@intentius/plywood 0.3.5 → 0.3.8

package/dist/plywood.mjs

@@ -20,7 +20,7 @@ var __export = (target, all) => {
 var define_PLYWOOD_IMAGE_DIGESTS_default;
 var init_define_PLYWOOD_IMAGE_DIGESTS = __esm({
   "<define:__PLYWOOD_IMAGE_DIGESTS__>"() {
-    define_PLYWOOD_IMAGE_DIGESTS_default = { "ghcr.io/intentius/plywood-pulumi:0.3.5-pulumi3.272.0": "sha256:a1288d42eaba8ec556ed3ea40a24cfda94a8413576b7f0129b30ab7620639f07", "ghcr.io/intentius/plywood-plunge:0.3.5-plunge0.2.0": "sha256:4384ee4b92c8b0cb00c4833bc0118a820a0c3620ad78dc50d9e21fb0d9fff370" };
+    define_PLYWOOD_IMAGE_DIGESTS_default = { "ghcr.io/intentius/plywood-pulumi:0.3.8-pulumi3.272.0": "sha256:b26afcdd7dd108768663bd5b3cef524b5323b5f5fff8ccb79d717c2895713ae3", "ghcr.io/intentius/plywood-plunge:0.3.8-plunge0.2.0": "sha256:48878580388a54ad5635c378d4848424354f9ca4b8f67434b7614a8210446b3e" };
   }
 });
 
@@ -409,38 +409,24 @@ function wordsForJobs(jobs2) {
 function driftOpName(stack) {
   return DRIFT_OP_PREFIX + stack.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function driftIssueMarker(stack) {
-  return `<!-- plywood:drift ${stack} -->`;
-}
 function driftIssueTitle(stack) {
   return `plywood: ${stack} has drifted`;
 }
-function cell(s) {
-  return s.replace(/\|/g, "\\|").replace(/\n/g, " ");
-}
-function driftIssueBody(input) {
-  const { stack, rows } = input;
-  const lines2 = [
-    driftIssueMarker(stack),
-    `plywood's drift check read ${stack} against the cloud at ${input.observedAt} and found ${rows.length} resource${rows.length === 1 ? "" : "s"} that differ from the stack's state.`,
-    "",
-    "| URN | Status | Attributes |",
-    "|---|---|---|",
-    ...rows.map((r) => `| \`${cell(r.urn)}\` | ${r.status} | ${r.attributes.length ? r.attributes.map((a) => `\`${cell(a)}\``).join(", ") : ""} |`),
-    "",
-    ...input.attribution?.length ? ["Who changed each attribute, from the known writes and the audit log:", "", ...input.attribution, ""] : [],
-    `To put the cloud back to the program, merge a change to ${stack} or run \`${PRODUCT} up\`. To keep the cloud's values, change the program to match and let its preview show no changes.`,
-    ...input.respond === "up" ? ["", `respond.drift is up, so this run also asked for an update of ${stack}'s wave; its gate decides.`] : [],
-    ...input.runUrl ? ["", `Read by ${input.runUrl}.`] : [],
-    "",
-    `<!-- plywood:drift-fingerprint ${input.fingerprint} -->`
-  ];
-  return lines2.join("\n");
-}
-function driftClearedComment(stack, observedAt2) {
-  return `plywood's drift check at ${observedAt2} found ${stack} matching its state, so this issue is closed.`;
+function driftIssueWords(stack, respond) {
+  return {
+    product: PRODUCT,
+    title: () => driftIssueTitle(stack),
+    intro: ({ drifted, observedAt: observedAt2 }) => `plywood's drift check read ${stack} against the cloud at ${observedAt2} and found ${drifted.length} resource${drifted.length === 1 ? "" : "s"} that differ from the stack's state.`,
+    address: "URN",
+    advice: () => [
+      `To put the cloud back to the program, merge a change to ${stack} or run \`${PRODUCT} up\`. To keep the cloud's values, change the program to match and let its preview show no changes.`,
+      ...respond === "up" ? ["", `respond.drift is up, so this run also asked for an update of ${stack}'s wave; its gate decides.`] : []
+    ].join("\n"),
+    foundBy: (runUrl) => `Read by ${runUrl}.`,
+    cleared: ({ observedAt: observedAt2 }) => `plywood's drift check at ${observedAt2} found ${stack} matching its state, so this issue is closed.`
+  };
 }
-var PRODUCT, TAGLINE, OP_NAME, PR_GATE, VERBS, BIN, NOTIFY_WORDS, PRODUCT_WORDS, ACTION_COMMAND, POLICY_RULE_FORMS, CLOUD_NAMES, NO_IDENTITY, TEMPLATE_REQUEST_WORDS, STACK_OP_WORDS, DRIFT_OP_PREFIX, LOCK_GRAIN_WORDS, PLUNGE_TIMING_ATTRIBUTES;
+var PRODUCT, TAGLINE, OP_NAME, PR_GATE, VERBS, BIN, NOTIFY_WORDS, PRODUCT_WORDS, ACTION_COMMAND, POLICY_RULE_FORMS, CLOUD_NAMES, NO_IDENTITY, TEMPLATE_REQUEST_WORDS, STACK_OP_WORDS, DRIFT_OP_PREFIX, DRIFT_ATTRIBUTION_HEADING, LOCK_GRAIN_WORDS, PLUNGE_TIMING_ATTRIBUTES;
 var init_words = __esm({
   "src/words.ts"() {
     "use strict";
@@ -484,7 +470,7 @@ var init_words = __esm({
     };
     STACK_OP_WORDS = {
       usage: {
-        export: `${PRODUCT} export <project/stack> --out <file>`,
+        export: `${PRODUCT} export <project/stack> --out <file> [--version <n>]`,
         cancel: `${PRODUCT} cancel <project/stack> [--lock <id>]`,
         move: `${PRODUCT} move <urn>... --from <project/stack> --to <project/stack>, or ${PRODUCT} move <project/stack> --onto plunge`,
         rollback: `${PRODUCT} rollback <project/stack> [--digest <sha256:...>], or ${PRODUCT} rollback --release <name> --env <env>`,
@@ -495,7 +481,7 @@ var init_words = __esm({
