@intentius/plywood 0.2.0 → 0.3.1

package/dist/plywood.mjs

@@ -260,13 +260,16 @@ function approvalOf(doc) {
 function gateOf(doc) {
   return typeof doc.gate === "string" && GATES.includes(doc.gate) ? doc.gate : DEFAULT_GATE;
 }
+function previewOf(doc) {
+  return doc.preview === true;
+}
 function quorumOf(rules) {
   return Object.entries(rules).map(([glob, r]) => {
     const roles = [...r.role !== void 0 ? [r.role] : [], ...r.roles ?? []];
     return { targets: [glob], count: r.quorum ?? 1, ...roles.length ? { roles } : {}, notAuthor: true };
   });
 }
-var GATES, DEFAULT_GATE, APPROVALS, DEFAULT_APPROVAL, APPROVAL_RULE_KEYS, approval;
+var GATES, DEFAULT_GATE, APPROVALS, DEFAULT_APPROVAL, DEFAULT_PREVIEW, APPROVAL_RULE_KEYS, approval;
 var init_approval = __esm({
   "src/config/approval.ts"() {
     "use strict";
@@ -275,13 +278,19 @@ var init_approval = __esm({
     DEFAULT_GATE = "on-destructive";
     APPROVALS = ["ledger", "sealed", "pr-review"];
     DEFAULT_APPROVAL = "ledger";
+    DEFAULT_PREVIEW = false;
     APPROVAL_RULE_KEYS = ["role", "roles", "quorum"];
     approval = {
       name: "approval",
-      keys: ["gate", "approval", "approval_rules"],
+      keys: ["gate", "approval", "approval_rules", "preview"],
       schema: {
         gate: { type: "string", enum: [...GATES], default: DEFAULT_GATE, description: "always, on-destructive or never." },
         approval: { type: "string", enum: [...APPROVALS], default: DEFAULT_APPROVAL, description: "ledger, sealed or pr-review." },
+        preview: {
+          type: "boolean",
+          default: DEFAULT_PREVIEW,
+          description: "true: plywood init sets approvals.preview in the waves spec, so a merged wave applies only the plans its pull request previewed, or exits 4. Known limits: plywood#55 (the second of two disjoint merges is refused) and plywood#56 (a pull request that creates an autonamed resource is refused)."
+        },
         approval_rules: {
           type: "object",
           description: "Role and quorum per stack glob. Read at base.",
@@ -298,6 +307,7 @@ var init_approval = __esm({
       },
       check(doc) {
         const out = [...oneOf(doc.gate, GATES, "gate"), ...oneOf(doc.approval, APPROVALS, "approval")];
+        if (doc.preview !== void 0 && typeof doc.preview !== "boolean") out.push(error("preview", "must be true or false"));
         const rules = doc.approval_rules;
         if (rules === void 0) return out;
         if (!isObject(rules)) return [...out, error("approval_rules", "must map a stack glob to { role, quorum }")];
@@ -422,7 +432,7 @@ var init_words = __esm({
   "src/words.ts"() {
     "use strict";
     PRODUCT = "plywood";
-    TAGLINE = "CI Automation for Pulumi";
+    TAGLINE = "Sophisticated automation for Pulumi.";
     OP_NAME = "pulumi-up";
     PR_GATE = "up";
     VERBS = [
@@ -587,13 +597,13 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.2.0";
+    version = "0.3.1";
     dependencies = {
-      "@intentius/chant": "0.124.58",
-      "@intentius/chant-lexicon-forgejo": "0.124.58",
-      "@intentius/chant-lexicon-github": "0.124.58",
-      "@intentius/chant-lexicon-gitlab": "0.124.58",
-      "@intentius/chant-lexicon-pulumi": "0.124.58"
+      "@intentius/chant": "0.124.59",
+      "@intentius/chant-lexicon-forgejo": "0.124.59",
+      "@intentius/chant-lexicon-github": "0.124.59",
+      "@intentius/chant-lexicon-gitlab": "0.124.59",
+      "@intentius/chant-lexicon-pulumi": "0.124.59"
     };
   }
 });
@@ -603,8 +613,8 @@ var image_digests_default;
 var init_image_digests = __esm({
   "src/image-digests.json"() {
     image_digests_default = {
-      "ghcr.io/intentius/plywood-pulumi:0.2.0-pulumi3.272.0": "sha256:ea268f1dd2fa15f80ddcedd5c3498d24b79cc2b8a590177c5499e2db3f686f18",
-      "ghcr.io/intentius/plywood-plunge:0.2.0-plunge0.1.0": "sha256:6a862ad23e39081a32fe8b2331b095ed2de44e527f2719416201b0affa46a1eb"
+      "ghcr.io/intentius/plywood-pulumi:0.3.1-pulumi3.272.0": "sha256:acdadb5000ade3afea20ab2f555946312281066e1df288b1007bff096514ebfd",
+      "ghcr.io/intentius/plywood-plunge:0.3.1-plunge0.2.0": "sha256:adc42bc97564ecb2074b3ee4d97f84ddb986e0f30f6a26f35b8721106c177456"
     };
   }
 });
@@ -741,14 +751,14 @@ var init_images = __esm({
     TOOL_VERSIONS = {
       pulumi: "3.272.0",
       /** A plunge release (INTENTIUS/plunge, tag plunge-v<ver>), not the Pulumi version it is built from. */
-      plunge: "0.1.0"
+      plunge: "0.2.0"
     };
     ARCHES = ["x64", "arm64"];
     PINNED_SHA256 = {
       "pulumi-v3.272.0-linux-x64.tar.gz": "58d545f2b98761051922008ebd381ecef95484d7f7a5ff7faa15d7a780ea84f6",
       "pulumi-v3.272.0-linux-arm64.tar.gz": "4f0741901b8982c4326b702dabf483c63d2cf77c88ac42dd752b72541284a534",
-      "plunge-v0.1.0-linux-x64.tar.gz": "22b89da39ab7dc11268c7b625fec3d99c0793c9c47bf8d031fa94e6967ee8187",
-      "plunge-v0.1.0-linux-arm64.tar.gz": "6855611b8cf8381d73f5ddf0b5c0a0d83bdc2a5bd8c50d415e52bb05a4574f83"
+      "plunge-v0.2.0-linux-x64.tar.gz": "c9c73d05cca9ad214b7f44230a6162cdcb6ad64bbfc725bc94688b997b191495",
+      "plunge-v0.2.0-linux-arm64.tar.gz": "c176a82f038164085aa19c8ad6530d6022e560e124050e535dbe364ae0473357"
     };
     ENGINE_ROOT = "/opt/plywood";
     JOB_ARCH = `"$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/')"`;
@@ -2458,7 +2468,7 @@ var init_chant_product = __esm({
   "src/chant-product.ts"() {
     "use strict";
     REQUIRED2 = ["assertProductWords", "productPipelineJobs", "approveLine", "runChantInProcess"];
-    BUILT_CHANT = true ? "0.124.58" : "unknown";
+    BUILT_CHANT = true ? "0.124.59" : "unknown";
   }
 });
 
@@ -2475,14 +2485,37 @@ function hasChantApprovalStatus(chant) {
 function hasChantPullRequestApprovalStatus(chant) {
   return typeof chant?.APPROVAL_STATUS_PULL_REQUEST_FLOOR === "string";
 }
+function hasChantWavePreview() {
+  wavePreview ??= (async () => {
+    try {
+      const m = await import("@intentius/chant/op");
+      return typeof m.OP_WAVES_PREVIEW_FLOOR === "string";
+    } catch {
+      return false;
+    }
+  })();
+  return wavePreview;
+}
+function withWavePreview(spec, forge) {
+  const approvals = spec.approvals && typeof spec.approvals === "object" && !Array.isArray(spec.approvals) ? spec.approvals : {};
+  const next = approvals.preview !== void 0 ? spec : { ...spec, approvals: { ...approvals, preview: true } };
+  if (forge === "gitlab" || next.approvals.preview !== true || !Array.isArray(next.waves)) return next;
+  const waves = next.waves.map((w) => ({
+    ...w,
+    variables: { [WAVE_TOKEN_VARIABLE]: "${{ github.token }}", ...w.variables ?? {} }
+  }));
+  return { ...next, waves };
+}
 function chantAudit() {
   audit ??= import("@intentius/chant/ci-audit").then((m) => m);
   return audit;
 }
-var audit;
+var wavePreview, WAVE_TOKEN_VARIABLE, GITLAB_READ_TOKEN, audit;
 var init_chant_next = __esm({
   "src/chant-next.ts"() {
     "use strict";
+    WAVE_TOKEN_VARIABLE = "GITHUB_TOKEN";
+    GITLAB_READ_TOKEN = "CHANT_FORGE_TOKEN";
   }
 });
 
@@ -2631,6 +2664,38 @@ var init_note_control = __esm({
   }
 });
 
+// src/init/run-group.ts
+function withRunGroup(text, forge, key) {
+  if (forge !== "forgejo" || TOP_CONCURRENCY.test(text)) return text;
+  const jobs2 = TOP_JOBS.exec(text);
+  if (!jobs2) return text;
+  const name = (TOP_NAME.exec(text)?.[1] ?? "plywood").replace(/^["']|["']$/g, "");
+  const group = key === "commit" ? `${name}-\${{ github.event_name }}-\${{ github.sha }}` : `${name}-\${{ github.event_name == 'pull_request' && github.ref || github.run_id }}`;
+  const cancel = key === "commit" ? "false" : "${{ github.event_name == 'pull_request' }}";
+  const block = [
+    "# Without a group Forgejo cancels the run in progress when a push starts another run of this workflow.",
+    key === "commit" ? "# One group for each commit keeps a merge's wave jobs running to completion when another merge lands (plywood#51)." : "# A push to main and a comment get a group of their own, so the record job runs to completion (plywood#51).",
+    "concurrency:",
+    `  group: ${yamlScalar(group)}`,
+    `  cancel-in-progress: ${yamlScalar(cancel)}`,
+    "",
+    ""
+  ].join("\n");
+  return text.slice(0, jobs2.index) + block + text.slice(jobs2.index);
+}
+function yamlScalar(value) {
+  return value === "false" ? value : JSON.stringify(value);
+}
+var TOP_CONCURRENCY, TOP_JOBS, TOP_NAME;
+var init_run_group = __esm({
+  "src/init/run-group.ts"() {
+    "use strict";
+    TOP_CONCURRENCY = /^concurrency:/m;
+    TOP_JOBS = /^jobs:/m;
+    TOP_NAME = /^name:\s*(.+?)\s*$/m;
+  }
+});
+
 // src/init/workflow.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { dirname as dirname2, isAbsolute, join as join2 } from "node:path";
@@ -2643,7 +2708,7 @@ async function writeWorkflow(chant, input) {
     if (previous !== void 0) writeFileSync(file, previous);
     return { code: code !== 0 ? code : 1, file, status: "failed", kept: [] };
   }
-  const generated = withNoteControl(readFileSync2(file, "utf8"), input.forge, input.noteControl);
+  const generated = withRunGroup(withNoteControl(readFileSync2(file, "utf8"), input.forge, input.noteControl), input.forge, "pull-request");
   const { text, kept } = keepOwnJobs(previous, generated, input.forge);
   writeFileSync(file, text);
   return { code, file, status: text === previous ? "unchanged" : "written", kept };
@@ -2653,6 +2718,7 @@ var init_workflow = __esm({
     "use strict";
     init_own_jobs();
     init_note_control();
+    init_run_group();
   }
 });
 
@@ -2794,11 +2860,9 @@ async function writeWaveJobs(chant, forge, waves, words, table, io, engine2 = {}
   }
   const lines2 = hasChant4607(chant) ? void 0 : binLines(waves, words.bin);
   for (const file of files) {
-    if (lines2) {
-      const text = readFileSync3(file, "utf8");
-      const next = withBinLines(text, lines2);
-      if (next !== text) writeFileSync2(file, next);
-    }
+    const text = readFileSync3(file, "utf8");
+    const next = withRunGroup(lines2 ? withBinLines(text, lines2) : text, forge, "commit");
+    if (next !== text) writeFileSync2(file, next);
     io.err(`${PRODUCT} ci: waves workflow at ${file.slice(io.cwd.length + 1)}`);
   }
   if (forge === "gitlab") {
@@ -2812,6 +2876,7 @@ var init_waves_workflow = __esm({
     "use strict";
     init_chant_product();
     init_images();
+    init_run_group();
     init_words();
     WAVES_OUTPUT_DIR = {
       github: ".github/workflows",
@@ -3121,193 +3186,573 @@ var init_jobs2 = __esm({
   }
 });
 
-// src/refusals.ts
-function refusalOf(code, table) {
