@pulumi/pulumiservice 0.38.0 → 0.40.0

package/accessToken.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Access tokens allow a user to authenticate against the Pulumi Cloud
+ * Access tokens allow a user to authenticate against the Pulumi Cloud.
  */
 export declare class AccessToken extends pulumi.CustomResource {
     /**
@@ -43,3 +43,4 @@ export interface AccessTokenArgs {
      */
     description: pulumi.Input<string>;
 }
+//# sourceMappingURL=accessToken.d.ts.map

package/accessToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessToken.d.ts","sourceRoot":"","sources":["../accessToken.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC;;GAEG;AACH,qBAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;OAOG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,WAAW;IAO9G;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,WAAW;IAOtD;;OAEG;IACH,SAAwB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3D;;OAEG;IACH,SAAgC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CAoBvF;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC5B;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CACrC"}

package/accessToken.js

@@ -1,12 +1,35 @@
 "use strict";
 // *** WARNING: this file was generated by pulumi-language-nodejs. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AccessToken = void 0;
-const pulumi = require("@pulumi/pulumi");
-const utilities = require("./utilities");
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("./utilities"));
 /**
- * Access tokens allow a user to authenticate against the Pulumi Cloud
+ * Access tokens allow a user to authenticate against the Pulumi Cloud.
  */
 class AccessToken extends pulumi.CustomResource {
     /**
@@ -20,6 +43,8 @@ class AccessToken extends pulumi.CustomResource {
     static get(name, id, opts) {
         return new AccessToken(name, undefined, { ...opts, id: id });
     }
+    /** @internal */
+    static __pulumiType = 'pulumiservice:index:AccessToken';
     /**
      * Returns true if the given object is an instance of AccessToken.  This is designed to work even
      * when multiple copies of the Pulumi SDK have been loaded into the same process.
@@ -54,10 +79,10 @@ class AccessToken extends pulumi.CustomResource {
         opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
         const secretOpts = { additionalSecretOutputs: ["value"] };
         opts = pulumi.mergeOptions(opts, secretOpts);
+        const replaceOnChanges = { replaceOnChanges: ["description"] };
+        opts = pulumi.mergeOptions(opts, replaceOnChanges);
         super(AccessToken.__pulumiType, name, resourceInputs, opts);
     }
 }
 exports.AccessToken = AccessToken;
-/** @internal */
-AccessToken.__pulumiType = 'pulumiservice:index:AccessToken';
 //# sourceMappingURL=accessToken.js.map

package/accessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessToken.js","sourceRoot":"","sources":["../accessToken.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,MAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;OAOG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,IAAmC;QAC5F,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,SAAgB,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,YAAY,CAAC;IAC5D,CAAC;IAWD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAqB,EAAE,IAAmC;QAChF,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC9D;YACD,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC/C;aAAM;YACH,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC/C;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;;AA5DL,kCA6DC;AAhDG,gBAAgB;AACO,wBAAY,GAAG,iCAAiC,CAAC"}
+{"version":3,"file":"accessToken.js","sourceRoot":"","sources":["../accessToken.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AACzC,uDAAyC;AAEzC;;GAEG;AACH,MAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;OAOG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,IAAmC;QAC5F,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,SAAgB,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,gBAAgB;IACT,MAAM,CAAU,YAAY,GAAG,iCAAiC,CAAC;IAExE;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,YAAY,CAAC;IAC5D,CAAC;IAWD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAqB,EAAE,IAAmC;QAChF,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;aAC9D;YACD,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC/C;aAAM;YACH,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC/C;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,EAAE,gBAAgB,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACnD,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;;AA9DL,kCA+DC"}

