@caelo-cms/provisioning 0.10.38 → 0.10.40

package/dist/admin-domain.d.ts

@@ -1,6 +1,8 @@
 /**
  * `cms-provision admin-domain enable` — serve a gcp-firebase admin at
- * `admin.<domain>` instead of its `*.run.app` URL.
+ * `admin.<domain>` instead of its `*.run.app` URL — and, the same way,
+ * `cms-provision staging-domain enable` (#650): serve the protected staging
+ * site at `staging.<domain>` from the gateway, which gates and proxies it.
  *
  * The gcp-firebase stack only creates that Cloud Run domain mapping behind
  * `provisionAdminDomain=true`, off by default: Google refuses a mapping
@@ -44,11 +46,27 @@ export type AdminDomainResult = {
     status: "failed";
     error: string;
 };
-export declare function enableAdminDomain(opts: {
+/** What `staging-domain enable` reports; same shape as the admin's. */
+export type StagingDomainResult = AdminDomainResult;
+interface DomainOpts {
     projectId: string;
     region: string;
     domain: string;
     run?: Run;
-}): Promise<AdminDomainResult>;
+    /** Progress lines (the one-time `beta` component install); defaults to stdout. */
+    log?: (message: string) => void;
+}
+export declare function enableAdminDomain(opts: DomainOpts): Promise<AdminDomainResult>;
+/**
+ * #650 — map the install's staging host (its setting, default
+ * `staging.<domain>`; any FQDN) to the gateway, which serves the protected
+ * staging site. Cloud Run refuses domain-mapped requests while a service's
+ * ingress is internal-only, so the gateway's ingress is opened first (the
+ * stack declares the same since #650; installs from before keep the old
+ * value until this runs). Idempotent like the admin mapping.
+ */
+export declare function enableStagingDomain(opts: DomainOpts & {
+    stagingHost: string;
+}): Promise<StagingDomainResult>;
 export {};
 //# sourceMappingURL=admin-domain.d.ts.map

package/dist/admin-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-domain.d.ts","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAexC,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;CACX,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyF7B"}
+{"version":3,"file":"admin-domain.d.ts","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAGzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAepD,UAAU,UAAU;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AA2CD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAMpF;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,mBAAmB,CAAC,CAwC9B"}

