStatus(chant) {
   return typeof chant?.APPROVAL_STATUS_PULL_REQUEST_FLOOR === "string";
 }
+function hasChantWavePreview() {
+  wavePreview ??= (async () => {
+    try {
+      const m = await import("@intentius/chant/op");
+      return typeof m.OP_WAVES_PREVIEW_FLOOR === "string";
+    } catch {
+      return false;
+    }
+  })();
+  return wavePreview;
+}
+function withWavePreview(spec, forge) {
+  const approvals = spec.approvals && typeof spec.approvals === "object" && !Array.isArray(spec.approvals) ? spec.approvals : {};
+  const next = approvals.preview !== void 0 ? spec : { ...spec, approvals: { ...approvals, preview: true } };
+  if (forge === "gitlab" || next.approvals.preview !== true || !Array.isArray(next.waves)) return next;
+  const waves = next.waves.map((w) => ({
+    ...w,
+    variables: { [WAVE_TOKEN_VARIABLE]: "${{ github.token }}", ...w.variables ?? {} }
+  }));
+  return { ...next, waves };
+}
 function chantAudit() {
   audit ??= import("@intentius/chant/ci-audit").then((m) => m);
   return audit;
 }
-var audit;
+var wavePreview, WAVE_TOKEN_VARIABLE, GITLAB_READ_TOKEN, audit;
 var init_chant_next = __esm({
   "src/chant-next.ts"() {
     "use strict";
+    WAVE_TOKEN_VARIABLE = "GITHUB_TOKEN";
+    GITLAB_READ_TOKEN = "CHANT_FORGE_TOKEN";
   }
 });
 
@@ -2631,6 +2654,38 @@ var init_note_control = __esm({
   }
 });
 
+// src/init/run-group.ts
+function withRunGroup(text, forge, key) {
+  if (forge !== "forgejo" || TOP_CONCURRENCY.test(text)) return text;
+  const jobs2 = TOP_JOBS.exec(text);
+  if (!jobs2) return text;
+  const name = (TOP_NAME.exec(text)?.[1] ?? "plywood").replace(/^["']|["']$/g, "");
+  const group = key === "commit" ? `${name}-\${{ github.event_name }}-\${{ github.sha }}` : `${name}-\${{ github.event_name == 'pull_request' && github.ref || github.run_id }}`;
+  const cancel = key === "commit" ? "false" : "${{ github.event_name == 'pull_request' }}";
+  const block = [
+    "# Without a group Forgejo cancels the run in progress when a push starts another run of this workflow.",
+    key === "commit" ? "# One group for each commit keeps a merge's wave jobs running to completion when another merge lands (plywood#51)." : "# A push to main and a comment get a group of their own, so the record job runs to completion (plywood#51).",
+    "concurrency:",
+    `  group: ${yamlScalar(group)}`,
+    `  cancel-in-progress: ${yamlScalar(cancel)}`,
+    "",
+    ""
+  ].join("\n");
+  return text.slice(0, jobs2.index) + block + text.slice(jobs2.index);
+}
+function yamlScalar(value) {
+  return value === "false" ? value : JSON.stringify(value);
+}
+var TOP_CONCURRENCY, TOP_JOBS, TOP_NAME;
+var init_run_group = __esm({
+  "src/init/run-group.ts"() {
+    "use strict";
+    TOP_CONCURRENCY = /^concurrency:/m;
+    TOP_JOBS = /^jobs:/m;
+    TOP_NAME = /^name:\s*(.+?)\s*$/m;
+  }
+});
+
 // src/init/workflow.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join2 } from "node:path";
@@ -2643,7 +2698,7 @@ async function writeWorkflow(chant, input) {
     if (previous !== void 0) writeFileSync(file, previous);
     return { code: code !== 0 ? code : 1, file, status: "failed", kept: [] };
   }
-  const generated = withNoteControl(readFileSync2(file, "utf8"), input.forge, input.noteControl);
+  const generated = withRunGroup(withNoteControl(readFileSync2(file, "utf8"), input.forge, input.noteControl), input.forge, "pull-request");
   const { text, kept } = keepOwnJobs(previous, generated, input.forge);
   writeFileSync(file, text);
   return { code, file, status: text === previous ? "unchanged" : "written", kept };
@@ -2653,6 +2708,7 @@ var init_workflow = __esm({
     "use strict";
     init_own_jobs();
     init_note_control();
+    init_run_group();
   }
 });
 
@@ -2794,11 +2850,9 @@ async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}
   }
   const lines2 = hasChant4607(chant) ? void 0 : binLines(waves, words.bin);
   for (const file of files) {
-    if (lines2) {
-      const text = readFileSync3(file, "utf8");
-      const next = withBinLines(text, lines2);
-      if (next !== text) writeFileSync2(file, next);
-    }
+    const text = readFileSync3(file, "utf8");
+    const next = withRunGroup(lines2 ? withBinLines(text, lines2) : text, forge, "commit");
+    if (next !== text) writeFileSync2(file, next);
     io.err(`${PRODUCT} ci: waves workflow at ${file.slice(io.cwd.length + 1)}`);
   }
   if (forge === "gitlab") {
@@ -2812,6 +2866,7 @@ var init_waves_workflow = __esm({
     "use strict";
     init_chant_product();
     init_images();
+    init_run_group();
     init_words();
     WAVES_OUTPUT_DIR = {
       github: ".github/workflows",
@@ -3111,13 +3166,383 @@ async function prJobsFor(pipeline) {
   const { flags, notes } = prLoopJobFlags(pipeline.jobs, pipeline.runner);
   return { options: prLoopJobOptions(pipeline.jobs, pipeline.runner), flags, notes };
 }
-var detected, JOBS_NEED_CHANT, GROUP_NAME;
-var init_jobs2 = __esm({
-  "src/jobs.ts"() {
+var detected, JOBS_NEED_CHANT, GROUP_NAME;
+var init_jobs2 = __esm({
+  "src/jobs.ts"() {
+    "use strict";
+    init_images2();
+    JOBS_NEED_CHANT = "needs chant's runners, variables, passed secrets and parallelism on the pull request jobs (chant#4625), which this chant lacks";
+    GROUP_NAME = /[^a-z0-9_-]+/g;
+  }
+});
+
+// src/init/detect.ts
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync5, statSync } from "node:fs";
+import { basename, dirname as dirname5, join as join5, relative, sep } from "node:path";
+import { parseYAML as parseYAML2 } from "@intentius/chant/yaml";
+function repoRoot(dir) {
+  let cur = dir;
+  for (let i = 0; i < 64; i++) {
+    if (existsSync5(join5(cur, ".git"))) return cur;
+    const parent = dirname5(cur);
+    if (parent === cur) return dir;
+    cur = parent;
+  }
+  return dir;
+}
+function posixRel(root, path) {
+  const rel = relative(root, path);
+  return rel === "" ? "." : rel.split(sep).join("/");
+}
+function readYamlFile(file) {
+  try {
+    const doc = parseYAML2(readFileSync5(file, "utf8"));
+    return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function findPulumiProjects(root) {
+  const out = [];
+  const walk = (dir, depth) => {
+    let entries;
+    try {
+      entries = readdirSync3(dir).sort();
+    } catch {
+      return;
+    }
+    const file = ["Pulumi.yaml", "Pulumi.yml"].find((n) => entries.includes(n));
+    if (file) {
+      const project = readProject(root, dir, join5(dir, file));
+      if (project) out.push(project);
+    }
+    if (depth >= MAX_DEPTH) return;
+    for (const name of entries) {
+      if (SKIP.has(name) || name.startsWith(".")) continue;
+      const path = join5(dir, name);
+      try {
+        if (statSync(path).isDirectory()) walk(path, depth + 1);
+      } catch {
+      }
+    }
+  };
+  walk(root, 0);
+  return out;
+}
+function readProject(root, dir, file) {
+  const doc = readYamlFile(file);
+  if (!doc || typeof doc.name !== "string" || doc.name === "") return void 0;
+  const runtime = typeof doc.runtime === "string" ? doc.runtime : doc.runtime?.name;
+  const backend = doc.backend;
+  const configDir = typeof doc.stackConfigDir === "string" ? join5(dir, doc.stackConfigDir) : dir;
+  return {
+    name: doc.name,
+    dir: posixRel(root, dir),
+    ...typeof runtime === "string" ? { runtime } : {},
