@caelo-cms/provisioning 0.10.29 → 0.10.31

package/dist/lifecycle.js

@@ -15,11 +15,18 @@
  */
 import { existsSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
+import { join, resolve as resolvePath } from "node:path";
 import { cancel, confirm, isCancel, log, note, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { gcloud } from "./gcloud.js";
-import { installRoot, readMetadata, readSecret } from "./install-state.js";
+import { GCP_STACK_ENV, gatewayServiceAccountEmail, runServiceAccountEmail } from "./gcp-names.js";
+import { installRoot, readMetadata, readSecret, recordImageDigests, } from "./install-state.js";
 import { ensureMcpIapAccess } from "./mcp-iap.js";
+import { ensureOperatorAccessSync, resolveOperatorAccessTarget } from "./operator-access.js";
+import { assertRegionUnchanged } from "./regions.js";
+import { ensureGatewayServiceAccount, ensureGeneratedSecrets, plainGeneratedSecretSeed, ROTATABLE_SECRETS, readSecretReplication, rotateRuntimeSecret, rotationRefusal, } from "./runtime-secrets.js";
+import { MCP_ENV_VAR, OPERATOR_ACCESS_JOB_ENV_VAR } from "./stack-contract.js";
+import { ensureStackInvariants, liveContainerEnv, liveContainerMemory, liveEnvHasInlinePassword, planAdminMemory, planContractEnv, rollService, serviceRollArgs, } from "./stack-converge.js";
 /** Find the single install on this machine — or warn if 0/multiple. */
 function findActiveInstall() {
     const home = homedir();
@@ -44,6 +51,25 @@ function requireInstall() {
     }
     return found;
 }
+/**
+ * The install's recorded region (#607); exits with the actionable reason
+ * when install.json has none, or when `requested` names a different one.
+ */
+function installRegion(meta, requested) {
+    try {
+        return assertRegionUnchanged(meta, requested);
+    }
+    catch (e) {
+        log.error(red(e instanceof Error ? e.message : String(e)));
+        process.exit(1);
+    }
+}
+/** A Cloud Run lookup is regional; there is no default region to guess. */
+function requiredRegion(region) {
+    if (!region)
+        throw new Error("a Cloud Run lookup needs the install region (install.json)");
+    return region;
+}
 /**
  * Pulumi auto-naming appends a random 7-char suffix to every resource
  * (e.g. `caelo-production-admin-3efcfea`). Lifecycle commands need the
@@ -56,7 +82,7 @@ function requireInstall() {
 async function resolveGcpResourceName(kind, prefix, projectId, region) {
     const args = [];
     if (kind === "run-service") {
-        args.push("run", "services", "list", "--region", region ?? "europe-west1", "--project", projectId, "--filter", `metadata.name~^${prefix}`, "--format=value(metadata.name)");
+        args.push("run", "services", "list", "--region", requiredRegion(region), "--project", projectId, "--filter", `metadata.name~^${prefix}`, "--format=value(metadata.name)");
     }
     else {
         args.push("sql", "instances", "list", "--project", projectId, "--filter", `name~^${prefix}`, "--format=value(name)");
@@ -122,7 +148,7 @@ async function gcpStatus(meta) {
         return;
     const s = spinner();
     s.start("Resolving deployed resources + checking health...");
-    const region = meta.region ?? "europe-west1";
+    const region = installRegion(meta);
     const adminName = await resolveGcpResourceName("run-service", "caelo-production-admin", meta.projectId, region);
     const sqlName = await resolveGcpResourceName("sql-instance", "caelo-production-pg", meta.projectId);
     if (!adminName || !sqlName) {
@@ -202,6 +228,21 @@ async function resolveTagDigest(region, project, repo, image, tag) {
         return { ok: false, reason: e instanceof Error ? e.message : String(e) };
     }
 }
+/** The deployed service as `gcloud run services describe --format=json` returns it. */
+async function describeServiceJson(projectId, region, serviceName) {
+    const r = await gcloud([
+        "run",
+        "services",
+        "describe",
+        serviceName,
+        "--region",
+        region,
+        "--project",
+        projectId,
+        "--format=json",
+    ]);
+    return r.ok ? r.stdout : null;
+}
 /** Look up the currently-serving Cloud Run revision so we can roll back to it. */
 async function findCurrentRevision(projectId, region, serviceName) {
     const r = await gcloud([
@@ -274,7 +315,7 @@ async function resolveAdminIapResource(meta, region, adminServiceName) {
     return name ? { kind: "backend-services", service: name } : null;
 }
 export async function upgradeCommand(opts = {}) {
-    const { meta } = requireInstall();
+    const { installId, meta } = requireInstall();
     // v0.5.15 — extended to cover gcp-firebase too. Both providers share
     // the identical admin + gateway shape on Cloud Run (Artifact
     // Registry image, `caelo-production-<slug>` service naming, the same
@@ -288,7 +329,9 @@ export async function upgradeCommand(opts = {}) {
     }
     if (!meta.projectId)
         return;
-    const region = meta.region ?? "europe-west1";
+    // #607 — upgrade never moves an install: a `--region` other than the
+    // recorded one is refused before anything rolls.
