@pulumi/pulumiservice 0.38.0 → 0.39.0

package/buildEnvironmentScopedPermissions.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` / `PermissionLiteralExpressionEnvironment` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the `on:` modifier yourself. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 export declare function buildEnvironmentScopedPermissions(args: BuildEnvironmentScopedPermissionsArgs, opts?: pulumi.InvokeOptions): Promise<BuildEnvironmentScopedPermissionsResult>;
 export interface BuildEnvironmentScopedPermissionsArgs {
@@ -15,18 +15,14 @@ export interface BuildEnvironmentScopedPermissionsArgs {
 }
 export interface BuildEnvironmentScopedPermissionsResult {
     /**
-     * A `PermissionDescriptor` tree ready to assign to `OrganizationRole.permissions`.
+     * A `kind: allow` descriptor with an `on: { environment: <uuid> }` modifier, ready to assign to `OrganizationRole.permissions`.
      */
     readonly permissions: {
         [key: string]: any;
     };
-    /**
-     * A JSON-encoded copy of `permissions`. Pulumi's Python SDK strips `__`-prefixed keys from invoke responses (see `pulumi/sdk` Python `runtime/rpc.py:deserialize_property`), so the structured `permissions` Mapping arrives at downstream resources missing every `__type` discriminator and Pulumi Cloud rejects it. Python users should consume `permissionsJson` and `.apply(json.loads)` it instead — that re-creates the dict on the input path (`serialize_property`), which preserves `__` keys. TypeScript/Yaml/Go/.NET/Java callers can use either field; `permissions` is the more ergonomic default.
-     */
-    readonly permissionsJson: string;
 }
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` / `PermissionLiteralExpressionEnvironment` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the `on:` modifier yourself. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 export declare function buildEnvironmentScopedPermissionsOutput(args: BuildEnvironmentScopedPermissionsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<BuildEnvironmentScopedPermissionsResult>;
 export interface BuildEnvironmentScopedPermissionsOutputArgs {

package/buildEnvironmentScopedPermissions.js

@@ -6,7 +6,7 @@ exports.buildEnvironmentScopedPermissionsOutput = exports.buildEnvironmentScoped
 const pulumi = require("@pulumi/pulumi");
 const utilities = require("./utilities");
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` / `PermissionLiteralExpressionEnvironment` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the `on:` modifier yourself. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 function buildEnvironmentScopedPermissions(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
@@ -17,7 +17,7 @@ function buildEnvironmentScopedPermissions(args, opts) {
 }
 exports.buildEnvironmentScopedPermissions = buildEnvironmentScopedPermissions;
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` / `PermissionLiteralExpressionEnvironment` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the `on:` modifier yourself. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 function buildEnvironmentScopedPermissionsOutput(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});

package/buildEnvironmentScopedPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildEnvironmentScopedPermissions.js","sourceRoot":"","sources":["../buildEnvironmentScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,SAAgB,iCAAiC,CAAC,IAA2C,EAAE,IAA2B;IACtH,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,uDAAuD,EAAE;QAClF,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,8EAMC;AAuBD;;GAEG;AACH,SAAgB,uCAAuC,CAAC,IAAiD,EAAE,IAAiC;IACxI,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,uDAAuD,EAAE;QACxF,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,0FAMC"}
+{"version":3,"file":"buildEnvironmentScopedPermissions.js","sourceRoot":"","sources":["../buildEnvironmentScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,SAAgB,iCAAiC,CAAC,IAA2C,EAAE,IAA2B;IACtH,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,uDAAuD,EAAE;QAClF,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,8EAMC;AAmBD;;GAEG;AACH,SAAgB,uCAAuC,CAAC,IAAiD,EAAE,IAAiC;IACxI,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,uDAAuD,EAAE;QACxF,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,0FAMC"}