       acted: (stack, name, r) => `Ran action ${name} on ${stack}: ${r.engine} replaced ${r.urn}.${r.tail ? `
 ${r.tail}` : ""}`,
       noAction: (stack, name, declared) => declared.length ? `${stack} has no action ${name} in plywood.yml; its actions are ${declared.join(", ")}` : `${stack} declares no actions in plywood.yml; add one under stacks.${stack}.actions with a name and the URN of a command resource`,
-      exported: (stack, r) => `Exported ${stack} to ${r.file} (${r.resources} resources, ${r.bytes} bytes, sha256 ${r.sha256}). The file is readable by you alone; the ledger keeps its digest and size, never its content.`,
+      exported: (stack, r) => `Exported version ${r.version} of ${stack} to ${r.file} (${r.resources} resources, ${r.bytes} bytes, sha256 ${r.sha256}). The file is readable by you alone; the ledger keeps its digest and size, never its content.`,
       cancelled: (stack, lock, checked) => `Released lock ${lock} on ${stack}.${checked ? "" : " The backend's lock could not be read, so it was not checked against the approved one first."}`,
       moved: (from, to, r) => `Moved ${r.moved.length} resource${r.moved.length === 1 ? "" : "s"} from ${from} to ${to} on ${r.engine}. Both stacks preview no change.`,
       needsLock: "cancel needs --lock <id>, the lock the stack holds: the id pulumi printed when it refused the update, or the file name under .pulumi/locks/ on a file:// backend",
@@ -509,6 +495,7 @@ ${r.tail}` : ""}`,
       releaseIsEnvWide: (stack, env) => `--release rolls back every stack the release records in an environment, so it takes --env, not a stack. Run '${PRODUCT} rollback --release <name> --env ${env}', or '${PRODUCT} rollback ${stack}' for this stack's previous release.`
     };
     DRIFT_OP_PREFIX = "plywood-drift-";
+    DRIFT_ATTRIBUTION_HEADING = "Who changed each attribute, from the known writes and the audit log:";
     LOCK_GRAIN_WORDS = {
       perEngine: (engine3) => engine3 === "plunge" ? "resource, plunge's default (no ci.lockGrain; chant's pulumi lexicon sets it)" : engine3 === "pulumi" ? "stack, stock Pulumi's default (no ci.lockGrain; chant's pulumi lexicon sets it)" : "per engine: resource on plunge, stack on stock Pulumi (no ci.lockGrain; chant's pulumi lexicon sets it)"
     };
@@ -618,47 +605,29 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.3.5";
+    version = "0.3.8";
     dependencies = {
-      "@intentius/chant": "0.124.79",
-      "@intentius/chant-lexicon-forgejo": "0.124.79",
-      "@intentius/chant-lexicon-github": "0.124.79",
-      "@intentius/chant-lexicon-gitlab": "0.124.79",
-      "@intentius/chant-lexicon-pulumi": "0.124.79"
+      "@intentius/chant": "0.124.87",
+      "@intentius/chant-lexicon-forgejo": "0.124.87",
+      "@intentius/chant-lexicon-github": "0.124.87",
+      "@intentius/chant-lexicon-gitlab": "0.124.87",
+      "@intentius/chant-lexicon-pulumi": "0.124.87"
     };
   }
 });
 
 // src/images.ts
-import { CI_DOCKER_ARCH, ciFetchScript, plungeInstallLine, pulumiInstallLine } from "@intentius/chant-lexicon-pulumi/ci-setup";
+import { ciToolSha256, derivedImageDockerfile, productImageDockerfile } from "@intentius/chant/ci-image";
+import { plungeInstallLine, pulumiInstallLine } from "@intentius/chant-lexicon-pulumi/ci-setup";
 function engineDir(engine3, version2) {
   return `${ENGINE_ROOT}/${engine3}-${version2}`;
 }
 function engineBin(engine3, version2) {
   return `${engineDir(engine3, version2)}/${engine3}`;
 }
-function release(engine3, version2) {
-  if (engine3 === "pulumi") {
-    return {
-      base: `https://github.com/pulumi/pulumi/releases/download/v${version2}`,
-      archive: (arch) => `pulumi-v${version2}-linux-${arch}.tar.gz`,
-      checksums: `pulumi-${version2}-checksums.txt`
-    };
-  }
-  return {
-    base: `https://github.com/INTENTIUS/plunge/releases/download/plunge-v${version2}`,
-    archive: (arch) => `plunge-v${version2}-linux-${arch}.tar.gz`,
-    checksums: `plunge-v${version2}-checksums.txt`
-  };
-}
 function pinnedSums(engine3, version2) {
-  const r = release(engine3, version2);
-  const out = {};
-  for (const arch of ARCHES) {
-    const sum = PINNED_SHA256[r.archive(arch)];
-    if (sum) out[arch] = sum;
-  }
-  return out;
+  const sums = ciToolSha256(engine3, version2);
+  return { ...sums.amd64 ? { x64: sums.amd64 } : {}, ...sums.arm64 ? { arm64: sums.arm64 } : {} };
 }
 function installLine(engine3, version2, link = true) {
   const sums = pinnedSums(engine3, version2);
@@ -704,7 +673,7 @@ function chantPipelineOptions(p) {
   const lines2 = p.engineSetup ?? [];
   return { ...p.image ? { image: p.image } : {}, ...p.runner !== void 0 ? { runner: p.runner } : {}, ...lines2.length ? { beforeScript: [...lines2] } : {} };
 }
-var digests, REGISTRY, TOOL_VERSIONS, ARCHES, PINNED_SHA256, ENGINE_ROOT, DIGEST, RELEASE_LABEL_ARG, LABEL_REF, PLUGIN;
