@caelo-cms/provisioning 0.10.26 → 0.10.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/dist/dns/index.d.ts +1 -1
  2. package/dist/dns/index.d.ts.map +1 -1
  3. package/dist/wizards/gcp-pulumi.d.ts +10 -0
  4. package/dist/wizards/gcp-pulumi.d.ts.map +1 -1
  5. package/dist/wizards/gcp-pulumi.js +29 -0
  6. package/dist/wizards/gcp-pulumi.js.map +1 -1
  7. package/package.json +5 -5
  8. package/stacks/gcp/index.ts +15 -1
  9. package/stacks/gcp-firebase/index.ts +15 -1
package/dist/dns/index.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  import type { DnsAdapter } from "./types.js";
2
- export type { DnsAdapter, DnsRecord } from "./types.js";
2
+ export type { DnsAdapter } from "./types.js";
3
3
  /**
4
4
  * Pick the right DNS adapter based on environment + interactive
5
5
  * detection. The CLI's wizard calls this; if a registrar's API is
package/dist/dns/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dns/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dns/index.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBtB"}
package/dist/wizards/gcp-pulumi.d.ts CHANGED
@@ -33,6 +33,16 @@ export interface PulumiUpResult {
33
33
  deleted: number;
34
34
  };
35
35
  }
36
+ /**
37
+ * Pick the stack's `secretReplication` (see stacks/<provider>/index.ts).
38
+ * A value already in config wins. Otherwise secrets that already exist
39
+ * in state with `auto` replication keep it — switching would replace
40
+ * them — and everything else (new stacks) gets `regional`.
41
+ */
42
+ export declare function resolveSecretReplication(configured: string | undefined, stateResources: ReadonlyArray<{
43
+ type?: string;
44
+ outputs?: Record<string, unknown>;
45
+ }>): "auto" | "regional";
36
46
  /**
37
47
  * Run `pulumi up` against the GCP stack via the Automation SDK.
38
48
  * Streams resource-create events to the supplied onEvent callback so
package/dist/wizards/gcp-pulumi.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"gcp-pulumi.d.ts","sourceRoot":"","sources":["../../src/wizards/gcp-pulumi.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;yEAEqE;IACrE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAeD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrE,OAAO,CAAC,cAAc,CAAC,CA8FzB"}
1
+ {"version":3,"file":"gcp-pulumi.d.ts","sourceRoot":"","sources":["../../src/wizards/gcp-pulumi.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;yEAEqE;IACrE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,cAAc,EAAE,aAAa,CAAC;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAClF,MAAM,GAAG,UAAU,CAWrB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrE,OAAO,CAAC,cAAc,CAAC,CAgHzB"}
package/dist/wizards/gcp-pulumi.js CHANGED
@@ -22,6 +22,26 @@ function gcpStackWorkDir(provider = "gcp") {
22
22
  // levels up + into the provider-specific stack folder.
23
23
  return resolvePath(import.meta.dir, `../../stacks/${provider}`);
24
24
  }
25
+ /**
26
+ * Pick the stack's `secretReplication` (see stacks/<provider>/index.ts).
27
+ * A value already in config wins. Otherwise secrets that already exist
28
+ * in state with `auto` replication keep it — switching would replace
29
+ * them — and everything else (new stacks) gets `regional`.
30
+ */
31
+ export function resolveSecretReplication(configured, stateResources) {
32
+ if (configured === "auto" || configured === "regional")
33
+ return configured;
34
+ if (configured !== undefined) {
35
+ throw new Error(`secretReplication must be "auto" or "regional", got "${configured}"`);
36
+ }
37
+ const hasAutoSecret = stateResources.some((r) => {
38
+ if (r.type !== "gcp:secretmanager/secret:Secret")
39
+ return false;
40
+ const replication = r.outputs?.replication;
41
+ return replication?.auto != null;
42
+ });
43
+ return hasAutoSecret ? "auto" : "regional";
44
+ }
25
45
  /**
26
46
  * Run `pulumi up` against the GCP stack via the Automation SDK.