package/dist/admin-domain.js

@@ -1,7 +1,9 @@
 // SPDX-License-Identifier: MPL-2.0
 /**
  * `cms-provision admin-domain enable` — serve a gcp-firebase admin at
- * `admin.<domain>` instead of its `*.run.app` URL.
+ * `admin.<domain>` instead of its `*.run.app` URL — and, the same way,
+ * `cms-provision staging-domain enable` (#650): serve the protected staging
+ * site at `staging.<domain>` from the gateway, which gates and proxies it.
  *
  * The gcp-firebase stack only creates that Cloud Run domain mapping behind
  * `provisionAdminDomain=true`, off by default: Google refuses a mapping
@@ -26,6 +28,7 @@
  * from the start.
  */
 import { gcloud as defaultGcloud } from "./gcloud.js";
+import { ensureGcloudComponent } from "./gcloud-components.js";
 function recordsOf(json, hostname) {
     const parsed = JSON.parse(json);
     return (parsed.status?.resourceRecords ?? []).map((r) => ({
@@ -34,36 +37,105 @@ function recordsOf(json, hostname) {
         value: r.rrdata ?? "",
     }));
 }
-export async function enableAdminDomain(opts) {
-    const run = opts.run ?? defaultGcloud;
-    const hostname = `admin.${opts.domain}`;
-    const scope = [`--region=${opts.region}`, `--project=${opts.projectId}`];
+function logOf(opts) {
+    return opts.log ?? ((message) => console.log(message));
+}
+/** The one deployed Cloud Run service of `slug` (Pulumi-suffixed name). */
+async function findService(run, scope, slug) {
+    const prefix = `caelo-production-${slug}`;
     const services = await run([
         "run",
         "services",
         "list",
         ...scope,
-        "--filter=metadata.name~^caelo-production-admin",
+        `--filter=metadata.name~^${prefix}`,
         "--format=value(metadata.name)",
     ]);
     if (!services.ok) {
-        return { status: "failed", error: `list Cloud Run services: ${services.stderr.trim()}` };
+        return { ok: false, error: `list Cloud Run services: ${services.stderr.trim()}` };
     }
     const matches = services.stdout
         .split("\n")
         .map((s) => s.trim())
         .filter(Boolean);
-    // Fail closed like the other admin lookups: with a leftover service from a
-    // failed deploy, picking one would bind the domain to the wrong revision.
+    // Fail closed like the other service lookups: with a leftover service from
+    // a failed deploy, picking one would bind the domain to the wrong revision.
     const service = matches.length === 1 ? matches[0] : undefined;
     if (!service) {
         return {
-            status: "failed",
+            ok: false,
             error: matches.length === 0
-                ? "admin Cloud Run service not found: no caelo-production-admin* service"
-                : `expected exactly one caelo-production-admin* Cloud Run service, found ${matches.length} (${matches.join(", ")}); delete the stale one first`,
+                ? `${slug} Cloud Run service not found: no ${prefix}* service`
+                : `expected exactly one ${prefix}* Cloud Run service, found ${matches.length} (${matches.join(", ")}); delete the stale one first`,
         };
     }
+    return { ok: true, service };
+}
+export async function enableAdminDomain(opts) {
+    const run = opts.run ?? defaultGcloud;
+    const scope = [`--region=${opts.region}`, `--project=${opts.projectId}`];
+    const found = await findService(run, scope, "admin");
+    if (!found.ok)
+        return { status: "failed", error: found.error };
+    return mapDomain(run, logOf(opts), scope, opts.domain, `admin.${opts.domain}`, found.service);
+}
+/**
+ * #650 — map the install's staging host (its setting, default
+ * `staging.<domain>`; any FQDN) to the gateway, which serves the protected
+ * staging site. Cloud Run refuses domain-mapped requests while a service's
+ * ingress is internal-only, so the gateway's ingress is opened first (the
+ * stack declares the same since #650; installs from before keep the old
+ * value until this runs). Idempotent like the admin mapping.
+ */
+export async function enableStagingDomain(opts) {
+    const run = opts.run ?? defaultGcloud;
+    const scope = [`--region=${opts.region}`, `--project=${opts.projectId}`];
+    const found = await findService(run, scope, "gateway");
+    if (!found.ok)
+        return { status: "failed", error: found.error };
+    const ingress = await run([
+        "run",
+        "services",
+        "describe",
+        found.service,
+        ...scope,
+        '--format=value(metadata.annotations["run.googleapis.com/ingress"])',
+    ]);
+    if (!ingress.ok) {
+        return { status: "failed", error: `read the gateway's ingress: ${ingress.stderr.trim()}` };
+    }
+    if (ingress.stdout.trim() !== "all") {
+        const update = await run([
+            "run",
+            "services",
+            "update",
+            found.service,
+            ...scope,
+            "--ingress=all",
+            "--quiet",
+        ]);
+        if (!update.ok) {
+            return {
+                status: "failed",
+                error: `open the gateway's ingress for the domain mapping: ${update.stderr.trim()}`,
+            };
+        }
+    }
+    // Search Console verification: the install domain covers its own
+    // subdomains; a host on another domain is verified itself.
+    const verifyDomain = opts.stagingHost === opts.domain || opts.stagingHost.endsWith(`.${opts.domain}`)
+        ? opts.domain
+        : opts.stagingHost;
+    return mapDomain(run, logOf(opts), scope, verifyDomain, opts.stagingHost, found.service);
+}
+/** Steps 2–4 of the module doc for `hostname` → `service`. */
+async function mapDomain(run, log, scope, domain, hostname, service) {
+    // Fully managed Cloud Run domain mappings exist only on the beta track: the
+    // GA `gcloud run domain-mappings` is Cloud Run for Anthos only. Install the
+    // component up front instead of letting gcloud ask for it mid-command.
+    const beta = await ensureGcloudComponent("beta", { run, log });
+    if (!beta.ok)
+        return { status: "failed", error: beta.error };
     const describeArgs = [
         "beta",
         "run",
@@ -88,15 +160,15 @@ export async function enableAdminDomain(opts) {
         return { status: "failed", error: `list verified domains: ${verified.stderr.trim()}` };
     }
     const verifiedIds = verified.stdout.split("\n").map((s) => s.trim());
-    if (!verifiedIds.includes(opts.domain) && !verifiedIds.includes(hostname)) {
-        const verify = await run(["domains", "verify", opts.domain]);
+    if (!verifiedIds.includes(domain) && !verifiedIds.includes(hostname)) {
+        const verify = await run(["domains", "verify", domain]);
         if (!verify.ok) {
             return {
                 status: "failed",
-                error: `start domain verification for ${opts.domain}: ${verify.stderr.trim()}`,
+                error: `start domain verification for ${domain}: ${verify.stderr.trim()}`,
             };
         }
-        return { status: "needs-verification", hostname, verifyDomain: opts.domain };
+        return { status: "needs-verification", hostname, verifyDomain: domain };
     }
     const create = await run([
         "beta",