+    const region = installRegion(meta, opts.region);
     const registryProject = "caelo-website";
     const registryRegion = "europe-west1";
     const registryRepo = "caelo-cms-images";
@@ -339,15 +382,57 @@ export async function upgradeCommand(opts = {}) {
             sPre.stop(red(`Could not capture current revision for ${slug} — refusing to roll`));
             return;
         }
+        const serviceJson = await describeServiceJson(meta.projectId, region, serviceName);
+        if (!serviceJson) {
+            sPre.stop(red(`Could not read the ${slug} service's configuration — refusing to roll`));
+            return;
+        }
         plans.push({
             slug,
             serviceName,
             digest,
             imageRef: `${registryRegion}-docker.pkg.dev/${registryProject}/${registryRepo}/${slug}@${digest}`,
             priorRevision,
+            liveEnv: liveContainerEnv(serviceJson),
+            liveMemory: liveContainerMemory(serviceJson),
         });
     }
-    sPre.stop(green(`Pre-flight ok — ${plans.length} services planned`));
+    const install = {
+        provider: meta.provider,
+        projectId: meta.projectId,
+        env: GCP_STACK_ENV,
+        domain: meta.domain,
+        region,
+    };
+    const deployed = Object.fromEntries(plans.map((p) => [p.slug, { serviceName: p.serviceName, liveEnv: p.liveEnv }]));
+    const envPlan = planContractEnv(install, deployed);
+    if (!envPlan.ok) {
+        sPre.stop(red("Pre-flight failed: the install's env contract can't be applied"));
+        log.error(envPlan.error);
+        return;
+    }
+    let rolls = plans.map((p) => {
+        // #553 — the admin runs the Lighthouse quality audit; raise it to the
+        // stack's memory default (never lowered; an unparsable value is kept).
+        const memory = p.slug === "admin" ? planAdminMemory(p.liveMemory) : null;
+        if (memory && !memory.ok)
+            log.warn(yellow(`admin memory left as is: ${memory.error}`));
+        return {
+            ...p,
+            envFlags: envPlan.services[p.slug].flags,
+            envChanges: envPlan.services[p.slug].changes,
+            resourceFlags: memory?.ok ? memory.flags : [],
+        };
+    });
+    sPre.stop(green(`Pre-flight ok — ${rolls.length} services planned`));
+    for (const roll of rolls) {
+        for (const f of roll.resourceFlags) {
+            log.info(`${roll.slug} ${bold("resources")}: ${roll.liveMemory ?? dim("(default)")} → ${f}`);
+        }
+        for (const c of roll.envChanges) {
+            log.info(`${roll.slug} env ${bold(c.name)}: ${c.from === undefined ? dim("(unset)") : c.from} → ${c.to === undefined ? dim("(removed)") : c.to}`);
+        }
+    }
     // ────────────────────────────────────────────────────────────────
     // P21 ship 4 — cosign verify each resolved digest against the
     // Caelo release workflow's keyless OIDC identity. Refuses to roll
@@ -368,6 +453,75 @@ export async function upgradeCommand(opts = {}) {
         log.warn(yellow("--skip-verify set — image signatures NOT verified."));
     }
     // ────────────────────────────────────────────────────────────────
+    // Runtime identities + secrets the env contract references: the
+    // gateway's own run SA and the CLI-generated secrets
+    // (runtime-secrets.ts). Created once, never overwritten. Must exist
+    // before the IAM invariants bind them and before the rolls reference
+    // them, so any failure aborts here.