package/buildInsightsAccountScopedPermissions.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source) to avoid hand-rolling the underlying `PermissionLiteralExpressionInsightsAccount` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source). The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 export declare function buildInsightsAccountScopedPermissions(args: BuildInsightsAccountScopedPermissionsArgs, opts?: pulumi.InvokeOptions): Promise<BuildInsightsAccountScopedPermissionsResult>;
 export interface BuildInsightsAccountScopedPermissionsArgs {
@@ -15,18 +15,14 @@ export interface BuildInsightsAccountScopedPermissionsArgs {
 }
 export interface BuildInsightsAccountScopedPermissionsResult {
     /**
-     * A `PermissionDescriptor` tree ready to assign to `OrganizationRole.permissions`.
+     * A `kind: allow` descriptor with an `on: { insightsAccount: <id> }` modifier, ready to assign to `OrganizationRole.permissions`.
      */
     readonly permissions: {
         [key: string]: any;
     };
-    /**
-     * A JSON-encoded copy of `permissions`. Pulumi's Python SDK strips `__`-prefixed keys from invoke responses (see `pulumi/sdk` Python `runtime/rpc.py:deserialize_property`), so the structured `permissions` Mapping arrives at downstream resources missing every `__type` discriminator and Pulumi Cloud rejects it. Python users should consume `permissionsJson` and `.apply(json.loads)` it instead — that re-creates the dict on the input path (`serialize_property`), which preserves `__` keys. TypeScript/Yaml/Go/.NET/Java callers can use either field; `permissions` is the more ergonomic default.
-     */
-    readonly permissionsJson: string;
 }
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source) to avoid hand-rolling the underlying `PermissionLiteralExpressionInsightsAccount` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source). The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 export declare function buildInsightsAccountScopedPermissionsOutput(args: BuildInsightsAccountScopedPermissionsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<BuildInsightsAccountScopedPermissionsResult>;
 export interface BuildInsightsAccountScopedPermissionsOutputArgs {

package/buildInsightsAccountScopedPermissions.js

@@ -6,7 +6,7 @@ exports.buildInsightsAccountScopedPermissionsOutput = exports.buildInsightsAccou
 const pulumi = require("@pulumi/pulumi");
 const utilities = require("./utilities");
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source) to avoid hand-rolling the underlying `PermissionLiteralExpressionInsightsAccount` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source). The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 function buildInsightsAccountScopedPermissions(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
@@ -17,7 +17,7 @@ function buildInsightsAccountScopedPermissions(args, opts) {
 }
 exports.buildInsightsAccountScopedPermissions = buildInsightsAccountScopedPermissions;
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source) to avoid hand-rolling the underlying `PermissionLiteralExpressionInsightsAccount` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source). The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 function buildInsightsAccountScopedPermissionsOutput(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});

package/buildInsightsAccountScopedPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildInsightsAccountScopedPermissions.js","sourceRoot":"","sources":["../buildInsightsAccountScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,SAAgB,qCAAqC,CAAC,IAA+C,EAAE,IAA2B;IAC9H,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,2DAA2D,EAAE;QACtF,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,sFAMC;AAuBD;;GAEG;AACH,SAAgB,2CAA2C,CAAC,IAAqD,EAAE,IAAiC;IAChJ,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,2DAA2D,EAAE;QAC5F,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,kGAMC"}
+{"version":3,"file":"buildInsightsAccountScopedPermissions.js","sourceRoot":"","sources":["../buildInsightsAccountScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,SAAgB,qCAAqC,CAAC,IAA+C,EAAE,IAA2B;IAC9H,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,2DAA2D,EAAE;QACtF,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,sFAMC;AAmBD;;GAEG;AACH,SAAgB,2CAA2C,CAAC,IAAqD,EAAE,IAAiC;IAChJ,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,2DAA2D,EAAE;QAC5F,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,kGAMC"}

package/buildStackScopedPermissions.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple — and is what `PermissionLiteralExpressionStack` expects. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 export declare function buildStackScopedPermissions(args: BuildStackScopedPermissionsArgs, opts?: pulumi.InvokeOptions): Promise<BuildStackScopedPermissionsResult>;
 export interface BuildStackScopedPermissionsArgs {
@@ -15,18 +15,14 @@ export interface BuildStackScopedPermissionsArgs {
 }
 export interface BuildStackScopedPermissionsResult {
     /**
-     * A `PermissionDescriptor` tree ready to assign to `OrganizationRole.permissions`.
+     * A `kind: allow` descriptor with an `on: { stack: <id> }` modifier, ready to assign to `OrganizationRole.permissions`.
      */
     readonly permissions: {
         [key: string]: any;
     };
-    /**
-     * A JSON-encoded copy of `permissions`. Pulumi's Python SDK strips `__`-prefixed keys from invoke responses (see `pulumi/sdk` Python `runtime/rpc.py:deserialize_property`), so the structured `permissions` Mapping arrives at downstream resources missing every `__type` discriminator and Pulumi Cloud rejects it. Python users should consume `permissionsJson` and `.apply(json.loads)` it instead — that re-creates the dict on the input path (`serialize_property`), which preserves `__` keys. TypeScript/Yaml/Go/.NET/Java callers can use either field; `permissions` is the more ergonomic default.
-     */
-    readonly permissionsJson: string;
 }
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple — and is what `PermissionLiteralExpressionStack` expects. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 export declare function buildStackScopedPermissionsOutput(args: BuildStackScopedPermissionsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<BuildStackScopedPermissionsResult>;
 export interface BuildStackScopedPermissionsOutputArgs {