package/dist/admin-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-domain.js","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AAmBzE,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/E,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAKvC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAG,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,MAAM;QACN,GAAG,KAAK;QACR,gDAAgD;QAChD,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,4BAA4B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM;SAC5B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EACH,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,uEAAuE;gBACzE,CAAC,CAAC,yEAAyE,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;SACpJ,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG;QACnB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,UAAU;QACV,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,eAAe;KAChB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,wEAAwE;QACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,iCAAiC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aAC/E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,QAAQ;QACR,aAAa,OAAO,EAAE;QACtB,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"admin-domain.js","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAsB/D,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/E,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAWD,SAAS,KAAK,CAAC,IAAgB;IAC7B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,WAAW,CACxB,GAAQ,EACR,KAAe,EACf,IAAyB;IAEzB,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,MAAM;QACN,GAAG,KAAK;QACR,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM;SAC5B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,GAAG,IAAI,oCAAoC,MAAM,WAAW;gBAC9D,CAAC,CAAC,wBAAwB,MAAM,8BAA8B,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;SACvI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAgB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;QACxB,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,oEAAoE;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,+BAA+B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,UAAU;YACV,QAAQ;YACR,KAAK,CAAC,OAAO;YACb,GAAG,KAAK;YACR,eAAe;YACf,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,sDAAsD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,iEAAiE;IACjE,2DAA2D;IAC3D,MAAM,YAAY,GAChB,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9E,CAAC,CAAC,IAAI,CAAC,MAAM;QACb,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACvB,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,GAA8B,EAC9B,KAAe,EACf,MAAc,EACd,QAAgB,EAChB,OAAe;IAEf,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAE7D,MAAM,YAAY,GAAG;QACnB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,UAAU;QACV,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,eAAe;KAChB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,wEAAwE;QACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,iCAAiC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aAC1E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,QAAQ;QACR,aAAa,OAAO,EAAE;QACtB,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;AACJ,CAAC"}

