How does pulumi decide what version of a plugin to download?

it reads your sdk dependency mechanism (ie, package.json, requirements.txt, go.mod or nuget)

For Typescript, could I determine the version of, say, aws plugin by inspecting the package-lock.json and finding the

version

key value for

@pulumi/aws

?

yes, that would work, but the version is also stored in the state for the provider as well