@caelo-cms/provisioning 0.10.43 → 0.10.46

package/dist/state-store.js

@@ -0,0 +1,140 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Where install.json and progress.json are read from and written to (#696).
+ *
+ *   - {@link LocalStateStore}: `~/.caelo-<id>/` — every install before #696,
+ *     and self-hosted always.
+ *   - {@link GcsStateStore}: the install's ops bucket
+ *     (`gs://<project>-caelo-ops/install/`), which is authoritative. A local
+ *     copy is kept in `~/.caelo-<id>/` so `listInstalls` and the install
+ *     picker work offline, but every read in a process starts from the
+ *     bucket and every write goes to the bucket first.
+ *
+ * Both stores refuse to write secret material (checkpoint-secrets.ts, #656 /
+ * #659): install.json and progress.json are read by tooling, backups and
+ * agents, and a bucket copy is no place for a database password either. The
+ * guard sits inside each store's `write`, so no caller can skip it.
+ *
+ * The interface is synchronous on purpose: install-state.ts's callers (the
+ * wizard steps, `markStepDone`, the lifecycle commands) are synchronous, and
+ * the bucket store shells out to `gcloud storage` synchronously.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { assertNoCheckpointSecrets, assertNoSecrets } from "./checkpoint-secrets.js";
+import { gcloudEnv } from "./gcloud.js";
+import { OPS_INSTALL_PREFIX } from "./state-backend.js";
+/** The real {@link SyncGcloud}: `gcloud` with prompts disabled. */
+export const realSyncGcloud = (args, input) => {
+    const r = spawnSync("gcloud", args, {
+        env: gcloudEnv(),
+        encoding: "utf8",
+        maxBuffer: 16 * 1024 * 1024,
+        ...(input !== undefined ? { input } : { stdio: ["ignore", "pipe", "pipe"] }),
+    });
+    if (r.error)
+        throw r.error;
+    return {
+        ok: r.status === 0,
+        stdout: r.stdout ?? "",
+        stderr: r.stderr ?? "",
+        exitCode: r.status ?? 1,
+    };
+};
+/**
+ * Serialize a document after the checkpoint-secrets guard. install.json is
+ * checked for any secret; progress.json with the checkpoint rules (step
+ * payloads, outputs).
+ */
+export function serializeGuarded(file, value) {
+    if (file === "install.json")
+        assertNoSecrets(value, file);
+    else
+        assertNoCheckpointSecrets(value, file);
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+/** Atomic mode-0600 write (temp file + rename in the same directory). */
+function writeTextAtomic(path, text) {
+    const tmp = `${path}.tmp-${process.pid}`;
+    try {
+        writeFileSync(tmp, text, { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch (e) {
+        rmSync(tmp, { force: true });
+        throw e;
+    }
+}
+/** install.json + progress.json in `~/.caelo-<id>/`. */
+export class LocalStateStore {
+    root;
+    kind = "local";
+    constructor(root) {
+        this.root = root;
+    }
+    read(file) {
+        const path = join(this.root, file);
+        return existsSync(path) ? readFileSync(path, "utf8") : null;
+    }
+    write(file, value) {
+        writeTextAtomic(join(this.root, file), serializeGuarded(file, value));
+    }
+}
+/** gcloud's wording for an object that is not there. */
+const NOT_FOUND = /matched no objects|No URLs matched|NotFound|404|does not exist/i;
+/**
+ * install.json + progress.json in the ops bucket, mirrored to
+ * `~/.caelo-<id>/`. The first read of a document in a process fetches it
+ * from the bucket; later reads use the in-memory copy, which every write
+ * updates. A bucket error throws — the bucket is the source of truth, so
+ * silently using the local mirror could resume from a stale checkpoint.