-  return REFUSALS.find((name) => table[name] === code);
-}
-function refusalLine(refusal, ctx = {}) {
-  const gate = ctx.wave !== void 0 ? `wave-${ctx.wave}` : PR_GATE;
-  const again = ctx.pr !== void 0 ? `/${PRODUCT} up on pull request ${ctx.pr}` : `${PRODUCT} up${ctx.wave !== void 0 ? ` --wave ${ctx.wave}` : ""}`;
-  switch (refusal) {
-    case "waiting":
-      return `${gate} waits for an approval. Approve the digest chant printed with '${PRODUCT} approve ${gate} --plan <digest>', then run ${again} again.`;
-    case "moved":
-      return `The preview moved after it was approved (on plunge, a record the saved plan read was written by another update), so nothing was updated. Preview again ('${PRODUCT} preview' or /${PRODUCT} preview), read the new change, and approve its digest with '${PRODUCT} approve ${PR_GATE} --plan <digest>'.`;
-    case "held":
-      return `Another update or pull request holds a lock on a resource this update touches, and chant named it above. A running update lets go when it ends; a pull request's lock goes with /${PRODUCT} unlock on that pull request. Then run ${again} again.`;
-    case "superseded":
-      return `A newer push stands in for this one, which stood down. Nothing needs doing: the newer run updates the stacks.`;
-    case "denied":
-      return `A policy denied the change. Fix it and preview again, or override it with '${PRODUCT} override <stack> --rule <id> --reason <text>' naming exactly the rules chant listed (${POLICY_RULE_FORMS}). An override is spent once its update runs.`;
-    case "declined":
-      return `An approver declined the change, so nothing was updated. Push a new change and preview it again.`;
-    case "misplaced":
-      return `The job ran outside the forge environment, branch or runner plywood.yml gives this stack, and chant's job guard named the difference above, so nothing ran. Run it from that branch on that runner, or change environments and runners in plywood.yml and run '${PRODUCT} ci' again.`;
+// src/init/detect.ts
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync5, statSync } from "node:fs";
+import { basename, dirname as dirname5, join as join5, relative, sep } from "node:path";
+import { parseYAML as parseYAML2 } from "@intentius/chant/yaml";
+function repoRoot(dir) {
+  let cur = dir;
+  for (let i = 0; i < 64; i++) {
+    if (existsSync5(join5(cur, ".git"))) return cur;
+    const parent = dirname5(cur);
+    if (parent === cur) return dir;
+    cur = parent;
   }
+  return dir;
 }
-function explainRefusal(code, table, err, ctx = {}) {
-  const refusal = refusalOf(code, table);
-  if (refusal) err(`${PRODUCT}: ${refusalLine(refusal, ctx)}`);
-  return code;
-}
-var REFUSALS;
-var init_refusals = __esm({
-  "src/refusals.ts"() {
-    "use strict";
-    init_words();
-    REFUSALS = ["waiting", "moved", "held", "superseded", "denied", "declined", "misplaced"];
-  }
-});
-
-// src/up.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "node:fs";
-import { join as join5 } from "node:path";
-function approveTarget(gate, opts) {
-  if (opts.op) return { op: opts.op, gate };
-  if (PR_OP.test(gate)) return { op: gate, gate: PR_GATE };
-  if (gate === REVIEW_GATE_WORD || gate === REVIEW_GATE) {
-    if (!opts.pr) return { error: `a review stack is a pull request's: name it with --pr <n> (or PR_NUMBER)` };
-    if (!/^\d+$/.test(opts.pr)) return { error: `--pr takes a pull request number, not '${opts.pr}'` };
-    return { op: reviewOp(opts.pr), gate: REVIEW_GATE };
-  }
-  if (gate === PR_GATE) {
-    if (!opts.pr) return { error: `the ${PR_GATE} gate is a pull request's: name it with --pr <n> (or PR_NUMBER), or approve pr-<n>` };
-    if (!/^\d+$/.test(opts.pr)) return { error: `--pr takes a pull request number, not '${opts.pr}'` };
-    return { op: opts.stack ? `pr-${opts.pr}-${opts.stack}` : `pr-${opts.pr}`, gate };
-  }
-  return { op: OP_NAME, gate };
+function posixRel(root, path) {
+  const rel = relative(root, path);
+  return rel === "" ? "." : rel.split(sep).join("/");
 }
-function passFlags(args, valued, switches) {
-  const argv = [];
-  const rest = [];
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (valued.includes(a)) {
-      const v = args[i + 1];
-      if (v === void 0 || v.startsWith("--")) return { argv, rest, missing: a };
-      argv.push(a, v);
-      i++;
-    } else if (switches.includes(a)) argv.push(a);
-    else rest.push(a);
+function readYamlFile(file) {
+  try {
+    const doc = parseYAML2(readFileSync5(file, "utf8"));
+    return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
+  } catch {
+    return void 0;
   }
-  return { argv, rest };
 }
-async function approve(args, json, table, io) {
-  const pr = takeFlag(args, "--pr");
-  const stack = takeFlag(pr.rest, "--stack");
-  const op = takeFlag(stack.rest, "--op");
-  const forgeFlag = takeFlag(op.rest, "--forge");
-  const branchFlag = takeFlag(forgeFlag.rest, "--branch");
-  for (const [flag, f] of [["--pr", pr], ["--stack", stack], ["--op", op], ["--forge", forgeFlag], ["--branch", branchFlag]]) {
-    if (f.missing) return usage(`${flag} takes a value`, table, io);
-  }
-  if (forgeFlag.value !== void 0 && !FORGES.includes(forgeFlag.value)) return usage(`--forge ${forgeFlag.value} is not one of ${FORGES.join(", ")}`, table, io);
-  const passed = passFlags(branchFlag.rest, APPROVE_PASS, APPROVE_SWITCHES);
-  if (passed.missing) return usage(`${passed.missing} takes a value`, table, io);
-  const named = positionals(passed.rest);
-  const unknown = passed.rest.filter((a) => a.startsWith("-"));
-  if (unknown.length) return usage(`approve does not take ${unknown.join(" ")}`, table, io);
-  if (named.length !== 1) return usage(`approve takes one gate: '${PRODUCT} approve ${PR_GATE} --pr <n> --plan <digest>' or '${PRODUCT} approve wave-<k> --plan <digest>'`, table, io);
-  const prNumber = pr.value ?? io.env.PR_NUMBER;
-  const gate = named[0];
-  const plan = passed.argv[passed.argv.indexOf("--plan") + 1];
-  const byPlan = gate === PR_GATE && !prNumber && !op.value && passed.argv.includes("--plan");
-  const target = byPlan ? void 0 : approveTarget(gate, { pr: prNumber, stack: stack.value, op: op.value });
-  if (target && "error" in target) return usage(target.error, table, io);
-  if (!passed.argv.includes("--plan") && !passed.argv.includes("--expire")) {
-    return usage(`approve needs --plan <digest>, the digest the preview printed, so a change that moved since is never approved in its place`, table, io);
-  }
-  return withChant(`${PRODUCT} approve`, table, io, async (chant) => {
-    let to = target;
-    if (!to) {
-      const found = await upTargetByPlan(chant, plan, { stack: stack.value, cwd: io.cwd });
-      if ("error" in found) return usage(found.error, table, io);
-      if (!json) io.err(`${PRODUCT} approve: ${plan} waits at pull request ${found.pr}'s ${PR_GATE} gate (op ${found.op})`);
-      to = { op: found.op, gate: PR_GATE };
+function findPulumiProjects(root) {
+  const out = [];
+  const walk = (dir, depth) => {
+    let entries;
+    try {
+      entries = readdirSync3(dir).sort();
+    } catch {
+      return;
     }
-    const argv = ["approve", to.op, to.gate, ...passed.argv, ...json ? ["--json"] : []];
-    const code = explainRefusal(await chant.runChantInProcess(argv, PRODUCT_WORDS), table, io.err);
-    if (code !== table.done || to.gate !== PR_GATE || !PR_OP.test(to.op) || !passed.argv.includes("--plan") || passed.argv.includes("--expire")) return code;
-    const spec = wavesSpecAt(io.cwd);
-    if (spec && wavesTakePullRequestApproval(spec)) {
-      const carried = await chant.runChantInProcess(carryArgv(passed.argv), PRODUCT_WORDS);
-      if (carried !== table.done) {
-        io.err(`${PRODUCT} approve: ${to.op} is approved, and recording the same approval under ${OP_NAME} failed (exit ${carried}), so the waves after the merge still wait at ${PR_GATE}. Run '${PRODUCT} approve ${PR_GATE} --op ${OP_NAME} --plan ${plan} --yes' to record it there.`);
-        return explainRefusal(carried, table, io.err);
+    const file = ["Pulumi.yaml", "Pulumi.yml"].find((n) => entries.includes(n));
+    if (file) {
+      const project = readProject(root, dir, join5(dir, file));
+      if (project) out.push(project);
+    }
+    if (depth >= MAX_DEPTH) return;
+    for (const name of entries) {
+      if (SKIP.has(name) || name.startsWith(".")) continue;
+      const path = join5(dir, name);
+      try {
+        if (statSync(path).isDirectory()) walk(path, depth + 1);
+      } catch {
       }
-      if (!json) io.err(`${PRODUCT} approve: recorded the same approval under ${OP_NAME}, where the waves after the merge read the pull request's ${PR_GATE} gate`);
     }
-    if (spec) await refreshApprovalStatus(chant, spec, { forge: forgeFlag.value, branch: branchFlag.value, json }, io);
-    return code;
-  });
+  };
+  walk(root, 0);
+  return out;
 }
-function wavesSpecAt(cwd, file = WAVES_SPEC_FILE) {
-  const path = join5(cwd, file);
-  if (!existsSync5(path)) return void 0;
+function readProject(root, dir, file) {
+  const doc = readYamlFile(file);
+  if (!doc || typeof doc.name !== "string" || doc.name === "") return void 0;
+  const runtime = typeof doc.runtime === "string" ? doc.runtime : doc.runtime?.name;
+  const backend = doc.backend;
+  const configDir = typeof doc.stackConfigDir === "string" ? join5(dir, doc.stackConfigDir) : dir;
+  return {
+    name: doc.name,
+    dir: posixRel(root, dir),
+    ...typeof runtime === "string" ? { runtime } : {},
+    ...backend && typeof backend.url === "string" ? { backendUrl: backend.url } : {},
+    stacks: stackNames(configDir)
+  };
+}
+function stackNames(configDir) {
+  let entries;
   try {
-    const spec = unwrapWavesSpec(JSON.parse(readFileSync5(path, "utf8")));
-    return spec && typeof spec === "object" && !Array.isArray(spec) ? spec : void 0;
+    entries = readdirSync3(configDir);
   } catch {
-    return void 0;
+    return [];
   }
+  const names = entries.map((n) => /^Pulumi\.(.+)\.ya?ml$/.exec(n)?.[1]).filter((s) => s !== void 0 && s !== "");
+  return [...new Set(names)].sort(byEnvironment);
 }
-function wavesTakePullRequestApproval(spec) {
-  const gate = spec.approvals?.pullRequest?.gate;
-  const waves = Array.isArray(spec.waves) ? spec.waves : [];
-  return gate === PR_GATE && waves.some((w) => w?.approval === "pull-request");
+function environmentOf(stack) {
+  const last = stack.split("/").pop().toLowerCase();
+  const head = last.split(/[-_.]/)[0];
+  return ENV_ORDER.includes(head) ? head : last;