package/dist/cert-wait.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Waiting for a Google-managed TLS certificate (§11.C: the CLI polls certs
+ * itself instead of telling the operator to check back later).
+ *
+ * Two certificate sources, one wait loop:
+ *   - the `gcp` load balancer's managed SSL certificates
+ *     ({@link lbCertProbe}) — the installer waits for the admin host;
+ *   - a Cloud Run domain mapping's certificate ({@link domainMappingProbe})
+ *     — `admin-domain enable` / `staging-domain enable` on gcp-firebase.
+ *
+ * {@link waitForCert} is pure apart from its injected clock, sleep and
+ * probe, so the timeout and progress behaviour is unit-tested without
+ * gcloud or real time.
+ */
+import type { GcloudResult } from "./gcloud.js";
+type Run = (args: string[]) => Promise<GcloudResult>;
+/** One look at a certificate. */
+export type CertProbe = {
+    readonly state: "ready";
+} | {
+    readonly state: "pending";
+    readonly detail: string;
+}
+/** gcloud itself failed (auth, permissions) — waiting will not fix it. */
+ | {
+    readonly state: "error";
+    readonly error: string;
+};
+export type CertWaitResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly reason: "timeout";
+    readonly lastDetail: string;
+} | {
+    readonly ok: false;
+    readonly reason: "error";
+    readonly error: string;
+};
+export interface CertWaitOpts {
+    readonly probe: () => Promise<CertProbe>;
+    readonly timeoutMs: number;
+    readonly intervalMs: number;
+    /** Called whenever the probe's detail text changes (spinner message). */
+    readonly onUpdate?: (detail: string) => void;
+    readonly sleep?: (ms: number) => Promise<void>;
+    readonly now?: () => number;
+}
+/**
+ * Poll `probe` until the certificate is ready, gcloud fails, or `timeoutMs`
+ * passes. The probe runs once more at the deadline so a certificate that
+ * flips during the last interval is not reported as a timeout.
+ */
+export declare function waitForCert(opts: CertWaitOpts): Promise<CertWaitResult>;
+/**
+ * The certificate state of the Cloud Run domain mapping for `hostname`.
+ * Ready once the mapping's `Ready` condition is True (Google sets it after
+ * `CertificateProvisioned` and `DomainRoutable`); until then the detail is
+ * the first non-True condition's message, which says what Google waits for
+ * (usually the DNS record).
+ */
+export declare function domainMappingProbe(run: Run, target: {
+    readonly hostname: string;
+    readonly region: string;
+    readonly projectId: string;
+}): Promise<CertProbe>;
+/**
+ * Whether the `gcp` load balancer has an ACTIVE managed certificate that
+ * covers `hostname`. Any such certificate counts: installs from before the
+ * admin got its own certificate serve the admin from the combined one.
+ * A certificate is only served once its overall status is ACTIVE, so a
+ * combined certificate whose other domain still fails does not count.
+ */
+export declare function lbCertProbe(run: Run, target: {
+    readonly projectId: string;
+    readonly hostname: string;
+}): Promise<CertProbe>;
+/**
+ * How long the CLI waits for a certificate before handing the operator the
+ * status command. Google documents up to 60 min after DNS resolves.
+ */
+export declare const CERT_WAIT_TIMEOUT_MS: number;
+export {};
+//# sourceMappingURL=cert-wait.d.ts.map

package/dist/cert-wait.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-wait.d.ts","sourceRoot":"","sources":["../src/cert-wait.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,iCAAiC;AACjC,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACxD,0EAA0E;GACxE;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB7E;AASD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzF,OAAO,CAAC,SAAS,CAAC,CAwBpB;AAOD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,GAAG,EACR,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChE,OAAO,CAAC,SAAS,CAAC,CA+BpB;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAAiB,CAAC"}