+ */
+export class GcsStateStore {
+    bucket;
+    root;
+    run;
+    kind = "gcs";
+    cache = new Map();
+    constructor(bucket, root, run = realSyncGcloud) {
+        this.bucket = bucket;
+        this.root = root;
+        this.run = run;
+    }
+    /** `gs://<bucket>/install/<file>`. */
+    objectUrl(file) {
+        return `gs://${this.bucket}/${OPS_INSTALL_PREFIX}/${file}`;
+    }
+    /**
+     * The document as the bucket holds it right now, without caching it or
+     * touching the local mirror — for looking at a bucket this machine may
+     * not own (the wizard's "is this project already an install?" check).
+     */
+    peek(file) {
+        const r = this.run(["storage", "cat", this.objectUrl(file)]);
+        if (r.ok)
+            return r.stdout;
+        if (NOT_FOUND.test(r.stderr))
+            return null;
+        throw new Error(`Could not read ${this.objectUrl(file)}: ${r.stderr.trim() || `gcloud exited ${r.exitCode}`}. Check that you are signed in (gcloud auth login) as an account with access to the install's ops bucket.`);
+    }
+    read(file) {
+        if (this.cache.has(file))
+            return this.cache.get(file) ?? null;
+        const text = this.peek(file);
+        this.cache.set(file, text);
+        if (text !== null)
+            writeTextAtomic(join(this.root, file), text);
+        return text;
+    }
+    write(file, value) {
+        const text = serializeGuarded(file, value);
+        const r = this.run(["storage", "cp", "-", this.objectUrl(file), "--content-type=application/json"], text);
+        if (!r.ok) {
+            throw new Error(`Could not write ${this.objectUrl(file)}: ${r.stderr.trim() || `gcloud exited ${r.exitCode}`}. Nothing was changed locally; fix access to the ops bucket and re-run.`);
+        }
+        this.cache.set(file, text);
+        writeTextAtomic(join(this.root, file), text);
+    }
+}
+//# sourceMappingURL=state-store.js.map

package/dist/state-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAqB,SAAS,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAiBxD,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAe,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;IACxD,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE;QAClC,GAAG,EAAE,SAAS,EAAE;QAChB,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC3B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK;QAAE,MAAM,CAAC,CAAC,KAAK,CAAC;IAC3B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC;KACxB,CAAC;AACJ,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAe,EAAE,KAAc;IAC9D,IAAI,IAAI,KAAK,cAAc;QAAE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;;QACrD,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,OAAO,eAAe;IAEG;IADpB,IAAI,GAAG,OAAgB,CAAC;IACjC,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,IAAI,CAAC,IAAe;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,IAAe,EAAE,KAAc;QACnC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,SAAS,GAAG,iEAAiE,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,OAAO,aAAa;IAKL;IACA;IACA;IANV,IAAI,GAAG,KAAc,CAAC;IACd,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,YACmB,MAAc,EACd,IAAY,EACZ,MAAkB,cAAc;QAFhC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QACZ,QAAG,GAAH,GAAG,CAA6B;IAChD,CAAC;IAEJ,sCAAsC;IACtC,SAAS,CAAC,IAAe;QACvB,OAAO,QAAQ,IAAI,CAAC,MAAM,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACH,IAAI,CAAC,IAAe;QAClB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,2GAA2G,CACvM,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAe;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,IAAI;YAAE,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAe,EAAE,KAAc;QACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAChB,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC,EAC/E,IAAI,CACL,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,yEAAyE,CACtK,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/upgrade/app-roll.d.ts

@@ -0,0 +1,164 @@
+/**
+ * The app-roll half of an upgrade (epic #696): migrations with the new admin
+ * image, then admin and gateway onto their new images with the env contract
+ * riding the same revision, traffic onto the new revisions, a deep health
+ * check, and — on any failure — traffic back onto the revisions that served
+ * before.
+ *
+ * It never changes IAM, never creates a service account or secret and never
+ * touches other cloud resources: everything here works under an identity
+ * that may only deploy Cloud Run revisions, run the migration job and take a
+ * Cloud SQL backup. That is the identity the in-cloud upgrader job runs as.
+ * Whatever needs more lives in converge.ts; `cms-provision upgrade` runs
+ * both, and the upgrader job refuses to run while the install needs a
+ * converge (`needsConverge`).