+    ...backend && typeof backend.url === "string" ? { backendUrl: backend.url } : {},
+    stacks: stackNames(configDir)
+  };
+}
+function stackNames(configDir) {
+  let entries;
+  try {
+    entries = readdirSync3(configDir);
+  } catch {
+    return [];
+  }
+  const names = entries.map((n) => /^Pulumi\.(.+)\.ya?ml$/.exec(n)?.[1]).filter((s) => s !== void 0 && s !== "");
+  return [...new Set(names)].sort(byEnvironment);
+}
+function environmentOf(stack) {
+  const last = stack.split("/").pop().toLowerCase();
+  const head = last.split(/[-_.]/)[0];
+  return ENV_ORDER.includes(head) ? head : last;
+}
+function rank(stack) {
+  const env = environmentOf(stack);
+  const at = ENV_ORDER.indexOf(env);
+  return at >= 0 ? at : PROD_RANK - 0.5;
+}
+function byEnvironment(a, b) {
+  return rank(a) - rank(b) || a.localeCompare(b);
+}
+function stacksOf2(projects) {
+  const names = /* @__PURE__ */ new Map();
+  for (const p of projects) names.set(p.name, (names.get(p.name) ?? 0) + 1);
+  const out = [];
+  for (const p of projects) {
+    const project = (names.get(p.name) ?? 0) > 1 ? `${p.name}-${slug(p.dir)}` : p.name;
+    for (const stack of p.stacks) out.push({ key: `${project}/${stack}`, project: p.name, stack, dir: p.dir });
+  }
+  return out.sort((x, y) => byEnvironment(x.stack, y.stack) || x.key.localeCompare(y.key));
+}
+function slug(s) {
+  const out = s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return out === "" ? "root" : out;
+}
+function originUrl(root) {
+  const config2 = gitFile(root, "config");
+  if (!config2) return void 0;
+  let inOrigin = false;
+  for (const raw of config2.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line.startsWith("[")) {
+      inOrigin = /^\[remote\s+"origin"\]$/.test(line);
+      continue;
+    }
+    const m = inOrigin ? /^url\s*=\s*(.+)$/.exec(line) : null;
+    if (m) return m[1].trim();
+  }
+  return void 0;
+}
+function gitFile(root, name) {
+  const dotGit = join5(root, ".git");
+  let gitDir = dotGit;
+  try {
+    if (statSync(dotGit).isFile()) {
+      const m = /^gitdir:\s*(.+)$/m.exec(readFileSync5(dotGit, "utf8"));
+      if (!m) return void 0;
+      gitDir = join5(root, m[1].trim());
+      const common = join5(gitDir, "commondir");
+      if (existsSync5(common) && !existsSync5(join5(gitDir, name))) gitDir = join5(gitDir, readFileSync5(common, "utf8").trim());
+    }
+    const path = join5(gitDir, name);
+    return existsSync5(path) ? readFileSync5(path, "utf8") : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function remoteHost(url) {
+  const scp = /^[^@/\s]+@([^:/\s]+):/.exec(url);
+  if (scp) return scp[1].toLowerCase();
+  try {
+    return new URL(url).hostname.toLowerCase() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function forgeOfRemote(url) {
+  const host = remoteHost(url);
+  if (!host) return void 0;
+  if (host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.")) return { kind: "github", because: `origin is on ${host}` };
+  if (host === "gitlab.com") return { kind: "gitlab", because: `origin is on ${host}` };
+  if (host === "codeberg.org") return { kind: "forgejo", because: `origin is on ${host}` };
+  if (/(^|[.-])gitlab([.-]|$)/.test(host)) return { kind: "gitlab", because: `origin is on ${host}`, url: `https://${host}` };
+  if (/(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return { kind: "forgejo", because: `origin is on ${host}`, url: `https://${host}` };
+  return void 0;
+}
+function detectForge(root) {
+  const url = originUrl(root);
+  const byRemote = url ? forgeOfRemote(url) : void 0;
+  if (byRemote) return byRemote;
+  if (existsSync5(join5(root, ".forgejo"))) return { kind: "forgejo", because: "the repository has .forgejo/" };
+  if (existsSync5(join5(root, ".gitlab-ci.yml"))) return { kind: "gitlab", because: "the repository has .gitlab-ci.yml" };
+  if (existsSync5(join5(root, ".github", "workflows"))) return { kind: "github", because: "the repository has .github/workflows/" };
+  return void 0;
+}
+function defaultBranch(root) {
+  const head = gitFile(root, "refs/remotes/origin/HEAD");
+  const remote = head && /ref:\s*refs\/remotes\/origin\/(.+)/.exec(head)?.[1];
+  if (remote) return remote.trim();
+  const local = gitFile(root, "HEAD");
+  const branch = local && /ref:\s*refs\/heads\/(.+)/.exec(local)?.[1];
+  return branch ? branch.trim() : "main";
+}
+function findPulumiActions(root) {
+  const out = [];
+  for (const d of WORKFLOW_DIRS) {
+    let names;
+    try {
+      names = readdirSync3(join5(root, d)).sort();
+    } catch {
+      continue;
+    }
+    for (const n of names) {
+      if (!/\.ya?ml$/.test(n)) continue;
+      try {
+        if (/uses:\s*["']?pulumi\/actions@/.test(readFileSync5(join5(root, d, n), "utf8"))) out.push(`${d}/${n}`);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function detect(cwd) {
+  const root = repoRoot(cwd);
+  const projects = findPulumiProjects(root);
+  const forge = detectForge(root);
+  const preCommit = [".pre-commit-config.yaml", ".pre-commit-config.yml"].find((n) => existsSync5(join5(root, n)));
+  return {
+    root,
+    projects,
+    stacks: stacksOf2(projects),
+    ...forge ? { forge } : {},
+    defaultBranch: defaultBranch(root),
+    pulumiActions: findPulumiActions(root),
+    ...preCommit ? { preCommit } : {}
+  };
+}
+function repoName(root) {
+  return slug(basename(root)).slice(0, 40).replace(/-+$/, "") || "plywood";
+}
+var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
+var init_detect = __esm({
+  "src/init/detect.ts"() {
+    "use strict";
+    SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
+    MAX_DEPTH = 8;
+    ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
+    PROD_RANK = ENV_ORDER.indexOf("prod");
+    WORKFLOW_DIRS = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
+  }
+});
+
+// src/templates.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+function template(name) {
+  return readFileSync6(new URL(`../templates/${name}`, import.meta.url), "utf8");
+}
+function fill(text, values) {
+  return text.replace(/\{\{(\w+)\}\}/g, (all, key) => key in values ? values[key] : all);
+}
+var init_templates = __esm({
+  "src/templates.ts"() {
+    "use strict";
+  }
+});
+
+// src/init/render.ts
+import { emitYAMLEntry } from "@intentius/chant/yaml";
+function plywoodYml(keys) {
+  const body = Object.entries(keys).filter(([, v]) => v !== void 0).map(([k, v]) => emitYAMLEntry(k, v)).join("\n");
+  const text = fill(template("plywood.yml"), { keys: body });
+  return text.endsWith("\n") ? text : text + "\n";
+}
+function chantConfigTs() {
+  return template("chant.config.ts.tmpl");
+}
+function componentName(stack) {
+  return slug(stack.key);
+}
+function exportName(stack, taken) {
+  let base = stack.key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  if (base === "" || /^\d/.test(base)) base = `stack_${base}`;
+  let name = base;
+  for (let i = 2; taken.has(name); i++) name = `${base}_${i}`;
+  taken.add(name);
+  return name;
+}
+function stepInput(s) {
+  return {
+    dir: s.dir,
+    stack: s.stack,
+    member: s.project,
+    ...s.engine ? { engine: s.engine } : {},
+    ...s.backend ? { backend: s.backend } : {},
+    ...s.engineVersion ? { engineVersion: s.engineVersion, ...s.engineRoot ? { engineRoot: s.engineRoot } : {} } : {},
+    ...s.lockGrain ? { lockGrain: s.lockGrain } : {},
