@caelo-cms/provisioning 0.10.29 → 0.10.31

package/stacks/gcp/index.ts

@@ -22,12 +22,34 @@ import * as pulumi from "@pulumi/pulumi";
 import * as random from "@pulumi/random";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
+import {
+  gatewayServiceAccountId,
+  gcpBucketName,
+  gcpSecretId,
+  MCP_IAP_SERVICE_ACCOUNT_ID,
+  runServiceAccountId,
+  staticPublisherServiceAccountId,
+} from "../../dist/gcp-names.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  adminEnvContract,
+  type CloudRunEnvVar,
+  type CloudRunSlug,
+  databaseUrls,
+  gatewayEnvContract,
+  type RuntimeSecret,
+  runtimeSecretBindings,
+  STATIC_CDN_POLICY,
+} from "../../dist/stack-contract.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
 const ownerEmail = cfg.require("ownerEmail");
 const project = cfg.require("project");
-const region = cfg.get("region") ?? "us-central1";
+// #607 — chosen by the operator in the wizard and fixed after install; no
+// default, so a stack run without it fails instead of landing in a region
+// nobody picked.
+const region = cfg.require("region");
 
 // Where Secret Manager keeps the secret payloads. Fixed at create time —
 // changing it replaces every secret — so the wizard pins it per stack:
@@ -57,6 +79,9 @@ const cloudSqlEdition = cfg.get("cloudSqlEdition") ?? "ENTERPRISE";
 // wants to `caelo-cms destroy` shouldn't hit a wall).
 const deletionProtection = cfg.getBoolean("deletionProtection") ?? false;
 const adminMinInstances = Number.parseInt(cfg.get("adminMinInstances") ?? "0", 10);
+// #553 — the admin also runs the Lighthouse quality audit; same knob and
+// default on every adapter (stack-contract.ts ADMIN_MEMORY_DEFAULT).
+const adminMemory = cfg.get("adminMemory") ?? ADMIN_MEMORY_DEFAULT;
 // adminMaxInstances default is intentionally low. Each admin process holds
 // TWO Bun SQL pools (admin_role on cms_admin + admin_role on cms_public),
 // each with default pool-max=10 → up to ~20 connections per instance under
@@ -140,7 +165,7 @@ const sqlPeering = new gcp.servicenetworking.Connection(
 );
 
 // =========================================================================
-// Secret Manager — never env-var literal; runtime mounts via secret_environment_variables
+// Secret Manager — never env-var literal; Cloud Run reads each via secretKeyRef
 // =========================================================================
 
 // v0.2.81 — secrets MUST be generated by a Pulumi resource that
@@ -160,15 +185,9 @@ const sqlPeering = new gcp.servicenetworking.Connection(
 // one — don't pass `opts` (which carries gcpProvider). Pulumi
 // auto-loads the random provider on first reference.
 const pgPasswordBytes = new random.RandomBytes(`${namePrefix}-pg-password-bytes`, { length: 32 });
-const csrfSecretBytes = new random.RandomBytes(`${namePrefix}-csrf-secret-bytes`, { length: 32 });
-const cookieSecretBytes = new random.RandomBytes(`${namePrefix}-cookie-secret-bytes`, {
-  length: 32,
-});
 const kekBytes = new random.RandomBytes(`${namePrefix}-secret-kek-bytes`, { length: 32 });
 