+ *
+ * Converge steps that must sit between app-roll steps — a database role that
+ * a migration creates gets its password after migrations and before the
+ * gateway rolls — come in through {@link AppRollHooks}. The upgrader job
+ * passes none.
+ *
+ * All gcloud calls go through the injected runner, all output through the
+ * injected reporter, so the whole sequence runs against a fake in tests.
+ */
+import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
+import type { ImageDigests } from "../install-state.js";
+import { type EnvChange, type LiveEnvValue, type LiveVolumes } from "../stack-converge.js";
+import { type SqlBackup } from "./backup.js";
+import type { HealthProbe } from "./health.js";
+import type { UpgradeReporter } from "./reporter.js";
+export type RollSlug = "admin" | "gateway";
+/** The roll order: the gateway follows the admin, never the other way round. */
+export declare const ROLL_ORDER: readonly RollSlug[];
+/** The install an app-roll acts on. */
+export interface AppRollInstall {
+    readonly provider: "gcp" | "gcp-firebase";
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    readonly domain: string;
+    /** The protected staging host the admin is told about (#650). */
+    readonly stagingHost: string;
+}
+/** The release image one service rolls to. */
+export interface ReleaseImage {
+    /** Fully qualified, digest-pinned reference (`…/admin@sha256:…`). */
+    readonly imageRef: string;
+    readonly digest: string;
+}
+/** A service as it runs now, plus the image it rolls to. */
+export interface ServicePlan {
+    readonly slug: RollSlug;
+    readonly serviceName: string;
+    readonly imageRef: string;
+    readonly digest: string;
+    readonly priorRevision: string;
+    readonly liveEnv: ReadonlyMap<string, LiveEnvValue>;
+    /** Container memory limit now (null = Cloud Run's default). */
+    readonly liveMemory: string | null;
+    readonly liveVolumes: LiveVolumes;
+}
+/** A service plan plus the changes its roll applies. */
+export interface RollPlan extends ServicePlan {
+    readonly envFlags: readonly string[];
+    readonly envChanges: readonly EnvChange[];
+    /** #553 — e.g. `--memory=2Gi` when the admin runs below the stack default. */
+    readonly resourceFlags: readonly string[];
+    /** The admin's media bucket volume when it is (partly) missing; empty otherwise. */
+    readonly volumeFlags: readonly string[];
+    readonly volumeChanges: readonly string[];
+}
+/** Everything an app-roll will do, computed read-only before anything changes. */
+export interface AppRollPlan {
+    readonly install: AppRollInstall;
+    /** In {@link ROLL_ORDER}. */
+    readonly services: readonly RollPlan[];
+    /** Notes for the operator (e.g. a memory limit left as is). */
+    readonly warnings: readonly string[];
+}
+export type PlanResult = {
+    readonly ok: true;
+    readonly plan: AppRollPlan;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Read both services and plan their rolls: prior revisions (the rollback
+ * targets), env-contract changes, the admin's memory and media volume. Makes
+ * no change; fails when anything a roll needs is missing.
+ */
+export declare function planAppRoll(install: AppRollInstall, images: Readonly<Record<RollSlug, ReleaseImage>>, run: GcloudRunner): Promise<PlanResult>;
+/**
+ * The plan with `names` left exactly as the services have them — for env
+ * vars that point at something a converge step could not set up.
+ */
+export declare function leavingEnvUntouched(plan: AppRollPlan, names: readonly string[]): AppRollPlan;
+/** Print what the plan will change, one line per change. */
+export declare function reportPlan(plan: AppRollPlan, reporter: UpgradeReporter): void;
+/** Converge steps that must sit between app-roll steps (none for the upgrader job). */
+export interface AppRollHooks {
+    /**
+     * After migrations, before any service rolls. Returns the contract env
+     * vars the rolls must leave untouched because what they point at could
+     * not be set up; `ok: false` aborts the upgrade (nothing rolled yet).