package/agentPool.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Agent Pool for customer managed deployments
+ * Agent Pool for customer managed deployments.
  */
 export declare class AgentPool extends pulumi.CustomResource {
     /**
@@ -30,7 +30,7 @@ export declare class AgentPool extends pulumi.CustomResource {
      */
     readonly forceDestroy: pulumi.Output<boolean | undefined>;
     /**
-     * The name of the agent pool.
+     * Name of the agent pool.
      */
     readonly name: pulumi.Output<string>;
     /**
@@ -57,11 +57,11 @@ export interface AgentPoolArgs {
     /**
      * Description of the agent pool.
      */
-    description?: pulumi.Input<string>;
+    description?: pulumi.Input<string | undefined>;
     /**
      * Optional. Flag indicating whether to delete the agent pool even if stacks are configured to use it.
      */
-    forceDestroy?: pulumi.Input<boolean>;
+    forceDestroy?: pulumi.Input<boolean | undefined>;
     /**
      * Name of the agent pool.
      */
@@ -71,3 +71,4 @@ export interface AgentPoolArgs {
      */
     organizationName: pulumi.Input<string>;
 }
+//# sourceMappingURL=agentPool.d.ts.map

package/agentPool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentPool.d.ts","sourceRoot":"","sources":["../agentPool.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC;;GAEG;AACH,qBAAa,SAAU,SAAQ,MAAM,CAAC,cAAc;IAChD;;;;;;;OAOG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,SAAS;IAO5G;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,SAAS;IAOpD;;OAEG;IACH,SAAgC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnE;;OAEG;IACH,SAAwB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACvE;;OAEG;IACH,SAAwB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACzE;;OAEG;IACH,SAAwB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD;;OAEG;IACH,SAAwB,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChE;;OAEG;IACH,SAAgC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAElE;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CA+BrF;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC1B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACjD;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAC1C"}

package/agentPool.js

@@ -1,12 +1,35 @@
 "use strict";
 // *** WARNING: this file was generated by pulumi-language-nodejs. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgentPool = void 0;
-const pulumi = require("@pulumi/pulumi");
-const utilities = require("./utilities");
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("./utilities"));
 /**
- * Agent Pool for customer managed deployments
+ * Agent Pool for customer managed deployments.
  */
 class AgentPool extends pulumi.CustomResource {
     /**
@@ -20,6 +43,8 @@ class AgentPool extends pulumi.CustomResource {
     static get(name, id, opts) {
         return new AgentPool(name, undefined, { ...opts, id: id });
     }
+    /** @internal */
+    static __pulumiType = 'pulumiservice:index:AgentPool';
     /**
      * Returns true if the given object is an instance of AgentPool.  This is designed to work even
      * when multiple copies of the Pulumi SDK have been loaded into the same process.
@@ -65,10 +90,10 @@ class AgentPool extends pulumi.CustomResource {
         opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
         const secretOpts = { additionalSecretOutputs: ["tokenValue"] };
         opts = pulumi.mergeOptions(opts, secretOpts);
+        const replaceOnChanges = { replaceOnChanges: ["organizationName"] };
+        opts = pulumi.mergeOptions(opts, replaceOnChanges);
         super(AgentPool.__pulumiType, name, resourceInputs, opts);
     }
 }
 exports.AgentPool = AgentPool;
-/** @internal */
-AgentPool.__pulumiType = 'pulumiservice:index:AgentPool';
 //# sourceMappingURL=agentPool.js.map

package/agentPool.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentPool.js","sourceRoot":"","sources":["../agentPool.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,MAAa,SAAU,SAAQ,MAAM,CAAC,cAAc;IAChD;;;;;;;OAOG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,IAAmC;QAC5F,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,SAAgB,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,SAAS,CAAC,YAAY,CAAC;IAC1D,CAAC;IA2BD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAmB,EAAE,IAAmC;QAC9E,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;aACvD;YACD,IAAI,IAAI,EAAE,gBAAgB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;aACnE;YACD,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,kBAAkB,CAAC,GAAG,IAAI,EAAE,gBAAgB,CAAC;YAC5D,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACpD;aAAM;YACH,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC3C,cAAc,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACvD,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACpD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;;AAvFL,8BAwFC;AA3EG,gBAAgB;AACO,sBAAY,GAAG,+BAA+B,CAAC"}
+{"version":3,"file":"agentPool.js","sourceRoot":"","sources":["../agentPool.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AACzC,uDAAyC;AAEzC;;GAEG;AACH,MAAa,SAAU,SAAQ,MAAM,CAAC,cAAc;IAChD;;;;;;;OAOG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,IAAmC;QAC5F,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,SAAgB,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,gBAAgB;IACT,MAAM,CAAU,YAAY,GAAG,+BAA+B,CAAC;IAEtE;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,SAAS,CAAC,YAAY,CAAC;IAC1D,CAAC;IA2BD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAmB,EAAE,IAAmC;QAC9E,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;aACvD;YACD,IAAI,IAAI,EAAE,gBAAgB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACnD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;aACnE;YACD,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC;YAClD,cAAc,CAAC,cAAc,CAAC,GAAG,IAAI,EAAE,YAAY,CAAC;YACpD,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,kBAAkB,CAAC,GAAG,IAAI,EAAE,gBAAgB,CAAC;YAC5D,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACpD;aAAM;YACH,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAClD,cAAc,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACnD,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC3C,cAAc,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACvD,cAAc,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SACpD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,gBAAgB,GAAG,EAAE,gBAAgB,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpE,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACnD,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;;AAzFL,8BA0FC"}