 const postgresPassword = pulumi.secret(pgPasswordBytes.hex);
-const csrfSecret = pulumi.secret(csrfSecretBytes.hex);
-const cookieSecret = pulumi.secret(cookieSecretBytes.hex);
 // P18 — project KEK (32 bytes hex) encrypts AI provider API keys
 // + future at-rest secrets in cms_admin. Stable across `pulumi up`
 // (see comment above). Cloud Run binds it as CAELO_SECRET_KEK env
@@ -181,25 +200,30 @@ const caeloSecretKek = pulumi.secret(kekBytes.hex);
 // Secret + SecretVersion, but the Cloud Run service never read it
 // (no env-var mount existed). Dead code path removed.
 //
-// resendApiKey is OPTIONAL — empty config means "skip the SecretVersion"
-// so GCP doesn't reject `payload: ""`. The Secret resource itself still
-// exists; operators add a v1 later via `gcloud secrets versions add`.
-const resendApiKeyConfig = cfg.getSecret("resendApiKey");
+// csrf-secret, cookie-secret and resend-api-key were dropped for the same
+// reason: CSRF secrets are per session (in cms_admin), the gateway's cookie
+// secret lives in site_settings, and the Resend key in the email config —
+// no service ever read the three Secret Manager secrets. `pulumi up` deletes
+// them; `cms-provision upgrade` leaves them in place (nothing reads them).
+//
+// internal-secret (CAELO_INTERNAL_SECRET) and tool-approval-secret
+// (CAELO_TOOL_APPROVAL_SECRET) are generated by the CLI, not here
+// (src/runtime-secrets.ts, stack-contract.ts CLI_GENERATED_SECRETS): the
+// wizard creates them before `pulumi up`, `upgrade` on installs that predate
+// them. This program only references them by id, so a plain `pulumi up`
+// needs them to exist (run the wizard or `cms-provision upgrade` once).
 
 interface MadeSecret {
   resource: gcp.secretmanager.Secret;
-  version: gcp.secretmanager.SecretVersion | null;
+  version: gcp.secretmanager.SecretVersion;
 }
 
-function makeSecret(name: string, value: pulumi.Output<string> | null): MadeSecret {
+function makeSecret(name: string, value: pulumi.Output<string>): MadeSecret {
   const resource = new gcp.secretmanager.Secret(
     `${namePrefix}-${name}`,
-    { secretId: `${namePrefix}-${name}`, replication: secretReplication },
+    { secretId: gcpSecretId(env, name), replication: secretReplication },
     opts,
   );
-  if (value === null) {
-    return { resource, version: null };
-  }
   const version = new gcp.secretmanager.SecretVersion(
     `${namePrefix}-${name}-v1`,
     { secret: resource.name, secretData: value },
@@ -209,17 +233,17 @@ function makeSecret(name: string, value: pulumi.Output<string> | null): MadeSecr
 }
 
 const pgSecret = makeSecret("postgres-password", postgresPassword);
-const csrfSecretRes = makeSecret("csrf-secret", csrfSecret);
-const cookieSecretRes = makeSecret("cookie-secret", cookieSecret);
 const kekSecret = makeSecret("secret-kek", caeloSecretKek);
-// v0.3.2 — anthropic-api-key Secret dropped. See the
-// caeloSecretKek comment above for the runtime-path rationale.
-//
-// Resend: skip the v1 when no key is configured (cfg.getSecret returns
-// undefined when the key is unset in Pulumi.yaml + not overridden in the
-// stack config). The Secret resource still exists; operators add a v1
-// later via `gcloud secrets versions add` or `pulumi config set --secret`.
-const resendSecretRes = makeSecret("resend-api-key", resendApiKeyConfig ?? null);
+
+// The id each runtime secret is bound by: the Pulumi resource where this
+// program owns the secret (so bindings wait for it), the CLI-generated id
+// otherwise.
+const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
+  "postgres-password": pgSecret.resource.secretId,
+  "secret-kek": kekSecret.resource.secretId,
+  "internal-secret": gcpSecretId(env, "internal-secret"),
+  "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
+};
 
