Update proto files

proto/pulumi/analyzer.proto

@@ -34,6 +34,9 @@ service Analyzer {
     // preview or update. The provided resources are the "outputs", after any mutations
     // have taken place.
     rpc AnalyzeStack(AnalyzeStackRequest) returns (AnalyzeResponse) {}
+    // Remediate optionally transforms a single resource object. This effectively rewrites
+    // a single resource object's properties instead of using what was generated by the program.
+    rpc Remediate(AnalyzeRequest) returns (RemediateResponse) {}
     // GetAnalyzerInfo returns metadata about the analyzer (e.g., list of policies contained).
     rpc GetAnalyzerInfo(google.protobuf.Empty) returns (AnalyzerInfo) {}
     // GetPluginInfo returns generic information about this plugin, like its version.
@@ -110,6 +113,7 @@ enum EnforcementLevel {
     ADVISORY = 0;  // Displayed to users, but does not block deployment.
     MANDATORY = 1; // Stops deployment, cannot be overridden.
     DISABLED = 2;  // Disabled policies do not run during a deployment.
+    REMEDIATE = 3; // Remediated policies actually fixes problems instead of issuing diagnostics.
 }
 
 message AnalyzeDiagnostic {
@@ -123,6 +127,21 @@ message AnalyzeDiagnostic {
     string urn = 8;                        // URN of the resource that violates the policy.
 }
 
+// Remediation is a single resource remediation result.
+message Remediation {
+    string policyName = 1;                 // Name of the policy that performed the remediation.
+    string policyPackName = 2;             // Name of the policy pack the transform is in.
+    string policyPackVersion = 3;          // Version of the policy pack.
+    string description = 4;                // Description of transform rule. e.g., "auto-tag resources."
+    google.protobuf.Struct properties = 5; // the transformed properties to use.
+    string diagnostic = 6;                 // an optional warning diagnostic to emit, if a transform failed.
+}
+
+// RemediateResponse contains a sequence of remediations applied, in order.
+message RemediateResponse {
+    repeated Remediation remediations = 1;       // the list of remediations that were applied.
+}
+
 // AnalyzerInfo provides metadata about a PolicyPack inside an analyzer.
 message AnalyzerInfo {
     string name = 1;                             // Name of the PolicyPack.

proto/pulumi/callback.proto

@@ -0,0 +1,46 @@
+// Copyright 2016-2023, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+import "google/protobuf/struct.proto";
+
+package pulumirpc;
+
+option go_package = "github.com/pulumi/pulumi/sdk/v3/proto/go;pulumirpc";
+
+// Callbacks is a service for invoking functions in one runtime from other processes.
+service Callbacks {
+    // Invoke invokes a given callback, identified by its token.
+    rpc Invoke(CallbackInvokeRequest) returns (CallbackInvokeResponse) {}
+}
+
+message Callback {
+    // the gRPC target of the callback service.
+    string target = 1;
+    // the service specific unique token for this callback.
+    string token = 2;
+}
+
+message CallbackInvokeRequest {
+    // the token for the callback.
+    string token = 1;
+    // the serialized protobuf message of the arguments for this callback.
+    bytes request = 2;
+}
+
+message CallbackInvokeResponse {
+    // the serialized protobuf message of the response for this callback.
+    bytes response = 1;
+}

proto/pulumi/converter.proto

@@ -54,11 +54,23 @@ message ResourceImport {
     string version = 4;
     // the provider PluginDownloadURL to use for the resource, if any.
     string pluginDownloadURL = 5;
+
+    // the logical name of the resource.
+    string logical_name = 6;
+
+    // true if this is a component resource.
+    bool is_component = 7;
+    // true if this is a remote resource. Ignored if is_component is false.
+    bool is_remote = 8;
 }
 
 message ConvertStateResponse {
+
     // a list of resources to import.
     repeated ResourceImport resources = 1;
+
+    // any diagnostics from state conversion.
+    repeated pulumirpc.codegen.Diagnostic diagnostics = 2;
 }
 
 message ConvertProgramRequest {

proto/pulumi/language.proto

@@ -17,6 +17,7 @@ syntax = "proto3";
 import "pulumi/codegen/hcl.proto";
 import "pulumi/plugin.proto";
 import "google/protobuf/empty.proto";
+import "google/protobuf/struct.proto";
 
 package pulumirpc;
 
@@ -57,6 +58,23 @@ service LanguageRuntime {
     rpc Pack(PackRequest) returns (PackResponse) {}
 }
 