 }
-function carryArgv(passed) {
-  const kept = passed.filter((a) => a !== "--resume");
-  return ["approve", OP_NAME, PR_GATE, ...kept, ...kept.includes("--yes") ? [] : ["--yes"]];
+function rank(stack) {
+  const env = environmentOf(stack);
+  const at = ENV_ORDER.indexOf(env);
+  return at >= 0 ? at : PROD_RANK - 0.5;
 }
-function approvalStatusTarget(opts, doc, env) {
-  const configured = doc?.forge?.kind;
-  const ci2 = env.GITLAB_CI === "true" ? "gitlab" : env.FORGEJO_ACTIONS === "true" || env.GITEA_ACTIONS === "true" ? "forgejo" : env.GITHUB_ACTIONS === "true" ? "github" : void 0;
-  const forge = opts.forge ?? configured ?? ci2;
-  const branch = opts.branch ?? (env.GITHUB_BASE_REF || env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME || env.CI_DEFAULT_BRANCH || (env.GITHUB_ACTIONS === "true" ? env.GITHUB_REF_NAME : void 0) || void 0);
-  return { ...forge ? { forge } : {}, ...branch ? { branch } : {} };
+function byEnvironment(a, b) {
+  return rank(a) - rank(b) || a.localeCompare(b);
 }
-async function refreshApprovalStatus(chant, spec, opts, io) {
-  if (!hasChantPullRequestApprovalStatus(chant)) return;
-  const posts = chant.opWavesPostsApprovalStatus ? chant.opWavesPostsApprovalStatus(spec) : wavesTakePullRequestApproval(spec);
-  if (!posts) return;
-  const path = findConfig(io.cwd);
-  const doc = path ? loadConfig(path).doc : void 0;
-  const at = approvalStatusTarget(opts, doc, io.env);
-  const line = (branch, forge) => `${PRODUCT} run wave --spec ${WAVES_SPEC_FILE} --approval-status --open --branch ${branch} --forge ${forge}`;
-  if (!at.forge || !at.branch) {
-    io.err(`${PRODUCT} approve: ${PRODUCT}/approval moves at the next push or review; to post it now, run '${line(at.branch ?? "<target branch>", at.forge ?? "<forge>")}' with a forge token`);
-    return;
+function stacksOf2(projects) {
+  const names = /* @__PURE__ */ new Map();
+  for (const p of projects) names.set(p.name, (names.get(p.name) ?? 0) + 1);
+  const out = [];
+  for (const p of projects) {
+    const project = (names.get(p.name) ?? 0) > 1 ? `${p.name}-${slug(p.dir)}` : p.name;
+    for (const stack of p.stacks) out.push({ key: `${project}/${stack}`, project: p.name, stack, dir: p.dir });
   }
-  const code = await chant.runChantInProcess(["run", "wave", "--spec", WAVES_SPEC_FILE, "--approval-status", "--open", "--branch", at.branch, "--forge", at.forge], PRODUCT_WORDS);
-  if (code !== 0) io.err(`${PRODUCT} approve: the approval is recorded, and ${PRODUCT}/approval was not posted again (exit ${code}); it moves at the next push or review, or run '${line(at.branch, at.forge)}'`);
-  else if (!opts.json) io.err(`${PRODUCT} approve: posted ${PRODUCT}/approval again on the open pull requests into ${at.branch}`);
+  return out.sort((x, y) => byEnvironment(x.stack, y.stack) || x.key.localeCompare(y.key));
 }
-async function upTargetByPlan(chant, digest, opts = {}) {
-  const needsPr = `the ${PR_GATE} gate is a pull request's: name it with --pr <n> (or PR_NUMBER), or approve pr-<n>`;
-  if (!hasChant4607(chant)) return { error: `${needsPr}. The installed chant cannot find a pull request from a plan digest (chant#4607)` };
-  let gates;
-  try {
-    gates = await chant.pendingGatesByPlan(digest, { pullRequestsOnly: true, ...opts.cwd ? { cwd: opts.cwd } : {} });
-  } catch (e) {
-    return { error: `${needsPr}. Reading the pending gates for ${digest} failed: ${e.message}` };
-  }
-  let up2 = gates.filter((g) => g.gate === PR_GATE && g.pr !== void 0);
-  if (opts.stack) up2 = up2.filter((g) => g.member === opts.stack);
-  const ops = [...new Set(up2.map((g) => g.op))];
-  if (ops.length === 0) return { error: `no pull request's ${PR_GATE} gate waits on ${digest}${opts.stack ? ` for ${opts.stack}` : ""}. Check the digest the preview printed and fetch chant/lifecycle, or name the pull request with --pr <n>` };
-  const prs = [...new Set(up2.map((g) => g.pr))];
-  if (prs.length > 1) return { error: `${digest} waits at the ${PR_GATE} gate of pull requests ${prs.sort((a, b) => a - b).join(", ")}; name one with --pr <n>` };
-  const whole = up2.find((g) => g.member === void 0);
-  if (whole) return { op: whole.op, pr: whole.pr };
-  if (ops.length > 1) return { error: `${digest} waits at the ${PR_GATE} gate of ${ops.join(", ")}; name the stack with --stack <stack>` };
-  return { op: ops[0], pr: prs[0] };
+function slug(s) {
+  const out = s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return out === "" ? "root" : out;
 }
-async function override(args, json, table, io) {
-  const rules = [];
-  const rest = [];
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--rule") {
+function originUrl(root) {
+  const config2 = gitFile(root, "config");
+  if (!config2) return void 0;
+  let inOrigin = false;
+  for (const raw of config2.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line.startsWith("[")) {
+      inOrigin = /^\[remote\s+"origin"\]$/.test(line);
+      continue;
+    }
+    const m = inOrigin ? /^url\s*=\s*(.+)$/.exec(line) : null;
+    if (m) return m[1].trim();
+  }
+  return void 0;
+}
+function gitFile(root, name) {
+  const dotGit = join5(root, ".git");
+  let gitDir = dotGit;
+  try {
+    if (statSync(dotGit).isFile()) {
+      const m = /^gitdir:\s*(.+)$/m.exec(readFileSync5(dotGit, "utf8"));
+      if (!m) return void 0;
+      gitDir = join5(root, m[1].trim());
+      const common = join5(gitDir, "commondir");
+      if (existsSync5(common) && !existsSync5(join5(gitDir, name))) gitDir = join5(gitDir, readFileSync5(common, "utf8").trim());
+    }
+    const path = join5(gitDir, name);
+    return existsSync5(path) ? readFileSync5(path, "utf8") : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function remoteHost(url) {
+  const scp = /^[^@/\s]+@([^:/\s]+):/.exec(url);
+  if (scp) return scp[1].toLowerCase();
+  try {
+    return new URL(url).hostname.toLowerCase() || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function forgeOfRemote(url) {
+  const host = remoteHost(url);
+  if (!host) return void 0;
+  if (host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.")) return { kind: "github", because: `origin is on ${host}` };
+  if (host === "gitlab.com") return { kind: "gitlab", because: `origin is on ${host}` };
+  if (host === "codeberg.org") return { kind: "forgejo", because: `origin is on ${host}` };
+  if (/(^|[.-])gitlab([.-]|$)/.test(host)) return { kind: "gitlab", because: `origin is on ${host}`, url: `https://${host}` };
+  if (/(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return { kind: "forgejo", because: `origin is on ${host}`, url: `https://${host}` };
+  return void 0;
+}
+function detectForge(root) {
+  const url = originUrl(root);
+  const byRemote = url ? forgeOfRemote(url) : void 0;
+  if (byRemote) return byRemote;
+  if (existsSync5(join5(root, ".forgejo"))) return { kind: "forgejo", because: "the repository has .forgejo/" };
+  if (existsSync5(join5(root, ".gitlab-ci.yml"))) return { kind: "gitlab", because: "the repository has .gitlab-ci.yml" };
+  if (existsSync5(join5(root, ".github", "workflows"))) return { kind: "github", because: "the repository has .github/workflows/" };
+  return void 0;
+}
+function defaultBranch(root) {
+  const head = gitFile(root, "refs/remotes/origin/HEAD");
+  const remote = head && /ref:\s*refs\/remotes\/origin\/(.+)/.exec(head)?.[1];
+  if (remote) return remote.trim();
+  const local = gitFile(root, "HEAD");
+  const branch = local && /ref:\s*refs\/heads\/(.+)/.exec(local)?.[1];
+  return branch ? branch.trim() : "main";
+}
+function findPulumiActions(root) {
+  const out = [];
+  for (const d of WORKFLOW_DIRS) {
+    let names;
+    try {
+      names = readdirSync3(join5(root, d)).sort();
+    } catch {
+      continue;
+    }
+    for (const n of names) {
+      if (!/\.ya?ml$/.test(n)) continue;
+      try {
+        if (/uses:\s*["']?pulumi\/actions@/.test(readFileSync5(join5(root, d, n), "utf8"))) out.push(`${d}/${n}`);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function detect(cwd) {
+  const root = repoRoot(cwd);
+  const projects = findPulumiProjects(root);
+  const forge = detectForge(root);
+  const preCommit = [".pre-commit-config.yaml", ".pre-commit-config.yml"].find((n) => existsSync5(join5(root, n)));
+  return {
+    root,
+    projects,
+    stacks: stacksOf2(projects),
+    ...forge ? { forge } : {},
+    defaultBranch: defaultBranch(root),
+    pulumiActions: findPulumiActions(root),
+    ...preCommit ? { preCommit } : {}
+  };
+}
+function repoName(root) {
+  return slug(basename(root)).slice(0, 40).replace(/-+$/, "") || "plywood";
+}
+var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
+var init_detect = __esm({
+  "src/init/detect.ts"() {
+    "use strict";
+    SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
+    MAX_DEPTH = 8;
+    ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
+    PROD_RANK = ENV_ORDER.indexOf("prod");
+    WORKFLOW_DIRS = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
+  }
+});
+
+// src/templates.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+function template(name) {
+  return readFileSync6(new URL(`../templates/${name}`, import.meta.url), "utf8");
+}
+function fill(text, values) {
+  return text.replace(/\{\{(\w+)\}\}/g, (all, key) => key in values ? values[key] : all);
+}
+var init_templates = __esm({
+  "src/templates.ts"() {
+    "use strict";
+  }
+});
+
+// src/init/render.ts
+import { emitYAMLEntry } from "@intentius/chant/yaml";
+function plywoodYml(keys) {
+  const body = Object.entries(keys).filter(([, v]) => v !== void 0).map(([k, v]) => emitYAMLEntry(k, v)).join("\n");
+  const text = fill(template("plywood.yml"), { keys: body });
+  return text.endsWith("\n") ? text : text + "\n";
+}
+function chantConfigTs() {
+  return template("chant.config.ts.tmpl");
+}
+function componentName(stack) {
+  return slug(stack.key);
+}
+function exportName(stack, taken) {
+  let base = stack.key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  if (base === "" || /^\d/.test(base)) base = `stack_${base}`;
+  let name = base;
+  for (let i = 2; taken.has(name); i++) name = `${base}_${i}`;
+  taken.add(name);
+  return name;
+}
+function stepInput(s) {
+  return {
+    dir: s.dir,
+    stack: s.stack,
+    member: s.project,
+    ...s.engine ? { engine: s.engine } : {},
+    ...s.backend ? { backend: s.backend } : {},
+    ...s.engineVersion ? { engineVersion: s.engineVersion, ...s.engineRoot ? { engineRoot: s.engineRoot } : {} } : {},
+    ...s.lockGrain ? { lockGrain: s.lockGrain } : {},