 // =========================================================================
 // Tier 4 — Cloud SQL Postgres (private IP only; HA + retention configurable)
@@ -242,7 +266,12 @@ const sqlInstance = new gcp.sql.DatabaseInstance(
       // pool-max=10, two pools per admin process). Override at
       // instance level so the cap matches the Cloud Run scale-out
       // headroom defined by adminMaxInstances + gatewayMaxInstances.
-      databaseFlags: [{ name: "max_connections", value: maxConnections.toString() }],
+      databaseFlags: [
+        { name: "max_connections", value: maxConnections.toString() },
+        // The operator-access sync job logs in as its service account (Cloud
+        // SQL IAM database authentication, no password). No restart needed.
+        { name: "cloudsql.iam_authentication", value: "on" },
+      ],
       backupConfiguration: {
         enabled: true,
         pointInTimeRecoveryEnabled: cloudSqlHa,
@@ -291,21 +320,10 @@ const cmsPublicDb = new gcp.sql.Database(
   opts,
 );
 
-// admin_role on cms_admin — admin app's primary DB.
-const adminDatabaseUrl = pulumi
-  .all([sqlInstance.privateIpAddress, postgresPassword])
-  .apply(([host, pw]) => `postgresql://admin_role:${pw}@${host}:5432/cms_admin?sslmode=require`);
-// admin_role on cms_public — admin's second pool: cross-DB reads of
-// plugin data + DDL for plugin schemas + migration runs. Wired to the
-// admin (and migration job) via PUBLIC_ADMIN_DATABASE_URL.
-const publicAdminDatabaseUrl = pulumi
-  .all([sqlInstance.privateIpAddress, postgresPassword])
-  .apply(([host, pw]) => `postgresql://admin_role:${pw}@${host}:5432/cms_public?sslmode=require`);
-// public_role on cms_public — write-limited gateway role. Wired to the
-// gateway via PUBLIC_DATABASE_URL.
-const publicDatabaseUrl = pulumi
-  .all([sqlInstance.privateIpAddress, postgresPassword])
-  .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?sslmode=require`);
+// Password-less connection URLs (stack-contract.ts databaseUrls); the
+// services get the password as a Secret Manager reference
+// (SERVICE_SECRET_ENV), so no revision ever carries it.
+const dbUrls = sqlInstance.privateIpAddress.apply(databaseUrls);
 
 // Reference pgPublicUser so Pulumi knows it's part of the dependency
 // graph (Cloud Run env-var deps don't see this directly).
@@ -318,7 +336,7 @@ void pgPublicUser;
 const mediaBucket = new gcp.storage.Bucket(
   `${namePrefix}-media`,
   {
-    name: `${project}-${namePrefix}-media`,
+    name: gcpBucketName(project, env, "media"),
     location: region.toUpperCase(),
     uniformBucketLevelAccess: true,
     forceDestroy: env !== "production",
@@ -330,7 +348,7 @@ const mediaBucket = new gcp.storage.Bucket(
 const staticBucket = new gcp.storage.Bucket(
   `${namePrefix}-static`,
   {
-    name: `${project}-${namePrefix}-static`,
+    name: gcpBucketName(project, env, "static"),
     location: region.toUpperCase(),
     uniformBucketLevelAccess: true,
     forceDestroy: env !== "production",
@@ -366,7 +384,7 @@ new gcp.storage.BucketIAMMember(
 const stagingBucket = new gcp.storage.Bucket(
   `${namePrefix}-staging`,
   {
-    name: `${project}-${namePrefix}-staging`,
+    name: gcpBucketName(project, env, "staging"),
     location: region.toUpperCase(),
     uniformBucketLevelAccess: true,
     forceDestroy: env !== "production",
@@ -384,32 +402,48 @@ const stagingBucket = new gcp.storage.Bucket(
 const runSa = new gcp.serviceaccount.Account(
   `${namePrefix}-run-sa`,
   {
-    accountId: `${namePrefix}-run-sa`,
+    accountId: runServiceAccountId(env),
     displayName: `Caelo ${env} Cloud Run service account`,
   },
   opts,
 );
 