+    ...s.policyPacks?.length ? { policyPacks: s.policyPacks } : {}
+  };
+}
+function componentsFile(stacks2, after = {}, opts = {}) {
+  const taken = /* @__PURE__ */ new Set();
+  const lines2 = [
+    "// Written by plywood init from the stacks it found; running it again rewrites",
+    "// this file. Each stack is a chant component whose pulumi-up step previews it",
+    "// on a pull request and updates it in its wave.",
+    ""
+  ];
+  for (const s of stacks2) {
+    const dependsOn = (after[s.key] ?? []).filter((u) => stacks2.some((x) => x.key === u)).map((u) => componentName({ key: u }));
+    const step = { kind: "pulumi-up", ...stepInput(s), ...opts.reviewSuffix ? { reviewSuffix: opts.reviewSuffix } : {} };
+    const component = { name: componentName(s), dependsOn, deploy: [{ phase: "up", steps: [step] }] };
+    lines2.push(`export const ${exportName(s, taken)} = ${JSON.stringify(component)};`);
+  }
+  return lines2.join("\n") + "\n";
+}
+function wavesOf(stacks2, configured) {
+  const byKey = new Map(stacks2.map((s) => [s.key, s]));
+  if (configured && configured.length > 0) {
+    return configured.map((keys, i) => ({ name: `wave-${i + 1}`, stacks: keys.map((k) => byKey.get(k)).filter((s) => s !== void 0) }));
+  }
+  const out = [];
+  for (const s of stacks2) {
+    const env = environmentOf(s.stack);
+    let name = slug(env);
+    if (!WAVE_NAME.test(name)) name = `wave-${out.length + 1}`;
+    const wave = out.find((w) => w.name === name);
+    if (wave) wave.stacks.push(s);
+    else out.push({ name, stacks: [s] });
+  }
+  return out;
+}
+function waveRunner(runner) {
+  if (runner === void 0) return void 0;
+  if (typeof runner === "string" || Array.isArray(runner) || "group" in runner) return runner;
+  const staged = runner;
+  return staged.up ?? staged.default;
+}
+function wavesSpec(input) {
+  const waves = (input.ordered ?? wavesOf(input.stacks, input.waves)).filter((w) => w.stacks.length > 0);
+  return {
+    name: OP_NAME,
+    op: OP_NAME,
+    gate: PR_GATE,
+    branches: [input.branch],
+    ...input.runner !== void 0 ? { runner: input.runner } : {},
+    step: { kind: "pulumi-up" },
+    ...input.quorum && input.quorum.length > 0 ? { approvals: { quorum: input.quorum } } : {},
+    ...input.notify ? { notify: input.notify } : {},
+    waves: waves.map((w) => {
+      const gate = w.stacks.map((s) => s.gate ?? input.gate).reduce((a, b) => STRICTNESS[b] > STRICTNESS[a] ? b : a);
+      return { name: w.name, gate, runs: w.stacks.map((s) => ({ target: s.key, input: stepInput(s) })) };
+    })
+  };
+}
+function jsonText(v) {
+  return JSON.stringify(v, null, 2) + "\n";
+}
+function memberName(project, taken) {
+  let base = slug(project.name).slice(0, 36).replace(/-+$/, "");
+  if (!MEMBER_NAME.test(base)) base = "stack";
+  let name = base;
+  for (let i = 2; taken.has(name); i++) name = `${base}-${i}`;
+  taken.add(name);
+  return name;
+}
+function workspaceDeclaration(existing, input) {
+  const doc = existing ? structuredClone(existing) : { name: input.name, schema: 1 };
+  const members = Array.isArray(doc.members) ? doc.members : [];
+  const taken = new Set(members.map((m) => String(m.name)));
+  for (const p of input.projects) {
+    if (members.some((m) => m.dir === p.dir || p.dir === "." && m.dir === void 0)) continue;
+    members.push({ name: memberName(p, taken), dir: p.dir, kind: "pulumi" });
+  }
+  doc.members = members;
+  const pins = Array.isArray(doc.pins) ? doc.pins : [];
+  if (!pins.some((p) => p.package === PULUMI_LEXICON)) pins.push({ package: PULUMI_LEXICON, version: input.lexiconVersion });
+  doc.pins = pins;
+  const ci2 = doc.ci && typeof doc.ci === "object" && !Array.isArray(doc.ci) ? doc.ci : {};
+  for (const [k, v] of Object.entries(input.ci)) if (v !== void 0) ci2[k] = v;
+  if (Object.keys(ci2).length > 0) doc.ci = ci2;
+  return doc;
+}
+function memberOfDir(doc, dir) {
+  const members = doc && Array.isArray(doc.members) ? doc.members : [];
+  const m = members.find((x) => x.dir === dir || dir === "." && x.dir === void 0);
+  return typeof m?.name === "string" ? m.name : void 0;
+}
+var WAVE_NAME, STRICTNESS, MEMBER_NAME, PULUMI_LEXICON;
+var init_render = __esm({
+  "src/init/render.ts"() {
     "use strict";
-    init_images2();
-    JOBS_NEED_CHANT = "needs chant's runners, variables, passed secrets and parallelism on the pull request jobs (chant#4625), which this chant lacks";
-    GROUP_NAME = /[^a-z0-9_-]+/g;
+    init_templates();
+    init_words();
+    init_detect();
+    WAVE_NAME = /^[a-z0-9][a-z0-9_-]*$/;
+    STRICTNESS = { never: 0, "on-destructive": 1, always: 2 };
+    MEMBER_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
+    PULUMI_LEXICON = "@intentius/chant-lexicon-pulumi";
   }
 });
 
@@ -3150,6 +3575,16 @@ function explainRefusal(code, table, err, ctx = {}) {
   if (refusal) err(`${PRODUCT}: ${refusalLine(refusal, ctx)}`);
   return code;
 }
+function approveLineIn(output) {
+  const m = /Approve these plans to apply them:[ \t]*([^\r\n]+)/.exec(output);
+  const line = m?.[1]?.trim();
+  return line ? line : void 0;
+}
+function waveMovedLine(output) {
+  const approve2 = approveLineIn(output);
+  const how = approve2 ? `If a person has read the plans chant listed above and wants them applied, approve exactly them with: ${approve2}, then run the job again.` : `chant named no approval for these plans. Read the plans above, then approve them with '${PRODUCT} approve <wave gate> --plan <digest>' and run the job again.`;
+  return `A merged wave stopped with exit 4 and nothing in it was applied: its plans are not the ones its pull request previewed (or no preview was recorded for it). ${how} To apply only what a pull request previews, open a new pull request, let '${PRODUCT} run wave --record-plans' record its plans, and merge that.`;
+}
 var REFUSALS;
 var init_refusals = __esm({
   "src/refusals.ts"() {
@@ -3160,8 +3595,8 @@ var init_refusals = __esm({
 });
 
 // src/up.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
-import { join as join5 } from "node:path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
+import { join as join6 } from "node:path";
 function approveTarget(gate, opts) {
   if (opts.op) return { op: opts.op, gate };
   if (PR_OP.test(gate)) return { op: gate, gate: PR_GATE };
@@ -3242,10 +3677,10 @@ async function approve(args, json, table, io) {
   });
 }
 function wavesSpecAt(cwd, file = WAVES_SPEC_FILE) {
-  const path = join5(cwd, file);
-  if (!existsSync5(path)) return void 0;
+  const path = join6(cwd, file);
+  if (!existsSync6(path)) return void 0;
   try {
-    const spec = unwrapWavesSpec(JSON.parse(readFileSync5(path, "utf8")));
+    const spec = unwrapWavesSpec(JSON.parse(readFileSync7(path, "utf8")));
     return spec && typeof spec === "object" && !Array.isArray(spec) ? spec : void 0;
   } catch {
     return void 0;
@@ -3329,11 +3764,11 @@ async function override(args, json, table, io) {
   return withChant(`${PRODUCT} override`, table, io, async (chant) => explainRefusal(await chant.runChantInProcess(argv, PRODUCT_WORDS), table, io.err));
 }
 function readUpSpec(cwd, file = WAVES_SPEC_FILE) {
-  const path = join5(cwd, file);
-  if (!existsSync5(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
+  const path = join6(cwd, file);