+    ...s.policyPacks?.length ? { policyPacks: s.policyPacks } : {}
+  };
+}
+function componentsFile(stacks2, after = {}, opts = {}) {
+  const taken = /* @__PURE__ */ new Set();
+  const lines2 = [
+    "// Written by plywood init from the stacks it found; running it again rewrites",
+    "// this file. Each stack is a chant component whose pulumi-up step previews it",
+    "// on a pull request and updates it in its wave.",
+    ""
+  ];
+  for (const s of stacks2) {
+    const dependsOn = (after[s.key] ?? []).filter((u) => stacks2.some((x) => x.key === u)).map((u) => componentName({ key: u }));
+    const step = { kind: "pulumi-up", ...stepInput(s), ...opts.reviewSuffix ? { reviewSuffix: opts.reviewSuffix } : {} };
+    const component = { name: componentName(s), dependsOn, deploy: [{ phase: "up", steps: [step] }] };
+    lines2.push(`export const ${exportName(s, taken)} = ${JSON.stringify(component)};`);
+  }
+  return lines2.join("\n") + "\n";
+}
+function wavesOf(stacks2, configured) {
+  const byKey = new Map(stacks2.map((s) => [s.key, s]));
+  if (configured && configured.length > 0) {
+    return configured.map((keys, i) => ({ name: `wave-${i + 1}`, stacks: keys.map((k) => byKey.get(k)).filter((s) => s !== void 0) }));
+  }
+  const out = [];
+  for (const s of stacks2) {
+    const env = environmentOf(s.stack);
+    let name = slug(env);
+    if (!WAVE_NAME.test(name)) name = `wave-${out.length + 1}`;
+    const wave = out.find((w) => w.name === name);
+    if (wave) wave.stacks.push(s);
+    else out.push({ name, stacks: [s] });
+  }
+  return out;
+}
+function waveRunner(runner) {
+  if (runner === void 0) return void 0;
+  if (typeof runner === "string" || Array.isArray(runner) || "group" in runner) return runner;
+  const staged = runner;
+  return staged.up ?? staged.default;
+}
+function wavesSpec(input) {
+  const waves = (input.ordered ?? wavesOf(input.stacks, input.waves)).filter((w) => w.stacks.length > 0);
+  return {
+    name: OP_NAME,
+    op: OP_NAME,
+    gate: PR_GATE,
+    branches: [input.branch],
+    ...input.runner !== void 0 ? { runner: input.runner } : {},
+    step: { kind: "pulumi-up" },
+    ...input.quorum && input.quorum.length > 0 ? { approvals: { quorum: input.quorum } } : {},
+    ...input.notify ? { notify: input.notify } : {},
+    waves: waves.map((w) => {
+      const gate = w.stacks.map((s) => s.gate ?? input.gate).reduce((a, b) => STRICTNESS[b] > STRICTNESS[a] ? b : a);
+      return { name: w.name, gate, runs: w.stacks.map((s) => ({ target: s.key, input: stepInput(s) })) };
+    })
+  };
+}
+function jsonText(v) {
+  return JSON.stringify(v, null, 2) + "\n";
+}
+function memberName(project, taken) {
+  let base = slug(project.name).slice(0, 36).replace(/-+$/, "");
+  if (!MEMBER_NAME.test(base)) base = "stack";
+  let name = base;
+  for (let i = 2; taken.has(name); i++) name = `${base}-${i}`;
+  taken.add(name);
+  return name;
+}
+function workspaceDeclaration(existing, input) {
+  const doc = existing ? structuredClone(existing) : { name: input.name, schema: 1 };
+  const members = Array.isArray(doc.members) ? doc.members : [];
+  const taken = new Set(members.map((m) => String(m.name)));
+  for (const p of input.projects) {
+    if (members.some((m) => m.dir === p.dir || p.dir === "." && m.dir === void 0)) continue;
+    members.push({ name: memberName(p, taken), dir: p.dir, kind: "pulumi" });
+  }
+  doc.members = members;
+  const pins = Array.isArray(doc.pins) ? doc.pins : [];
+  if (!pins.some((p) => p.package === PULUMI_LEXICON)) pins.push({ package: PULUMI_LEXICON, version: input.lexiconVersion });
+  doc.pins = pins;
+  const ci2 = doc.ci && typeof doc.ci === "object" && !Array.isArray(doc.ci) ? doc.ci : {};
+  for (const [k, v] of Object.entries(input.ci)) if (v !== void 0) ci2[k] = v;
+  if (Object.keys(ci2).length > 0) doc.ci = ci2;
+  return doc;
+}
+function memberOfDir(doc, dir) {
+  const members = doc && Array.isArray(doc.members) ? doc.members : [];
+  const m = members.find((x) => x.dir === dir || dir === "." && x.dir === void 0);
+  return typeof m?.name === "string" ? m.name : void 0;
+}
+var WAVE_NAME, STRICTNESS, MEMBER_NAME, PULUMI_LEXICON;
+var init_render = __esm({
+  "src/init/render.ts"() {
+    "use strict";
+    init_templates();
+    init_words();
+    init_detect();
+    WAVE_NAME = /^[a-z0-9][a-z0-9_-]*$/;
+    STRICTNESS = { never: 0, "on-destructive": 1, always: 2 };
+    MEMBER_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
+    PULUMI_LEXICON = "@intentius/chant-lexicon-pulumi";
+  }
+});
+
+// src/refusals.ts
+function refusalOf(code, table) {
+  return REFUSALS.find((name) => table[name] === code);
+}
+function refusalLine(refusal, ctx = {}) {
+  const gate = ctx.wave !== void 0 ? `wave-${ctx.wave}` : PR_GATE;
+  const again = ctx.pr !== void 0 ? `/${PRODUCT} up on pull request ${ctx.pr}` : `${PRODUCT} up${ctx.wave !== void 0 ? ` --wave ${ctx.wave}` : ""}`;
+  switch (refusal) {
+    case "waiting":
+      return `${gate} waits for an approval. Approve the digest chant printed with '${PRODUCT} approve ${gate} --plan <digest>', then run ${again} again.`;
+    case "moved":
+      return `The preview moved after it was approved (on plunge, a record the saved plan read was written by another update), so nothing was updated. Preview again ('${PRODUCT} preview' or /${PRODUCT} preview), read the new change, and approve its digest with '${PRODUCT} approve ${PR_GATE} --plan <digest>'.`;
+    case "held":
+      return `Another update or pull request holds a lock on a resource this update touches, and chant named it above. A running update lets go when it ends; a pull request's lock goes with /${PRODUCT} unlock on that pull request. Then run ${again} again.`;
+    case "superseded":
+      return `A newer push stands in for this one, which stood down. Nothing needs doing: the newer run updates the stacks.`;
+    case "denied":
+      return `A policy denied the change. Fix it and preview again, or override it with '${PRODUCT} override <stack> --rule <id> --reason <text>' naming exactly the rules chant listed (${POLICY_RULE_FORMS}). An override is spent once its update runs.`;
+    case "declined":
+      return `An approver declined the change, so nothing was updated. Push a new change and preview it again.`;
+    case "misplaced":
+      return `The job ran outside the forge environment, branch or runner plywood.yml gives this stack, and chant's job guard named the difference above, so nothing ran. Run it from that branch on that runner, or change environments and runners in plywood.yml and run '${PRODUCT} ci' again.`;
+  }
+}
+function explainRefusal(code, table, err, ctx = {}) {
+  const refusal = refusalOf(code, table);
+  if (refusal) err(`${PRODUCT}: ${refusalLine(refusal, ctx)}`);
+  return code;
+}
+function approveLineIn(output) {
+  const m = /Approve these plans to apply them:[ \t]*([^\r\n]+)/.exec(output);
+  const line = m?.[1]?.trim();
+  return line ? line : void 0;
+}
+function waveMovedLine(output) {
+  const approve2 = approveLineIn(output);
+  const how = approve2 ? `If a person has read the plans chant listed above and wants them applied, approve exactly them with: ${approve2}, then run the job again.` : `chant named no approval for these plans. Read the plans above, then approve them with '${PRODUCT} approve <wave gate> --plan <digest>' and run the job again.`;
+  return `A merged wave stopped with exit 4 and nothing in it was applied: its plans are not the ones its pull request previewed (or no preview was recorded for it). ${how} To apply only what a pull request previews, open a new pull request, let '${PRODUCT} run wave --record-plans' record its plans, and merge that.`;
+}
+var REFUSALS;
+var init_refusals = __esm({
+  "src/refusals.ts"() {
+    "use strict";
+    init_words();
+    REFUSALS = ["waiting", "moved", "held", "superseded", "denied", "declined", "misplaced"];
+  }
+});
+
+// src/up.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "node:fs";
+import { join as join6 } from "node:path";
+function approveTarget(gate, opts) {
+  if (opts.op) return { op: opts.op, gate };
+  if (PR_OP.test(gate)) return { op: gate, gate: PR_GATE };
+  if (gate === REVIEW_GATE_WORD || gate === REVIEW_GATE) {
+    if (!opts.pr) return { error: `a review stack is a pull request's: name it with --pr <n> (or PR_NUMBER)` };
+    if (!/^\d+$/.test(opts.pr)) return { error: `--pr takes a pull request number, not '${opts.pr}'` };
+    return { op: reviewOp(opts.pr), gate: REVIEW_GATE };
+  }
+  if (gate === PR_GATE) {
+    if (!opts.pr) return { error: `the ${PR_GATE} gate is a pull request's: name it with --pr <n> (or PR_NUMBER), or approve pr-<n>` };
+    if (!/^\d+$/.test(opts.pr)) return { error: `--pr takes a pull request number, not '${opts.pr}'` };
+    return { op: opts.stack ? `pr-${opts.pr}-${opts.stack}` : `pr-${opts.pr}`, gate };
+  }
+  return { op: OP_NAME, gate };
+}
+function passFlags(args, valued, switches) {
+  const argv = [];
+  const rest = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (valued.includes(a)) {
+      const v = args[i + 1];
+      if (v === void 0 || v.startsWith("--")) return { argv, rest, missing: a };
+      argv.push(a, v);
+      i++;
+    } else if (switches.includes(a)) argv.push(a);
+    else rest.push(a);
+  }
+  return { argv, rest };
+}
+async function approve(args, json, table, io) {
+  const pr = takeFlag(args, "--pr");
+  const stack = takeFlag(pr.rest, "--stack");
+  const op = takeFlag(stack.rest, "--op");
+  const forgeFlag = takeFlag(op.rest, "--forge");
+  const branchFlag = takeFlag(forgeFlag.rest, "--branch");
+  for (const [flag, f] of [["--pr", pr], ["--stack", stack], ["--op", op], ["--forge", forgeFlag], ["--branch", branchFlag]]) {
+    if (f.missing) return usage(`${flag} takes a value`, table, io);
+  }
+  if (forgeFlag.value !== void 0 && !FORGES.includes(forgeFlag.value)) return usage(`--forge ${forgeFlag.value} is not one of ${FORGES.join(", ")}`, table, io);
+  const passed = passFlags(branchFlag.rest, APPROVE_PASS, APPROVE_SWITCHES);
+  if (passed.missing) return usage(`${passed.missing} takes a value`, table, io);
+  const named = positionals(passed.rest);
+  const unknown = passed.rest.filter((a) => a.startsWith("-"));
+  if (unknown.length) return usage(`approve does not take ${unknown.join(" ")}`, table, io);
+  if (named.length !== 1) return usage(`approve takes one gate: '${PRODUCT} approve ${PR_GATE} --pr <n> --plan <digest>' or '${PRODUCT} approve wave-<k> --plan <digest>'`, table, io);