package/dist/cert-wait.js

@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Poll `probe` until the certificate is ready, gcloud fails, or `timeoutMs`
+ * passes. The probe runs once more at the deadline so a certificate that
+ * flips during the last interval is not reported as a timeout.
+ */
+export async function waitForCert(opts) {
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const deadline = now() + opts.timeoutMs;
+    let lastDetail = "";
+    for (;;) {
+        const p = await opts.probe();
+        if (p.state === "ready")
+            return { ok: true };
+        if (p.state === "error")
+            return { ok: false, reason: "error", error: p.error };
+        if (p.detail !== lastDetail) {
+            lastDetail = p.detail;
+            opts.onUpdate?.(p.detail);
+        }
+        const remaining = deadline - now();
+        if (remaining <= 0)
+            return { ok: false, reason: "timeout", lastDetail };
+        await sleep(Math.min(opts.intervalMs, remaining));
+    }
+}
+/**
+ * The certificate state of the Cloud Run domain mapping for `hostname`.
+ * Ready once the mapping's `Ready` condition is True (Google sets it after
+ * `CertificateProvisioned` and `DomainRoutable`); until then the detail is
+ * the first non-True condition's message, which says what Google waits for
+ * (usually the DNS record).
+ */
+export async function domainMappingProbe(run, target) {
+    const r = await run([
+        "beta",
+        "run",
+        "domain-mappings",
+        "describe",
+        `--domain=${target.hostname}`,
+        `--region=${target.region}`,
+        `--project=${target.projectId}`,
+        "--format=json",
+    ]);
+    if (!r.ok)
+        return { state: "error", error: `describe the domain mapping: ${r.stderr.trim()}` };
+    const conditions = JSON.parse(r.stdout).status?.conditions ??
+        [];
+    const ready = conditions.find((c) => c.type === "Ready");
+    if (ready?.status === "True")
+        return { state: "ready" };
+    const blocking = conditions.find((c) => c.type === "CertificateProvisioned" && c.status !== "True") ??
+        conditions.find((c) => c.status !== "True");
+    const detail = blocking
+        ? `${blocking.type}: ${blocking.message || blocking.reason || blocking.status || "pending"}`
+        : "Google has not reported the mapping's status yet";
+    return { state: "pending", detail };
+}
+/**
+ * Whether the `gcp` load balancer has an ACTIVE managed certificate that
+ * covers `hostname`. Any such certificate counts: installs from before the
+ * admin got its own certificate serve the admin from the combined one.
+ * A certificate is only served once its overall status is ACTIVE, so a
+ * combined certificate whose other domain still fails does not count.
+ */
+export async function lbCertProbe(run, target) {
+    const r = await run([
+        "compute",
+        "ssl-certificates",
+        "list",
+        "--global",
+        `--project=${target.projectId}`,
+        "--format=json",
+    ]);
+    if (!r.ok)
+        return { state: "error", error: `list SSL certificates: ${r.stderr.trim()}` };
+    const covering = JSON.parse(r.stdout).filter((c) => c.managed?.domainStatus?.[target.hostname] !== undefined);
+    if (covering.some((c) => c.managed?.status === "ACTIVE" && c.managed.domainStatus?.[target.hostname] === "ACTIVE")) {
+        return { state: "ready" };
+    }
+    if (covering.length === 0) {
+        return { state: "pending", detail: `no managed certificate lists ${target.hostname} yet` };
+    }
+    const detail = covering
+        .map((c) => `${c.name ?? "certificate"}: ${target.hostname} ${c.managed?.domainStatus?.[target.hostname]}`)
+        .join("; ");
+    return { state: "pending", detail };
+}
+/**
+ * How long the CLI waits for a certificate before handing the operator the
+ * status command. Google documents up to 60 min after DNS resolves.
+ */
+export const CERT_WAIT_TIMEOUT_MS = 60 * 60 * 1000;
+//# sourceMappingURL=cert-wait.js.map

package/dist/cert-wait.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-wait.js","sourceRoot":"","sources":["../src/cert-wait.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA2CnC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IACxC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC5B,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;YACtB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACxE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAQ,EACR,MAA0F;IAE1F,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,UAAU;QACV,YAAY,MAAM,CAAC,QAAQ,EAAE;QAC7B,YAAY,MAAM,CAAC,MAAM,EAAE;QAC3B,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC/F,MAAM,UAAU,GACb,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAsD,CAAC,MAAM,EAAE,UAAU;QAC7F,EAAE,CAAC;IACL,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACzD,IAAI,KAAK,EAAE,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACxD,MAAM,QAAQ,GACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,wBAAwB,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;QAClF,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ;QACrB,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE;QAC5F,CAAC,CAAC,kDAAkD,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAQ,EACR,MAAiE;IAEjE,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,SAAS;QACT,kBAAkB;QAClB,MAAM;QACN,UAAU;QACV,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACzF,MAAM,QAAQ,GAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAA0B,CAAC,MAAM,CACpE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,SAAS,CAChE,CAAC;IACF,IACE,QAAQ,CAAC,IAAI,CACX,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAC3F,EACD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gCAAgC,MAAM,CAAC,QAAQ,MAAM,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ;SACpB,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,CAAC,IAAI,IAAI,aAAa,KAAK,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CACjG;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/checkpoint-secrets.d.ts