package/approvalRule.d.ts

@@ -74,3 +74,4 @@ export interface ApprovalRuleArgs {
      */
     targetActionTypes: pulumi.Input<pulumi.Input<enums.TargetActionType>[]>;
 }
+//# sourceMappingURL=approvalRule.d.ts.map

package/approvalRule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvalRule.d.ts","sourceRoot":"","sources":["../approvalRule.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,eAAe,CAAC;AAGvC;;GAEG;AACH,qBAAa,YAAa,SAAQ,MAAM,CAAC,cAAc;IACnD;;;;;;;OAOG;WACW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB,GAAG,YAAY;IAO/G;;;OAGG;WACW,UAAU,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,YAAY;IAOvD;;OAEG;IACH,SAAwB,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtF;;OAEG;IACH,SAAwB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD;;OAEG;IACH,SAAwB,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5F;;OAEG;IACH,SAAwB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpD;;OAEG;IACH,SAAwB,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEnF;;;;;;OAMG;gBACS,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,qBAAqB;CAkCxF;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAChE;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B;;OAEG;IACH,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACtE;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;CAC3E"}

package/approvalRule.js

@@ -1,10 +1,33 @@
 "use strict";
 // *** WARNING: this file was generated by pulumi-language-nodejs. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApprovalRule = void 0;
-const pulumi = require("@pulumi/pulumi");
-const utilities = require("./utilities");
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("./utilities"));
 /**
  * An approval rule for environment deployments.
  */
@@ -20,6 +43,8 @@ class ApprovalRule extends pulumi.CustomResource {
     static get(name, id, opts) {
         return new ApprovalRule(name, undefined, { ...opts, id: id });
     }
+    /** @internal */
+    static __pulumiType = 'pulumiservice:index:ApprovalRule';
     /**
      * Returns true if the given object is an instance of ApprovalRule.  This is designed to work even
      * when multiple copies of the Pulumi SDK have been loaded into the same process.
@@ -74,6 +99,4 @@ class ApprovalRule extends pulumi.CustomResource {
     }
 }
 exports.ApprovalRule = ApprovalRule;
-/** @internal */
-ApprovalRule.__pulumiType = 'pulumiservice:index:ApprovalRule';
 //# sourceMappingURL=approvalRule.js.map