-// Pass the Secret RESOURCE (not a hardcoded id) so Pulumi infers the
-// dependency edge — otherwise the IamMember create races the Secret
-// create on first apply and 404s. Same `dependsOn` for belt-and-braces.
-for (const made of [
-  { name: "postgres-password", made: pgSecret },
-  { name: "csrf-secret", made: csrfSecretRes },
-  { name: "cookie-secret", made: cookieSecretRes },
-  { name: "secret-kek", made: kekSecret },
-  { name: "resend-api-key", made: resendSecretRes },
-]) {
-  new gcp.secretmanager.SecretIamMember(
-    `${namePrefix}-${made.name}-binding`,
-    {
-      // .secretId from the resource is an Output<string> — Pulumi
-      // tracks the read-after-create edge automatically.
-      secretId: made.made.resource.secretId,
-      role: "roles/secretmanager.secretAccessor",
-      member: pulumi.interpolate`serviceAccount:${runSa.email}`,
-    },
-    { ...opts, dependsOn: [made.made.resource] },
+// The gateway runs as its own SA so it can read only the secrets it needs
+// (stack-contract.ts SERVICE_SECRET_ENV) — never the KEK or the admin-only
+// secrets. `cms-provision upgrade` creates it on older installs, hence
+// createIgnoreAlreadyExists.
+const gatewaySa = new gcp.serviceaccount.Account(
+  `${namePrefix}-gateway-sa`,
+  {
+    accountId: gatewayServiceAccountId(env),
+    displayName: `Caelo ${env} gateway`,
+    createIgnoreAlreadyExists: true,
+  },
+  opts,
+);
+const serviceSa: Record<CloudRunSlug, gcp.serviceaccount.Account> = {
+  admin: runSa,
+  gateway: gatewaySa,
+};
+
+// secretAccessor for each service's SA on exactly the secrets its env reads.
+// Cloud Run refuses to deploy a revision whose SA can't read a referenced
+// secret, so each service waits for its bindings (secretBindings below).
+const secretBindings: Record<CloudRunSlug, gcp.secretmanager.SecretIamMember[]> = {
+  admin: [],
+  gateway: [],
+};
+for (const binding of runtimeSecretBindings()) {
+  secretBindings[binding.service].push(
+    new gcp.secretmanager.SecretIamMember(
+      `${namePrefix}-${binding.stackResource}`,
+      {
+        secretId: runtimeSecretIds[binding.secret],
+        role: "roles/secretmanager.secretAccessor",
+        member: pulumi.interpolate`serviceAccount:${serviceSa[binding.service].email}`,
+      },
+      opts,
+    ),
   );
 }
 
@@ -455,6 +489,49 @@ new gcp.storage.BucketIAMMember(
   opts,
 );
 
+// Cloud Run telemetry IAM (the gcp-firebase stack has had these since
+// v0.6.6). A Cloud Run service running as a CUSTOM SA gets no telemetry
+// roles implicitly — only the default Compute SA does:
+//   - roles/logging.logWriter: container stdout → Cloud Logging
+//   - roles/monitoring.metricWriter: CPU/memory metrics → autoscaler
+// Project-scoped (telemetry endpoints are project-level resources).
+new gcp.projects.IAMMember(
+  `${namePrefix}-run-log-writer`,
+  {
+    project,
+    role: "roles/logging.logWriter",
+    member: pulumi.interpolate`serviceAccount:${runSa.email}`,
+  },
+  opts,
+);
+new gcp.projects.IAMMember(
+  `${namePrefix}-run-metric-writer`,
+  {
+    project,
+    role: "roles/monitoring.metricWriter",
+    member: pulumi.interpolate`serviceAccount:${runSa.email}`,
+  },
+  opts,
+);
+new gcp.projects.IAMMember(
+  `${namePrefix}-gateway-log-writer`,
+  {
+    project,
+    role: "roles/logging.logWriter",
+    member: pulumi.interpolate`serviceAccount:${gatewaySa.email}`,
+  },
+  opts,
+);
+new gcp.projects.IAMMember(
+  `${namePrefix}-gateway-metric-writer`,
+  {
+    project,
+    role: "roles/monitoring.metricWriter",
+    member: pulumi.interpolate`serviceAccount:${gatewaySa.email}`,
+  },
+  opts,
+);
+
 // `static-publisher` SA used by `bunx @caelo-cms/provisioning deploy` to
 // upload the static-generator output to the bucket. Pre-v0.2.78 this
 // was the only path; admin Cloud Run now does the publish in-process
@@ -462,11 +539,10 @@ new gcp.storage.BucketIAMMember(
 // a manual gsutil rsync from CI as a backup or for bulk re-uploads.
 // Account-id max 30 chars; collapse "production" → "prod" so dev/staging/prod
 // all fit within the budget.
-const envShort = env === "production" ? "prod" : env === "staging" ? "stg" : "dev";
 const staticPublisherSa = new gcp.serviceaccount.Account(
   `${namePrefix}-static-publisher`,
   {
-    accountId: `caelo-${envShort}-publisher`,
+    accountId: staticPublisherServiceAccountId(env),
     displayName: `Caelo ${env} static publisher`,
   },
   opts,
@@ -518,7 +594,7 @@ function imageTag(service: string): pulumi.Output<string> {
 }
 