@@ -0,0 +1,88 @@
+/** One place a JSON value holds secret material. Never carries the secret itself. */
+export interface SecretFinding {
+    /** Dotted path to the offending value, e.g. `steps.pulumi-up-acme.outputs.adminDatabaseUrlOut`. */
+    readonly path: string;
+    /**
+     * `credential-url`: a URL whose user-info carries a password.
+     * `token-url`: a URL with a token / secret / password query parameter.
+     * `secret-key`: a key whose name marks its value as secret.
+     */
+    readonly kind: "credential-url" | "token-url" | "secret-key";
+    /** For a credential URL: the user whose password it carries. */
+    readonly user?: string;
+}
+/**
+ * Every place `value` holds secret material.
+ *
+ * @param value any JSON-shaped value (a checkpoint payload, install.json)
+ * @param path the path prefix to report findings under
+ */
+export declare function findSecrets(value: unknown, path?: string): SecretFinding[];
+/**
+ * Throw when `value` holds secret material. The message names the paths,
+ * never the values, so the error itself cannot leak them.
+ *
+ * @param what what was about to be written, for the message
+ */
+export declare function assertNoSecrets(value: unknown, what: string): void;
+/** {@link assertNoSecrets} for a whole checkpoint (see {@link findCheckpointSecrets}). */
+export declare function assertNoCheckpointSecrets(checkpoint: unknown, what: string): void;
+/**
+ * {@link findSecrets} for a progress.json checkpoint. Its step names are
+ * derived from operator input (`project-<project id>`), so they are
+ * identifiers, not field names: a project called `acme-token` must not read
+ * as a secret. Only the step payloads (and the other top-level fields) are
+ * inspected.
+ */
+export declare function findCheckpointSecrets(checkpoint: unknown): SecretFinding[];
+/**
+ * `value` without its secret material: secret-named keys and strings that
+ * hold a credential or token URL are dropped. Everything else is kept.
+ */
+export declare function withoutSecrets(value: unknown): unknown;
+/**
+ * The Pulumi outputs worth checkpointing: everything except outputs Pulumi
+ * marks secret and anything else that holds secret material (the Owner
+ * setup link). Nothing reads secrets back from the checkpoint; code that
+ * needs one reads the stack (`readStackOutput`) when it needs it.
+ *
+ * @param outputs the stack outputs as the Automation API returns them
+ */
+export declare function checkpointableOutputs(outputs: Readonly<Record<string, {
+    value: unknown;
+    secret?: boolean;
+}>>): Record<string, unknown>;
+/** Outcome of {@link scrubProgressFile}. */
+export interface ScrubReport {
+    /** What was removed (paths + kinds, never values). Empty when the file was clean or absent. */
+    readonly removed: readonly SecretFinding[];
+}
+/**
+ * Remove secret material from a `progress.json` in place. The rewrite is
+ * atomic (temp file in the same directory, then rename) and the result is
+ * mode 0600, so an interrupted scrub never leaves a truncated checkpoint
+ * and wizard re-runs still find every completed step.
+ *
+ * @param path the checkpoint file; a missing file is a no-op
+ */
+export declare function scrubProgressFile(path: string): ScrubReport;
+/**
+ * Write `value` as JSON to `path` atomically with mode 0600: a temp file in
+ * the same directory (so the rename stays on one filesystem), then rename.
+ */
+export declare function writeJsonAtomic(path: string, value: unknown): void;
+/**
+ * What the operator should do about secrets a scrub removed: one line per
+ * affected secret, with the exact command where one exists.
+ *
+ * @param removed the scrub's findings
+ * @param installId the install, named in each command so it acts on the right one
+ */
+export declare function rotationHints(removed: readonly SecretFinding[], installId: string): string[];
+/**
+ * `text` with every URL password masked (`postgresql://admin_role:***@`),
+ * for anything the CLI prints that could carry one (errors from Pulumi or
+ * gcloud, for instance). Same masking as the API gateway's error log.
+ */
+export declare function redactCredentials(text: string): string;
+//# sourceMappingURL=checkpoint-secrets.d.ts.map

package/dist/checkpoint-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-secrets.d.ts","sourceRoot":"","sources":["../src/checkpoint-secrets.ts"],"names":[],"mappings":"AA4BA,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,YAAY,CAAC;IAC7D,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AA2CD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,aAAa,EAAE,CAetE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAElE;AAED,0FAA0F;AAC1F,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEjF;AAcD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,OAAO,GAAG,aAAa,EAAE,CAO1E;AAcD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAgBtD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,GACtE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAO3D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CASlE;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAuB5F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD"}