+     */
+    afterMigrations?(): Promise<{
+        readonly ok: true;
+        readonly leaveUntouched: readonly string[];
+    } | {
+        readonly ok: false;
+    }>;
+    /** Right before `slug` rolls; `ok: false` aborts and rolls back what rolled. */
+    beforeRoll?(slug: RollSlug): Promise<{
+        readonly ok: true;
+    } | {
+        readonly ok: false;
+        readonly error: string;
+    }>;
+    /** After `slug` went back to its prior revision (or its roll failed). */
+    afterRollback?(slug: RollSlug): Promise<void>;
+}
+export interface AppRollDeps {
+    readonly run: GcloudRunner;
+    readonly sleep?: Sleep;
+    readonly reporter: UpgradeReporter;
+    /** Runs both migration targets with `imageRef` (the NEW admin image). */
+    readonly migrate: (imageRef: string) => Promise<{
+        readonly ok: boolean;
+        readonly error?: string;
+    }>;
+    /** The deep health check, or null when the operator explicitly skipped it. */
+    readonly health: HealthProbe | null;
+    /** Persist the digests now serving (install.json, stack config, …). */
+    readonly recordDigests: (digests: ImageDigests) => Promise<void>;
+}
+export interface AppRollInput {
+    readonly plan: AppRollPlan;
+    /**
+     * The backup taken before this roll. Required: migrations never run
+     * without a backup to go back to.
+     */
+    readonly backup: SqlBackup;
+    /** The release version rolled to, when known (`0.11.0`; null for a channel tag). */
+    readonly targetVersion: string | null;
+    /**
+     * Whether the release's migrations are contract-type (destructive for the
+     * previous release; from the signed release manifest). null = unknown.
+     */
+    readonly migrationsContract: boolean | null;
+}
+export type AppRollPhase = "health-baseline" | "migrations" | "converge" | "roll" | "health";
+export type AppRollResult = {
+    readonly ok: true;
+    readonly digests: ImageDigests;
+} | {
+    readonly ok: false;
+    readonly phase: AppRollPhase;
+    /** Whether migrations ran before the failure (the backup matters then). */
+    readonly migrated: boolean;
+};
+/** Run the app-roll. See the file comment for the sequence. */
+export declare function executeAppRoll(input: AppRollInput, hooks: AppRollHooks, deps: AppRollDeps): Promise<AppRollResult>;
+//# sourceMappingURL=app-roll.d.ts.map

package/dist/upgrade/app-roll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-roll.d.ts","sourceRoot":"","sources":["../../src/upgrade/app-roll.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EASjB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;AAE3C,gFAAgF;AAChF,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAAyB,CAAC;AAEpE,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpD,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,oFAAoF;IACpF,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,EAChD,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,UAAU,CAAC,CAsErB;AAwBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAY5F;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,IAAI,CAa7E;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,eAAe,CAAC,IAAI,OAAO,CACzB;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;KAAE,CAC3F,CAAC;IACF,gFAAgF;IAChF,UAAU,CAAC,CACT,IAAI,EAAE,QAAQ,GACb,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnF,yEAAyE;IACzE,aAAa,CAAC,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,CAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IACpC,uEAAuE;IACvE,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAAC;CAC7C;AAED,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,YAAY,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7F,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GACrD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEN,+DAA+D;AAC/D,wBAAsB,cAAc,CAClC,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CA2JxB"}

package/dist/upgrade/app-roll.js

@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: MPL-2.0
+import { gatewayServiceAccountEmail, runServiceAccountEmail } from "../gcp-names.js";
+import { adminMediaVolume } from "../stack-contract.js";
+import { liveContainerEnv, liveContainerMemory, liveVolumes, planAdminMemory, planContractEnv, planMediaVolume, rollService, serviceRollArgs, } from "../stack-converge.js";
+import { restoreCommand } from "./backup.js";
+import { describeServiceJson, findCurrentRevision, findServiceUrl, pinTraffic, resolveGcpResourceName, } from "./gcp-lookup.js";
+/** The roll order: the gateway follows the admin, never the other way round. */
+export const ROLL_ORDER = ["admin", "gateway"];
+/**
+ * Read both services and plan their rolls: prior revisions (the rollback
+ * targets), env-contract changes, the admin's memory and media volume. Makes
+ * no change; fails when anything a roll needs is missing.