 interface CloudRunArgs {
-  readonly serviceName: string;
+  readonly serviceName: "admin" | "gateway";
   readonly minInstances: number;
   readonly maxInstances: number;
   readonly memory: string;
@@ -530,9 +606,25 @@ interface CloudRunArgs {
    * legitimately need longer.
    */
   readonly timeout?: string;
-  readonly extraEnv?: ReadonlyArray<{ name: string; value: pulumi.Input<string> }>;
+  /**
+   * The service's complete env — plain values and Secret Manager
+   * references: its env contract (src/stack-contract.ts).
+   */
+  readonly contractEnv: ReadonlyArray<CloudRunEnvVar<pulumi.Input<string>>>;
 }
 
+// Inputs of the admin + gateway env contracts. The contracts are shared with
+// `cms-provision upgrade`, which applies them to installs it rolls — add new
+// env vars and secrets there, not here.
+const envContractInputs = {
+  provider: "gcp",
+  projectId: project,
+  env,
+  domain,
+  region,
+  databaseUrls: { admin: dbUrls.admin, publicAdmin: dbUrls.publicAdmin, public: dbUrls.public },
+} as const;
+
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   return new gcp.cloudrunv2.Service(
     `${namePrefix}-${args.serviceName}`,
@@ -553,7 +645,7 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
       // config knob to true.
       deletionProtection,
       template: {
-        serviceAccount: runSa.email,
+        serviceAccount: serviceSa[args.serviceName].email,
         scaling: {
           minInstanceCount: args.minInstances,
           maxInstanceCount: args.maxInstances,
@@ -562,24 +654,7 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
         containers: [
           {
             image: imageTag(args.serviceName),
-            envs: [
-              { name: "CAELO_PROVIDER", value: "gcp" },
-              { name: "CAELO_ENV", value: env },
-              { name: "ADMIN_DATABASE_URL", value: adminDatabaseUrl },
-              { name: "MEDIA_STORAGE_URL", value: pulumi.interpolate`gs://${mediaBucket.name}` },
-              // P18 — project KEK is mounted from Secret Manager so AI
-              // provider keys (and any future at-rest secrets) can be
-              // decrypted at runtime. Failing to bind would surface as
-              // "CAELO_SECRET_KEK is not set" the moment the resolver
-              // tries to decrypt — clear, loud failure.
-              {
-                name: "CAELO_SECRET_KEK",
-                valueSource: {
-                  secretKeyRef: { secret: kekSecret.resource.secretId, version: "latest" },
-                },
-              },
-              ...(args.extraEnv ?? []),
-            ],
+            envs: [...args.contractEnv],
             resources: { limits: { cpu: "1", memory: args.memory } },
           },
         ],
@@ -595,22 +670,26 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
         pgAdminUser,
         cmsAdminDb,
         cmsPublicDb,
-        ...(pgSecret.version ? [pgSecret.version] : []),
-        // KEK must exist before Cloud Run can mount it via secretKeyRef.
-        ...(kekSecret.version ? [kekSecret.version] : []),
+        // The env contract names the buckets as strings; keep them ordered
+        // before the services that use them.
+        mediaBucket,
+        staticBucket,
+        stagingBucket,
+        // Referenced secrets must have a version, and the service's SA
+        // must be able to read them, before Cloud Run deploys a revision.
+        pgSecret.version,
+        kekSecret.version,
+        ...secretBindings[args.serviceName],
       ],
     },
   );
 }
 