package/buildStackScopedPermissions.js

@@ -6,7 +6,7 @@ exports.buildStackScopedPermissionsOutput = exports.buildStackScopedPermissions
 const pulumi = require("@pulumi/pulumi");
 const utilities = require("./utilities");
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple — and is what `PermissionLiteralExpressionStack` expects. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 function buildStackScopedPermissions(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
@@ -17,7 +17,7 @@ function buildStackScopedPermissions(args, opts) {
 }
 exports.buildStackScopedPermissions = buildStackScopedPermissions;
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple — and is what `PermissionLiteralExpressionStack` expects. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `group` whose `entries` list pulls the output of each helper.
  */
 function buildStackScopedPermissionsOutput(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});

package/buildStackScopedPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildStackScopedPermissions.js","sourceRoot":"","sources":["../buildStackScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,SAAgB,2BAA2B,CAAC,IAAqC,EAAE,IAA2B;IAC1G,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iDAAiD,EAAE;QAC5E,aAAa,EAAE,IAAI,CAAC,WAAW;QAC/B,SAAS,EAAE,IAAI,CAAC,OAAO;KAC1B,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,kEAMC;AAuBD;;GAEG;AACH,SAAgB,iCAAiC,CAAC,IAA2C,EAAE,IAAiC;IAC5H,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,iDAAiD,EAAE;QAClF,aAAa,EAAE,IAAI,CAAC,WAAW;QAC/B,SAAS,EAAE,IAAI,CAAC,OAAO;KAC1B,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,8EAMC"}
+{"version":3,"file":"buildStackScopedPermissions.js","sourceRoot":"","sources":["../buildStackScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,SAAgB,2BAA2B,CAAC,IAAqC,EAAE,IAA2B;IAC1G,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,iDAAiD,EAAE;QAC5E,aAAa,EAAE,IAAI,CAAC,WAAW;QAC/B,SAAS,EAAE,IAAI,CAAC,OAAO;KAC1B,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,kEAMC;AAmBD;;GAEG;AACH,SAAgB,iCAAiC,CAAC,IAA2C,EAAE,IAAiC;IAC5H,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,iDAAiD,EAAE;QAClF,aAAa,EAAE,IAAI,CAAC,WAAW;QAC/B,SAAS,EAAE,IAAI,CAAC,OAAO;KAC1B,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,8EAMC"}

package/environment.d.ts

@@ -18,7 +18,7 @@ export declare class Environment extends pulumi.CustomResource {
      */
     static isInstance(obj: any): obj is Environment;
     /**
-     * The environment's UUID. Use this as the `identity` value when pinning a custom RBAC role to this environment via a `PermissionLiteralExpressionEnvironment` expression in `OrganizationRole.permissions`.
+     * The environment's UUID. Use this as the `identity` value when pinning a custom RBAC role to this environment via a `literalEnvironment` expression in `OrganizationRole.permissions`.
      */
     readonly environmentId: pulumi.Output<string | undefined>;
     /**

package/getEnvironment.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Looks up an existing ESC environment by name and returns its UUID. Use this to pin a custom RBAC role to a specific environment via `PermissionLiteralExpressionEnvironment` when the environment is not managed by the current Pulumi program. Errors when the environment is not found.
+ * Looks up an existing ESC environment by name and returns its UUID. Use this to pin a custom RBAC role to a specific environment via a `literalEnvironment` expression when the environment is not managed by the current Pulumi program. Errors when the environment is not found.
  */
 export declare function getEnvironment(args: GetEnvironmentArgs, opts?: pulumi.InvokeOptions): Promise<GetEnvironmentResult>;
 export interface GetEnvironmentArgs {
@@ -19,7 +19,7 @@ export interface GetEnvironmentArgs {
 }
 export interface GetEnvironmentResult {
     /**
-     * The environment's UUID. Use this as the `identity` value when pinning a custom RBAC role to this environment via a `PermissionLiteralExpressionEnvironment` expression.
+     * The environment's UUID. Use this as the `identity` value when pinning a custom RBAC role to this environment via a `literalEnvironment` expression.
      */
     readonly environmentId: string;
     /**
@@ -36,7 +36,7 @@ export interface GetEnvironmentResult {
     readonly projectName: string;
 }
 /**
- * Looks up an existing ESC environment by name and returns its UUID. Use this to pin a custom RBAC role to a specific environment via `PermissionLiteralExpressionEnvironment` when the environment is not managed by the current Pulumi program. Errors when the environment is not found.
+ * Looks up an existing ESC environment by name and returns its UUID. Use this to pin a custom RBAC role to a specific environment via a `literalEnvironment` expression when the environment is not managed by the current Pulumi program. Errors when the environment is not found.
  */
 export declare function getEnvironmentOutput(args: GetEnvironmentOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<GetEnvironmentResult>;
 export interface GetEnvironmentOutputArgs {