+  if (!existsSync6(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
   let spec;
   try {
-    spec = unwrapWavesSpec(JSON.parse(readFileSync5(path, "utf8")));
+    spec = unwrapWavesSpec(JSON.parse(readFileSync7(path, "utf8")));
   } catch (e) {
     return { error: `${file}: ${e.message}` };
   }
@@ -3488,9 +3923,9 @@ var init_up = __esm({
 // src/drift.ts
 import { createHash as createHash2 } from "node:crypto";
 import { resolveTargetCloudIdentity } from "@intentius/chant/ci-identity";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname5, join as join6 } from "node:path";
+import { dirname as dirname6, join as join7 } from "node:path";
 function driftRows(doc) {
   return (doc.records ?? []).filter((r) => DRIFT_STATUSES.includes(r.status)).map((r) => ({ urn: r.address, status: r.status, attributes: (r.attributes ?? []).map((a) => a.path).sort() })).sort((a, b) => a.urn < b.urn ? -1 : a.urn > b.urn ? 1 : 0);
 }
@@ -3549,11 +3984,12 @@ async function drift2(args, json, table, io) {
   const respond = respondFlag.value ?? driftResponseOf(doc);
   const forge = forgeFlag.value;
   return withChant(`${PRODUCT} drift`, table, io, async (chant) => {
-    const dir = mkdtempSync(join6(tmpdir(), "plywood-drift-"));
+    const dir = mkdtempSync(join7(tmpdir(), "plywood-drift-"));
     const results = [];
     try {
       const attribute = await attributionFor(doc, io);
-      for (const stack of stacks2) results.push(await readStack(chant, stack, dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} }));
+      const root = dirname6(path);
+      for (const stack of stacks2) results.push(await readStack(chant, stack, driftMember(root, doc, stack), dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} }));
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -3628,13 +4064,31 @@ async function driftNotice(chant, doc, results, environment, io) {
     ...notifyFetch ? { fetch: notifyFetch } : {}
   });
 }
-async function readStack(chant, stack, dir, opts) {
-  const file = join6(dir, `${driftOpName(stack)}.json`);
-  const argv = ["workspace", "drift", "--member", stack, ...opts.resource ? ["--resource", opts.resource] : [], ...opts.env ? ["--env", opts.env] : [], "-o", file];
+function driftMember(root, doc, stack) {
+  const project = stack.includes("/") ? stack.slice(0, stack.indexOf("/")) : stack;
+  let declaration;
+  try {
+    declaration = JSON.parse(readFileSync8(join7(root, "chant.workspace.json"), "utf8"));
+  } catch {
+    return project;
+  }
+  const dir = stacksOf(doc)[stack]?.dir;
+  const byDir = dir !== void 0 ? memberOfDir(declaration, dir) : void 0;
+  if (byDir) return byDir;
+  const names = (Array.isArray(declaration.members) ? declaration.members : []).flatMap((m) => typeof m.name === "string" ? [m.name] : []);
+  if (names.includes(project)) return project;
+  const slugged = names.find((n) => n === slug(project));
+  if (slugged) return slugged;
+  return names.length === 1 ? names[0] : project;
+}
+async function readStack(chant, stack, member, dir, opts) {
+  const file = join7(dir, `${driftOpName(stack)}.json`);
+  const pulumiStack = stack.slice(stack.indexOf("/") + 1);
+  const argv = ["workspace", "drift", "--member", member, "--stack", pulumiStack, ...opts.resource ? ["--resource", opts.resource] : [], ...opts.env ? ["--env", opts.env] : [], "-o", file];
   const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
   let doc;
   try {
-    if (existsSync6(file)) doc = JSON.parse(readFileSync6(file, "utf8"));
+    if (existsSync7(file)) doc = JSON.parse(readFileSync8(file, "utf8"));
   } catch (e) {
     return { stack, ok: false, drifted: 0, rows: [], error: `chant wrote a drift document plywood cannot read: ${e.message}` };
   }
@@ -3667,7 +4121,7 @@ async function attributeStack(a, stack, doc) {
 }
 function specHasUpdate(cwd, op) {
   try {
-    const spec = JSON.parse(readFileSync6(join6(cwd, DRIFT_SPEC_FILE), "utf8"));
+    const spec = JSON.parse(readFileSync8(join7(cwd, DRIFT_SPEC_FILE), "utf8"));
     return (spec.ops ?? []).some((o) => o.name === op && o.update !== void 0);
   } catch {
     return false;
@@ -3743,9 +4197,9 @@ function withNotifyVariables(fields, notify2) {
   return { ...fields, variables: { ...notify2, ...fields.variables ?? {} } };
 }
 function writeIfChanged2(cwd, file, text) {
-  const path = join6(cwd, file);
-  if (existsSync6(path) && readFileSync6(path, "utf8") === text) return false;
-  mkdirSync4(dirname5(path), { recursive: true });
+  const path = join7(cwd, file);
+  if (existsSync7(path) && readFileSync8(path, "utf8") === text) return false;
+  mkdirSync4(dirname6(path), { recursive: true });
   writeFileSync4(path, text);
   return true;
 }
@@ -3761,9 +4215,9 @@ async function writeDriftJobs(chant, forge, doc, words, table, io, env = "produc
   const outDir = OP_OUTPUT_DIR2[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", DRIFT_SPEC_FILE, "--output", outDir], words);
   if (code !== table.done) return code;
-  const dir = join6(io.cwd, outDir);
-  const files = existsSync6(dir) ? readdirSync3(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync6(join6(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${DRIFT_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: drift job at ${join6(outDir, f).replace(/^\.\//, "")} on ${settings.schedule}`);
+  const dir = join7(io.cwd, outDir);
+  const files = existsSync7(dir) ? readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync8(join7(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${DRIFT_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: drift job at ${join7(outDir, f).replace(/^\.\//, "")} on ${settings.schedule}`);
   if (files.length && forge === "gitlab") io.err(`${PRODUCT} ci: GitLab runs the drift job from a pipeline schedule; include the file from .gitlab-ci.yml and add a schedule`);
   return table.done;
 }
@@ -3781,6 +4235,8 @@ var init_drift2 = __esm({
     init_drift();
     init_config();
     init_stacks();
+    init_detect();
+    init_render();
     init_routing();
     init_images();
     init_stages();
@@ -3837,8 +4293,8 @@ var init_tips = __esm({
 });
 
 // src/agents.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname6, join as join7 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname7, join as join8 } from "node:path";
 function plywoodMcpTools(ctx) {
   const none = { type: "object", properties: {} };
   const doc = () => {
@@ -3948,304 +4404,83 @@ function reviewOpFile(doc) {
     "",
     "export default Op({",
     `  name: ${JSON.stringify(REVIEW_OP)},`,
-    `  overview: "A model reviews the pull request against its stacks' previews",`,
-    "  phases: [",
-    `    phase("Preview", [shell(${JSON.stringify(REVIEW_PREVIEW_LINE)})]),`,
-    `    phase("Review", [reviewAgent({ ${fields} })]),`,
-    "  ],",
-    "});",
-    ""
-  ].join("\n");
-}
-function reviewOpSpec(doc) {
-  const settings = toChantSettings({ doc });
-  const p = settings.pipeline;
-  const engine2 = chantPipelineOptions({ ...p.image ? { image: p.image } : {}, ...p.engineSetup ? { engineSetup: p.engineSetup } : {} }, false);
-  return {
-    ops: [
-      {
-        name: REVIEW_OP,
-        trigger: { kind: "pull_request" },
-        reviewAgent: true,
-        // The preview in the review job takes the preview identity; id-token is the one write the review job may hold.