+var digests, REGISTRY, TOOL_VERSIONS, ENGINE_ROOT, DIGEST, PACK_DIR, RELEASE_LABEL_ARG, LABEL_REF, DOCKERFILE_HEADER, PLUGIN;
 var init_images = __esm({
   "src/images.ts"() {
     "use strict";
@@ -717,17 +686,17 @@ var init_images = __esm({
       /** A plunge release (INTENTIUS/plunge, tag plunge-v<ver>), not the Pulumi version it is built from. */
       plunge: "0.2.0"
     };
-    ARCHES = ["x64", "arm64"];
-    PINNED_SHA256 = {
-      "pulumi-v3.272.0-linux-x64.tar.gz": "58d545f2b98761051922008ebd381ecef95484d7f7a5ff7faa15d7a780ea84f6",
-      "pulumi-v3.272.0-linux-arm64.tar.gz": "4f0741901b8982c4326b702dabf483c63d2cf77c88ac42dd752b72541284a534",
-      "plunge-v0.2.0-linux-x64.tar.gz": "c9c73d05cca9ad214b7f44230a6162cdcb6ad64bbfc725bc94688b997b191495",
-      "plunge-v0.2.0-linux-arm64.tar.gz": "c176a82f038164085aa19c8ad6530d6022e560e124050e535dbe364ae0473357"
-    };
     ENGINE_ROOT = "/opt/plywood";
     DIGEST = /@sha256:[0-9a-f]{64}$/;
+    PACK_DIR = "images/pack";
     RELEASE_LABEL_ARG = "CHANT_RELEASE_LABEL";
     LABEL_REF = `\${${RELEASE_LABEL_ARG}}`;
+    DOCKERFILE_HEADER = [
+      "Rendered from packages/plywood/src/images.ts by packages/plywood/scripts/build-images.mjs.",
+      "Edit the module, then run npm run images -w @intentius/plywood. Build from the repository root",
+      `after npm pack -w @intentius/plywood --pack-destination ${PACK_DIR}, with --build-arg ${RELEASE_LABEL_ARG}=<the packed version>`,
+      "(just images passes the committed one; a release passes its label); nothing pushes it."
+    ];
     PLUGIN = /^(?:(resource|converter|language|analyzer|tool):)?([a-z0-9][a-z0-9-]*)@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/;
   }
 });
@@ -2666,8 +2635,9 @@ var init_agent_jobs = __esm({
 
 // src/drift-notify.ts
 import { createHash } from "node:crypto";
-function runFingerprint(results, stackFingerprint) {
-  const parts = results.filter((r) => r.ok && r.drifted > 0).map((r) => `${r.stack}	${stackFingerprint(r.rows)}`).sort();
+import { driftIssueFingerprint } from "@intentius/chant/drift-issue";
+function runFingerprint(results) {
+  const parts = results.filter((r) => r.ok && r.drifted > 0).map((r) => `${r.stack}	${driftIssueFingerprint(r.records)}`).sort();
   return createHash("sha256").update(parts.join("\n")).digest("hex").slice(0, 16);
 }
 function notifiesDrift(notify2) {
@@ -2677,7 +2647,7 @@ async function sendDriftNotice(input) {
   if (!notifiesDrift(input.notify)) return void 0;
   const drifted = input.results.filter((r) => r.ok && r.drifted > 0);
   if (drifted.length === 0) return void 0;
-  const fingerprint = runFingerprint(input.results, input.stackFingerprint);
+  const fingerprint = runFingerprint(input.results);
   if (drifted.every((r) => r.issue?.action === "unchanged")) {
     return { sent: false, reason: "no drift event was sent: every drifted stack's finding is the one its issue already holds", fingerprint };
   }
@@ -3589,26 +3559,23 @@ var init_up = __esm({
 });
 
 // src/drift.ts
-import { createHash as createHash2 } from "node:crypto";
 import { resolveTargetCloudIdentity } from "@intentius/chant/ci-identity";
+import { ForgeFlagError, forgeTargetOptionsFromFlags, forgeTargetWith } from "@intentius/chant/forge-flags";
+import { forgeClient } from "@intentius/chant/pr-forge";
+import { keepDriftIssue } from "@intentius/chant/drift-issue";
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, mkdtempSync, readdirSync as readdirSync4, readFileSync as readFileSync8, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname as dirname6, join as join7 } from "node:path";
 function driftRows(doc) {
   return (doc.records ?? []).filter((r) => DRIFT_STATUSES.includes(r.status)).map((r) => ({ urn: r.address, status: r.status, attributes: (r.attributes ?? []).map((a) => a.path).sort() })).sort((a, b) => a.urn < b.urn ? -1 : a.urn > b.urn ? 1 : 0);
 }
-function driftFingerprint(rows) {
-  const text = rows.map((r) => `${r.urn}	${r.status}	${r.attributes.join(",")}`).join("\n");
-  return createHash2("sha256").update(text).digest("hex").slice(0, 16);
-}
 function observedAt(doc) {
   const times = (doc.records ?? []).map((r) => r.observedAt).filter((t) => typeof t === "string").sort();
   return times[times.length - 1] ?? (/* @__PURE__ */ new Date()).toISOString();
 }
 async function forgeFor(kind, env) {
   if (forgeOverride) return forgeOverride(kind, env);
-  const m = await import("@intentius/chant/pr-forge");
-  return m.forgeClient(m.forgeTargetFromEnv(env, { kind }));
+  return forgeClient(forgeTargetWith(env, { kind }));
 }
 function wavesHolding(doc, stacks2) {
   if (!Array.isArray(doc.waves)) return "all";
@@ -3626,7 +3593,13 @@ async function drift2(args, json, table, io) {
   }
   const unknown = stackFlag.rest.filter((a) => a.startsWith("-"));