package/getEnvironment.js

@@ -6,7 +6,7 @@ exports.getEnvironmentOutput = exports.getEnvironment = void 0;
 const pulumi = require("@pulumi/pulumi");
 const utilities = require("./utilities");
 /**
- * Looks up an existing ESC environment by name and returns its UUID. Use this to pin a custom RBAC role to a specific environment via `PermissionLiteralExpressionEnvironment` when the environment is not managed by the current Pulumi program. Errors when the environment is not found.
+ * Looks up an existing ESC environment by name and returns its UUID. Use this to pin a custom RBAC role to a specific environment via a `literalEnvironment` expression when the environment is not managed by the current Pulumi program. Errors when the environment is not found.
  */
 function getEnvironment(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
@@ -18,7 +18,7 @@ function getEnvironment(args, opts) {
 }
 exports.getEnvironment = getEnvironment;
 /**
- * Looks up an existing ESC environment by name and returns its UUID. Use this to pin a custom RBAC role to a specific environment via `PermissionLiteralExpressionEnvironment` when the environment is not managed by the current Pulumi program. Errors when the environment is not found.
+ * Looks up an existing ESC environment by name and returns its UUID. Use this to pin a custom RBAC role to a specific environment via a `literalEnvironment` expression when the environment is not managed by the current Pulumi program. Errors when the environment is not found.
  */
 function getEnvironmentOutput(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});

package/organizationRole.d.ts

@@ -32,7 +32,7 @@ export declare class OrganizationRole extends pulumi.CustomResource {
      */
     readonly organizationName: pulumi.Output<string>;
     /**
-     * The role's permission descriptor tree — passed to the service verbatim. This is the `details` field of a Pulumi Cloud PermissionDescriptor: an object with a `__type` discriminator (e.g. `PermissionDescriptorAllow`, `PermissionDescriptorCompose`) describing which scopes are granted. For per-entity scoping, prefer the `buildEnvironmentScopedPermissions`, `buildStackScopedPermissions`, and `buildInsightsAccountScopedPermissions` helpers, which build the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` tree for you.
+     * The role's permission descriptor tree. Two kinds: `{kind: "allow", permissions: ["<scope>", ...]}` to grant scopes, or `{kind: "group", entries: [...]}` to compose multiple grants. Either may carry an optional `on:` modifier — a single-key map `{environment: <uuid>}` / `{stack: <id>}` / `{insightsAccount: <id>}` — to scope the descriptor to one entity. For per-entity scoping, prefer the `buildEnvironmentScopedPermissions`, `buildStackScopedPermissions`, and `buildInsightsAccountScopedPermissions` helpers, which build the `on:`-modified Allow for you.
      */
     readonly permissions: pulumi.Output<{
         [key: string]: any;
@@ -75,7 +75,7 @@ export interface OrganizationRoleArgs {
      */
     organizationName: pulumi.Input<string>;
     /**
-     * The role's permission descriptor tree — passed to the service verbatim. This is the `details` field of a Pulumi Cloud PermissionDescriptor: an object with a `__type` discriminator (e.g. `PermissionDescriptorAllow`, `PermissionDescriptorCompose`) describing which scopes are granted. For per-entity scoping, prefer the `buildEnvironmentScopedPermissions`, `buildStackScopedPermissions`, and `buildInsightsAccountScopedPermissions` helpers, which build the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` tree for you.
+     * The role's permission descriptor tree. Two kinds: `{kind: "allow", permissions: ["<scope>", ...]}` to grant scopes, or `{kind: "group", entries: [...]}` to compose multiple grants. Either may carry an optional `on:` modifier — a single-key map `{environment: <uuid>}` / `{stack: <id>}` / `{insightsAccount: <id>}` — to scope the descriptor to one entity. For per-entity scoping, prefer the `buildEnvironmentScopedPermissions`, `buildStackScopedPermissions`, and `buildInsightsAccountScopedPermissions` helpers, which build the `on:`-modified Allow for you.
      */
     permissions: pulumi.Input<{
         [key: string]: any;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@pulumi/pulumiservice",
-    "version": "0.38.0",
+    "version": "0.39.0",
     "keywords": [
         "pulumi",
         "kind/native",
@@ -22,6 +22,6 @@
     "pulumi": {
         "resource": true,
         "name": "pulumiservice",
-        "version": "0.38.0"
+        "version": "0.39.0"
     }
 }