-        ...settings.ci.identity ? { permissions: { "id-token": "write" } } : {}
-      }
-    ],
-    options: {
-      ...engine2.beforeScript ? { beforeScript: engine2.beforeScript } : {},
-      ...engine2.image ? { image: engine2.image } : {}
-    }
-  };
-}
-function writeIfChanged3(cwd, file, text) {
-  const path = join7(cwd, file);
-  if (existsSync7(path) && readFileSync7(path, "utf8") === text) return false;
-  mkdirSync5(dirname6(path), { recursive: true });
-  writeFileSync5(path, text);
-  return true;
-}
-async function writeReviewJobs(chant, forge, doc, words, table, io) {
-  if (!reviewOf(doc)) return table.done;
-  if (writeIfChanged3(io.cwd, REVIEW_OP_FILE, reviewOpFile(doc))) io.err(`${PRODUCT} ci: wrote ${REVIEW_OP_FILE}; commit it with the workflow`);
-  if (writeIfChanged3(io.cwd, REVIEW_SPEC_FILE, JSON.stringify(reviewOpSpec(doc), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${REVIEW_SPEC_FILE}`);
-  const outDir = OP_OUTPUT_DIR3[forge];
-  const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", REVIEW_SPEC_FILE, "--output", outDir], words);
-  if (code !== table.done) return code;
-  const dir = join7(io.cwd, outDir);
-  const files = existsSync7(dir) ? readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync7(join7(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${REVIEW_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: review jobs at ${join7(outDir, f).replace(/^\.\//, "")}`);
-  const r = reviewOf(doc);
-  io.err(`${PRODUCT} ci: the review job reads the model's key from ${r.keyEnv}; set it from a secret`);
-  if (forge === "gitlab") io.err(`${PRODUCT} ci: on GitLab the note job runs on the default branch with CHANT_REVIEW_NOTES=1 from a pipeline schedule, and posts with a protected CHANT_FORGE_TOKEN`);
-  return table.done;
-}
-var PERSON_VERBS, READ_INSTRUCTIONS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE, REVIEW_CHANGE_SET, REVIEW_PREVIEW_LINE, OP_OUTPUT_DIR3;
-var init_agents2 = __esm({
-  "src/agents.ts"() {
-    "use strict";
-    init_chant_config();
-    init_config_check();
-    init_agents();
-    init_config();
-    init_stacks();
-    init_images();
-    init_stages();
-    init_tips();
-    init_words();
-    PERSON_VERBS = ["up", "approve", "override"];
-    READ_INSTRUCTIONS = `To change a stack, open a pull request: ${PRODUCT} previews it, and its update runs after a person approves the digest.`;
-    REVIEW_OP = "plywood-review";
-    REVIEW_OP_FILE = "ops/plywood-review.op.ts";
-    REVIEW_SPEC_FILE = ".chant/ops/plywood-review.spec.json";
-    REVIEW_CHANGE_SET = ".chant/pr/change-set.json";
-    REVIEW_PREVIEW_LINE = `${BIN} components pr-plan --base "origin/\${GITHUB_BASE_REF:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME}" --pr "\${CI_MERGE_REQUEST_IID:-$(node -p 'require(process.env.GITHUB_EVENT_PATH).pull_request.number')}" --gate ${PR_GATE} --no-status`;
-    OP_OUTPUT_DIR3 = { github: ".github/workflows", forgejo: ".forgejo/workflows", gitlab: "." };
-  }
-});
-
-// src/init/detect.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5, readFileSync as readFileSync8, statSync } from "node:fs";
-import { basename, dirname as dirname7, join as join8, relative, sep } from "node:path";
-import { parseYAML as parseYAML2 } from "@intentius/chant/yaml";
-function repoRoot(dir) {
-  let cur = dir;
-  for (let i = 0; i < 64; i++) {
-    if (existsSync8(join8(cur, ".git"))) return cur;
-    const parent = dirname7(cur);
-    if (parent === cur) return dir;
-    cur = parent;
-  }
-  return dir;
-}
-function posixRel(root, path) {
-  const rel = relative(root, path);
-  return rel === "" ? "." : rel.split(sep).join("/");
-}
-function readYamlFile(file) {
-  try {
-    const doc = parseYAML2(readFileSync8(file, "utf8"));
-    return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function findPulumiProjects(root) {
-  const out = [];
-  const walk = (dir, depth) => {
-    let entries;
-    try {
-      entries = readdirSync5(dir).sort();
-    } catch {
-      return;
-    }
-    const file = ["Pulumi.yaml", "Pulumi.yml"].find((n) => entries.includes(n));
-    if (file) {
-      const project = readProject(root, dir, join8(dir, file));
-      if (project) out.push(project);
-    }
-    if (depth >= MAX_DEPTH) return;
-    for (const name of entries) {
-      if (SKIP.has(name) || name.startsWith(".")) continue;
-      const path = join8(dir, name);
-      try {
-        if (statSync(path).isDirectory()) walk(path, depth + 1);
-      } catch {
-      }
-    }
-  };
-  walk(root, 0);
-  return out;
-}
-function readProject(root, dir, file) {
-  const doc = readYamlFile(file);
-  if (!doc || typeof doc.name !== "string" || doc.name === "") return void 0;
-  const runtime = typeof doc.runtime === "string" ? doc.runtime : doc.runtime?.name;
-  const backend = doc.backend;
-  const configDir = typeof doc.stackConfigDir === "string" ? join8(dir, doc.stackConfigDir) : dir;
-  return {
-    name: doc.name,
-    dir: posixRel(root, dir),
-    ...typeof runtime === "string" ? { runtime } : {},
-    ...backend && typeof backend.url === "string" ? { backendUrl: backend.url } : {},
-    stacks: stackNames(configDir)
-  };
-}
-function stackNames(configDir) {
-  let entries;
-  try {
-    entries = readdirSync5(configDir);
-  } catch {
-    return [];
-  }
-  const names = entries.map((n) => /^Pulumi\.(.+)\.ya?ml$/.exec(n)?.[1]).filter((s) => s !== void 0 && s !== "");
-  return [...new Set(names)].sort(byEnvironment);
-}
-function environmentOf(stack) {
-  const last = stack.split("/").pop().toLowerCase();
-  const head = last.split(/[-_.]/)[0];
-  return ENV_ORDER.includes(head) ? head : last;
-}
-function rank(stack) {
-  const env = environmentOf(stack);
-  const at = ENV_ORDER.indexOf(env);
-  return at >= 0 ? at : PROD_RANK - 0.5;
-}
-function byEnvironment(a, b) {
-  return rank(a) - rank(b) || a.localeCompare(b);
-}
-function stacksOf2(projects) {
-  const names = /* @__PURE__ */ new Map();
-  for (const p of projects) names.set(p.name, (names.get(p.name) ?? 0) + 1);
-  const out = [];
-  for (const p of projects) {
-    const project = (names.get(p.name) ?? 0) > 1 ? `${p.name}-${slug(p.dir)}` : p.name;
-    for (const stack of p.stacks) out.push({ key: `${project}/${stack}`, project: p.name, stack, dir: p.dir });
-  }
-  return out.sort((x, y) => byEnvironment(x.stack, y.stack) || x.key.localeCompare(y.key));
-}
-function slug(s) {
-  const out = s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return out === "" ? "root" : out;
-}
-function originUrl(root) {
-  const config2 = gitFile(root, "config");
-  if (!config2) return void 0;
-  let inOrigin = false;
-  for (const raw of config2.split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line.startsWith("[")) {