27
47
  * Streams resource-create events to the supplied onEvent callback so
@@ -76,6 +96,15 @@ export async function pulumiUpGcp(inputs, onEvent) {
76
96
  { value: digest },
77
97
  ])),
78
98
  });
99
+ // Read back only after the required keys are set: `pulumi config` refuses to
100
+ // list a stack that lacks them, which is every fresh stack.
101
+ const configuredReplication = await stack.getConfig(`${ns}:secretReplication`).then((v) => v.value, (e) => {
102
+ if (/not found/i.test(String(e)))
103
+ return undefined;
104
+ throw e;
105
+ });
106
+ const secretReplication = resolveSecretReplication(configuredReplication, ((await stack.exportStack()).deployment?.resources ?? []));
107
+ await stack.setConfig(`${ns}:secretReplication`, { value: secretReplication });
79
108
  // Refresh state first to detect drift from any out-of-band changes.
80
109
  await stack.refresh({ onOutput: (msg) => onEvent("log", msg) });
81
110
  // Run `up`. The onEvent callback receives the same JSON-RPC events
package/dist/wizards/gcp-pulumi.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"gcp-pulumi.js","sourceRoot":"","sources":["../../src/wizards/gcp-pulumi.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AAmCpD;;;;GAIG;AACH,SAAS,eAAe,CAAC,WAAmC,KAAK;IAC/D,+DAA+D;IAC/D,mEAAmE;IACnE,6DAA6D;IAC7D,uDAAuD;IACvD,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAsB,EACtB,OAAsE;IAEtE,mDAAmD;IACnD,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,GAAG,GAA2B;QAClC,GAAI,OAAO,CAAC,GAA8B;QAC1C,wBAAwB,EAAE,MAAM,CAAC,gBAAgB;QACjD,8BAA8B,EAAE,MAAM,CAAC,SAAS;QAChD,kEAAkE;QAClE,kBAAkB,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE;KAClE,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC;IAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,iDAAiD;IACjD,MAAM,EAAE,GAAG,SAAS,QAAQ,EAAE,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC3D;QACE,SAAS;QACT,OAAO;KACR,EACD;QACE,OAAO,EAAE,GAAG;KACb,CACF,CAAC;IAEF,qEAAqE;IACrE,wDAAwD;IACxD,mEAAmE;IACnE,8DAA8D;IAC9D,MAAM,KAAK,CAAC,YAAY,CAAC;QACvB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAC9C,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1C,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAClD,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1C,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;QACtD,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QAC1D,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;QACxE,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;QAC5E,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChE,2DAA2D;QAC3D,8DAA8D;QAC9D,8DAA8D;QAC9D,wCAAwC;QACxC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7D,GAAG,EAAE,iBAAiB,OAAO,EAAE;YAC/B,EAAE,KAAK,EAAE,MAAM,EAAE;SAClB,CAAC,CACH;KACF,CAAC,CAAC;IAEH,oEAAoE;IACpE,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhE,mEAAmE;IACnE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACtC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,0DAA0D;YAC1D,0DAA0D;YAC1D,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,OAAO,CACL,OAAO,EACP,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAC;YACJ,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;gBACjC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO;QACP,aAAa,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;SAC7B;KACF,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"gcp-pulumi.js","sourceRoot":"","sources":["../../src/wizards/gcp-pulumi.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,KAAK,MAAM,MAAM,2BAA2B,CAAC;AAmCpD;;;;GAIG;AACH,SAAS,eAAe,CAAC,WAAmC,KAAK;IAC/D,+DAA+D;IAC/D,mEAAmE;IACnE,6DAA6D;IAC7D,uDAAuD;IACvD,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,QAAQ,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA8B,EAC9B,cAAmF;IAEnF,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC1E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,UAAU,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9C,IAAI,CAAC,CAAC,IAAI,KAAK,iCAAiC;YAAE,OAAO,KAAK,CAAC;QAC/D,MAAM,WAAW,GAAG,CAAC,CAAC,OAAO,EAAE,WAA6C,CAAC;QAC7E,OAAO,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAsB,EACtB,OAAsE;IAEtE,mDAAmD;IACnD,mEAAmE;IACnE,sEAAsE;IACtE,MAAM,GAAG,GAA2B;QAClC,GAAI,OAAO,CAAC,GAA8B;QAC1C,wBAAwB,EAAE,MAAM,CAAC,gBAAgB;QACjD,8BAA8B,EAAE,MAAM,CAAC,SAAS;QAChD,kEAAkE;QAClE,kBAAkB,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE;KAClE,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,YAAY,CAAC;IAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,iDAAiD;IACjD,MAAM,EAAE,GAAG,SAAS,QAAQ,EAAE,CAAC;IAE/B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAC3D;QACE,SAAS;QACT,OAAO;KACR,EACD;QACE,OAAO,EAAE,GAAG;KACb,CACF,CAAC;IAEF,qEAAqE;IACrE,wDAAwD;IACxD,mEAAmE;IACnE,8DAA8D;IAC9D,MAAM,KAAK,CAAC,YAAY,CAAC;QACvB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAC9C,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1C,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAClD,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1C,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;QACtD,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QAC1D,CAAC,GAAG,EAAE,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE;QACxE,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE;QAC5E,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,EAAE;YACtF,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAChE,2DAA2D;QAC3D,8DAA8D;QAC9D,8DAA8D;QAC9D,wCAAwC;QACxC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7D,GAAG,EAAE,iBAAiB,OAAO,EAAE;YAC/B,EAAE,KAAK,EAAE,MAAM,EAAE;SAClB,CAAC,CACH;KACF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC,IAAI,CACjF,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EACd,CAAC,CAAU,EAAE,EAAE;QACb,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,MAAM,CAAC,CAAC;IACV,CAAC,CACF,CAAC;IACF,MAAM,iBAAiB,GAAG,wBAAwB,CAChD,qBAAqB,EACrB,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAGtD,CACH,CAAC;IACF,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAE/E,oEAAoE;IACpE,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhE,mEAAmE;IACnE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QACtC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,0DAA0D;YAC1D,0DAA0D;YAC1D,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gBAC3B,OAAO,CACL,OAAO,EACP,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,KAAK,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAC3E,CAAC;YACJ,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;gBACjC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO;QACP,aAAa,EAAE;YACb,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;YAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;SAC7B;KACF,CAAC;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@caelo-cms/provisioning",
3
- "version": "0.10.26",
3
+ "version": "0.10.27",
4
4
  "private": false,
5
5
  "license": "MPL-2.0",
6
6
  "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -38,16 +38,16 @@
38
38
  "prepublishOnly": "tsc -b --force && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
39
39
  },
40
40
  "dependencies": {
41
- "@caelo-cms/edge-router": "^0.10.26",
42
- "@caelo-cms/shared": "^0.10.26",
43
- "@clack/prompts": "1.7.0",
41
+ "@caelo-cms/edge-router": "^0.10.27",
42
+ "@caelo-cms/shared": "^0.10.27",
43
+ "@clack/prompts": "1.8.1",
44
44
  "@pulumi/aws": "^7",
45
45
  "@pulumi/awsx": "^3",
46
46
  "@pulumi/azure-native": "^3",
47
47
  "@pulumi/command": "^1",
48
48
  "@pulumi/gcp": "^9",
49
49
  "@pulumi/pulumi": "^3",
50
- "@pulumi/random": "^4.21.1",
50
+ "@pulumi/random": "^4.21.2",
51
51
  "kleur": "4.1.5",
52
52
  "ts-node": "^10",
53
53
  "typescript": "^5"
package/stacks/gcp/index.ts CHANGED
@@ -29,6 +29,20 @@ const ownerEmail = cfg.require("ownerEmail");
29
29
  const project = cfg.require("project");
30
30
  const region = cfg.get("region") ?? "us-central1";
31
31
 
32
+ // Where Secret Manager keeps the secret payloads. Fixed at create time —
33
+ // changing it replaces every secret — so the wizard pins it per stack:
34
+ // `regional` (the install region) for new stacks, because orgs with a
35
+ // `gcp.resourceLocations` policy reject `auto` (it resolves to location
36
+ // "global"); `auto` for stacks whose secrets already exist that way.