+ */
+export async function planAppRoll(install, images, run) {
+    const services = [];
+    for (const slug of ROLL_ORDER) {
+        const prefix = `caelo-${install.env}-${slug}`;
+        const serviceName = await resolveGcpResourceName(run, "run-service", prefix, install.projectId, install.region);
+        if (!serviceName)
+            return { ok: false, error: `Could not find the ${prefix}* Cloud Run service` };
+        const priorRevision = await findCurrentRevision(run, install.projectId, install.region, serviceName);
+        if (!priorRevision) {
+            return {
+                ok: false,
+                error: `Could not capture the current ${slug} revision — refusing to roll`,
+            };
+        }
+        const json = await describeServiceJson(run, install.projectId, install.region, serviceName);
+        if (!json) {
+            return {
+                ok: false,
+                error: `Could not read the ${slug} service's configuration — refusing to roll`,
+            };
+        }
+        services.push({
+            slug,
+            serviceName,
+            ...images[slug],
+            priorRevision,
+            liveEnv: liveContainerEnv(json),
+            liveMemory: liveContainerMemory(json),
+            liveVolumes: liveVolumes(json),
+        });
+    }
+    const env = planEnv(install, services, []);
+    if (!env.ok)
+        return { ok: false, error: `the install's env contract can't be applied: ${env.error}` };
+    // Without the media volume every upload is lost on the next revision or
+    // scale-to-zero, so a volume the roll cannot add fails the plan.
+    const admin = services.find((s) => s.slug === "admin");
+    const media = planMediaVolume(admin.liveVolumes, adminMediaVolume(install.projectId, install.env));
+    if (!media.ok)
+        return { ok: false, error: `the admin's media volume can't be set up: ${media.error}` };
+    const warnings = [];
+    const rolls = services.map((s) => {
+        // #553 — the admin runs the Lighthouse quality audit; raise it to the
+        // stack's memory default (never lowered; an unparsable value is kept).
+        const memory = s.slug === "admin" ? planAdminMemory(s.liveMemory) : null;
+        if (memory && !memory.ok)
+            warnings.push(`admin memory left as is: ${memory.error}`);
+        return {
+            ...s,
+            envFlags: env.services[s.slug].flags,
+            envChanges: env.services[s.slug].changes,
+            resourceFlags: memory?.ok ? memory.flags : [],
+            volumeFlags: s.slug === "admin" ? media.flags : [],
+            volumeChanges: s.slug === "admin" ? media.changes : [],
+        };
+    });
+    return { ok: true, plan: { install, services: rolls, warnings } };
+}
+function planEnv(install, services, leaveUntouched) {
+    const deployed = Object.fromEntries(services.map((s) => [s.slug, { serviceName: s.serviceName, liveEnv: s.liveEnv }]));
+    return planContractEnv({
+        provider: install.provider,
+        projectId: install.projectId,
+        env: install.env,
+        domain: install.domain,
+        region: install.region,
+        stagingHost: install.stagingHost,
+    }, deployed, { leaveUntouched });
+}
+/**
+ * The plan with `names` left exactly as the services have them — for env
+ * vars that point at something a converge step could not set up.