+    // ────────────────────────────────────────────────────────────────
+    const sRt = spinner();
+    sRt.start("Ensuring the gateway service account + generated runtime secrets...");
+    const secretsTarget = { projectId: meta.projectId, env: GCP_STACK_ENV };
+    const replication = await readSecretReplication(secretsTarget);
+    const runtime = [
+        await ensureGatewayServiceAccount(secretsTarget),
+        ...(replication.ok
+            ? await ensureGeneratedSecrets({
+                ...secretsTarget,
+                replication: replication.replication,
+                seed: plainGeneratedSecretSeed(deployed.admin.liveEnv),
+            })
+            : [{ id: "secret replication", status: "failed", error: replication.error }]),
+    ];
+    const runtimeFailed = runtime.filter((o) => o.status === "failed");
+    if (runtimeFailed.length > 0) {
+        sRt.stop(red("Runtime identities/secrets could not be ensured. Aborting upgrade."));
+        for (const o of runtimeFailed)
+            log.error(red(`  FAILED: ${o.id}\n    ${o.error ?? ""}`));
+        log.warn("No traffic was shifted and no migrations ran. Fix the above and re-run.");
+        return;
+    }
+    sRt.stop(green("Gateway service account + runtime secrets ok"));
+    for (const o of runtime.filter((o) => o.status === "applied"))
+        log.info(`  created: ${o.id}`);
+    // ────────────────────────────────────────────────────────────────
+    // Converge the infrastructure the stack declares but upgrade can't get
+    // from an image roll: IAM bindings + CDN policy added to the stacks after
+    // this install was provisioned (stack-contract.ts). Additive + idempotent.
+    // A failure the install can't work without aborts here, before
+    // migrations or any traffic shift; the rest warn.
+    // ────────────────────────────────────────────────────────────────
+    const sInv = spinner();
+    sInv.start("Ensuring the IAM bindings + CDN settings the stack declares...");
+    const invariants = await ensureStackInvariants({
+        provider: meta.provider,
+        projectId: meta.projectId,
+        region,
+        env: GCP_STACK_ENV,
+        services: Object.fromEntries(rolls.map((r) => [r.slug, r.serviceName])),
+    });
+    const applied = invariants.outcomes.filter((o) => o.status === "applied");
+    const failed = invariants.outcomes.filter((o) => o.status === "failed");
+    if (invariants.mustAbort) {
+        sInv.stop(red("Stack invariants could not be ensured. Aborting upgrade."));
+    }
+    else {
+        sInv.stop(green(`Stack invariants ok (${invariants.outcomes.length - failed.length}/${invariants.outcomes.length}, ${applied.length} applied)`));
+    }
+    for (const o of applied)
+        log.info(`  applied: ${o.id} ${dim(`(${o.why})`)}`);
+    for (const o of failed) {
+        const line = `  ${o.onFailure === "abort" ? "FAILED" : "not applied"}: ${o.id} — ${o.why}\n    ${o.error ?? ""}`;
+        if (o.onFailure === "abort")
+            log.error(red(line));
+        else
+            log.warn(yellow(line));
+    }
+    if (invariants.mustAbort) {
+        log.warn("No traffic was shifted and no migrations ran. Fix the bindings above and re-run.");
+        return;
+    }
+    // ────────────────────────────────────────────────────────────────
     // P21 ship 3 — DB migrations BEFORE traffic shifts. Idempotent
     // (drizzle bookkeeping table); a failure here aborts the upgrade
     // before the new image touches traffic, so the admin keeps
@@ -382,7 +536,7 @@ export async function upgradeCommand(opts = {}) {
     // so new migrations were silently skipped. Production hit this on
     // every upgrade that introduced schema changes — the symptom was
     // post-rollout queries failing with "column does not exist".
-    const adminPlan = plans.find((p) => p.slug === "admin");
+    const adminPlan = rolls.find((p) => p.slug === "admin");
     const mig = await runMigrationsViaCloudRunJob({
         projectId: meta.projectId,
         region,
@@ -399,13 +553,14 @@ export async function upgradeCommand(opts = {}) {
     sMig.stop(green("Migrations applied"));
     // ────────────────────────────────────────────────────────────────
     // Issue #37 — MCP through IAP. Idempotently ensure the MCP service
-    // account + its IAP/token-creator bindings, then hand its email to the
-    // new admin revision (CAELO_MCP_IAP_SERVICE_ACCOUNT) so /security/mcp
-    // shows a working `claude mcp add` command. Installs provisioned before
-    // this existed get it here, with no operator config. A failure only
-    // costs MCP access, so it warns instead of aborting the upgrade.