package/approvalRule.js.map

@@ -1 +1 @@
-{"version":3,"file":"approvalRule.js","sourceRoot":"","sources":["../approvalRule.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AAIzC,yCAAyC;AAEzC;;GAEG;AACH,MAAa,YAAa,SAAQ,MAAM,CAAC,cAAc;IACnD;;;;;;;OAOG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,IAAmC;QAC5F,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,SAAgB,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,YAAY,CAAC,YAAY,CAAC;IAC7D,CAAC;IAuBD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAsB,EAAE,IAAmC;QACjF,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,kBAAkB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;aACrE;YACD,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;aAC1D;YACD,IAAI,IAAI,EAAE,qBAAqB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACxE;YACD,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;aACvD;YACD,IAAI,IAAI,EAAE,iBAAiB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;aACpE;YACD,cAAc,CAAC,oBAAoB,CAAC,GAAG,IAAI,EAAE,kBAAkB,CAAC;YAChE,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,uBAAuB,CAAC,GAAG,IAAI,EAAE,qBAAqB,CAAC;YACtE,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,mBAAmB,CAAC,GAAG,IAAI,EAAE,iBAAiB,CAAC;SACjE;aAAM;YACH,cAAc,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACzD,cAAc,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC9C,cAAc,CAAC,uBAAuB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5D,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC3C,cAAc,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC3D;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;;AAxFL,oCAyFC;AA5EG,gBAAgB;AACO,yBAAY,GAAG,kCAAkC,CAAC"}
+{"version":3,"file":"approvalRule.js","sourceRoot":"","sources":["../approvalRule.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AAIzC,uDAAyC;AAEzC;;GAEG;AACH,MAAa,YAAa,SAAQ,MAAM,CAAC,cAAc;IACnD;;;;;;;OAOG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,IAAmC;QAC5F,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,SAAgB,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,gBAAgB;IACT,MAAM,CAAU,YAAY,GAAG,kCAAkC,CAAC;IAEzE;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,YAAY,CAAC,YAAY,CAAC;IAC7D,CAAC;IAuBD;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,IAAsB,EAAE,IAAmC;QACjF,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;YACV,IAAI,IAAI,EAAE,kBAAkB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;aACrE;YACD,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1C,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;aAC1D;YACD,IAAI,IAAI,EAAE,qBAAqB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;aACxE;YACD,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACvC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;aACvD;YACD,IAAI,IAAI,EAAE,iBAAiB,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;aACpE;YACD,cAAc,CAAC,oBAAoB,CAAC,GAAG,IAAI,EAAE,kBAAkB,CAAC;YAChE,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC;YAC1C,cAAc,CAAC,uBAAuB,CAAC,GAAG,IAAI,EAAE,qBAAqB,CAAC;YACtE,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC;YACpC,cAAc,CAAC,mBAAmB,CAAC,GAAG,IAAI,EAAE,iBAAiB,CAAC;SACjE;aAAM;YACH,cAAc,CAAC,oBAAoB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YACzD,cAAc,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC9C,cAAc,CAAC,uBAAuB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC5D,cAAc,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;YAC3C,cAAc,CAAC,mBAAmB,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAC3D;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;;AAxFL,oCAyFC"}

package/buildAllowPermissions.d.ts

@@ -0,0 +1,30 @@
+import * as pulumi from "@pulumi/pulumi";
+/**
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes globally — i.e. on every entity of the matching resource type. This is the simplest descriptor: a flat `PermissionDescriptorAllow`. Use this helper instead of hand-authoring the descriptor literal so the wire-format `__type` discriminator stays an implementation detail. For grants scoped to a specific entity, see `buildEnvironmentScopedPermissions`, `buildStackScopedPermissions`, or `buildInsightsAccountScopedPermissions`. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
+ */
+export declare function buildAllowPermissions(args: BuildAllowPermissionsArgs, opts?: pulumi.InvokeOptions): Promise<BuildAllowPermissionsResult>;
+export interface BuildAllowPermissionsArgs {
+    /**
+     * The set of scopes to grant globally (e.g. `stack:read`, `environment:open`, `organization:billingManager`). Discover valid scope names via the `getOrganizationRoleScopes` data source.
+     */
+    permissions: string[];
+}
+export interface BuildAllowPermissionsResult {
+    /**
+     * A `PermissionDescriptorAllow` granting the supplied scopes on every entity of the matching resource type, ready to assign to `OrganizationRole.permissions`.
+     */
+    readonly permissions: {
+        [key: string]: any;
+    };
+}
+/**
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes globally — i.e. on every entity of the matching resource type. This is the simplest descriptor: a flat `PermissionDescriptorAllow`. Use this helper instead of hand-authoring the descriptor literal so the wire-format `__type` discriminator stays an implementation detail. For grants scoped to a specific entity, see `buildEnvironmentScopedPermissions`, `buildStackScopedPermissions`, or `buildInsightsAccountScopedPermissions`. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
+ */
+export declare function buildAllowPermissionsOutput(args: BuildAllowPermissionsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<BuildAllowPermissionsResult>;
+export interface BuildAllowPermissionsOutputArgs {
+    /**
+     * The set of scopes to grant globally (e.g. `stack:read`, `environment:open`, `organization:billingManager`). Discover valid scope names via the `getOrganizationRoleScopes` data source.
+     */
+    permissions: pulumi.Input<pulumi.Input<string>[]>;
+}
+//# sourceMappingURL=buildAllowPermissions.d.ts.map