   if (unknown.length) return usage(`drift does not take ${unknown.join(" ")}`, table, io);
-  if (forgeFlag.value !== void 0 && !FORGES.includes(forgeFlag.value)) return usage(`--forge ${forgeFlag.value} is not one of ${FORGES.join(", ")}`, table, io);
+  let forge;
+  try {
+    forge = forgeTargetOptionsFromFlags({ forge: forgeFlag.value }).kind;
+  } catch (e) {
+    if (e instanceof ForgeFlagError) return usage(e.message, table, io);
+    throw e;
+  }
   if (respondFlag.value !== void 0 && !DRIFT_RESPONSES.includes(respondFlag.value)) return usage(`--respond takes one of ${DRIFT_RESPONSES.join(", ")}`, table, io);
   const path = findConfig(io.cwd);
   if (!path) return usage(`no plywood.yml in ${io.cwd} or above it; run '${PRODUCT} init' first`, table, io);
@@ -3650,7 +3623,6 @@ async function drift2(args, json, table, io) {
   if (strangers.length) return usage(`${strangers.join(", ")} ${strangers.length === 1 ? "is" : "are"} not under stacks in ${path}`, table, io);
   if (resource.value !== void 0 && stacks2.length !== 1) return usage("--resource reads one resource of one stack; name the stack", table, io);
   const respond = respondFlag.value ?? driftResponseOf(doc);
-  const forge = forgeFlag.value;
   return withChant(`${PRODUCT} drift`, table, io, async (chant) => {
     const dir = mkdtempSync(join7(tmpdir(), "plywood-drift-"));
     const results = [];
@@ -3703,7 +3675,7 @@ async function drift2(args, json, table, io) {
     const failed = results.some((r) => !r.ok) || upkeepFailed;
     const code = failed ? table.failed : upCode !== void 0 && upCode !== table.done ? upCode : drifted.length ? table.drift : table.done;
     if (json) {
-      io.out(JSON.stringify({ command: "drift", ok: code === table.done, exitCode: code, respond, stacks: results, ...notice ? { notify: notice } : {} }));
+      io.out(JSON.stringify({ command: "drift", ok: code === table.done, exitCode: code, respond, stacks: results.map(({ records: _, ...r }) => r), ...notice ? { notify: notice } : {} }));
     } else {
       if (notice) io.err(`${PRODUCT} drift: ${notice.sent ? `sent the drift event, fingerprint ${notice.fingerprint}` : notice.reason}`);
       for (const r of results) {
@@ -3725,7 +3697,6 @@ async function driftNotice(chant, doc, results, environment, io) {
   return sendDriftNotice({
     notify: notify2,
     results,
-    stackFingerprint: driftFingerprint,
     chant: { ...await chantDriftNotify(), words: chant.assertProductWords(PRODUCT_WORDS) },
     env: io.env,
     ...environment ? { environment } : {},
@@ -3759,20 +3730,21 @@ async function readStack(chant, stack, member, dir, opts) {
   try {
     if (existsSync7(file)) doc = JSON.parse(readFileSync8(file, "utf8"));
   } catch (e) {
-    return { stack, ok: false, drifted: 0, rows: [], error: `chant wrote a drift document plywood cannot read: ${e.message}` };
+    return { stack, ok: false, drifted: 0, rows: [], records: [], error: `chant wrote a drift document plywood cannot read: ${e.message}` };
   }
   if (code !== 0 || !doc || doc.error) {
-    return { stack, ok: false, drifted: 0, rows: [], error: doc?.error ? `${doc.error.code}: ${doc.error.message}` : `chant workspace drift exited ${code}` };
+    return { stack, ok: false, drifted: 0, rows: [], records: [], error: doc?.error ? `${doc.error.code}: ${doc.error.message}` : `chant workspace drift exited ${code}` };
   }
   const rows = driftRows(doc);
+  const records = (doc.records ?? []).map((r) => ({ ...r, member: r.member ?? member }));
   const unread = (doc.records ?? []).filter((r) => r.status === "not-observed");
   if (rows.length === 0 && unread.length > 0) {
     const first = unread[0];
     const why = first.unobserved?.detail ?? first.unobserved?.reason ?? "no reason given";
-    return { stack, ok: false, drifted: 0, rows: [], error: `${unread.length} resource${unread.length === 1 ? "" : "s"} could not be read, so the stack's drift is unknown: ${first.address}: ${why}` };
+    return { stack, ok: false, drifted: 0, rows: [], records: [], error: `${unread.length} resource${unread.length === 1 ? "" : "s"} could not be read, so the stack's drift is unknown: ${first.address}: ${why}` };
   }
   const attribution = rows.length && opts.attribute ? await attributeStack(opts.attribute, stack, doc) : void 0;
-  return { stack, ok: true, drifted: rows.length, rows, observedAt: observedAt(doc), ...attribution ? { attribution } : {} };
+  return { stack, ok: true, drifted: rows.length, rows, records, observedAt: observedAt(doc), ...attribution ? { attribution } : {} };
 }
 async function withBackend(backend, read) {
   if (backend === void 0) return read();
@@ -3813,13 +3785,13 @@ function specHasUpdate(cwd, op) {
     return false;
   }
 }
+function driftIssueNotes(attribution) {