+    // account + its IAP/token-creator bindings; the admin learns the SA's
+    // email from CAELO_MCP_IAP_SERVICE_ACCOUNT in the env contract. Installs
+    // provisioned before this existed get it here, with no operator config.
+    // A failure only costs MCP access, so it warns instead of aborting.
     // ────────────────────────────────────────────────────────────────
-    let mcpServiceAccount = null;
+    // Env vars the rolls must leave as the service has them, because the
+    // thing they point at could not be set up.
+    const leaveUntouched = [];
     if (adminPlan) {
         const sMcp = spinner();
         sMcp.start("Ensuring MCP access through IAP...");
@@ -414,39 +569,82 @@ export async function upgradeCommand(opts = {}) {
             ? await ensureMcpIapAccess({ projectId: meta.projectId, resource })
             : { ok: false, error: "admin IAP backend service not found" };
         if (mcp.ok) {
-            mcpServiceAccount = mcp.serviceAccount;
             sMcp.stop(green(`MCP access ready (${mcp.serviceAccount}; ${mcp.operators.length} operator(s))`));
         }
         else {
             sMcp.stop(yellow(`MCP access not configured: ${mcp.error}`));
             log.warn("The upgrade continues; external MCP clients stay blocked by IAP until this succeeds.");
+            // Don't hand the admin an MCP service account that may not exist or
+            // lacks its bindings: /security/mcp would print a `claude mcp add`
+            // command that can't work. Leave the var as the service has it.
+            leaveUntouched.push(MCP_ENV_VAR);
+        }
+        // ──────────────────────────────────────────────────────────────
+        // Operator access: the sync job that keeps Google IAP in step with the
+        // user list (operator-access.ts) — its own SA, the only principal that
+        // may change the IAP binding; the admin may only start it. Also removes
+        // the operator-access rights an earlier revision gave the admin's SA.
+        // After migrations: the job's database user gets the role migration
+        // 0239 creates. A failure only costs IAP following the user list, so it
+        // warns; the admin then reports the sync as not set up, loudly.
+        // ──────────────────────────────────────────────────────────────
+        const sOa = spinner();
+        sOa.start("Ensuring the operator-access sync job...");
+        const resolved = await resolveOperatorAccessTarget({
+            provider: meta.provider,
+            projectId: meta.projectId,
+            region,
+            env: GCP_STACK_ENV,
+            ownerEmail: meta.ownerEmail,
+            imageRef: adminPlan.imageRef,
+        });
+        const oa = resolved.ok
+            ? await ensureOperatorAccessSync(resolved.target)
+            : { ok: false, done: [], error: resolved.error };
+        for (const step of oa.done)
+            log.info(`  ${dim(step)}`);
+        if (oa.ok) {
+            sOa.stop(green("Operator-access sync job ready (IAP follows the user list)"));
+        }
+        else {
+            sOa.stop(yellow(`Operator-access sync job not set up: ${oa.error}`));
+            log.warn("The upgrade continues; user changes will report that Google IAP could not be updated until this succeeds. Re-run upgrade once the cause is fixed.");
+            leaveUntouched.push(OPERATOR_ACCESS_JOB_ENV_VAR);
+        }
+    }
+    if (leaveUntouched.length > 0) {
+        const replan = planContractEnv(install, deployed, { leaveUntouched });
+        if (replan.ok) {
+            rolls = rolls.map((r) => ({
+                ...r,
+                envFlags: replan.services[r.slug].flags,
+                envChanges: replan.services[r.slug].changes,
+            }));
         }
     }
     // ────────────────────────────────────────────────────────────────
     // Phase 2: roll each service, probe health, auto-rollback on fail.
     // If admin succeeds but gateway fails, also roll admin back so the
-    // operator never ends up on a mismatched-version pair.
+    // operator never ends up on a mismatched-version pair. The env
+    // contract's changes ride the same `services update` as the image, so
+    // they land in the new revision (and roll back with it). So does the
+    // service's run SA: the gateway moves to its own SA here.