37
+ const secretReplicationMode = cfg.require("secretReplication");
38
+ if (secretReplicationMode !== "auto" && secretReplicationMode !== "regional") {
39
+ throw new Error(`secretReplication must be "auto" or "regional", got "${secretReplicationMode}"`);
40
+ }
41
+ const secretReplication =
42
+ secretReplicationMode === "regional"
43
+ ? { userManaged: { replicas: [{ location: region }] } }
44
+ : { auto: {} };
45
+
32
46
  // === Operator-tunable knobs (defaults: minimal viable; scale-up later) ===
33
47
  const cloudSqlTier = cfg.get("cloudSqlTier") ?? "db-f1-micro";
34
48
  const cloudSqlHa = cfg.getBoolean("cloudSqlHa") ?? false;
@@ -180,7 +194,7 @@ interface MadeSecret {
180
194
  function makeSecret(name: string, value: pulumi.Output<string> | null): MadeSecret {
181
195
  const resource = new gcp.secretmanager.Secret(
182
196
  `${namePrefix}-${name}`,
183
- { secretId: `${namePrefix}-${name}`, replication: { auto: {} } },
197
+ { secretId: `${namePrefix}-${name}`, replication: secretReplication },
184
198
  opts,
185
199
  );
186
200
  if (value === null) {
package/stacks/gcp-firebase/index.ts CHANGED
@@ -37,6 +37,20 @@ const ownerEmail = cfg.require("ownerEmail");
37
37
  const project = cfg.require("project");
38
38
  const region = cfg.get("region") ?? "us-central1";
39
39
 
40
+ // Where Secret Manager keeps the secret payloads. Fixed at create time —
41
+ // changing it replaces every secret — so the wizard pins it per stack:
42
+ // `regional` (the install region) for new stacks, because orgs with a
43
+ // `gcp.resourceLocations` policy reject `auto` (it resolves to location
44
+ // "global"); `auto` for stacks whose secrets already exist that way.
45
+ const secretReplicationMode = cfg.require("secretReplication");
46
+ if (secretReplicationMode !== "auto" && secretReplicationMode !== "regional") {
47
+ throw new Error(`secretReplication must be "auto" or "regional", got "${secretReplicationMode}"`);
48
+ }
49
+ const secretReplication =
50
+ secretReplicationMode === "regional"
51
+ ? { userManaged: { replicas: [{ location: region }] } }
52
+ : { auto: {} };
53
+
40
54
  // === Operator-tunable knobs ===
41
55
  const cloudSqlTier = cfg.get("cloudSqlTier") ?? "db-f1-micro";
42
56
  const cloudSqlHa = cfg.getBoolean("cloudSqlHa") ?? false;
@@ -157,7 +171,7 @@ interface MadeSecret {
157
171
  function makeSecret(name: string, value: pulumi.Output<string> | null): MadeSecret {
158
172
  const resource = new gcp.secretmanager.Secret(
159
173
  `${namePrefix}-${name}`,
160
- { secretId: `${namePrefix}-${name}`, replication: { auto: {} } },
174
+ { secretId: `${namePrefix}-${name}`, replication: secretReplication },
161
175
  opts,
162
176
  );
163
177
  if (value === null) return { resource, version: null };