+  return attribution?.length ? [DRIFT_ATTRIBUTION_HEADING, "", ...attribution] : void 0;
+}
 async function keepIssue(client, r, respond) {
-  const at = r.observedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-  const marker = driftIssueMarker(r.stack);
-  if (r.drifted === 0) return client.trackIssue(marker, null, { closeOnClear: true, clearComment: driftClearedComment(r.stack, at) });
-  const fingerprint = driftFingerprint(r.rows);
-  const body = driftIssueBody({ stack: r.stack, rows: r.rows, observedAt: at, fingerprint, ...client.runUrl ? { runUrl: client.runUrl } : {}, respond, ...r.attribution?.length ? { attribution: r.attribution } : {} });
-  return client.trackIssue(marker, { title: driftIssueTitle(r.stack), body }, { sameWhen: fingerprint });
+  const notes = driftIssueNotes(r.attribution);
+  const kept = await keepDriftIssue(client, { words: driftIssueWords(r.stack, respond), environment: r.stack, records: r.records, ...client.runUrl ? { runUrl: client.runUrl } : {}, ...notes ? { notes } : {} });
+  return { action: kept.action, ...kept.number !== void 0 ? { number: kept.number } : {}, ...kept.url ? { url: kept.url } : {} };
 }
 function driftOpFile(doc, stacks2, schedule) {
   const listed = stacksOf(doc);
@@ -3923,7 +3895,6 @@ var init_drift2 = __esm({
     init_stacks();
     init_detect();
     init_render();
-    init_routing();
     init_images();
     init_stages();
     init_up();
@@ -4533,14 +4504,12 @@ function chantReferenceReader() {
 }
 async function exportOf(reader, root, s) {
   const dir = join9(root, s.dir);
-  if (reader.memberExportOf) {
-    try {
-      const found = await reader.memberExportOf(dir, { stack: s.stack });
-      if (found !== void 0) return found;
-    } catch {
-    }
+  try {
+    const found = await reader.memberExportOf(dir, { stack: s.stack });
+    if (found !== void 0) return found;
+  } catch {
   }
-  return reader.readMemberExport?.(dir);
+  return reader.readMemberExport(dir);
 }
 async function stackOrder(root, stacks2, after = {}) {
   const edges = [];
@@ -5647,9 +5616,7 @@ __export(control_exports, {
   wavesControl: () => wavesControl
 });
 import { existsSync as existsSync11, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
-import { createRequire } from "node:module";
 import { dirname as dirname10, join as join14 } from "node:path";
-import { pathToFileURL } from "node:url";
 import { emitYAMLEntry as emitYAMLEntry3, parseYAML as parseYAML4 } from "@intentius/chant/yaml";
 async function wavesControl(cwd) {
   const file = findConfig(cwd);
@@ -5744,14 +5711,14 @@ async function control2(args, json, table, io) {
     return table.failed;
   }
 }
-async function forgeControlPipeline(cwd, forge) {
-  const name = `@intentius/chant-lexicon-${forge}/components/control-pipeline`;
-  try {
-    const require2 = createRequire(join14(cwd, "package.json"));
-    const m = await import(pathToFileURL(require2.resolve(name)).href);
-    return typeof m.generateControlPipeline === "function" ? m.generateControlPipeline : void 0;
-  } catch {
-    return void 0;
+async function forgeControlPipeline(forge) {
+  switch (forge) {
+    case "github":
+      return (await import("@intentius/chant-lexicon-github/components/control-pipeline")).generateControlPipeline;
+    case "gitlab":
+      return (await import("@intentius/chant-lexicon-gitlab/components/control-pipeline")).generateControlPipeline;
+    case "forgejo":
+      return (await import("@intentius/chant-lexicon-forgejo/components/control-pipeline")).generateControlPipeline;
   }
 }
 async function controlInit(chant, args, emit, table, io) {
@@ -5762,10 +5729,7 @@ async function controlInit(chant, args, emit, table, io) {
   const dryRun = forgeFlag.rest.includes("--dry-run");
   const forge = forgeFlag.value ?? "github";
   if (!FORGES.includes(forge)) return usage(`--forge ${forge} is not one of ${FORGES.join(", ")}`, table, io);
-  const generate = await forgeControlPipeline(io.cwd, forge);
-  if (!generate) {
-    return usage(`control init writes the control repo's workflow with @intentius/chant-lexicon-${forge}'s generateControlPipeline (chant#4568); install it in the control repo at the chant release that has it`, table, io);
-  }
+  const generate = await forgeControlPipeline(forge);
   const file = generate({ words: PRODUCT_WORDS });
   const path = join14(io.cwd, file.path);
   const before = existsSync11(path) ? readFileSync13(path, "utf8") : void 0;
@@ -6168,7 +6132,9 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     staleNotes: true,
     ...respond.options,
     ...applyMerge ? { applyMerge } : {},
-    ...actionJob ? { actionJob: true } : {}
+    ...actionJob ? { actionJob: true } : {},
+    // chant#4785: GitLab starts no pipeline on a note, so a scheduled note-commands job answers the comments.
