@intentius/plywood 0.3.1 → 0.3.2

package/dist/plywood.mjs

@@ -432,7 +432,7 @@ var init_words = __esm({
   "src/words.ts"() {
     "use strict";
     PRODUCT = "plywood";
-    TAGLINE = "Sophisticated automation for Pulumi.";
+    TAGLINE = "Pulumi ops and governance.";
     OP_NAME = "pulumi-up";
     PR_GATE = "up";
     VERBS = [
@@ -597,13 +597,13 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.3.1";
+    version = "0.3.2";
     dependencies = {
-      "@intentius/chant": "0.124.59",
-      "@intentius/chant-lexicon-forgejo": "0.124.59",
-      "@intentius/chant-lexicon-github": "0.124.59",
-      "@intentius/chant-lexicon-gitlab": "0.124.59",
-      "@intentius/chant-lexicon-pulumi": "0.124.59"
+      "@intentius/chant": "0.124.67",
+      "@intentius/chant-lexicon-forgejo": "0.124.67",
+      "@intentius/chant-lexicon-github": "0.124.67",
+      "@intentius/chant-lexicon-gitlab": "0.124.67",
+      "@intentius/chant-lexicon-pulumi": "0.124.67"
     };
   }
 });
@@ -613,8 +613,8 @@ var image_digests_default;
 var init_image_digests = __esm({
   "src/image-digests.json"() {
     image_digests_default = {
-      "ghcr.io/intentius/plywood-pulumi:0.3.1-pulumi3.272.0": "sha256:acdadb5000ade3afea20ab2f555946312281066e1df288b1007bff096514ebfd",
-      "ghcr.io/intentius/plywood-plunge:0.3.1-plunge0.2.0": "sha256:adc42bc97564ecb2074b3ee4d97f84ddb986e0f30f6a26f35b8721106c177456"
+      "ghcr.io/intentius/plywood-pulumi:0.3.2-pulumi3.272.0": "sha256:eeb44ac18dc594acd8a56dfc1a6ed00751154f6b6bfba8bbdff97a513f4b9f84",
+      "ghcr.io/intentius/plywood-plunge:0.3.2-plunge0.2.0": "sha256:5239ffabd5f5b7a4ffc5cbbe1628a34990bc95549cd4a1bef27953d3dfb7d8a9"
     };
   }
 });
@@ -2468,7 +2468,7 @@ var init_chant_product = __esm({
   "src/chant-product.ts"() {
     "use strict";
     REQUIRED2 = ["assertProductWords", "productPipelineJobs", "approveLine", "runChantInProcess"];
-    BUILT_CHANT = true ? "0.124.59" : "unknown";
+    BUILT_CHANT = true ? "0.124.67" : "unknown";
   }
 });
 
@@ -3503,6 +3503,7 @@ function wavesSpec(input) {
     step: { kind: "pulumi-up" },
     ...input.quorum && input.quorum.length > 0 ? { approvals: { quorum: input.quorum } } : {},
     ...input.notify ? { notify: input.notify } : {},
+    ...input.policy ? { holds: { policy: true } } : {},
     waves: waves.map((w) => {
       const gate = w.stacks.map((s) => s.gate ?? input.gate).reduce((a, b) => STRICTNESS[b] > STRICTNESS[a] ? b : a);
       return { name: w.name, gate, runs: w.stacks.map((s) => ({ target: s.key, input: stepInput(s) })) };
@@ -3999,7 +4000,10 @@ async function drift2(args, json, table, io) {
     try {
       const attribute = await attributionFor(doc, io);
       const root = dirname6(path);
-      for (const stack of stacks2) results.push(await readStack(chant, stack, driftMember(root, doc, stack), dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} }));
+      for (const stack of stacks2) {
+        const backend = stacksOf(doc)[stack]?.backend ?? (typeof doc.backend === "string" ? doc.backend : void 0);
+        results.push(await withBackend(backend, () => readStack(chant, stack, driftMember(root, doc, stack), dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} })));
+      }
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -4106,9 +4110,26 @@ async function readStack(chant, stack, member, dir, opts) {
     return { stack, ok: false, drifted: 0, rows: [], error: doc?.error ? `${doc.error.code}: ${doc.error.message}` : `chant workspace drift exited ${code}` };
   }
   const rows = driftRows(doc);
+  const unread = (doc.records ?? []).filter((r) => r.status === "not-observed");
+  if (rows.length === 0 && unread.length > 0) {
+    const first = unread[0];
+    const why = first.unobserved?.detail ?? first.unobserved?.reason ?? "no reason given";
+    return { stack, ok: false, drifted: 0, rows: [], error: `${unread.length} resource${unread.length === 1 ? "" : "s"} could not be read, so the stack's drift is unknown: ${first.address}: ${why}` };
+  }
   const attribution = rows.length && opts.attribute ? await attributeStack(opts.attribute, stack, doc) : void 0;
   return { stack, ok: true, drifted: rows.length, rows, observedAt: observedAt(doc), ...attribution ? { attribution } : {} };
 }
+async function withBackend(backend, read) {
+  if (backend === void 0) return read();
+  const before = process.env.PULUMI_BACKEND_URL;
+  process.env.PULUMI_BACKEND_URL = backend;
+  try {
+    return await read();
+  } finally {
+    if (before === void 0) delete process.env.PULUMI_BACKEND_URL;
+    else process.env.PULUMI_BACKEND_URL = before;
+  }
+}
 async function attributionFor(doc, io) {
   const logs = driftSettingsOf(doc).auditLogs;
   if (!logs) return void 0;
@@ -5808,7 +5829,9 @@ async function preCommitStep(root, config2, dryRun) {
 }
 async function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered, forge) {
   const runner = waveRunner(chantPipelineOptions(settings.pipeline, false).runner);
+  const rego = isObject(doc.policy) && (typeof doc.policy.rego === "string" || doc.policy.source !== void 0 || doc.policy.command !== void 0);
   const base = wavesSpec({
+    ...rego ? { policy: true } : {},
     stacks: stacks2,
     ordered,
     gate: gateOf(doc),
@@ -7928,7 +7951,7 @@ var execChild = (bin, args, opts) => new Promise((done) => {
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.3.1" : "0.0.0-dev";
+var VERSION3 = true ? "0.3.2" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")