+// ProgramInfo are the common set of options that a language runtime needs to execute or query a program. This
+// is filled in by the engine based on where the `Pulumi.yaml` file was, the `runtime.options` property, and
+// the `main` property.
+message ProgramInfo {
+    // the root of the project, where the `Pulumi.yaml` file is located.
+    string root_directory = 1;
+    // the absolute path to the directory of the program to execute. Generally, but not required to be,
+    // underneath the root directory.
+    string program_directory = 2;
+    // the entry point of the program, normally '.' meaning to just use the program directory, but can also be
+    // a filename inside the program directory. How that filename is interpreted, if at all, is language
+    // specific.
+    string entry_point = 3;
+    // JSON style options from the `Pulumi.yaml` runtime options section.
+    google.protobuf.Struct options = 4;
+}
+
 // AboutResponse returns runtime information about the language.
 message AboutResponse {
     string executable = 1; // the primary executable for the runtime of this language.
@@ -65,10 +83,11 @@ message AboutResponse {
 }
 
 message GetProgramDependenciesRequest {
-    string project = 1; // the project name.
-    string pwd = 2;     // the program's working directory.
-    string program = 3; // the path to the program.
+    string project = 1 [deprecated = true]; // the project name, the engine always sets this to "deprecated" now.
+    string pwd = 2 [deprecated = true];     // the program's working directory.
+    string program = 3 [deprecated = true]; // the path to the program.
     bool transitiveDependencies = 4; // if transitive dependencies should be included in the result.
+    ProgramInfo info = 5; // the program info to use to calculate dependencies.
 }
 
 message DependencyInfo {
@@ -81,9 +100,10 @@ message GetProgramDependenciesResponse {
 }
 
 message GetRequiredPluginsRequest {
-    string project = 1; // the project name.
-    string pwd = 2;     // the program's working directory.
-    string program = 3; // the path to the program.
+    string project = 1 [deprecated = true]; // the project name, the engine always sets this to "deprecated" now.
+    string pwd = 2 [deprecated = true];     // the program's working directory.
+    string program = 3 [deprecated = true]; // the path to the program.
+    ProgramInfo info = 4; // the program info to use to calculate plugins.
 }
 
 message GetRequiredPluginsResponse {
@@ -95,7 +115,7 @@ message RunRequest {
     string project = 1;             // the project name.
     string stack = 2;               // the name of the stack being deployed into.
     string pwd = 3;                 // the program's working directory.
-    string program = 4;             // the path to the program to execute.
+    string program = 4 [deprecated = true];             // the path to the program to execute.
     repeated string args = 5;       // any arguments to pass to the program.
     map<string, string> config = 6; // the configuration variables to apply before running.
     bool dryRun = 7;                // true if we're only doing a dryrun (preview).
@@ -104,6 +124,8 @@ message RunRequest {
     bool queryMode = 10;            // true if we're only doing a query.
     repeated string configSecretKeys = 11; // the configuration keys that have secret values.
     string organization = 12;       // the organization of the stack being deployed into.
+    google.protobuf.Struct configPropertyMap = 13; // the configuration variables to apply before running.
+    ProgramInfo info = 14; // the program info to use to execute the program.
 }
 
 // RunResponse is the response back from the interpreter/source back to the monitor.
@@ -118,8 +140,9 @@ message RunResponse {
 }
 
 message InstallDependenciesRequest {
-    string directory = 1; // the program's working directory.
+    string directory = 1 [deprecated = true]; // the program's working directory.
     bool is_terminal = 2; // if we are running in a terminal and should use ANSI codes
+    ProgramInfo info = 3; // the program info to use to execute the plugin.
 }
 
 message InstallDependenciesResponse {
@@ -129,9 +152,10 @@ message InstallDependenciesResponse {
 
 message RunPluginRequest{
     string pwd = 1; // the program's working directory.
-    string program = 2; // the path to the program to execute.
+    string program = 2 [deprecated = true]; // the path to the program to execute.
     repeated string args = 3; // any arguments to pass to the program.
     repeated string env = 4; // any environment variables to set as part of the program.
+    ProgramInfo info = 5; // the program info to use to execute the plugin.
 }
 
 message RunPluginResponse {
@@ -189,6 +213,8 @@ message GeneratePackageRequest {
 }
 
 message GeneratePackageResponse {
+    // any diagnostics from code generation.
+    repeated pulumirpc.codegen.Diagnostic diagnostics = 1;
 }
 