+    ...forge === "gitlab" ? { noteCommands: true } : {}
   });
   const prWords = shape.applyBeforeMerge ? words : wordsForJobs(jobsWanted.filter((j) => j !== "apply"));
   const argv = [
@@ -6188,6 +6154,7 @@ function workflowPlan(chant, doc, forge, env, waves, extra = [], opts = {}) {
     "--preview-comment",
     "--stale-notes",
     ...actionJob ? ["--action-job"] : [],
+    ...forge === "gitlab" ? ["--note-commands"] : [],
     // Review stacks (plywood#15): chant's pr-env jobs.
     ...doc.review_stacks !== void 0 ? ["--pr-env"] : [],
     ...opts.prJobs?.flags ?? [],
@@ -6264,7 +6231,7 @@ var init_stages = __esm({
       forgejo: ".forgejo/workflows/plywood.yml",
       gitlab: ".gitlab-ci.yml"
     };
-    ACTIONS_NOT_ON_GITLAB = "plywood.yml declares actions, and a GitLab pipeline starts on no comment or dispatch with inputs, so it has no action job; run 'plywood action <stack> <name>' from a pipeline of your own";
+    ACTIONS_NOT_ON_GITLAB = "plywood.yml declares actions, and chant's GitLab pipeline has no action job: GitLab has no dispatch with inputs, and the note-commands job answers no /plywood action; run 'plywood action <stack> <name>' from a pipeline of your own";
     CHANT_RESPOND_DEFAULTS = Object.freeze({ "wave-refused": "diff", "apply-failed": "triage", description: "off" });
     DECIDE_LEFT_OFF = "decide is set and respond.description is not check, so plywood leaves the decide service off the pull request jobs";
   }
@@ -6272,32 +6239,7 @@ var init_stages = __esm({
 
 // src/bin.ts
 init_define_PLYWOOD_IMAGE_DIGESTS();
-
-// src/chant-resolve.ts
-init_define_PLYWOOD_IMAGE_DIGESTS();
-import * as nodeModule from "node:module";
-var CHANT_SPECIFIER = /^@intentius\/chant(?:-lexicon-[a-z0-9-]+)?(?:\/|$)/;
-function chantResolveHook(from) {
-  return (specifier, context, next) => {
-    try {
-      return next(specifier, context);
-    } catch (err) {
-      const code = err.code;
-      if (!CHANT_SPECIFIER.test(specifier) || code !== "ERR_MODULE_NOT_FOUND" && code !== "MODULE_NOT_FOUND") throw err;
-      if (context.parentURL === from) throw err;
-      return next(specifier, { ...context, parentURL: from });
-    }
-  };
-}
-var installed = false;
-function installChantResolution(from = import.meta.url) {
-  if (installed) return true;
-  const register = nodeModule.registerHooks;
-  if (typeof register !== "function") return false;
-  register({ resolve: chantResolveHook(from) });
-  installed = true;
-  return true;
-}
+import { installChantResolveFallback } from "@intentius/chant/chant-install";
 
 // src/cli.ts
 init_define_PLYWOOD_IMAGE_DIGESTS();
@@ -6349,7 +6291,7 @@ async function lockToCancel(given, stack, env) {
 }
 var cachedOps;
 function chantStackOps() {
-  cachedOps ??= import("@intentius/chant-lexicon-pulumi").then((m) => m);
+  cachedOps ??= import("@intentius/chant-lexicon-pulumi");
   return cachedOps;
 }
 function readConfig(cwd) {
@@ -6424,7 +6366,7 @@ function reportOutcome(verb, outcome, gate, rules, done, json, table, io) {
       text = done(outcome.result);
       break;
     case "failed":
-      code = table.failed;
+      code = outcome.check === "moved" ? table.moved : table.failed;
       text = `${PRODUCT} ${verb}: ${outcome.error}`;
       break;
   }
@@ -6439,7 +6381,7 @@ function reportOutcome(verb, outcome, gate, rules, done, json, table, io) {
       digest: outcome.digest,
       ...approveLine ? { approve: approveLine } : {},
       ...outcome.status === "done" ? { result: outcome.result } : {},
-      ...outcome.status === "failed" ? { error: outcome.error } : {},
+      ...outcome.status === "failed" ? { error: outcome.error, ...outcome.check ? { check: outcome.check } : {} } : {},
       ...outcome.status === "refused" ? { refusedBy: outcome.by, reason: outcome.reason } : {}
     }));
   } else (code === table.done ? io.out : io.err)(text);
@@ -6451,9 +6393,11 @@ async function runRequest(verb, json, table, io, call) {
     return await call(ops);
   } catch (e) {
     const message = e.message;
-    if (json) io.out(JSON.stringify({ command: verb, ok: false, exitCode: table.failed, error: message }));
+    const refusal = e instanceof ops.PulumiStackOpRefused ? e.code : void 0;
+    const code = refusal === "live-run" || refusal === "held" ? table.held : table.failed;
+    if (json) io.out(JSON.stringify({ command: verb, ok: false, exitCode: code, error: message, ...refusal ? { refusal } : {} }));
     else io.err(`${PRODUCT} ${verb}: ${message}`);
-    return table.failed;
+    return code;
   }
 }
 function commonFlags(args) {
@@ -6468,9 +6412,11 @@ async function exportStack(args, json, table, io) {