-      inOrigin = /^\[remote\s+"origin"\]$/.test(line);
-      continue;
-    }
-    const m = inOrigin ? /^url\s*=\s*(.+)$/.exec(line) : null;
-    if (m) return m[1].trim();
-  }
-  return void 0;
-}
-function gitFile(root, name) {
-  const dotGit = join8(root, ".git");
-  let gitDir = dotGit;
-  try {
-    if (statSync(dotGit).isFile()) {
-      const m = /^gitdir:\s*(.+)$/m.exec(readFileSync8(dotGit, "utf8"));
-      if (!m) return void 0;
-      gitDir = join8(root, m[1].trim());
-      const common = join8(gitDir, "commondir");
-      if (existsSync8(common) && !existsSync8(join8(gitDir, name))) gitDir = join8(gitDir, readFileSync8(common, "utf8").trim());
-    }
-    const path = join8(gitDir, name);
-    return existsSync8(path) ? readFileSync8(path, "utf8") : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function remoteHost(url) {
-  const scp = /^[^@/\s]+@([^:/\s]+):/.exec(url);
-  if (scp) return scp[1].toLowerCase();
-  try {
-    return new URL(url).hostname.toLowerCase() || void 0;
-  } catch {
-    return void 0;
-  }
-}
-function forgeOfRemote(url) {
-  const host = remoteHost(url);
-  if (!host) return void 0;
-  if (host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.")) return { kind: "github", because: `origin is on ${host}` };
-  if (host === "gitlab.com") return { kind: "gitlab", because: `origin is on ${host}` };
-  if (host === "codeberg.org") return { kind: "forgejo", because: `origin is on ${host}` };
-  if (/(^|[.-])gitlab([.-]|$)/.test(host)) return { kind: "gitlab", because: `origin is on ${host}`, url: `https://${host}` };
-  if (/(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return { kind: "forgejo", because: `origin is on ${host}`, url: `https://${host}` };
-  return void 0;
-}
-function detectForge(root) {
-  const url = originUrl(root);
-  const byRemote = url ? forgeOfRemote(url) : void 0;
-  if (byRemote) return byRemote;
-  if (existsSync8(join8(root, ".forgejo"))) return { kind: "forgejo", because: "the repository has .forgejo/" };
-  if (existsSync8(join8(root, ".gitlab-ci.yml"))) return { kind: "gitlab", because: "the repository has .gitlab-ci.yml" };
-  if (existsSync8(join8(root, ".github", "workflows"))) return { kind: "github", because: "the repository has .github/workflows/" };
-  return void 0;
-}
-function defaultBranch(root) {
-  const head = gitFile(root, "refs/remotes/origin/HEAD");
-  const remote = head && /ref:\s*refs\/remotes\/origin\/(.+)/.exec(head)?.[1];
-  if (remote) return remote.trim();
-  const local = gitFile(root, "HEAD");
-  const branch = local && /ref:\s*refs\/heads\/(.+)/.exec(local)?.[1];
-  return branch ? branch.trim() : "main";
+    `  overview: "A model reviews the pull request against its stacks' previews",`,
+    "  phases: [",
+    `    phase("Preview", [shell(${JSON.stringify(REVIEW_PREVIEW_LINE)})]),`,
+    `    phase("Review", [reviewAgent({ ${fields} })]),`,
+    "  ],",
+    "});",
+    ""
+  ].join("\n");
 }
-function findPulumiActions(root) {
-  const out = [];
-  for (const d of WORKFLOW_DIRS) {
-    let names;
-    try {
-      names = readdirSync5(join8(root, d)).sort();
-    } catch {
-      continue;
-    }
-    for (const n of names) {
-      if (!/\.ya?ml$/.test(n)) continue;
-      try {
-        if (/uses:\s*["']?pulumi\/actions@/.test(readFileSync8(join8(root, d, n), "utf8"))) out.push(`${d}/${n}`);
-      } catch {
+function reviewOpSpec(doc) {
+  const settings = toChantSettings({ doc });
+  const p = settings.pipeline;
+  const engine2 = chantPipelineOptions({ ...p.image ? { image: p.image } : {}, ...p.engineSetup ? { engineSetup: p.engineSetup } : {} }, false);
+  return {
+    ops: [
+      {
+        name: REVIEW_OP,
+        trigger: { kind: "pull_request" },
+        reviewAgent: true,
+        // The preview in the review job takes the preview identity; id-token is the one write the review job may hold.
+        ...settings.ci.identity ? { permissions: { "id-token": "write" } } : {}
       }
+    ],
+    options: {
+      ...engine2.beforeScript ? { beforeScript: engine2.beforeScript } : {},
+      ...engine2.image ? { image: engine2.image } : {}
     }
-  }
-  return out;
-}
-function detect(cwd) {
-  const root = repoRoot(cwd);
-  const projects = findPulumiProjects(root);
-  const forge = detectForge(root);
-  const preCommit = [".pre-commit-config.yaml", ".pre-commit-config.yml"].find((n) => existsSync8(join8(root, n)));
-  return {
-    root,
-    projects,
-    stacks: stacksOf2(projects),
-    ...forge ? { forge } : {},
-    defaultBranch: defaultBranch(root),
-    pulumiActions: findPulumiActions(root),
-    ...preCommit ? { preCommit } : {}
   };
 }
-function repoName(root) {
-  return slug(basename(root)).slice(0, 40).replace(/-+$/, "") || "plywood";
+function writeIfChanged3(cwd, file, text) {
+  const path = join8(cwd, file);
+  if (existsSync8(path) && readFileSync9(path, "utf8") === text) return false;
+  mkdirSync5(dirname7(path), { recursive: true });
+  writeFileSync5(path, text);
+  return true;
 }
-var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
-var init_detect = __esm({
-  "src/init/detect.ts"() {
+async function writeReviewJobs(chant, forge, doc, words, table, io) {
+  if (!reviewOf(doc)) return table.done;
+  if (writeIfChanged3(io.cwd, REVIEW_OP_FILE, reviewOpFile(doc))) io.err(`${PRODUCT} ci: wrote ${REVIEW_OP_FILE}; commit it with the workflow`);
+  if (writeIfChanged3(io.cwd, REVIEW_SPEC_FILE, JSON.stringify(reviewOpSpec(doc), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${REVIEW_SPEC_FILE}`);
+  const outDir = OP_OUTPUT_DIR3[forge];
+  const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", REVIEW_SPEC_FILE, "--output", outDir], words);
+  if (code !== table.done) return code;
+  const dir = join8(io.cwd, outDir);
+  const files = existsSync8(dir) ? readdirSync5(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync9(join8(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${REVIEW_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: review jobs at ${join8(outDir, f).replace(/^\.\//, "")}`);
+  const r = reviewOf(doc);
+  io.err(`${PRODUCT} ci: the review job reads the model's key from ${r.keyEnv}; set it from a secret`);
+  if (forge === "gitlab") io.err(`${PRODUCT} ci: on GitLab the note job runs on the default branch with CHANT_REVIEW_NOTES=1 from a pipeline schedule, and posts with a protected CHANT_FORGE_TOKEN`);
+  return table.done;
+}
+var PERSON_VERBS, READ_INSTRUCTIONS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE, REVIEW_CHANGE_SET, REVIEW_PREVIEW_LINE, OP_OUTPUT_DIR3;
+var init_agents2 = __esm({
+  "src/agents.ts"() {
     "use strict";
-    SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
-    MAX_DEPTH = 8;
-    ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