+ */
+export function leavingEnvUntouched(plan, names) {
+    if (names.length === 0)
+        return plan;
+    const env = planEnv(plan.install, plan.services, names);
+    if (!env.ok)
+        return plan;
+    return {
+        ...plan,
+        services: plan.services.map((s) => ({
+            ...s,
+            envFlags: env.services[s.slug].flags,
+            envChanges: env.services[s.slug].changes,
+        })),
+    };
+}
+/** Print what the plan will change, one line per change. */
+export function reportPlan(plan, reporter) {
+    for (const w of plan.warnings)
+        reporter.warn(w);
+    for (const s of plan.services) {
+        for (const c of s.volumeChanges)
+            reporter.info(`${s.slug} media: ${c}`);
+        for (const f of s.resourceFlags) {
+            reporter.info(`${s.slug} resources: ${s.liveMemory ?? "(default)"} → ${f}`);
+        }
+        for (const c of s.envChanges) {
+            reporter.info(`${s.slug} env ${c.name}: ${c.from === undefined ? "(unset)" : c.from} → ${c.to === undefined ? "(removed)" : c.to}`);
+        }
+    }
+}
+/** Run the app-roll. See the file comment for the sequence. */
+export async function executeAppRoll(input, hooks, deps) {
+    const { reporter: r, run } = deps;
+    const { install } = input.plan;
+    let plan = input.plan;
+    const fail = (phase, migrated) => ({
+        ok: false,
+        phase,
+        migrated,
+    });
+    // A probe that cannot reach the install now would only fail after the
+    // migrations, and roll a healthy release back.
+    if (deps.health) {
+        const s = r.step("Checking the health check can reach admin + gateway...");
+        const base = await deps.health.baseline().catch((e) => ({
+            ok: false,
+            error: e instanceof Error ? e.message : String(e),
+        }));
+        if (!base.ok) {
+            s.failed(`Health check can't reach the install: ${base.error}`);
+            r.warn("No migrations ran and no traffic moved. Fix the access problem, or re-run with --skip-health-check to roll with Cloud Run's readiness check only.");
+            return fail("health-baseline", false);
+        }
+        s.done(`Health check reaches the install (${base.detail})`);
+    }
+    else {
+        r.warn("--skip-health-check set — the new revisions get Cloud Run's readiness check only.");
+    }
+    // Migrations BEFORE any traffic moves, with the NEW admin image: the old
+    // image does not carry the release's migration files (v0.9.2).
+    const admin = plan.services.find((s) => s.slug === "admin");
+    const sMig = r.step("Applying DB migrations (idempotent)...");
+    const mig = await deps.migrate(admin.imageRef);
+    if (!mig.ok) {
+        sMig.failed(`Migrations failed (${mig.error ?? "unknown"}). Aborting upgrade.`);
+        r.warn(`No traffic was shifted. Inspect the Cloud Run Job logs:\n  gcloud logging read 'resource.type=cloud_run_job AND resource.labels.job_name=~"caelo-migrate-.*"' --project=${install.projectId} --limit=50\n${restoreHint(input, "if a migration left the schema half-applied")}`);
+        return fail("migrations", true);
+    }
+    sMig.done("Migrations applied");
+    if (hooks.afterMigrations) {
+        const converged = await hooks.afterMigrations();
+        if (!converged.ok)
+            return fail("converge", true);
+        plan = leavingEnvUntouched(plan, converged.leaveUntouched);
+    }
+    const rolled = [];
+    const rollBack = async (alsoCurrent) => {
+        const services = alsoCurrent ? [...rolled, alsoCurrent] : rolled;
+        if (services.length === 0)
+            return;
+        r.warn(`Rolling back ${services.length} service(s) to the revisions that served before...`);
+        for (const p of [...services].reverse()) {
+            const ok = await pinTraffic(run, install.projectId, install.region, p.serviceName, p.priorRevision);
+            if (ok)
+                r.info(`  ${p.slug} traffic restored to ${p.priorRevision}`);
+            else
+                r.error(`  ${p.slug} rollback FAILED — pin ${p.priorRevision} by hand`);
+            await hooks.afterRollback?.(p.slug);
+        }
+    };
+    for (const p of plan.services) {
+        const s = r.step(`Rolling ${p.slug} → ${p.digest.slice(0, 19)}...`);
+        const before = (await hooks.beforeRoll?.(p.slug)) ?? { ok: true };
+        if (!before.ok) {
+            s.failed(before.error);
+            await rollBack();
+            return fail("roll", true);
+        }
+        const upd = await rollService(serviceRollArgs({
+            serviceName: p.serviceName,
+            region: install.region,
+            projectId: install.projectId,
+            imageRef: p.imageRef,
+            serviceAccount: p.slug === "admin"
+                ? runServiceAccountEmail(install.projectId, install.env)
+                : gatewayServiceAccountEmail(install.projectId, install.env),
+            envFlags: p.envFlags,
+            resourceFlags: p.resourceFlags,
+            volumeFlags: p.volumeFlags,
+        }), { run, ...(deps.sleep ? { sleep: deps.sleep } : {}) });
+        if (!upd.ok) {
+            s.failed(`Failed: ${upd.stderr.trim()}`);
+            // The failed update created no serving revision; only undo what the
+            // hook changed for it, then the services that rolled before.