     // ────────────────────────────────────────────────────────────────
     const rolled = [];
-    for (const plan of plans) {
+    for (const plan of rolls) {
         const s = spinner();
         s.start(`Rolling ${plan.slug} → ${plan.digest.slice(0, 19)}...`);
-        const upd = await gcloud([
-            "run",
-            "services",
-            "update",
-            plan.serviceName,
-            "--region",
+        const upd = await rollService(serviceRollArgs({
+            serviceName: plan.serviceName,
             region,
-            "--project",
-            meta.projectId,
-            "--image",
-            plan.imageRef,
-            ...(plan.slug === "admin" && mcpServiceAccount
-                ? [`--update-env-vars=CAELO_MCP_IAP_SERVICE_ACCOUNT=${mcpServiceAccount}`]
-                : []),
-            "--quiet",
-        ]);
+            projectId: meta.projectId,
+            imageRef: plan.imageRef,
+            serviceAccount: plan.slug === "admin"
+                ? runServiceAccountEmail(meta.projectId, GCP_STACK_ENV)
+                : gatewayServiceAccountEmail(meta.projectId, GCP_STACK_ENV),
+            envFlags: plan.envFlags,
+            resourceFlags: plan.resourceFlags,
+        }));
         if (!upd.ok) {
             s.stop(red(`Failed: ${upd.stderr.trim()}`));
             await rollbackPriorlyRolled(meta.projectId, region, rolled);
@@ -501,6 +699,74 @@ export async function upgradeCommand(opts = {}) {
         rolled.push(plan);
     }
     log.success(`Upgrade to ${bold(targetTag)} complete (admin + gateway revisions Ready).`);
+    if (rolls.some((r) => liveEnvHasInlinePassword(r.liveEnv))) {
+        // The services just moved their database password to Secret Manager,
+        // but every earlier revision still shows it in its env.
+        log.warn(yellow(`The database password was stored in plain env vars before this upgrade and stays readable in the services' old revisions. Rotate it now: ${bold("bunx @caelo-cms/provisioning rotate-secret postgres-password")}`));
+    }
+    const digestOf = (slug) => {
+        const roll = rolls.find((r) => r.slug === slug);
+        if (!roll)
+            throw new Error(`upgrade rolled no ${slug} service`);
+        return roll.digest;
+    };
+    await recordRolledDigests(installId, meta.provider, {
+        admin: digestOf("admin"),
+        gateway: digestOf("gateway"),
+    });
+}
+/**
+ * Record the digests just rolled so nothing re-deploys an older release:
+ * install.json (what a wizard re-run deploys) and the Pulumi stack config
+ * (what a plain `pulumi up` deploys). The roll already succeeded, so each
+ * write that fails warns with the exact manual fix instead of failing the
+ * upgrade, and one failing never skips the other.
+ */
+async function recordRolledDigests(installId, provider, digests) {
+    const reason = (e) => (e instanceof Error ? e.message.split("\n")[0] : String(e));
+    try {
+        recordImageDigests(installId, digests);
+    }
+    catch (e) {
+        log.warn(yellow(`Could not record the rolled digests in ${installRoot(installId)}/install.json (${reason(e)}). Add this before re-running the installer, or it deploys the newest release instead:\n  "imageDigests": ${JSON.stringify(digests)}`));
+    }
+    const manual = stackConfigRecovery(installId, provider, digests);
+    const passphrase = readSecret(installId, "pulumi-passphrase");
+    if (!passphrase) {
+        log.warn(yellow(`No Pulumi passphrase in ~/.caelo-${installId}/secrets — stack config not updated. Before any manual \`pulumi up\`, run:\n${manual}`));
+        return;
+    }
+    try {
+        const { writeImageDigestsToStack } = await import("./wizards/gcp-pulumi.js");
+        const { removedOverrides } = await writeImageDigestsToStack({
+            installRoot: installRoot(installId),
+            pulumiPassphrase: passphrase,
+            provider,
+            digests,
+        });
+        log.info(dim("Pinned the rolled image digests in the Pulumi stack config."));
+        if (removedOverrides.length > 0) {
+            log.warn(yellow(`Removed ${removedOverrides.join(", ")} from the stack config: those image overrides win over the digest pins, so a later \`pulumi up\` would have rolled back to them.`));
+        }
+    }
+    catch (e) {
+        log.warn(yellow(`Could not pin the rolled digests in the Pulumi stack config (${reason(e)}). Before any manual \`pulumi up\`, run:\n${manual}`));
+    }
+}
+/**
+ * Shell commands that pin `digests` in the install's own Pulumi stack, with
+ * the same workspace, backend, stack and passphrase the CLI uses — run from
+ * any directory, they cannot hit an unrelated stack.