-// Issue #37 — deterministic, so the admin env can carry it as a plain string.
-const mcpServiceAccountEmail = `caelo-mcp@${project}.iam.gserviceaccount.com`;
-
 const adminSvc = cloudRunService({
   serviceName: "admin",
   minInstances: adminMinInstances,
   maxInstances: adminMaxInstances,
-  memory: "1Gi",
+  memory: adminMemory,
   // 1 hour — covers the longest realistic SSE chat session (multi-tool
   // compose-page runs that orchestrate 10+ tool calls). Cloud Run's
   // 300s default truncated mid-stream and surfaced to operators as
@@ -618,36 +697,17 @@ const adminSvc = cloudRunService({
   // in Cloud Run logs. 3600s is the platform max; no cost penalty for
   // unused timeout (Cloud Run bills running time, not allocated time).
   timeout: "3600s",
-  // Admin's second pool: admin_role on cms_public for cross-DB reads
-  // + DDL + migrations. NOT public_role (write-limited).
-  // v0.2.78 — CAELO_STATIC_BUCKET / CAELO_STAGING_BUCKET drive the
-  // GCS StaticPublisher (Stage uploads to staging, Confirm-publish
-  // copies to static). CAELO_GENERATOR_CLI points at the absolute
-  // path the Dockerfile shipped the static-generator source to —
-  // the cwd-walk fallback in resolveGeneratorCli landed at
-  // /app/apps/apps/static-generator/... (doubled apps/) before
-  // v0.2.78 because the SSR bundle's import.meta.dirname doesn't
-  // sit where the walk expects.
-  extraEnv: [
-    { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
-    // #551 — the public site URL; the admin seeds site_defaults.site_base_url
-    // from it (canonical, og:url, sitemap) when it is not configured yet.
-    { name: "CAELO_SITE_URL", value: `https://${domain}` },
-    { name: "CAELO_STATIC_BUCKET", value: staticBucket.name },
-    { name: "CAELO_STAGING_BUCKET", value: stagingBucket.name },
-    { name: "CAELO_GENERATOR_CLI", value: "/app/apps/static-generator/src/cli.ts" },
-    // Issue #37 — shown in the /security/mcp `claude mcp add` command.
-    { name: "CAELO_MCP_IAP_SERVICE_ACCOUNT", value: mcpServiceAccountEmail },
-  ],
+  contractEnv: adminEnvContract(envContractInputs),
 });
 const gatewaySvc = cloudRunService({
   serviceName: "gateway",
   minInstances: gatewayMinInstances,
   maxInstances: 100,
   memory: "512Mi",
-  // Gateway's only DB pool: public_role on cms_public, write-limited
-  // per CLAUDE.md (gateway must NEVER hold admin_role creds).
-  extraEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
+  // public_role on cms_public for visitor writes — plus, for now, an
+  // admin_role pool (see the known gap on stack-contract.ts
+  // SERVICE_SECRET_ENV.gateway).
+  contractEnv: gatewayEnvContract(envContractInputs),
 });
 
 // =========================================================================
@@ -725,27 +785,15 @@ const wafPolicy = new gcp.compute.SecurityPolicy(
   opts,
 );
 