+            await hooks.afterRollback?.(p.slug);
+            await rollBack();
+            return fail("roll", true);
+        }
+        // `update --image` only moves traffic when the service has no explicit
+        // traffic config — but a rollback pins traffic to the prior revision,
+        // and that pin survives later updates. Moving traffic to latest on
+        // every roll is idempotent and un-pins services an earlier failed
+        // upgrade left pinned.
+        const flip = await run([
+            "run",
+            "services",
+            "update-traffic",
+            p.serviceName,
+            "--region",
+            install.region,
+            "--project",
+            install.projectId,
+            "--to-latest",
+            "--quiet",
+        ]);
+        if (!flip.ok) {
+            s.failed(`Traffic flip to latest failed: ${flip.stderr.trim()}`);
+            await rollBack(p);
+            return fail("roll", true);
+        }
+        if (!(await findServiceUrl(run, install.projectId, install.region, p.serviceName))) {
+            s.failed(`Could not resolve the service URL for ${p.slug} — rolling back`);
+            await rollBack(p);
+            return fail("roll", true);
+        }
+        s.done(`${p.slug} rolled to ${p.digest.slice(0, 19)}...`);
+        rolled.push(p);
+    }
+    if (deps.health) {
+        const s = r.step("Deep health check (database, migrations, version)...");
+        // A probe that throws is a failed check: roll back, never leave the
+        // new revisions serving unverified.
+        const deep = await deps.health.deep({ version: input.targetVersion }).catch((e) => ({
+            ok: false,
+            error: e instanceof Error ? e.message : String(e),
+        }));
+        if (!deep.ok) {
+            s.failed(`Deep health check failed: ${deep.error}`);
+            await rollBack();
+            r.warn(restoreHint(input, "if the previous release now fails against the migrated schema"));
+            return fail("health", true);
+        }
+        s.done(`Healthy: ${deep.detail}`);
+    }
+    const digests = {
+        admin: plan.services.find((s) => s.slug === "admin").digest,
+        gateway: plan.services.find((s) => s.slug === "gateway").digest,
+    };
+    await deps.recordDigests(digests);
+    return { ok: true, digests };
+}
+/**
+ * The restore hint after migrations ran and the roll failed. Expand-only
+ * migrations leave a schema the previous release still runs on, so restoring
+ * is only advised outright for contract-type migrations.