+  const prNumber = pr.value ?? io.env.PR_NUMBER;
+  const gate = named[0];
+  const plan = passed.argv[passed.argv.indexOf("--plan") + 1];
+  const byPlan = gate === PR_GATE && !prNumber && !op.value && passed.argv.includes("--plan");
+  const target = byPlan ? void 0 : approveTarget(gate, { pr: prNumber, stack: stack.value, op: op.value });
+  if (target && "error" in target) return usage(target.error, table, io);
+  if (!passed.argv.includes("--plan") && !passed.argv.includes("--expire")) {
+    return usage(`approve needs --plan <digest>, the digest the preview printed, so a change that moved since is never approved in its place`, table, io);
+  }
+  return withChant(`${PRODUCT} approve`, table, io, async (chant) => {
+    let to = target;
+    if (!to) {
+      const found = await upTargetByPlan(chant, plan, { stack: stack.value, cwd: io.cwd });
+      if ("error" in found) return usage(found.error, table, io);
+      if (!json) io.err(`${PRODUCT} approve: ${plan} waits at pull request ${found.pr}'s ${PR_GATE} gate (op ${found.op})`);
+      to = { op: found.op, gate: PR_GATE };
+    }
+    const argv = ["approve", to.op, to.gate, ...passed.argv, ...json ? ["--json"] : []];
+    const code = explainRefusal(await chant.runChantInProcess(argv, PRODUCT_WORDS), table, io.err);
+    if (code !== table.done || to.gate !== PR_GATE || !PR_OP.test(to.op) || !passed.argv.includes("--plan") || passed.argv.includes("--expire")) return code;
+    const spec = wavesSpecAt(io.cwd);
+    if (spec && wavesTakePullRequestApproval(spec)) {
+      const carried = await chant.runChantInProcess(carryArgv(passed.argv), PRODUCT_WORDS);
+      if (carried !== table.done) {
+        io.err(`${PRODUCT} approve: ${to.op} is approved, and recording the same approval under ${OP_NAME} failed (exit ${carried}), so the waves after the merge still wait at ${PR_GATE}. Run '${PRODUCT} approve ${PR_GATE} --op ${OP_NAME} --plan ${plan} --yes' to record it there.`);
+        return explainRefusal(carried, table, io.err);
+      }
+      if (!json) io.err(`${PRODUCT} approve: recorded the same approval under ${OP_NAME}, where the waves after the merge read the pull request's ${PR_GATE} gate`);
+    }
+    if (spec) await refreshApprovalStatus(chant, spec, { forge: forgeFlag.value, branch: branchFlag.value, json }, io);
+    return code;
+  });
+}
+function wavesSpecAt(cwd, file = WAVES_SPEC_FILE) {
+  const path = join6(cwd, file);
+  if (!existsSync6(path)) return void 0;
+  try {
+    const spec = unwrapWavesSpec(JSON.parse(readFileSync7(path, "utf8")));
+    return spec && typeof spec === "object" && !Array.isArray(spec) ? spec : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function wavesTakePullRequestApproval(spec) {
+  const gate = spec.approvals?.pullRequest?.gate;
+  const waves = Array.isArray(spec.waves) ? spec.waves : [];
+  return gate === PR_GATE && waves.some((w) => w?.approval === "pull-request");
+}
+function carryArgv(passed) {
+  const kept = passed.filter((a) => a !== "--resume");
+  return ["approve", OP_NAME, PR_GATE, ...kept, ...kept.includes("--yes") ? [] : ["--yes"]];
+}
+function approvalStatusTarget(opts, doc, env) {
+  const configured = doc?.forge?.kind;
+  const ci2 = env.GITLAB_CI === "true" ? "gitlab" : env.FORGEJO_ACTIONS === "true" || env.GITEA_ACTIONS === "true" ? "forgejo" : env.GITHUB_ACTIONS === "true" ? "github" : void 0;
+  const forge = opts.forge ?? configured ?? ci2;
+  const branch = opts.branch ?? (env.GITHUB_BASE_REF || env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME || env.CI_DEFAULT_BRANCH || (env.GITHUB_ACTIONS === "true" ? env.GITHUB_REF_NAME : void 0) || void 0);
+  return { ...forge ? { forge } : {}, ...branch ? { branch } : {} };
+}
+async function refreshApprovalStatus(chant, spec, opts, io) {
+  if (!hasChantPullRequestApprovalStatus(chant)) return;
+  const posts = chant.opWavesPostsApprovalStatus ? chant.opWavesPostsApprovalStatus(spec) : wavesTakePullRequestApproval(spec);
+  if (!posts) return;
+  const path = findConfig(io.cwd);
+  const doc = path ? loadConfig(path).doc : void 0;
+  const at = approvalStatusTarget(opts, doc, io.env);
+  const line = (branch, forge) => `${PRODUCT} run wave --spec ${WAVES_SPEC_FILE} --approval-status --open --branch ${branch} --forge ${forge}`;
+  if (!at.forge || !at.branch) {
+    io.err(`${PRODUCT} approve: ${PRODUCT}/approval moves at the next push or review; to post it now, run '${line(at.branch ?? "<target branch>", at.forge ?? "<forge>")}' with a forge token`);
+    return;
+  }
+  const code = await chant.runChantInProcess(["run", "wave", "--spec", WAVES_SPEC_FILE, "--approval-status", "--open", "--branch", at.branch, "--forge", at.forge], PRODUCT_WORDS);
+  if (code !== 0) io.err(`${PRODUCT} approve: the approval is recorded, and ${PRODUCT}/approval was not posted again (exit ${code}); it moves at the next push or review, or run '${line(at.branch, at.forge)}'`);
+  else if (!opts.json) io.err(`${PRODUCT} approve: posted ${PRODUCT}/approval again on the open pull requests into ${at.branch}`);
+}
+async function upTargetByPlan(chant, digest, opts = {}) {
+  const needsPr = `the ${PR_GATE} gate is a pull request's: name it with --pr <n> (or PR_NUMBER), or approve pr-<n>`;
+  if (!hasChant4607(chant)) return { error: `${needsPr}. The installed chant cannot find a pull request from a plan digest (chant#4607)` };
+  let gates;
+  try {
+    gates = await chant.pendingGatesByPlan(digest, { pullRequestsOnly: true, ...opts.cwd ? { cwd: opts.cwd } : {} });
+  } catch (e) {
+    return { error: `${needsPr}. Reading the pending gates for ${digest} failed: ${e.message}` };
+  }
+  let up2 = gates.filter((g) => g.gate === PR_GATE && g.pr !== void 0);
+  if (opts.stack) up2 = up2.filter((g) => g.member === opts.stack);
+  const ops = [...new Set(up2.map((g) => g.op))];
+  if (ops.length === 0) return { error: `no pull request's ${PR_GATE} gate waits on ${digest}${opts.stack ? ` for ${opts.stack}` : ""}. Check the digest the preview printed and fetch chant/lifecycle, or name the pull request with --pr <n>` };
+  const prs = [...new Set(up2.map((g) => g.pr))];
+  if (prs.length > 1) return { error: `${digest} waits at the ${PR_GATE} gate of pull requests ${prs.sort((a, b) => a - b).join(", ")}; name one with --pr <n>` };
+  const whole = up2.find((g) => g.member === void 0);
+  if (whole) return { op: whole.op, pr: whole.pr };
+  if (ops.length > 1) return { error: `${digest} waits at the ${PR_GATE} gate of ${ops.join(", ")}; name the stack with --stack <stack>` };
+  return { op: ops[0], pr: prs[0] };
+}
+async function override(args, json, table, io) {
+  const rules = [];
+  const rest = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--rule") {
       const v = args[i + 1];
       if (v === void 0 || v.startsWith("--")) return usage("--rule takes a rule id", table, io);
       rules.push(v);
@@ -3329,11 +3774,11 @@ async function override(args, json, table, io) {
   return withChant(`${PRODUCT} override`, table, io, async (chant) => explainRefusal(await chant.runChantInProcess(argv, PRODUCT_WORDS), table, io.err));
 }
 function readUpSpec(cwd, file = WAVES_SPEC_FILE) {
-  const path = join5(cwd, file);
-  if (!existsSync5(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
+  const path = join6(cwd, file);
+  if (!existsSync6(path)) return { error: `no ${file}; '${PRODUCT} init' writes it from plywood.yml's waves` };
   let spec;
   try {
-    spec = unwrapWavesSpec(JSON.parse(readFileSync5(path, "utf8")));
+    spec = unwrapWavesSpec(JSON.parse(readFileSync7(path, "utf8")));
   } catch (e) {
     return { error: `${file}: ${e.message}` };
   }
@@ -3488,9 +3933,9 @@ var init_up = __esm({
 // src/drift.ts
 import { createHash as createHash2 } from "node:crypto";
 import { resolveTargetCloudIdentity } from "@intentius/chant/ci-identity";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync3, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname5, join as join6 } from "node:path";
+import { dirname as dirname6, join as join7 } from "node:path";
 function driftRows(doc) {
   return (doc.records ?? []).filter((r) => DRIFT_STATUSES.includes(r.status)).map((r) => ({ urn: r.address, status: r.status, attributes: (r.attributes ?? []).map((a) => a.path).sort() })).sort((a, b) => a.urn < b.urn ? -1 : a.urn > b.urn ? 1 : 0);
 }
@@ -3549,11 +3994,12 @@ async function drift2(args, json, table, io) {
   const respond = respondFlag.value ?? driftResponseOf(doc);
   const forge = forgeFlag.value;
   return withChant(`${PRODUCT} drift`, table, io, async (chant) => {
-    const dir = mkdtempSync(join6(tmpdir(), "plywood-drift-"));
+    const dir = mkdtempSync(join7(tmpdir(), "plywood-drift-"));
     const results = [];
     try {
       const attribute = await attributionFor(doc, io);
-      for (const stack of stacks2) results.push(await readStack(chant, stack, dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} }));
+      const root = dirname6(path);
+      for (const stack of stacks2) results.push(await readStack(chant, stack, driftMember(root, doc, stack), dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} }));
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -3628,13 +4074,31 @@ async function driftNotice(chant, doc, results, environment, io) {
     ...notifyFetch ? { fetch: notifyFetch } : {}
   });
 }
-async function readStack(chant, stack, dir, opts) {
-  const file = join6(dir, `${driftOpName(stack)}.json`);
-  const argv = ["workspace", "drift", "--member", stack, ...opts.resource ? ["--resource", opts.resource] : [], ...opts.env ? ["--env", opts.env] : [], "-o", file];
+function driftMember(root, doc, stack) {
+  const project = stack.includes("/") ? stack.slice(0, stack.indexOf("/")) : stack;
+  let declaration;
+  try {
+    declaration = JSON.parse(readFileSync8(join7(root, "chant.workspace.json"), "utf8"));
+  } catch {
+    return project;
+  }
+  const dir = stacksOf(doc)[stack]?.dir;
+  const byDir = dir !== void 0 ? memberOfDir(declaration, dir) : void 0;
+  if (byDir) return byDir;
+  const names = (Array.isArray(declaration.members) ? declaration.members : []).flatMap((m) => typeof m.name === "string" ? [m.name] : []);
+  if (names.includes(project)) return project;
+  const slugged = names.find((n) => n === slug(project));
+  if (slugged) return slugged;
+  return names.length === 1 ? names[0] : project;
+}
+async function readStack(chant, stack, member, dir, opts) {
+  const file = join7(dir, `${driftOpName(stack)}.json`);
+  const pulumiStack = stack.slice(stack.indexOf("/") + 1);