-    PROD_RANK = ENV_ORDER.indexOf("prod");
-    WORKFLOW_DIRS = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
+    init_chant_config();
+    init_config_check();
+    init_agents();
+    init_config();
+    init_stacks();
+    init_images();
+    init_stages();
+    init_tips();
+    init_words();
+    PERSON_VERBS = ["up", "approve", "override"];
+    READ_INSTRUCTIONS = `To change a stack, open a pull request: ${PRODUCT} previews it, and its update runs after a person approves the digest.`;
+    REVIEW_OP = "plywood-review";
+    REVIEW_OP_FILE = "ops/plywood-review.op.ts";
+    REVIEW_SPEC_FILE = ".chant/ops/plywood-review.spec.json";
+    REVIEW_CHANGE_SET = ".chant/pr/change-set.json";
+    REVIEW_PREVIEW_LINE = `${BIN} components pr-plan --base "origin/\${GITHUB_BASE_REF:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME}" --pr "\${CI_MERGE_REQUEST_IID:-$(node -p 'require(process.env.GITHUB_EVENT_PATH).pull_request.number')}" --gate ${PR_GATE} --no-status`;
+    OP_OUTPUT_DIR3 = { github: ".github/workflows", forgejo: ".forgejo/workflows", gitlab: "." };
   }
 });
 
 // src/policy-presets.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 function providersRego(allowed, namespace = "main") {
   const set = allowed.length ? `{${[...new Set(allowed)].sort().map((p) => JSON.stringify(p)).join(", ")}}` : "set()";
   return preset("plywood_providers.rego.tmpl").replace("{{namespace}}", namespace).replace("{{allowed}}", set);
@@ -4264,7 +4499,7 @@ var init_policy_presets = __esm({
     PROVIDERS_PACK_CONFIG = "policy/plywood-providers.json";
     PROVIDERS_REGO_FILE = "plywood_providers.rego";
     PROVIDERS_POLICY = "provider-allowlist";
-    preset = (rel) => readFileSync9(new URL(`../presets/policy/${rel}`, import.meta.url), "utf8");
+    preset = (rel) => readFileSync10(new URL(`../presets/policy/${rel}`, import.meta.url), "utf8");
   }
 });
 
@@ -4617,155 +4852,6 @@ var init_presets = __esm({
   }
 });
 
-// src/templates.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-function template(name) {
-  return readFileSync10(new URL(`../templates/${name}`, import.meta.url), "utf8");
-}
-function fill(text, values) {
-  return text.replace(/\{\{(\w+)\}\}/g, (all, key) => key in values ? values[key] : all);
-}
-var init_templates = __esm({
-  "src/templates.ts"() {
-    "use strict";
-  }
-});
-
-// src/init/render.ts
-import { emitYAMLEntry } from "@intentius/chant/yaml";
-function plywoodYml(keys) {
-  const body = Object.entries(keys).filter(([, v]) => v !== void 0).map(([k, v]) => emitYAMLEntry(k, v)).join("\n");
-  const text = fill(template("plywood.yml"), { keys: body });
-  return text.endsWith("\n") ? text : text + "\n";
-}
-function chantConfigTs() {
-  return template("chant.config.ts.tmpl");
-}
-function componentName(stack) {
-  return slug(stack.key);
-}
-function exportName(stack, taken) {
-  let base = stack.key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  if (base === "" || /^\d/.test(base)) base = `stack_${base}`;
-  let name = base;
-  for (let i = 2; taken.has(name); i++) name = `${base}_${i}`;
-  taken.add(name);
-  return name;
-}
-function stepInput(s) {
-  return {
-    dir: s.dir,
-    stack: s.stack,
-    member: s.project,
-    ...s.engine ? { engine: s.engine } : {},
-    ...s.backend ? { backend: s.backend } : {},
-    ...s.engineVersion ? { engineVersion: s.engineVersion, ...s.engineRoot ? { engineRoot: s.engineRoot } : {} } : {},
-    ...s.lockGrain ? { lockGrain: s.lockGrain } : {},
-    ...s.policyPacks?.length ? { policyPacks: s.policyPacks } : {}
-  };
-}
-function componentsFile(stacks2, after = {}, opts = {}) {
-  const taken = /* @__PURE__ */ new Set();
-  const lines2 = [
-    "// Written by plywood init from the stacks it found; running it again rewrites",
-    "// this file. Each stack is a chant component whose pulumi-up step previews it",
-    "// on a pull request and updates it in its wave.",
-    ""
-  ];
-  for (const s of stacks2) {
-    const dependsOn = (after[s.key] ?? []).filter((u) => stacks2.some((x) => x.key === u)).map((u) => componentName({ key: u }));
-    const step = { kind: "pulumi-up", ...stepInput(s), ...opts.reviewSuffix ? { reviewSuffix: opts.reviewSuffix } : {} };
-    const component = { name: componentName(s), dependsOn, deploy: [{ phase: "up", steps: [step] }] };
-    lines2.push(`export const ${exportName(s, taken)} = ${JSON.stringify(component)};`);
-  }
-  return lines2.join("\n") + "\n";
-}
-function wavesOf(stacks2, configured) {
-  const byKey = new Map(stacks2.map((s) => [s.key, s]));
-  if (configured && configured.length > 0) {
-    return configured.map((keys, i) => ({ name: `wave-${i + 1}`, stacks: keys.map((k) => byKey.get(k)).filter((s) => s !== void 0) }));
-  }
-  const out = [];
-  for (const s of stacks2) {
-    const env = environmentOf(s.stack);
-    let name = slug(env);
-    if (!WAVE_NAME.test(name)) name = `wave-${out.length + 1}`;
-    const wave = out.find((w) => w.name === name);
-    if (wave) wave.stacks.push(s);
-    else out.push({ name, stacks: [s] });
-  }
-  return out;
-}
-function waveRunner(runner) {
-  if (runner === void 0) return void 0;
-  if (typeof runner === "string" || Array.isArray(runner) || "group" in runner) return runner;
-  const staged = runner;
-  return staged.up ?? staged.default;
-}
-function wavesSpec(input) {
-  const waves = (input.ordered ?? wavesOf(input.stacks, input.waves)).filter((w) => w.stacks.length > 0);
-  return {
-    name: OP_NAME,
-    op: OP_NAME,
-    gate: PR_GATE,
-    branches: [input.branch],
-    ...input.runner !== void 0 ? { runner: input.runner } : {},
-    step: { kind: "pulumi-up" },
-    ...input.quorum && input.quorum.length > 0 ? { approvals: { quorum: input.quorum } } : {},
-    ...input.notify ? { notify: input.notify } : {},
-    waves: waves.map((w) => {
-      const gate = w.stacks.map((s) => s.gate ?? input.gate).reduce((a, b) => STRICTNESS[b] > STRICTNESS[a] ? b : a);
-      return { name: w.name, gate, runs: w.stacks.map((s) => ({ target: s.key, input: stepInput(s) })) };
-    })
-  };
-}
-function jsonText(v) {
-  return JSON.stringify(v, null, 2) + "\n";
-}
-function memberName(project, taken) {
-  let base = slug(project.name).slice(0, 36).replace(/-+$/, "");
-  if (!MEMBER_NAME.test(base)) base = "stack";
-  let name = base;
-  for (let i = 2; taken.has(name); i++) name = `${base}-${i}`;
-  taken.add(name);
-  return name;
-}
-function workspaceDeclaration(existing, input) {
-  const doc = existing ? structuredClone(existing) : { name: input.name, schema: 1 };
-  const members = Array.isArray(doc.members) ? doc.members : [];
-  const taken = new Set(members.map((m) => String(m.name)));
-  for (const p of input.projects) {