   if (common.missing) return usage(`${common.missing} takes a value`, table, io);
   const out = takeFlag(common.rest, "--out");
   if (out.missing) return usage("--out takes a file path outside the repository", table, io);
-  const extra = out.rest.filter((a) => a.startsWith("-"));
+  const version2 = takeFlag(out.rest, "--version");
+  if (version2.missing) return usage("--version takes the update number, or the sha256: digest of an export, that the stack holds now", table, io);
+  const extra = version2.rest.filter((a) => a.startsWith("-"));
   if (extra.length) return usage(`export does not take ${extra.join(" ")}`, table, io);
-  const named = positionals(out.rest);
+  const named = positionals(version2.rest);
   if (named.length !== 1) return usage(`export takes one stack: ${STACK_OP_WORDS.usage.export}`, table, io);
   if (!out.value) return usage(`export needs --out <file>, a path on your machine outside every git working tree: ${STACK_OP_WORDS.usage.export}`, table, io);
   const read = readConfig(io.cwd);
@@ -6490,11 +6436,19 @@ async function exportStack(args, json, table, io) {
       dir: stack.dir,
       stack: stack.stack,
       out: outFile,
+      ...version2.value ? { version: version2.value } : {},
       ...stack.engine ? { engine: stack.engine } : {}
     });
     return reportOutcome("export", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.exported(stack.key, r), json, table, io);
   });
 }
+function cancelForge(config2, root) {
+  const f = toChantSettings(config2).pipeline.forge;
+  const detected = f?.kind ? void 0 : detectForge(root);
+  const kind = f?.kind ?? detected?.kind;
+  const url = f?.url ?? detected?.url;
+  return { ...kind ? { kind } : {}, ...url ? { url } : {} };
+}
 async function cancelStack(args, json, table, io) {
   const common = commonFlags(args);
   if (common.missing) return usage(`${common.missing} takes a value`, table, io);
@@ -6524,7 +6478,8 @@ async function cancelStack(args, json, table, io) {
       stack: stack.stack,
       lockId: lockId.lockId,
       project: stack.project,
-      ...stack.engine ? { engine: stack.engine } : {}
+      ...stack.engine ? { engine: stack.engine } : {},
+      forge: cancelForge(read.config, dirname11(read.path))
     });
     return reportOutcome("cancel", outcome, stack.stack, rules, (r) => STACK_OP_WORDS.cancelled(stack.key, lockId.lockId, r.lockChecked), json, table, io);
   });
@@ -6596,11 +6551,11 @@ async function moveOntoPlunge(engine3, args, json, table, io) {
   });
 }
 async function rollbackStack(args, json, table, io) {
-  const release2 = takeFlag(args, "--release");
-  const env = takeFlag(release2.rest, "--env");
+  const release = takeFlag(args, "--release");
+  const env = takeFlag(release.rest, "--env");
   const digest = takeFlag(env.rest, "--digest");
   const actor = takeFlag(digest.rest, "--actor");
-  for (const [flag, f] of [["--release", release2], ["--env", env], ["--digest", digest], ["--actor", actor]]) {
+  for (const [flag, f] of [["--release", release], ["--env", env], ["--digest", digest], ["--actor", actor]]) {
     if (f.missing) return usage(`${flag} takes a value`, table, io);
   }
   const switches = actor.rest.filter((a) => a === "--dry-run" || a === "--events-json");
@@ -6610,11 +6565,11 @@ async function rollbackStack(args, json, table, io) {
   const named = positionals(rest);
   if (named.length > 1) return usage(`rollback takes one stack: ${STACK_OP_WORDS.usage.rollback}`, table, io);
   let argv;
-  if (release2.value !== void 0) {
+  if (release.value !== void 0) {
     if (named.length) return usage(STACK_OP_WORDS.releaseIsEnvWide(named[0], environmentOf(named[0])), table, io);
     if (digest.value !== void 0) return usage("--release takes no --digest: the release names what each stack goes back to", table, io);
     if (!env.value) return usage(`rollback --release needs --env <env>, the environment whose stacks go back: ${STACK_OP_WORDS.usage.rollback}`, table, io);
-    argv = ["components", "rollback", env.value, "--release", release2.value];
+    argv = ["components", "rollback", env.value, "--release", release.value];
   } else {
     if (named.length !== 1) return usage(`rollback takes a stack, or --release <name> --env <env>: ${STACK_OP_WORDS.usage.rollback}`, table, io);
     const read = readConfig(io.cwd);
@@ -7259,11 +7214,11 @@ async function upgrade(args, json, table, io) {
   const configFile = findConfig(io.cwd);
   const configDir = configFile ? dirname14(configFile) : pkgDir;
   const rel = (f) => relative2(io.cwd, f) || f;