+  const argv = ["workspace", "drift", "--member", member, "--stack", pulumiStack, ...opts.resource ? ["--resource", opts.resource] : [], ...opts.env ? ["--env", opts.env] : [], "-o", file];
   const code = await chant.runChantInProcess(argv, PRODUCT_WORDS);
   let doc;
   try {
-    if (existsSync6(file)) doc = JSON.parse(readFileSync6(file, "utf8"));
+    if (existsSync7(file)) doc = JSON.parse(readFileSync8(file, "utf8"));
   } catch (e) {
     return { stack, ok: false, drifted: 0, rows: [], error: `chant wrote a drift document plywood cannot read: ${e.message}` };
   }
@@ -3667,7 +4131,7 @@ async function attributeStack(a, stack, doc) {
 }
 function specHasUpdate(cwd, op) {
   try {
-    const spec = JSON.parse(readFileSync6(join6(cwd, DRIFT_SPEC_FILE), "utf8"));
+    const spec = JSON.parse(readFileSync8(join7(cwd, DRIFT_SPEC_FILE), "utf8"));
     return (spec.ops ?? []).some((o) => o.name === op && o.update !== void 0);
   } catch {
     return false;
@@ -3743,9 +4207,9 @@ function withNotifyVariables(fields, notify2) {
   return { ...fields, variables: { ...notify2, ...fields.variables ?? {} } };
 }
 function writeIfChanged2(cwd, file, text) {
-  const path = join6(cwd, file);
-  if (existsSync6(path) && readFileSync6(path, "utf8") === text) return false;
-  mkdirSync4(dirname5(path), { recursive: true });
+  const path = join7(cwd, file);
+  if (existsSync7(path) && readFileSync8(path, "utf8") === text) return false;
+  mkdirSync4(dirname6(path), { recursive: true });
   writeFileSync4(path, text);
   return true;
 }
@@ -3761,9 +4225,9 @@ async function writeDriftJobs(chant, forge, doc, words, table, io, env = "produc
   const outDir = OP_OUTPUT_DIR2[forge];
   const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", DRIFT_SPEC_FILE, "--output", outDir], words);
   if (code !== table.done) return code;
-  const dir = join6(io.cwd, outDir);
-  const files = existsSync6(dir) ? readdirSync3(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync6(join6(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${DRIFT_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: drift job at ${join6(outDir, f).replace(/^\.\//, "")} on ${settings.schedule}`);
+  const dir = join7(io.cwd, outDir);
+  const files = existsSync7(dir) ? readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync8(join7(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${DRIFT_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: drift job at ${join7(outDir, f).replace(/^\.\//, "")} on ${settings.schedule}`);
   if (files.length && forge === "gitlab") io.err(`${PRODUCT} ci: GitLab runs the drift job from a pipeline schedule; include the file from .gitlab-ci.yml and add a schedule`);
   return table.done;
 }
@@ -3781,6 +4245,8 @@ var init_drift2 = __esm({
     init_drift();
     init_config();
     init_stacks();
+    init_detect();
+    init_render();
     init_routing();
     init_images();
     init_stages();
@@ -3837,8 +4303,8 @@ var init_tips = __esm({
 });
 
 // src/agents.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname6, join as join7 } from "node:path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readdirSync as readdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "node:fs";
+import { dirname as dirname7, join as join8 } from "node:path";
 function plywoodMcpTools(ctx) {
   const none = { type: "object", properties: {} };
   const doc = () => {
@@ -3948,304 +4414,83 @@ function reviewOpFile(doc) {
     "",
     "export default Op({",
     `  name: ${JSON.stringify(REVIEW_OP)},`,
-    `  overview: "A model reviews the pull request against its stacks' previews",`,
-    "  phases: [",
-    `    phase("Preview", [shell(${JSON.stringify(REVIEW_PREVIEW_LINE)})]),`,
-    `    phase("Review", [reviewAgent({ ${fields} })]),`,
-    "  ],",
-    "});",
-    ""
-  ].join("\n");
-}
-function reviewOpSpec(doc) {
-  const settings = toChantSettings({ doc });
-  const p = settings.pipeline;
-  const engine2 = chantPipelineOptions({ ...p.image ? { image: p.image } : {}, ...p.engineSetup ? { engineSetup: p.engineSetup } : {} }, false);
-  return {
-    ops: [
-      {
-        name: REVIEW_OP,
-        trigger: { kind: "pull_request" },
-        reviewAgent: true,
-        // The preview in the review job takes the preview identity; id-token is the one write the review job may hold.
-        ...settings.ci.identity ? { permissions: { "id-token": "write" } } : {}
-      }
-    ],
-    options: {
-      ...engine2.beforeScript ? { beforeScript: engine2.beforeScript } : {},
-      ...engine2.image ? { image: engine2.image } : {}
-    }
-  };
-}
-function writeIfChanged3(cwd, file, text) {
-  const path = join7(cwd, file);
-  if (existsSync7(path) && readFileSync7(path, "utf8") === text) return false;
-  mkdirSync5(dirname6(path), { recursive: true });
-  writeFileSync5(path, text);
-  return true;
-}
-async function writeReviewJobs(chant, forge, doc, words, table, io) {
-  if (!reviewOf(doc)) return table.done;
-  if (writeIfChanged3(io.cwd, REVIEW_OP_FILE, reviewOpFile(doc))) io.err(`${PRODUCT} ci: wrote ${REVIEW_OP_FILE}; commit it with the workflow`);
-  if (writeIfChanged3(io.cwd, REVIEW_SPEC_FILE, JSON.stringify(reviewOpSpec(doc), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${REVIEW_SPEC_FILE}`);
-  const outDir = OP_OUTPUT_DIR3[forge];
-  const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", REVIEW_SPEC_FILE, "--output", outDir], words);
-  if (code !== table.done) return code;
-  const dir = join7(io.cwd, outDir);
-  const files = existsSync7(dir) ? readdirSync4(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync7(join7(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${REVIEW_SPEC_FILE}`)) : [];
-  for (const f of files) io.err(`${PRODUCT} ci: review jobs at ${join7(outDir, f).replace(/^\.\//, "")}`);
-  const r = reviewOf(doc);
-  io.err(`${PRODUCT} ci: the review job reads the model's key from ${r.keyEnv}; set it from a secret`);
-  if (forge === "gitlab") io.err(`${PRODUCT} ci: on GitLab the note job runs on the default branch with CHANT_REVIEW_NOTES=1 from a pipeline schedule, and posts with a protected CHANT_FORGE_TOKEN`);
-  return table.done;
-}
-var PERSON_VERBS, READ_INSTRUCTIONS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE, REVIEW_CHANGE_SET, REVIEW_PREVIEW_LINE, OP_OUTPUT_DIR3;
-var init_agents2 = __esm({
-  "src/agents.ts"() {
-    "use strict";
-    init_chant_config();
-    init_config_check();
-    init_agents();
-    init_config();
-    init_stacks();
-    init_images();
-    init_stages();
-    init_tips();
-    init_words();
-    PERSON_VERBS = ["up", "approve", "override"];
-    READ_INSTRUCTIONS = `To change a stack, open a pull request: ${PRODUCT} previews it, and its update runs after a person approves the digest.`;
-    REVIEW_OP = "plywood-review";
-    REVIEW_OP_FILE = "ops/plywood-review.op.ts";
-    REVIEW_SPEC_FILE = ".chant/ops/plywood-review.spec.json";
-    REVIEW_CHANGE_SET = ".chant/pr/change-set.json";
-    REVIEW_PREVIEW_LINE = `${BIN} components pr-plan --base "origin/\${GITHUB_BASE_REF:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME}" --pr "\${CI_MERGE_REQUEST_IID:-$(node -p 'require(process.env.GITHUB_EVENT_PATH).pull_request.number')}" --gate ${PR_GATE} --no-status`;
-    OP_OUTPUT_DIR3 = { github: ".github/workflows", forgejo: ".forgejo/workflows", gitlab: "." };
-  }
-});
-
-// src/init/detect.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5, readFileSync as readFileSync8, statSync } from "node:fs";
-import { basename, dirname as dirname7, join as join8, relative, sep } from "node:path";
-import { parseYAML as parseYAML2 } from "@intentius/chant/yaml";
-function repoRoot(dir) {
-  let cur = dir;
-  for (let i = 0; i < 64; i++) {
-    if (existsSync8(join8(cur, ".git"))) return cur;
-    const parent = dirname7(cur);
-    if (parent === cur) return dir;
-    cur = parent;
-  }
-  return dir;
-}
-function posixRel(root, path) {
-  const rel = relative(root, path);
-  return rel === "" ? "." : rel.split(sep).join("/");
-}
-function readYamlFile(file) {
-  try {
-    const doc = parseYAML2(readFileSync8(file, "utf8"));
-    return doc && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function findPulumiProjects(root) {
-  const out = [];
-  const walk = (dir, depth) => {
-    let entries;
-    try {
-      entries = readdirSync5(dir).sort();
-    } catch {
-      return;
-    }
-    const file = ["Pulumi.yaml", "Pulumi.yml"].find((n) => entries.includes(n));
-    if (file) {
-      const project = readProject(root, dir, join8(dir, file));
-      if (project) out.push(project);
-    }
-    if (depth >= MAX_DEPTH) return;
-    for (const name of entries) {
-      if (SKIP.has(name) || name.startsWith(".")) continue;
-      const path = join8(dir, name);
-      try {
-        if (statSync(path).isDirectory()) walk(path, depth + 1);
-      } catch {
-      }
-    }
-  };
-  walk(root, 0);
-  return out;
-}
-function readProject(root, dir, file) {
-  const doc = readYamlFile(file);
-  if (!doc || typeof doc.name !== "string" || doc.name === "") return void 0;
-  const runtime = typeof doc.runtime === "string" ? doc.runtime : doc.runtime?.name;
-  const backend = doc.backend;
-  const configDir = typeof doc.stackConfigDir === "string" ? join8(dir, doc.stackConfigDir) : dir;
-  return {
-    name: doc.name,
-    dir: posixRel(root, dir),
-    ...typeof runtime === "string" ? { runtime } : {},
-    ...backend && typeof backend.url === "string" ? { backendUrl: backend.url } : {},
-    stacks: stackNames(configDir)
-  };
-}
-function stackNames(configDir) {
-  let entries;
-  try {
-    entries = readdirSync5(configDir);
-  } catch {
-    return [];
-  }
-  const names = entries.map((n) => /^Pulumi\.(.+)\.ya?ml$/.exec(n)?.[1]).filter((s) => s !== void 0 && s !== "");
-  return [...new Set(names)].sort(byEnvironment);
-}
-function environmentOf(stack) {
-  const last = stack.split("/").pop().toLowerCase();
-  const head = last.split(/[-_.]/)[0];
-  return ENV_ORDER.includes(head) ? head : last;
-}
-function rank(stack) {
-  const env = environmentOf(stack);
-  const at = ENV_ORDER.indexOf(env);
-  return at >= 0 ? at : PROD_RANK - 0.5;
-}
-function byEnvironment(a, b) {
-  return rank(a) - rank(b) || a.localeCompare(b);
-}
-function stacksOf2(projects) {
-  const names = /* @__PURE__ */ new Map();
-  for (const p of projects) names.set(p.name, (names.get(p.name) ?? 0) + 1);
-  const out = [];
-  for (const p of projects) {
-    const project = (names.get(p.name) ?? 0) > 1 ? `${p.name}-${slug(p.dir)}` : p.name;