-    if (members.some((m) => m.dir === p.dir || p.dir === "." && m.dir === void 0)) continue;
-    members.push({ name: memberName(p, taken), dir: p.dir, kind: "pulumi" });
-  }
-  doc.members = members;
-  const pins = Array.isArray(doc.pins) ? doc.pins : [];
-  if (!pins.some((p) => p.package === PULUMI_LEXICON)) pins.push({ package: PULUMI_LEXICON, version: input.lexiconVersion });
-  doc.pins = pins;
-  const ci2 = doc.ci && typeof doc.ci === "object" && !Array.isArray(doc.ci) ? doc.ci : {};
-  for (const [k, v] of Object.entries(input.ci)) if (v !== void 0) ci2[k] = v;
-  if (Object.keys(ci2).length > 0) doc.ci = ci2;
-  return doc;
-}
-function memberOfDir(doc, dir) {
-  const members = doc && Array.isArray(doc.members) ? doc.members : [];
-  const m = members.find((x) => x.dir === dir || dir === "." && x.dir === void 0);
-  return typeof m?.name === "string" ? m.name : void 0;
-}
-var WAVE_NAME, STRICTNESS, MEMBER_NAME, PULUMI_LEXICON;
-var init_render = __esm({
-  "src/init/render.ts"() {
-    "use strict";
-    init_templates();
-    init_words();
-    init_detect();
-    WAVE_NAME = /^[a-z0-9][a-z0-9_-]*$/;
-    STRICTNESS = { never: 0, "on-destructive": 1, always: 2 };
-    MEMBER_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
-    PULUMI_LEXICON = "@intentius/chant-lexicon-pulumi";
-  }
-});
-
 // src/stack-order.ts
 import { join as join9 } from "node:path";
 function chantReferenceReader() {
@@ -5400,6 +5486,11 @@ __export(init_exports, {
 import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
 import { emitYAMLEntry as emitYAMLEntry2 } from "@intentius/chant/yaml";
 import { dirname as dirname9, join as join13, posix as posix3 } from "node:path";
+function chantPin() {
+  const pin = dependencies["@intentius/chant"];
+  if (!pin) throw new Error("packages/plywood/package.json has no @intentius/chant dependency");
+  return pin;
+}
 function parseInitArgs(args) {
   if (args.includes("--print-prompt")) return { printPrompt: true };
   let rest = args;
@@ -5620,7 +5711,7 @@ async function runInit(opts, table, io) {
     const message = needsChantMessage("Writing the waves spec and the workflow");
     files.push({ file: WAVES_SPEC_FILE2, status: "skipped", note: message }, { file: WORKFLOW_FILE[forge.kind], status: "skipped", note: "needs the same chant" });
   } else {
-    let spec = wavesSpecStep(chant, stacks2, doc, settings, detected2.defaultBranch, waves);
+    let spec = await wavesSpecStep(chant, stacks2, doc, settings, detected2.defaultBranch, waves, forge.kind);
     if (settings.pipeline.jobs) {
       try {
         spec = withJobSettings(spec, settings.pipeline.jobs, forge.kind, { parallelism: await hasChant4625() });
@@ -5638,6 +5729,9 @@ async function runInit(opts, table, io) {
   if (opts.bucketCheck) notes.push(...await bucketStep(detected2, doc, io.env, buckets));
   adopt.push(...await adoptStep(root, detected2, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
   todo.push(...todoLines(detected2, doc, forge.kind, io.env));
+  if (forge.kind === "gitlab" && chant && stacks2.length > 0 && await hasChantWavePreview()) {
+    todo.push(`Add a ${GITLAB_READ_TOKEN} CI/CD variable (a project access token with the read_api scope, masked and protected) so a wave can read the merge request it applies; without it the wave refuses`);
+  }
   const failed = files.find((f) => f.status === "failed");
   return {
     ok: !failed,
@@ -5702,7 +5796,7 @@ async function preCommitStep(root, config2, dryRun) {
   const after = readFileSync12(join13(root, DECLARATION_FILE), "utf8");
   return { file: DECLARATION_FILE, status: after === before ? "unchanged" : "written", note: `${config2} runs as the check hook pre-commit; the check job's image needs pre-commit` };
 }
-function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered) {
+async function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered, forge) {
   const runner = waveRunner(chantPipelineOptions(settings.pipeline, false).runner);
   const base = wavesSpec({
     stacks: stacks2,
@@ -5714,7 +5808,8 @@ function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered) {
     // notify.relay only on a chant with the relay (chant#4611); an older chant refuses the setting.
     ...settings.pipeline.notify ? { notify: { ...notifyForChant(settings.pipeline.notify, chant) } } : {}
   });
-  return chant.productWavesSpec ? chant.productWavesSpec(base, PRODUCT_WORDS) : base;
+  const named = chant.productWavesSpec ? chant.productWavesSpec(base, PRODUCT_WORDS) : base;
+  return await hasChantWavePreview() ? withWavePreview(named, forge) : named;
 }
 async function workflowStep(chant, root, doc, settings, forge, opts, spec, table, io) {
   const output = WORKFLOW_FILE[forge];
@@ -5872,6 +5967,7 @@ var init_init = __esm({
     init_stacks();
     init_types();
     init_images();
+    init_chant_next();
     init_jobs2();
     init_backend();
     init_adopt();
@@ -5891,7 +5987,7 @@ var init_init = __esm({
     CHANT_CONFIG_FILE = "chant.config.ts";
     COMPONENTS_FILE = "plywood.component.ts";
     WAVES_SPEC_FILE2 = `.chant/op-waves/${OP_NAME}.spec.json`;
-    CHANT_PIN = dependencies["@intentius/chant"] ?? "0.124.54";
+    CHANT_PIN = chantPin();
   }
 });
 
@@ -6244,8 +6340,25 @@ async function withChant(what, table, io, run) {
   return run(chant);
 }
 function passthrough(argv, table, io) {
+  if (argv[0] === "run" && argv[1] === "wave") return runWave(argv, table, io);
   return withChant(`${PRODUCT} ${argv[0]}`, table, io, (chant) => chant.runChantInProcess(argv, PRODUCT_WORDS));
 }
+async function runWave(argv, table, io) {
+  const seen = [];
+  const write = process.stderr.write;
+  process.stderr.write = ((chunk, ...rest) => {
+    seen.push(typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8"));
+    return write.call(process.stderr, chunk, ...rest);
+  });
+  let code;
+  try {
+    code = await withChant(`${PRODUCT} run wave`, table, io, (chant) => chant.runChantInProcess(argv, PRODUCT_WORDS));
+  } finally {
+    process.stderr.write = write;
+  }
+  if (code === table.moved) io.err(`${PRODUCT}: ${waveMovedLine(seen.join(""))}`);
+  return code;
+}
 async function check(args, json, table, io) {
   const file = takeFlag(args, "--file");
   if (file.missing) return usage("--file takes a path", table, io);
@@ -6544,6 +6657,7 @@ var init_stages = __esm({
     init_review_stacks2();
     init_waves_workflow();
     init_drift2();
+    init_refusals();
     init_agents2();
     init_agent_jobs();
     init_words();
@@ -7804,7 +7918,7 @@ var execChild = (bin, args, opts) => new Promise((done) => {
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.2.0" : "0.0.0-dev";
+var VERSION3 = true ? "0.3.0" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")