 message PackRequest {
@@ -203,4 +229,4 @@ message PackRequest {
 message PackResponse {
     // the full path of the packed artifact.
     string artifact_path = 1;
-}
+}

proto/pulumi/provider.proto

@@ -104,6 +104,7 @@ message ConfigureRequest {
     bool acceptSecrets  = 3;           // when true, operations should return secrets as strongly typed.
     bool acceptResources = 4;          // when true, operations should return resources as strongly typed values to the provider.
     bool sends_old_inputs = 5;         // when true, diff and update will be called with the old outputs and the old inputs.
+    bool sends_old_inputs_to_delete = 6; // when true, delete will be called with the old outputs and the old inputs.
 }
 
 message ConfigureResponse {
@@ -145,13 +146,15 @@ message CallRequest {
         repeated string urns = 1; // A list of URNs this argument depends on.
     }
 
+    // We used to send CallRequest for both provider calls and monitor calls, despite them being different.
+    // We've now split them but need to make sure we don't confuse any old plugins/monitors making sure those
+    // fields don't get reused.
+    reserved 4, 5, 13, 16, 15;
+    reserved "provider", "version", "pluginDownloadURL", "pluginChecksums", "sourcePosition";
+
     string tok = 1;                                        // the function token to invoke.
     google.protobuf.Struct args = 2;                       // the arguments for the function invocation.
     map<string, ArgumentDependencies> argDependencies = 3; // a map from argument keys to the dependencies of the argument.
-    string provider = 4;                                   // an optional reference to the provider to use for this invoke.
-    string version = 5;                                    // the version of the provider to use when servicing this request.
-    string pluginDownloadURL = 13;                         // the pluginDownloadURL of the provider to use when servicing this request.
-    map<string, bytes> pluginChecksums = 16;               // a map of checksums of the provider to use when servicing this request.
 
     string project = 6;             // the project name.
     string stack = 7;               // the name of the stack being deployed into.
@@ -162,7 +165,7 @@ message CallRequest {
     string monitorEndpoint = 12;    // the address for communicating back to the resource monitor.
     string organization = 14;       // the organization of the stack being deployed into.
 
-    SourcePosition sourcePosition = 15; // the optional source position of the user code that initiated the call.
+    bool accepts_output_values = 17; // the engine can be passed output values back, returnDependencies can be left blank if returning output values.
 }
 
 message CallResponse {
@@ -317,6 +320,7 @@ message DeleteRequest {
     string urn = 2;                        // the Pulumi URN for this resource.
     google.protobuf.Struct properties = 3; // the current properties on the resource.
     double timeout = 4;                    // the delete request timeout represented in seconds.
+    google.protobuf.Struct old_inputs = 5; // the old input values of the resource to delete.
 }
 
 message ConstructRequest {
@@ -376,6 +380,8 @@ message ConstructRequest {
     repeated string ignoreChanges           = 22; // properties that should be ignored during a diff
     repeated string replaceOnChanges        = 23; // properties that, when changed, trigger a replacement
     bool retainOnDelete                     = 24; // whether to retain the resource in the cloud provider when it is deleted
+
+    bool accepts_output_values = 25; // the engine can be passed output values back, stateDependencies can be left blank if returning output values.
 }
 
 message ConstructResponse {

proto/pulumi/resource.proto

@@ -19,6 +19,7 @@ import "google/protobuf/struct.proto";
 import "pulumi/provider.proto";
 import "pulumi/alias.proto";
 import "pulumi/source.proto";
+import "pulumi/callback.proto";
 
 package pulumirpc;
 
@@ -29,10 +30,12 @@ service ResourceMonitor {
     rpc SupportsFeature(SupportsFeatureRequest) returns (SupportsFeatureResponse) {}
     rpc Invoke(ResourceInvokeRequest) returns (InvokeResponse) {}
     rpc StreamInvoke(ResourceInvokeRequest) returns (stream InvokeResponse) {}
-    rpc Call(CallRequest) returns (CallResponse) {}
+    rpc Call(ResourceCallRequest) returns (CallResponse) {}
     rpc ReadResource(ReadResourceRequest) returns (ReadResourceResponse) {}
     rpc RegisterResource(RegisterResourceRequest) returns (RegisterResourceResponse) {}
     rpc RegisterResourceOutputs(RegisterResourceOutputsRequest) returns (google.protobuf.Empty) {}
+
+    rpc RegisterStackTransform(Callback) returns (google.protobuf.Empty) {}
 }
 