-  const release2 = await viewRelease(exec, pkgDir, io.env, opts.version);
-  if ("error" in release2) return fail(release2.error);
-  const chant = opts.chant ?? release2.chant;
+  const release = await viewRelease(exec, pkgDir, io.env, opts.version);
+  if ("error" in release) return fail(release.error);
+  const chant = opts.chant ?? release.chant;
   const pkgText = readFileSync16(pkgFile, "utf8");
-  const pkgMove = movePackagePins(pkgText, rel(pkgFile), release2.version, chant);
+  const pkgMove = movePackagePins(pkgText, rel(pkgFile), release.version, chant);
   const declFile = join19(configDir, "chant.workspace.json");
   const declText = existsSync15(declFile) ? readFileSync16(declFile, "utf8") : void 0;
   let declMove;
@@ -7278,7 +7233,7 @@ async function upgrade(args, json, table, io) {
   if (existsSync15(join19(configDir, "chant.workspace.jsonc"))) notes.push(`chant.workspace.jsonc is yours: move its @intentius/chant* pins to ${chant} by hand`);
   if (configFile) {
     try {
-      const note = imageNote(loadConfig(configFile).doc, release2.version);
+      const note = imageNote(loadConfig(configFile).doc, release.version);
       if (note) notes.push(note);
     } catch {
     }
@@ -7291,11 +7246,11 @@ async function upgrade(args, json, table, io) {
     install: { cwd: rel(pkgDir) || ".", command: "npm install --no-audit --no-fund" },
     ci: { cwd: rel(configDir) || ".", command: `npx ${ciArgs.join(" ")}` }
   };
-  const envelope = { command: "upgrade", plywood: release2.version, chant, moves, notes, dryRun: opts.dryRun };
+  const envelope = { command: "upgrade", plywood: release.version, chant, moves, notes, dryRun: opts.dryRun };
   const say = (line) => {
     if (!json) io.err(line);
   };
-  say(`${PRODUCT} upgrade: ${PLYWOOD_PACKAGE} ${release2.version}, ${CHANT_PACKAGE} ${chant}`);
+  say(`${PRODUCT} upgrade: ${PLYWOOD_PACKAGE} ${release.version}, ${CHANT_PACKAGE} ${chant}`);
   for (const m of moves) say(`  ${m.file}  ${m.name}  ${m.from} -> ${m.to}`);
   if (moves.length === 0) say("  every pin is already there");
   if (opts.dryRun) {
@@ -7314,14 +7269,14 @@ async function upgrade(args, json, table, io) {
     return table.done;
   }
   say(`  $ ${steps.install.command}`);
-  const installed2 = await exec("npm", ["install", "--no-audit", "--no-fund"], { cwd: pkgDir, env: io.env });
-  if (installed2.code !== 0) {
+  const installed = await exec("npm", ["install", "--no-audit", "--no-fund"], { cwd: pkgDir, env: io.env });
+  if (installed.code !== 0) {
     for (const n of notes) say(`  note: ${n}`);
-    return fail(`npm install failed (exit ${installed2.code}); package.json is moved, so fix the install and run '${steps.ci.command}'
-${installed2.stderr.trim()}`);
+    return fail(`npm install failed (exit ${installed.code}); package.json is moved, so fix the install and run '${steps.ci.command}'
+${installed.stderr.trim()}`);
   }
   const got = installedVersion(pkgDir);
-  if (got !== void 0 && got !== release2.version) notes.push(`node_modules holds ${PLYWOOD_PACKAGE} ${got}, not ${release2.version}; check the install`);
+  if (got !== void 0 && got !== release.version) notes.push(`node_modules holds ${PLYWOOD_PACKAGE} ${got}, not ${release.version}; check the install`);
   let ci2;
   if (configFile) {
     say(`  $ ${steps.ci.command}`);
@@ -7363,7 +7318,7 @@ var execChild = (bin, args, opts) => new Promise((done) => {
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.3.5" : "0.0.0-dev";
+var VERSION3 = true ? "0.3.8" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")
@@ -7408,7 +7363,7 @@ function helpText() {
     "  override <stack> --rule <id>... --reason <text>     override a policy denial, spent once its update runs",
     "",
     "Stack operations (each waits for a second person's approval):",
-    "  export <stack> --out <file>                         the stack's export, to a file on your machine",
+    "  export <stack> --out <file> [--version <v>]         the stack's export, or one version of it, to a file on your machine",
     "  cancel <stack> [--lock <id>]                        release a stuck stack lock; on file:// it reads the id",
     "  move <urn>... --from <stack> --to <stack>           move resources; both stacks preview no change",
     "  move <stack> --onto plunge                          adopt the stacks onto plunge (plywood.adopt.op.ts)",
@@ -7560,6 +7515,6 @@ function config(args, table, emit) {
 }
 
 // src/bin.ts
-installChantResolution();
+installChantResolveFallback(import.meta.url);
 process.exitCode = await main(process.argv.slice(2));
 //# sourceMappingURL=plywood.mjs.map