package/buildAllowPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildAllowPermissions.d.ts","sourceRoot":"","sources":["../buildAllowPermissions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAKxI;AAED,MAAM,WAAW,yBAAyB;IACtC;;OAEG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IACxC;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC,CAAC;CAC9C;AACD;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAKhK;AAED,MAAM,WAAW,+BAA+B;IAC5C;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;CACrD"}

package/buildAllowPermissions.js

@@ -0,0 +1,51 @@
+"use strict";
+// *** WARNING: this file was generated by pulumi-language-nodejs. ***
+// *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAllowPermissionsOutput = exports.buildAllowPermissions = void 0;
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("./utilities"));
+/**
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes globally — i.e. on every entity of the matching resource type. This is the simplest descriptor: a flat `PermissionDescriptorAllow`. Use this helper instead of hand-authoring the descriptor literal so the wire-format `__type` discriminator stays an implementation detail. For grants scoped to a specific entity, see `buildEnvironmentScopedPermissions`, `buildStackScopedPermissions`, or `buildInsightsAccountScopedPermissions`. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
+ */
+function buildAllowPermissions(args, opts) {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invoke("pulumiservice:index:buildAllowPermissions", {
+        "permissions": args.permissions,
+    }, opts);
+}
+exports.buildAllowPermissions = buildAllowPermissions;
+/**
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes globally — i.e. on every entity of the matching resource type. This is the simplest descriptor: a flat `PermissionDescriptorAllow`. Use this helper instead of hand-authoring the descriptor literal so the wire-format `__type` discriminator stays an implementation detail. For grants scoped to a specific entity, see `buildEnvironmentScopedPermissions`, `buildStackScopedPermissions`, or `buildInsightsAccountScopedPermissions`. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
+ */
+function buildAllowPermissionsOutput(args, opts) {
+    opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
+    return pulumi.runtime.invokeOutput("pulumiservice:index:buildAllowPermissions", {
+        "permissions": args.permissions,
+    }, opts);
+}
+exports.buildAllowPermissionsOutput = buildAllowPermissionsOutput;
+//# sourceMappingURL=buildAllowPermissions.js.map

package/buildAllowPermissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildAllowPermissions.js","sourceRoot":"","sources":["../buildAllowPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AACzC,uDAAyC;AAEzC;;GAEG;AACH,SAAgB,qBAAqB,CAAC,IAA+B,EAAE,IAA2B;IAC9F,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,2CAA2C,EAAE;QACtE,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AALD,sDAKC;AAeD;;GAEG;AACH,SAAgB,2BAA2B,CAAC,IAAqC,EAAE,IAAiC;IAChH,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,2CAA2C,EAAE;QAC5E,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AALD,kEAKC"}

package/buildEnvironmentScopedPermissions.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` / `PermissionLiteralExpressionEnvironment` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the `PermissionDescriptorCondition` tree yourself. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 export declare function buildEnvironmentScopedPermissions(args: BuildEnvironmentScopedPermissionsArgs, opts?: pulumi.InvokeOptions): Promise<BuildEnvironmentScopedPermissionsResult>;
 export interface BuildEnvironmentScopedPermissionsArgs {
@@ -15,18 +15,14 @@ export interface BuildEnvironmentScopedPermissionsArgs {
 }
 export interface BuildEnvironmentScopedPermissionsResult {
     /**
-     * A `PermissionDescriptor` tree ready to assign to `OrganizationRole.permissions`.
+     * A `PermissionDescriptorCondition` tree gating a `PermissionDescriptorAllow` on the named environment, ready to assign to `OrganizationRole.permissions`.
      */
     readonly permissions: {
         [key: string]: any;
     };
-    /**
-     * A JSON-encoded copy of `permissions`. Pulumi's Python SDK strips `__`-prefixed keys from invoke responses (see `pulumi/sdk` Python `runtime/rpc.py:deserialize_property`), so the structured `permissions` Mapping arrives at downstream resources missing every `__type` discriminator and Pulumi Cloud rejects it. Python users should consume `permissionsJson` and `.apply(json.loads)` it instead — that re-creates the dict on the input path (`serialize_property`), which preserves `__` keys. TypeScript/Yaml/Go/.NET/Java callers can use either field; `permissions` is the more ergonomic default.
-     */
-    readonly permissionsJson: string;
 }
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` / `PermissionLiteralExpressionEnvironment` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the `PermissionDescriptorCondition` tree yourself. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 export declare function buildEnvironmentScopedPermissionsOutput(args: BuildEnvironmentScopedPermissionsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<BuildEnvironmentScopedPermissionsResult>;
 export interface BuildEnvironmentScopedPermissionsOutputArgs {
@@ -39,3 +35,4 @@ export interface BuildEnvironmentScopedPermissionsOutputArgs {
      */
     permissions: pulumi.Input<pulumi.Input<string>[]>;
 }
+//# sourceMappingURL=buildEnvironmentScopedPermissions.d.ts.map