+ */
+function stackConfigRecovery(installId, provider, digests) {
+    const root = installRoot(installId);
+    const env = `PULUMI_BACKEND_URL=file://${join(root, "state")} PULUMI_CONFIG_PASSPHRASE="$(cat ${join(root, "secrets", "pulumi-passphrase")})"`;
+    const cwd = `--cwd ${resolvePath(import.meta.dir, "../stacks", provider)} --stack ${GCP_STACK_ENV}`;
+    const lines = Object.entries(digests).map(([svc, d]) => `  ${env} pulumi config set ${cwd} caelo-${provider}:image-digest-${svc} ${d}`);
+    if (provider === "gcp") {
+        lines.push(`  ${env} pulumi config rm ${cwd} caelo-gcp:image-admin  # only if set`, `  ${env} pulumi config rm ${cwd} caelo-gcp:image-gateway  # only if set`);
+    }
+    return lines.join("\n");
 }
 /**
  * Roll back any services that already passed their probe in this
@@ -662,30 +928,54 @@ export async function backupCommand() {
 export async function rotateSecretCommand(name) {
     if (!name) {
         log.error(red("Usage: caelo-cms rotate-secret <name>"));
-        log.warn(`Names: ${[
-            "postgres-password",
-            "csrf-secret",
-            "cookie-secret",
-            "secret-kek",
-            "anthropic-api-key",
-            "resend-api-key",
-        ].join(", ")}`);
+        log.warn(`Names: ${ROTATABLE_SECRETS.join(", ")}`);
         process.exit(2);
     }
+    const refusal = rotationRefusal(name);
+    if (refusal) {
+        log.error(red(refusal));
+        process.exit(2);
+    }
+    const secret = name;
     const { meta } = requireInstall();
-    if (meta.provider !== "gcp") {
+    if (meta.provider !== "gcp" && meta.provider !== "gcp-firebase") {
         log.warn(`rotate-secret for provider ${meta.provider} not yet implemented.`);
         return;
     }
-    log.warn(yellow(`Secret rotation v1 prints the gcloud command for you to run. Full automation lands in a follow-up.`));
-    note([
-        bold("Run this from your terminal:"),
-        "",
-        `  ${cyan(`echo -n "<new-value>" | gcloud secrets versions add caelo-production-${name} --data-file=- --project=${meta.projectId}`)}`,
-        "",
-        `Then redeploy admin + gateway to pick up the new value:`,
-        `  ${cyan(`bunx @caelo-cms/provisioning upgrade`)}`,
-    ].join("\n"), "Rotate secret");
+    if (!meta.projectId)
+        return;
+    const region = installRegion(meta);
+    const s = spinner();
+    s.start(`Rotating ${secret}...`);
+    const services = {};
+    for (const slug of ["admin", "gateway"]) {
+        const serviceName = await resolveGcpResourceName("run-service", `caelo-production-${slug}`, meta.projectId, region);
+        if (!serviceName) {
+            s.stop(red(`Could not find caelo-production-${slug}* Cloud Run service — nothing rotated`));
+            return;
+        }
+        services[slug] = serviceName;
+    }
+    const sqlInstance = secret === "postgres-password"
+        ? await resolveGcpResourceName("sql-instance", "caelo-production-pg", meta.projectId)
+        : null;
+    const report = await rotateRuntimeSecret({
+        projectId: meta.projectId,
+        region,
+        env: GCP_STACK_ENV,
+        services: services,
+        ...(sqlInstance ? { sqlInstance } : {}),
+    }, secret);
+    if (report.ok) {
+        s.stop(green(`${secret} rotated`));
+    }
+    else {
+        s.stop(red(`Rotating ${secret} failed`));
+    }
+    for (const step of report.steps)
+        log.info(`  ${step}`);
+    if (report.error)
+        log.error(red(report.error));
 }
 // =========================================================================
 // destroy — pulumi destroy + gcloud projects delete
@@ -729,7 +1019,7 @@ export async function truncateCommand() {
     }
     if ((meta.provider === "gcp" || meta.provider === "gcp-firebase") && meta.projectId) {
         const { truncateViaCloudRunJob } = await import("./migration-runner.js");
-        const region = meta.region ?? "europe-west1";
+        const region = installRegion(meta);
         const r = await truncateViaCloudRunJob({ projectId: meta.projectId, region });
         if (!r.ok) {
             cancel(`Truncate failed: ${r.error}.`);