-    for (const stack of p.stacks) out.push({ key: `${project}/${stack}`, project: p.name, stack, dir: p.dir });
-  }
-  return out.sort((x, y) => byEnvironment(x.stack, y.stack) || x.key.localeCompare(y.key));
-}
-function slug(s) {
-  const out = s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  return out === "" ? "root" : out;
-}
-function originUrl(root) {
-  const config2 = gitFile(root, "config");
-  if (!config2) return void 0;
-  let inOrigin = false;
-  for (const raw of config2.split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line.startsWith("[")) {
-      inOrigin = /^\[remote\s+"origin"\]$/.test(line);
-      continue;
-    }
-    const m = inOrigin ? /^url\s*=\s*(.+)$/.exec(line) : null;
-    if (m) return m[1].trim();
-  }
-  return void 0;
-}
-function gitFile(root, name) {
-  const dotGit = join8(root, ".git");
-  let gitDir = dotGit;
-  try {
-    if (statSync(dotGit).isFile()) {
-      const m = /^gitdir:\s*(.+)$/m.exec(readFileSync8(dotGit, "utf8"));
-      if (!m) return void 0;
-      gitDir = join8(root, m[1].trim());
-      const common = join8(gitDir, "commondir");
-      if (existsSync8(common) && !existsSync8(join8(gitDir, name))) gitDir = join8(gitDir, readFileSync8(common, "utf8").trim());
-    }
-    const path = join8(gitDir, name);
-    return existsSync8(path) ? readFileSync8(path, "utf8") : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function remoteHost(url) {
-  const scp = /^[^@/\s]+@([^:/\s]+):/.exec(url);
-  if (scp) return scp[1].toLowerCase();
-  try {
-    return new URL(url).hostname.toLowerCase() || void 0;
-  } catch {
-    return void 0;
-  }
-}
-function forgeOfRemote(url) {
-  const host = remoteHost(url);
-  if (!host) return void 0;
-  if (host === "github.com" || host.endsWith(".github.com") || host.startsWith("github.")) return { kind: "github", because: `origin is on ${host}` };
-  if (host === "gitlab.com") return { kind: "gitlab", because: `origin is on ${host}` };
-  if (host === "codeberg.org") return { kind: "forgejo", because: `origin is on ${host}` };
-  if (/(^|[.-])gitlab([.-]|$)/.test(host)) return { kind: "gitlab", because: `origin is on ${host}`, url: `https://${host}` };
-  if (/(^|[.-])(forgejo|gitea)([.-]|$)/.test(host)) return { kind: "forgejo", because: `origin is on ${host}`, url: `https://${host}` };
-  return void 0;
-}
-function detectForge(root) {
-  const url = originUrl(root);
-  const byRemote = url ? forgeOfRemote(url) : void 0;
-  if (byRemote) return byRemote;
-  if (existsSync8(join8(root, ".forgejo"))) return { kind: "forgejo", because: "the repository has .forgejo/" };
-  if (existsSync8(join8(root, ".gitlab-ci.yml"))) return { kind: "gitlab", because: "the repository has .gitlab-ci.yml" };
-  if (existsSync8(join8(root, ".github", "workflows"))) return { kind: "github", because: "the repository has .github/workflows/" };
-  return void 0;
-}
-function defaultBranch(root) {
-  const head = gitFile(root, "refs/remotes/origin/HEAD");
-  const remote = head && /ref:\s*refs\/remotes\/origin\/(.+)/.exec(head)?.[1];
-  if (remote) return remote.trim();
-  const local = gitFile(root, "HEAD");
-  const branch = local && /ref:\s*refs\/heads\/(.+)/.exec(local)?.[1];
-  return branch ? branch.trim() : "main";
+    `  overview: "A model reviews the pull request against its stacks' previews",`,
+    "  phases: [",
+    `    phase("Preview", [shell(${JSON.stringify(REVIEW_PREVIEW_LINE)})]),`,
+    `    phase("Review", [reviewAgent({ ${fields} })]),`,
+    "  ],",
+    "});",
+    ""
+  ].join("\n");
 }
-function findPulumiActions(root) {
-  const out = [];
-  for (const d of WORKFLOW_DIRS) {
-    let names;
-    try {
-      names = readdirSync5(join8(root, d)).sort();
-    } catch {
-      continue;
-    }
-    for (const n of names) {
-      if (!/\.ya?ml$/.test(n)) continue;
-      try {
-        if (/uses:\s*["']?pulumi\/actions@/.test(readFileSync8(join8(root, d, n), "utf8"))) out.push(`${d}/${n}`);
-      } catch {
+function reviewOpSpec(doc) {
+  const settings = toChantSettings({ doc });
+  const p = settings.pipeline;
+  const engine2 = chantPipelineOptions({ ...p.image ? { image: p.image } : {}, ...p.engineSetup ? { engineSetup: p.engineSetup } : {} }, false);
+  return {
+    ops: [
+      {
+        name: REVIEW_OP,
+        trigger: { kind: "pull_request" },
+        reviewAgent: true,
+        // The preview in the review job takes the preview identity; id-token is the one write the review job may hold.
+        ...settings.ci.identity ? { permissions: { "id-token": "write" } } : {}
       }
+    ],
+    options: {
+      ...engine2.beforeScript ? { beforeScript: engine2.beforeScript } : {},
+      ...engine2.image ? { image: engine2.image } : {}
     }
-  }
-  return out;
-}
-function detect(cwd) {
-  const root = repoRoot(cwd);
-  const projects = findPulumiProjects(root);
-  const forge = detectForge(root);
-  const preCommit = [".pre-commit-config.yaml", ".pre-commit-config.yml"].find((n) => existsSync8(join8(root, n)));
-  return {
-    root,
-    projects,
-    stacks: stacksOf2(projects),
-    ...forge ? { forge } : {},
-    defaultBranch: defaultBranch(root),
-    pulumiActions: findPulumiActions(root),
-    ...preCommit ? { preCommit } : {}
   };
 }
-function repoName(root) {
-  return slug(basename(root)).slice(0, 40).replace(/-+$/, "") || "plywood";
+function writeIfChanged3(cwd, file, text) {
+  const path = join8(cwd, file);
+  if (existsSync8(path) && readFileSync9(path, "utf8") === text) return false;
+  mkdirSync5(dirname7(path), { recursive: true });
+  writeFileSync5(path, text);
+  return true;
 }
-var SKIP, MAX_DEPTH, ENV_ORDER, PROD_RANK, WORKFLOW_DIRS;
-var init_detect = __esm({
-  "src/init/detect.ts"() {
+async function writeReviewJobs(chant, forge, doc, words, table, io) {
+  if (!reviewOf(doc)) return table.done;
+  if (writeIfChanged3(io.cwd, REVIEW_OP_FILE, reviewOpFile(doc))) io.err(`${PRODUCT} ci: wrote ${REVIEW_OP_FILE}; commit it with the workflow`);
+  if (writeIfChanged3(io.cwd, REVIEW_SPEC_FILE, JSON.stringify(reviewOpSpec(doc), null, 2) + "\n")) io.err(`${PRODUCT} ci: wrote ${REVIEW_SPEC_FILE}`);
+  const outDir = OP_OUTPUT_DIR3[forge];
+  const code = await chant.runChantInProcess(["run", "--generate", forge, "--spec", REVIEW_SPEC_FILE, "--output", outDir], words);
+  if (code !== table.done) return code;
+  const dir = join8(io.cwd, outDir);
+  const files = existsSync8(dir) ? readdirSync5(dir).filter((f) => /\.ya?ml$/.test(f) && (readFileSync9(join8(dir, f), "utf8").split("\n", 1)[0] ?? "").includes(`--spec ${REVIEW_SPEC_FILE}`)) : [];
+  for (const f of files) io.err(`${PRODUCT} ci: review jobs at ${join8(outDir, f).replace(/^\.\//, "")}`);
+  const r = reviewOf(doc);
+  io.err(`${PRODUCT} ci: the review job reads the model's key from ${r.keyEnv}; set it from a secret`);
+  if (forge === "gitlab") io.err(`${PRODUCT} ci: on GitLab the note job runs on the default branch with CHANT_REVIEW_NOTES=1 from a pipeline schedule, and posts with a protected CHANT_FORGE_TOKEN`);
+  return table.done;
+}
+var PERSON_VERBS, READ_INSTRUCTIONS, REVIEW_OP, REVIEW_OP_FILE, REVIEW_SPEC_FILE, REVIEW_CHANGE_SET, REVIEW_PREVIEW_LINE, OP_OUTPUT_DIR3;
+var init_agents2 = __esm({
+  "src/agents.ts"() {
     "use strict";
-    SKIP = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", "vendor", "venv", ".venv", "__pycache__", "target", "bin", "obj"]);
-    MAX_DEPTH = 8;
-    ENV_ORDER = ["local", "dev", "development", "sandbox", "test", "testing", "qa", "ci", "stage", "staging", "preprod", "uat", "prod", "production"];
-    PROD_RANK = ENV_ORDER.indexOf("prod");
-    WORKFLOW_DIRS = [".github/workflows", ".forgejo/workflows", ".gitea/workflows"];
+    init_chant_config();
+    init_config_check();
+    init_agents();
+    init_config();
+    init_stacks();
+    init_images();
+    init_stages();
+    init_tips();
+    init_words();
+    PERSON_VERBS = ["up", "approve", "override"];
+    READ_INSTRUCTIONS = `To change a stack, open a pull request: ${PRODUCT} previews it, and its update runs after a person approves the digest.`;
+    REVIEW_OP = "plywood-review";
+    REVIEW_OP_FILE = "ops/plywood-review.op.ts";
+    REVIEW_SPEC_FILE = ".chant/ops/plywood-review.spec.json";
+    REVIEW_CHANGE_SET = ".chant/pr/change-set.json";
+    REVIEW_PREVIEW_LINE = `${BIN} components pr-plan --base "origin/\${GITHUB_BASE_REF:-$CI_MERGE_REQUEST_TARGET_BRANCH_NAME}" --pr "\${CI_MERGE_REQUEST_IID:-$(node -p 'require(process.env.GITHUB_EVENT_PATH).pull_request.number')}" --gate ${PR_GATE} --no-status`;
+    OP_OUTPUT_DIR3 = { github: ".github/workflows", forgejo: ".forgejo/workflows", gitlab: "." };
   }
 });
 
 // src/policy-presets.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 function providersRego(allowed, namespace = "main") {
   const set = allowed.length ? `{${[...new Set(allowed)].sort().map((p) => JSON.stringify(p)).join(", ")}}` : "set()";
   return preset("plywood_providers.rego.tmpl").replace("{{namespace}}", namespace).replace("{{allowed}}", set);
@@ -4264,7 +4509,7 @@ var init_policy_presets = __esm({
     PROVIDERS_PACK_CONFIG = "policy/plywood-providers.json";
     PROVIDERS_REGO_FILE = "plywood_providers.rego";
     PROVIDERS_POLICY = "provider-allowlist";
-    preset = (rel) => readFileSync9(new URL(`../presets/policy/${rel}`, import.meta.url), "utf8");
+    preset = (rel) => readFileSync10(new URL(`../presets/policy/${rel}`, import.meta.url), "utf8");
   }
 });
 
@@ -4617,155 +4862,6 @@ var init_presets = __esm({
   }
 });
 
-// src/templates.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-function template(name) {
-  return readFileSync10(new URL(`../templates/${name}`, import.meta.url), "utf8");
-}
-function fill(text, values) {
-  return text.replace(/\{\{(\w+)\}\}/g, (all, key) => key in values ? values[key] : all);
-}
-var init_templates = __esm({
-  "src/templates.ts"() {
-    "use strict";
-  }
-});
-
-// src/init/render.ts
-import { emitYAMLEntry } from "@intentius/chant/yaml";
-function plywoodYml(keys) {
-  const body = Object.entries(keys).filter(([, v]) => v !== void 0).map(([k, v]) => emitYAMLEntry(k, v)).join("\n");
-  const text = fill(template("plywood.yml"), { keys: body });
-  return text.endsWith("\n") ? text : text + "\n";
-}
-function chantConfigTs() {
-  return template("chant.config.ts.tmpl");
-}
-function componentName(stack) {
-  return slug(stack.key);
-}
-function exportName(stack, taken) {
-  let base = stack.key.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  if (base === "" || /^\d/.test(base)) base = `stack_${base}`;