package/buildEnvironmentScopedPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildEnvironmentScopedPermissions.d.ts","sourceRoot":"","sources":["../buildEnvironmentScopedPermissions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,qCAAqC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,uCAAuC,CAAC,CAM5K;AAED,MAAM,WAAW,qCAAqC;IAClD;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uCAAuC;IACpD;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC,CAAC;CAC9C;AACD;;GAEG;AACH,wBAAgB,uCAAuC,CAAC,IAAI,EAAE,2CAA2C,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,uCAAuC,CAAC,CAMpM;AAED,MAAM,WAAW,2CAA2C;IACxD;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;CACrD"}

package/buildEnvironmentScopedPermissions.js

@@ -1,12 +1,35 @@
 "use strict";
 // *** WARNING: this file was generated by pulumi-language-nodejs. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildEnvironmentScopedPermissionsOutput = exports.buildEnvironmentScopedPermissions = void 0;
-const pulumi = require("@pulumi/pulumi");
-const utilities = require("./utilities");
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("./utilities"));
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` / `PermissionLiteralExpressionEnvironment` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the `PermissionDescriptorCondition` tree yourself. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 function buildEnvironmentScopedPermissions(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
@@ -17,7 +40,7 @@ function buildEnvironmentScopedPermissions(args, opts) {
 }
 exports.buildEnvironmentScopedPermissions = buildEnvironmentScopedPermissions;
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the underlying `PermissionDescriptorGroup` / `PermissionDescriptorCondition` / `PermissionLiteralExpressionEnvironment` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named environment. Pair with `Environment.environmentId` (or the `getEnvironment` data source) to avoid hand-rolling the `PermissionDescriptorCondition` tree yourself. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 function buildEnvironmentScopedPermissionsOutput(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});

package/buildEnvironmentScopedPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildEnvironmentScopedPermissions.js","sourceRoot":"","sources":["../buildEnvironmentScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,SAAgB,iCAAiC,CAAC,IAA2C,EAAE,IAA2B;IACtH,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,uDAAuD,EAAE;QAClF,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,8EAMC;AAuBD;;GAEG;AACH,SAAgB,uCAAuC,CAAC,IAAiD,EAAE,IAAiC;IACxI,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,uDAAuD,EAAE;QACxF,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,0FAMC"}
+{"version":3,"file":"buildEnvironmentScopedPermissions.js","sourceRoot":"","sources":["../buildEnvironmentScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AACzC,uDAAyC;AAEzC;;GAEG;AACH,SAAgB,iCAAiC,CAAC,IAA2C,EAAE,IAA2B;IACtH,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,uDAAuD,EAAE;QAClF,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,8EAMC;AAmBD;;GAEG;AACH,SAAgB,uCAAuC,CAAC,IAAiD,EAAE,IAAiC;IACxI,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,uDAAuD,EAAE;QACxF,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,0FAMC"}