 // SupportsFeatureRequest allows a client to test if the resource monitor supports a certain feature, which it may use
@@ -134,6 +137,8 @@ message RegisterResourceRequest {
     bool aliasSpecs = 28;
 
     SourcePosition sourcePosition = 29;    // the optional source position of the user code that initiated the register.
+
+    repeated Callback transforms = 31; // a list of transforms to apply to the resource before registering it.
 }
 
 // RegisterResourceResponse is returned by the engine after a resource has finished being initialized.  It includes the
@@ -169,3 +174,59 @@ message ResourceInvokeRequest {
 
     SourcePosition sourcePosition = 7; // the optional source position of the user code that initiated the invoke.
 }
+
+message ResourceCallRequest {
+    // ArgumentDependencies describes the resources that a particular argument depends on.
+    message ArgumentDependencies {
+        repeated string urns = 1; // A list of URNs this argument depends on.
+    }
+
+    string tok = 1;                                        // the function token to invoke.
+    google.protobuf.Struct args = 2;                       // the arguments for the function invocation.
+    map<string, ArgumentDependencies> argDependencies = 3; // a map from argument keys to the dependencies of the argument.
+    string provider = 4;                                   // an optional reference to the provider to use for this invoke.
+    string version = 5;                                    // the version of the provider to use when servicing this request.
+    string pluginDownloadURL = 13;                         // the pluginDownloadURL of the provider to use when servicing this request.
+    map<string, bytes> pluginChecksums = 16;               // a map of checksums of the provider to use when servicing this request.
+
+    // We used to send CallRequest for both provider calls and monitor calls, despite them being different.
+    // We've now split them but need to make sure we don't confuse any old plugins/monitors making sure those
+    // fields don't get reused.
+    reserved 6, 7, 8, 9, 10, 11, 12, 14;
+    reserved "project", "stack", "config", "configSecretKeys", "dryRun", "parallel", "monitorEndpoint", "organization";
+
+    SourcePosition sourcePosition = 15; // the optional source position of the user code that initiated the call.
+}
+
+// TransformResourceOptions is a subset of all resource options that are relevant to transforms.
+message TransformResourceOptions {
+    repeated string depends_on = 1;
+    bool protect = 2;
+    repeated string ignore_changes = 3;
+    repeated string replace_on_changes = 4;
+    string version = 5;
+    repeated Alias aliases = 6;
+    string provider = 7;
+    RegisterResourceRequest.CustomTimeouts custom_timeouts = 8;
+    string plugin_download_url = 9;
+    bool retain_on_delete = 10;
+    string deleted_with = 11;
+    optional bool delete_before_replace = 12;
+    repeated string additional_secret_outputs = 13;
+    map<string, string> providers = 14;
+    map<string, bytes> plugin_checksums = 15;
+}
+
+message TransformRequest {
+    string type = 1; // the type of the resource.
+    string name = 2; // the name of the resource.
+    bool custom = 3; // true if the resource is a custom resource, else it's a component resource.
+    string parent = 4; // the parent of the resource, this can't be changed by the transform.
+    google.protobuf.Struct properties = 5; // the input properties of the resource.
+    TransformResourceOptions options = 6; // the options for the resource.
+}
+
+message TransformResponse {
+    google.protobuf.Struct properties = 1; // the transformed input properties.
+    TransformResourceOptions options = 2; // the options for the resource.
+}

sdk/Pulumi/Deployment/Deployment_Call.cs

@@ -79,7 +79,7 @@ private async Task<OutputData<T>> CallAsync<T>(
             var providerReference = await ProviderResource.RegisterAsync(provider).ConfigureAwait(false);
 
             // Create the request.
-            var request = new CallRequest
+            var request = new ResourceCallRequest
             {
                 Tok = token,
                 Provider = providerReference ?? "",
@@ -92,7 +92,7 @@ private async Task<OutputData<T>> CallAsync<T>(
             foreach (var (argName, directDependencies) in argDependencies)
             {
                 var urns = await GetAllTransitivelyReferencedResourceUrnsAsync(directDependencies).ConfigureAwait(false);
-                var deps = new CallRequest.Types.ArgumentDependencies();
+                var deps = new ResourceCallRequest.Types.ArgumentDependencies();
                 deps.Urns.AddRange(urns);
                 request.ArgDependencies.Add(argName, deps);
             }