-  let name = base;
-  for (let i = 2; taken.has(name); i++) name = `${base}_${i}`;
-  taken.add(name);
-  return name;
-}
-function stepInput(s) {
-  return {
-    dir: s.dir,
-    stack: s.stack,
-    member: s.project,
-    ...s.engine ? { engine: s.engine } : {},
-    ...s.backend ? { backend: s.backend } : {},
-    ...s.engineVersion ? { engineVersion: s.engineVersion, ...s.engineRoot ? { engineRoot: s.engineRoot } : {} } : {},
-    ...s.lockGrain ? { lockGrain: s.lockGrain } : {},
-    ...s.policyPacks?.length ? { policyPacks: s.policyPacks } : {}
-  };
-}
-function componentsFile(stacks2, after = {}, opts = {}) {
-  const taken = /* @__PURE__ */ new Set();
-  const lines2 = [
-    "// Written by plywood init from the stacks it found; running it again rewrites",
-    "// this file. Each stack is a chant component whose pulumi-up step previews it",
-    "// on a pull request and updates it in its wave.",
-    ""
-  ];
-  for (const s of stacks2) {
-    const dependsOn = (after[s.key] ?? []).filter((u) => stacks2.some((x) => x.key === u)).map((u) => componentName({ key: u }));
-    const step = { kind: "pulumi-up", ...stepInput(s), ...opts.reviewSuffix ? { reviewSuffix: opts.reviewSuffix } : {} };
-    const component = { name: componentName(s), dependsOn, deploy: [{ phase: "up", steps: [step] }] };
-    lines2.push(`export const ${exportName(s, taken)} = ${JSON.stringify(component)};`);
-  }
-  return lines2.join("\n") + "\n";
-}
-function wavesOf(stacks2, configured) {
-  const byKey = new Map(stacks2.map((s) => [s.key, s]));
-  if (configured && configured.length > 0) {
-    return configured.map((keys, i) => ({ name: `wave-${i + 1}`, stacks: keys.map((k) => byKey.get(k)).filter((s) => s !== void 0) }));
-  }
-  const out = [];
-  for (const s of stacks2) {
-    const env = environmentOf(s.stack);
-    let name = slug(env);
-    if (!WAVE_NAME.test(name)) name = `wave-${out.length + 1}`;
-    const wave = out.find((w) => w.name === name);
-    if (wave) wave.stacks.push(s);
-    else out.push({ name, stacks: [s] });
-  }
-  return out;
-}
-function waveRunner(runner) {
-  if (runner === void 0) return void 0;
-  if (typeof runner === "string" || Array.isArray(runner) || "group" in runner) return runner;
-  const staged = runner;
-  return staged.up ?? staged.default;
-}
-function wavesSpec(input) {
-  const waves = (input.ordered ?? wavesOf(input.stacks, input.waves)).filter((w) => w.stacks.length > 0);
-  return {
-    name: OP_NAME,
-    op: OP_NAME,
-    gate: PR_GATE,
-    branches: [input.branch],
-    ...input.runner !== void 0 ? { runner: input.runner } : {},
-    step: { kind: "pulumi-up" },
-    ...input.quorum && input.quorum.length > 0 ? { approvals: { quorum: input.quorum } } : {},
-    ...input.notify ? { notify: input.notify } : {},
-    waves: waves.map((w) => {
-      const gate = w.stacks.map((s) => s.gate ?? input.gate).reduce((a, b) => STRICTNESS[b] > STRICTNESS[a] ? b : a);
-      return { name: w.name, gate, runs: w.stacks.map((s) => ({ target: s.key, input: stepInput(s) })) };
-    })
-  };
-}
-function jsonText(v) {
-  return JSON.stringify(v, null, 2) + "\n";
-}
-function memberName(project, taken) {
-  let base = slug(project.name).slice(0, 36).replace(/-+$/, "");
-  if (!MEMBER_NAME.test(base)) base = "stack";
-  let name = base;
-  for (let i = 2; taken.has(name); i++) name = `${base}-${i}`;
-  taken.add(name);
-  return name;
-}
-function workspaceDeclaration(existing, input) {
-  const doc = existing ? structuredClone(existing) : { name: input.name, schema: 1 };
-  const members = Array.isArray(doc.members) ? doc.members : [];
-  const taken = new Set(members.map((m) => String(m.name)));
-  for (const p of input.projects) {
-    if (members.some((m) => m.dir === p.dir || p.dir === "." && m.dir === void 0)) continue;
-    members.push({ name: memberName(p, taken), dir: p.dir, kind: "pulumi" });
-  }
-  doc.members = members;
-  const pins = Array.isArray(doc.pins) ? doc.pins : [];
-  if (!pins.some((p) => p.package === PULUMI_LEXICON)) pins.push({ package: PULUMI_LEXICON, version: input.lexiconVersion });
-  doc.pins = pins;
-  const ci2 = doc.ci && typeof doc.ci === "object" && !Array.isArray(doc.ci) ? doc.ci : {};
-  for (const [k, v] of Object.entries(input.ci)) if (v !== void 0) ci2[k] = v;
-  if (Object.keys(ci2).length > 0) doc.ci = ci2;
-  return doc;
-}
-function memberOfDir(doc, dir) {
-  const members = doc && Array.isArray(doc.members) ? doc.members : [];
-  const m = members.find((x) => x.dir === dir || dir === "." && x.dir === void 0);
-  return typeof m?.name === "string" ? m.name : void 0;
-}
-var WAVE_NAME, STRICTNESS, MEMBER_NAME, PULUMI_LEXICON;
-var init_render = __esm({
-  "src/init/render.ts"() {
-    "use strict";
-    init_templates();
-    init_words();
-    init_detect();
-    WAVE_NAME = /^[a-z0-9][a-z0-9_-]*$/;
-    STRICTNESS = { never: 0, "on-destructive": 1, always: 2 };
-    MEMBER_NAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
-    PULUMI_LEXICON = "@intentius/chant-lexicon-pulumi";
-  }
-});
-
 // src/stack-order.ts
 import { join as join9 } from "node:path";
 function chantReferenceReader() {
@@ -5400,6 +5496,11 @@ __export(init_exports, {
 import { existsSync as existsSync10, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "node:fs";
 import { emitYAMLEntry as emitYAMLEntry2 } from "@intentius/chant/yaml";
 import { dirname as dirname9, join as join13, posix as posix3 } from "node:path";
+function chantPin() {
+  const pin = dependencies["@intentius/chant"];
+  if (!pin) throw new Error("packages/plywood/package.json has no @intentius/chant dependency");
+  return pin;
+}
 function parseInitArgs(args) {
   if (args.includes("--print-prompt")) return { printPrompt: true };
   let rest = args;
@@ -5620,7 +5721,7 @@ async function runInit(opts, table, io) {
     const message = needsChantMessage("Writing the waves spec and the workflow");
     files.push({ file: WAVES_SPEC_FILE2, status: "skipped", note: message }, { file: WORKFLOW_FILE[forge.kind], status: "skipped", note: "needs the same chant" });
   } else {
-    let spec = wavesSpecStep(chant, stacks2, doc, settings, detected2.defaultBranch, waves);
+    let spec = await wavesSpecStep(chant, stacks2, doc, settings, detected2.defaultBranch, waves, forge.kind);
     if (settings.pipeline.jobs) {
       try {
         spec = withJobSettings(spec, settings.pipeline.jobs, forge.kind, { parallelism: await hasChant4625() });
@@ -5638,6 +5739,9 @@ async function runInit(opts, table, io) {
   if (opts.bucketCheck) notes.push(...await bucketStep(detected2, doc, io.env, buckets));
   adopt.push(...await adoptStep(root, detected2, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
   todo.push(...todoLines(detected2, doc, forge.kind, io.env));
+  if (forge.kind === "gitlab" && chant && stacks2.length > 0 && previewOf(doc) && await hasChantWavePreview()) {
+    todo.push(`Add a ${GITLAB_READ_TOKEN} CI/CD variable (a project access token with the read_api scope, masked and protected) so a wave can read the merge request it applies; without it the wave refuses`);
+  }
   const failed = files.find((f) => f.status === "failed");
   return {
     ok: !failed,
@@ -5702,7 +5806,7 @@ async function preCommitStep(root, config2, dryRun) {
   const after = readFileSync12(join13(root, DECLARATION_FILE), "utf8");
   return { file: DECLARATION_FILE, status: after === before ? "unchanged" : "written", note: `${config2} runs as the check hook pre-commit; the check job's image needs pre-commit` };
 }
-function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered) {
+async function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered, forge) {
   const runner = waveRunner(chantPipelineOptions(settings.pipeline, false).runner);
   const base = wavesSpec({
     stacks: stacks2,
@@ -5714,7 +5818,8 @@ function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered) {
     // notify.relay only on a chant with the relay (chant#4611); an older chant refuses the setting.
     ...settings.pipeline.notify ? { notify: { ...notifyForChant(settings.pipeline.notify, chant) } } : {}
   });
-  return chant.productWavesSpec ? chant.productWavesSpec(base, PRODUCT_WORDS) : base;
+  const named = chant.productWavesSpec ? chant.productWavesSpec(base, PRODUCT_WORDS) : base;
+  return previewOf(doc) && await hasChantWavePreview() ? withWavePreview(named, forge) : named;
 }
 async function workflowStep(chant, root, doc, settings, forge, opts, spec, table, io) {
   const output = WORKFLOW_FILE[forge];
@@ -5872,6 +5977,7 @@ var init_init = __esm({
     init_stacks();
     init_types();
     init_images();
+    init_chant_next();
     init_jobs2();
     init_backend();
     init_adopt();
@@ -5891,7 +5997,7 @@ var init_init = __esm({
     CHANT_CONFIG_FILE = "chant.config.ts";
     COMPONENTS_FILE = "plywood.component.ts";
     WAVES_SPEC_FILE2 = `.chant/op-waves/${OP_NAME}.spec.json`;
-    CHANT_PIN = dependencies["@intentius/chant"] ?? "0.124.54";
+    CHANT_PIN = chantPin();
   }
 });
 
@@ -6244,8 +6350,25 @@ async function withChant(what, table, io, run) {
   return run(chant);
 }
 function passthrough(argv, table, io) {
+  if (argv[0] === "run" && argv[1] === "wave") return runWave(argv, table, io);
   return withChant(`${PRODUCT} ${argv[0]}`, table, io, (chant) => chant.runChantInProcess(argv, PRODUCT_WORDS));
 }
+async function runWave(argv, table, io) {
+  const seen = [];
+  const write = process.stderr.write;
+  process.stderr.write = ((chunk, ...rest) => {
+    seen.push(typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8"));
+    return write.call(process.stderr, chunk, ...rest);
+  });
+  let code;
+  try {
+    code = await withChant(`${PRODUCT} run wave`, table, io, (chant) => chant.runChantInProcess(argv, PRODUCT_WORDS));
+  } finally {
+    process.stderr.write = write;
+  }
+  if (code === table.moved) io.err(`${PRODUCT}: ${waveMovedLine(seen.join(""))}`);
+  return code;
+}
 async function check(args, json, table, io) {
   const file = takeFlag(args, "--file");
   if (file.missing) return usage("--file takes a path", table, io);
@@ -6544,6 +6667,7 @@ var init_stages = __esm({
     init_review_stacks2();
     init_waves_workflow();
     init_drift2();
+    init_refusals();
     init_agents2();
     init_agent_jobs();
     init_words();
@@ -7804,7 +7928,7 @@ var execChild = (bin, args, opts) => new Promise((done) => {
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.2.0" : "0.0.0-dev";
+var VERSION3 = true ? "0.3.1" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")