package/buildInsightsAccountScopedPermissions.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source) to avoid hand-rolling the underlying `PermissionLiteralExpressionInsightsAccount` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source). The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 export declare function buildInsightsAccountScopedPermissions(args: BuildInsightsAccountScopedPermissionsArgs, opts?: pulumi.InvokeOptions): Promise<BuildInsightsAccountScopedPermissionsResult>;
 export interface BuildInsightsAccountScopedPermissionsArgs {
@@ -15,18 +15,14 @@ export interface BuildInsightsAccountScopedPermissionsArgs {
 }
 export interface BuildInsightsAccountScopedPermissionsResult {
     /**
-     * A `PermissionDescriptor` tree ready to assign to `OrganizationRole.permissions`.
+     * A `PermissionDescriptorCondition` tree gating a `PermissionDescriptorAllow` on the named insights account, ready to assign to `OrganizationRole.permissions`.
      */
     readonly permissions: {
         [key: string]: any;
     };
-    /**
-     * A JSON-encoded copy of `permissions`. Pulumi's Python SDK strips `__`-prefixed keys from invoke responses (see `pulumi/sdk` Python `runtime/rpc.py:deserialize_property`), so the structured `permissions` Mapping arrives at downstream resources missing every `__type` discriminator and Pulumi Cloud rejects it. Python users should consume `permissionsJson` and `.apply(json.loads)` it instead — that re-creates the dict on the input path (`serialize_property`), which preserves `__` keys. TypeScript/Yaml/Go/.NET/Java callers can use either field; `permissions` is the more ergonomic default.
-     */
-    readonly permissionsJson: string;
 }
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source) to avoid hand-rolling the underlying `PermissionLiteralExpressionInsightsAccount` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source). The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 export declare function buildInsightsAccountScopedPermissionsOutput(args: BuildInsightsAccountScopedPermissionsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<BuildInsightsAccountScopedPermissionsResult>;
 export interface BuildInsightsAccountScopedPermissionsOutputArgs {
@@ -39,3 +35,4 @@ export interface BuildInsightsAccountScopedPermissionsOutputArgs {
      */
     permissions: pulumi.Input<pulumi.Input<string>[]>;
 }
+//# sourceMappingURL=buildInsightsAccountScopedPermissions.d.ts.map

package/buildInsightsAccountScopedPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildInsightsAccountScopedPermissions.d.ts","sourceRoot":"","sources":["../buildInsightsAccountScopedPermissions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC;;GAEG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,yCAAyC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,2CAA2C,CAAC,CAMxL;AAED,MAAM,WAAW,yCAAyC;IACtD;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;OAEG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,2CAA2C;IACxD;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC,CAAC;CAC9C;AACD;;GAEG;AACH,wBAAgB,2CAA2C,CAAC,IAAI,EAAE,+CAA+C,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAMhN;AAED,MAAM,WAAW,+CAA+C;IAC5D;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;CACrD"}

package/buildInsightsAccountScopedPermissions.js

@@ -1,12 +1,35 @@
 "use strict";
 // *** WARNING: this file was generated by pulumi-language-nodejs. ***
 // *** Do not edit by hand unless you're certain you know what you are doing! ***
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildInsightsAccountScopedPermissionsOutput = exports.buildInsightsAccountScopedPermissions = void 0;
-const pulumi = require("@pulumi/pulumi");
-const utilities = require("./utilities");
+const pulumi = __importStar(require("@pulumi/pulumi"));
+const utilities = __importStar(require("./utilities"));
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source) to avoid hand-rolling the underlying `PermissionLiteralExpressionInsightsAccount` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source). The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 function buildInsightsAccountScopedPermissions(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});
@@ -17,7 +40,7 @@ function buildInsightsAccountScopedPermissions(args, opts) {
 }
 exports.buildInsightsAccountScopedPermissions = buildInsightsAccountScopedPermissions;
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source) to avoid hand-rolling the underlying `PermissionLiteralExpressionInsightsAccount` JSON. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named insights account. Pair with `InsightsAccount.insightsAccountId` (or the `getInsightsAccount` data source). The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 function buildInsightsAccountScopedPermissionsOutput(args, opts) {
     opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts || {});

package/buildInsightsAccountScopedPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildInsightsAccountScopedPermissions.js","sourceRoot":"","sources":["../buildInsightsAccountScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;AAEjF,yCAAyC;AACzC,yCAAyC;AAEzC;;GAEG;AACH,SAAgB,qCAAqC,CAAC,IAA+C,EAAE,IAA2B;IAC9H,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,2DAA2D,EAAE;QACtF,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,sFAMC;AAuBD;;GAEG;AACH,SAAgB,2CAA2C,CAAC,IAAqD,EAAE,IAAiC;IAChJ,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,2DAA2D,EAAE;QAC5F,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,kGAMC"}
+{"version":3,"file":"buildInsightsAccountScopedPermissions.js","sourceRoot":"","sources":["../buildInsightsAccountScopedPermissions.ts"],"names":[],"mappings":";AAAA,sEAAsE;AACtE,iFAAiF;;;;;;;;;;;;;;;;;;;;;;;;;;AAEjF,uDAAyC;AACzC,uDAAyC;AAEzC;;GAEG;AACH,SAAgB,qCAAqC,CAAC,IAA+C,EAAE,IAA2B;IAC9H,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,2DAA2D,EAAE;QACtF,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,sFAMC;AAmBD;;GAEG;AACH,SAAgB,2CAA2C,CAAC,IAAqD,EAAE,IAAiC;IAChJ,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,2DAA2D,EAAE;QAC5F,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;KAClC,EAAE,IAAI,CAAC,CAAC;AACb,CAAC;AAND,kGAMC"}

package/buildStackScopedPermissions.d.ts

@@ -1,6 +1,6 @@
 import * as pulumi from "@pulumi/pulumi";
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple — and is what `PermissionLiteralExpressionStack` expects. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 export declare function buildStackScopedPermissions(args: BuildStackScopedPermissionsArgs, opts?: pulumi.InvokeOptions): Promise<BuildStackScopedPermissionsResult>;
 export interface BuildStackScopedPermissionsArgs {
@@ -15,18 +15,14 @@ export interface BuildStackScopedPermissionsArgs {
 }
 export interface BuildStackScopedPermissionsResult {
     /**
-     * A `PermissionDescriptor` tree ready to assign to `OrganizationRole.permissions`.
+     * A `PermissionDescriptorCondition` tree gating a `PermissionDescriptorAllow` on the named stack, ready to assign to `OrganizationRole.permissions`.
      */
     readonly permissions: {
         [key: string]: any;
     };
-    /**
-     * A JSON-encoded copy of `permissions`. Pulumi's Python SDK strips `__`-prefixed keys from invoke responses (see `pulumi/sdk` Python `runtime/rpc.py:deserialize_property`), so the structured `permissions` Mapping arrives at downstream resources missing every `__type` discriminator and Pulumi Cloud rejects it. Python users should consume `permissionsJson` and `.apply(json.loads)` it instead — that re-creates the dict on the input path (`serialize_property`), which preserves `__` keys. TypeScript/Yaml/Go/.NET/Java callers can use either field; `permissions` is the more ergonomic default.
-     */
-    readonly permissionsJson: string;
 }
 /**
- * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple — and is what `PermissionLiteralExpressionStack` expects. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls a `PermissionDescriptorCondition` from each helper output.
+ * Builds an `OrganizationRole.permissions` descriptor that grants the supplied scopes only on the named stack. The `stackId` is the stack's opaque Pulumi Cloud identifier — distinct from the `organization/project/stack` triple. The result is directly assignable to `OrganizationRole.permissions`. To grant scopes on more than one entity in a single role, hand-roll a `PermissionDescriptorGroup` whose `entries` list pulls the output of each helper.
  */
 export declare function buildStackScopedPermissionsOutput(args: BuildStackScopedPermissionsOutputArgs, opts?: pulumi.InvokeOutputOptions): pulumi.Output<BuildStackScopedPermissionsResult>;
 export interface BuildStackScopedPermissionsOutputArgs {
@@ -39,3 +35,4 @@ export interface BuildStackScopedPermissionsOutputArgs {
      */
     stackId: pulumi.Input<string>;
 }
+//# sourceMappingURL=buildStackScopedPermissions.d.ts.map

package/buildStackScopedPermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildStackScopedPermissions.d.ts","sourceRoot":"","sources":["../buildStackScopedPermissions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAGzC;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,aAAa,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAM1J;AAED,MAAM,WAAW,+BAA+B;IAC5C;;OAEG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iCAAiC;IAC9C;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC,CAAC;CAC9C;AACD;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,qCAAqC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAMlL;AAED,MAAM,WAAW,qCAAqC;IAClD;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClD;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CACjC"}