-// Tier 1 backend — static GCS bucket via Cloud CDN
-//
-// The GCS publisher sets an explicit Cache-Control on every object
-// (static-publisher-gcs.ts): content-hashed fonts / plugin bundles are
-// `max-age=31536000, immutable`, pages `max-age=60` + SWR. In
-// CACHE_ALL_STATIC mode `clientTtl` CLAMPS the max-age sent to
-// browsers and `maxTtl` caps the edge TTL, so both must allow a year
-// or the immutable policy is silently cut back to the old 1h. Objects
-// that state a shorter max-age keep it; `defaultTtl` still applies only
-// to responses without one.
+// Tier 1 backend — static GCS bucket via Cloud CDN. The CDN policy (one-year
+// client/edge TTL so immutable assets stay immutable, #555) is shared with
+// `cms-provision upgrade`, which applies it to existing installs.
 const staticBackendBucket = new gcp.compute.BackendBucket(
   `${namePrefix}-static-backend`,
   {
     bucketName: staticBucket.name,
     enableCdn: true,
-    cdnPolicy: {
-      cacheMode: "CACHE_ALL_STATIC",
-      defaultTtl: 3600,
-      maxTtl: 31536000,
-      clientTtl: 31536000,
-    },
+    cdnPolicy: { ...STATIC_CDN_POLICY },
   },
   opts,
 );
@@ -856,7 +904,7 @@ const mcpServiceAccount = new gcp.serviceaccount.Account(
   `${namePrefix}-mcp-sa`,
   {
     project,
-    accountId: "caelo-mcp",
+    accountId: MCP_IAP_SERVICE_ACCOUNT_ID,
     displayName: "Caelo MCP (IAP ingress)",
     description:
       "Signs the IAP credential external MCP clients use to reach the admin (issue #37).",
@@ -892,6 +940,20 @@ new gcp.iap.WebBackendServiceIamMember(
   opts,
 );
 
+// =========================================================================
+// Operator access — deliberately NOT here
+// =========================================================================
+//
+// Who passes IAP beyond the allowlist above follows the Caelo user list. A
+// Cloud Run job with its own service account keeps the IAP binding and the
+// caelo-mcp token-creator binding in step (admin-core
+// security/operator-access/sync-job.ts); the admin's run SA holds no IAM
+// policy rights and may only start that job. The CLI owns the job, its
+// account, its grants and its schedule (packages/provisioning/src/
+// operator-access.ts, run by the wizard after migrations and by `upgrade`),
+// because the job's database user can only be assigned its role after the
+// migrations have created that role.
+
 // URL map: routes by host header.
 //   admin.<domain>  → admin backend (IAP-gated)
 //   <domain>        → default static bucket; /api/* → gateway
@@ -1034,8 +1096,9 @@ const dnsRecordsRequired: pulumi.Output<DnsRecord[]> = lbIp.address.apply((ip):
 ]);
 
 const out: CloudAdapterOutputs = {
-  adminDatabaseUrl: adminDatabaseUrl as unknown as string,
-  publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  // Password-less — the password lives only in Secret Manager.
+  adminDatabaseUrl: dbUrls.admin as unknown as string,
+  publicDatabaseUrl: dbUrls.public as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
   bootstrapUrl:

package/stacks/gcp-firebase/Pulumi.yaml

@@ -35,8 +35,7 @@ config:
   # The 7 cross-provider knobs (subset of gcp's 8 — no Cloud Armor adaptive protection here)
   caelo-gcp-firebase:region:
     type: string
-    default: us-central1
-    description: Primary GCP region (Cloud SQL, Cloud Run).
+    description: Primary GCP region (Cloud SQL, Cloud Run). Required, no default; chosen in the wizard and fixed after install (#607).
   caelo-gcp-firebase:cloudSqlTier:
     type: string
     default: db-f1-micro
@@ -53,6 +52,10 @@ config:
     type: string
     default: "0"
     description: Admin Cloud Run min instances.
+  caelo-gcp-firebase:adminMemory:
+    type: string
+    default: "2Gi"
+    description: Admin Cloud Run memory. 2Gi leaves room for the Lighthouse quality audit next to editor requests; billed only while an instance runs.
   caelo-gcp-firebase:adminMaxInstances:
     type: string
     default: "5"