+ */
+function restoreHint(input, when) {
+    const cmd = restoreCommand(input.backup);
+    if (input.migrationsContract === true) {
+        return `This release's migrations are contract-type: the previous release may not work against the migrated schema. Restore the pre-upgrade backup ${input.backup.backupId} (overwrites all data written since):\n  ${cmd}`;
+    }
+    return `Pre-upgrade backup: ${input.backup.backupId}. Restore it only ${when} (overwrites all data written since):\n  ${cmd}`;
+}
+//# sourceMappingURL=app-roll.js.map

package/dist/upgrade/app-roll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-roll.js","sourceRoot":"","sources":["../../src/upgrade/app-roll.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA2BnC,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAKL,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAkB,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAMzB,gFAAgF;AAChF,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AA0DpE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAuB,EACvB,MAAgD,EAChD,GAAiB;IAEjB,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAC9C,GAAG,EACH,aAAa,EACb,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;QACF,IAAI,CAAC,WAAW;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,MAAM,qBAAqB,EAAE,CAAC;QACjF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAC7C,GAAG,EACH,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,iCAAiC,IAAI,8BAA8B;aAC3E,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,sBAAsB,IAAI,6CAA6C;aAC/E,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,WAAW;YACX,GAAG,MAAM,CAAC,IAAI,CAAC;YACf,aAAa;YACb,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC/B,UAAU,EAAE,mBAAmB,CAAC,IAAI,CAAC;YACrC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,EAAE;QACT,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IAC3F,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAgB,CAAC;IACtE,MAAM,KAAK,GAAG,eAAe,CAC3B,KAAK,CAAC,WAAW,EACjB,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CACjD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAC1F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAY,EAAE;QACzC,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACpF,OAAO;YACL,GAAG,CAAC;YACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK;YACpC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;YACxC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAC7C,WAAW,EAAE,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YAClD,aAAa,EAAE,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;SACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,OAAO,CACd,OAAuB,EACvB,QAAgC,EAChC,cAAiC;IAEjC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC7C,CAAC;IACvC,OAAO,eAAe,CACpB;QACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,EACD,QAAQ,EACR,EAAE,cAAc,EAAE,CACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB,EAAE,KAAwB;IAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,GAAG,CAAC;YACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK;YACpC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO;SACzC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,IAAiB,EAAE,QAAyB;IACrE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,UAAU,IAAI,WAAW,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AA6DD,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAmB,EACnB,KAAmB,EACnB,IAAiB;IAEjB,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,CAAC,KAAmB,EAAE,QAAiB,EAAiB,EAAE,CAAC,CAAC;QACvE,EAAE,EAAE,KAAK;QACT,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IAEH,sEAAsE;IACtE,+CAA+C;IAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YAC/D,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,yCAAyC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC,CAAC,IAAI,CACJ,mJAAmJ,CACpJ,CAAC;YACF,OAAO,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IAC9F,CAAC;IAED,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAa,CAAC;IACxE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,MAAM,CAAC,sBAAsB,GAAG,CAAC,KAAK,IAAI,SAAS,sBAAsB,CAAC,CAAC;QAChF,CAAC,CAAC,IAAI,CACJ,2KAA2K,OAAO,CAAC,SAAS,gBAAgB,WAAW,CAAC,KAAK,EAAE,6CAA6C,CAAC,EAAE,CAChR,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAEhC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAsB,EAAiB,EAAE;QAC/D,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,QAAQ,CAAC,MAAM,oDAAoD,CAAC,CAAC;QAC5F,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,MAAM,UAAU,CACzB,GAAG,EACH,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,MAAM,EACd,CAAC,CAAC,WAAW,EACb,CAAC,CAAC,aAAa,CAChB,CAAC;YACF,IAAI,EAAE;gBAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,wBAAwB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;;gBAChE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC,aAAa,UAAU,CAAC,CAAC;YAC7E,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAC3B,eAAe,CAAC;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,cAAc,EACZ,CAAC,CAAC,IAAI,KAAK,OAAO;gBAChB,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC;gBACxD,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC;YAChE,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,EACF,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACtD,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,CAAC,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,uBAAuB;QACvB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;YACrB,KAAK;YACL,UAAU;YACV,gBAAgB;YAChB,CAAC,CAAC,WAAW;YACb,UAAU;YACV,OAAO,CAAC,MAAM;YACd,WAAW;YACX,OAAO,CAAC,SAAS;YACjB,aAAa;YACb,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACnF,CAAC,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC;YAC3E,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACzE,oEAAoE;QACpE,oCAAoC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE,EAAE,KAAc;YAClB,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,6BAA6B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACpD,MAAM,QAAQ,EAAE,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,+DAA+D,CAAC,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAiB;QAC5B,KAAK,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAc,CAAC,MAAM;QACzE,OAAO,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAc,CAAC,MAAM;KAC9E,CAAC;IACF,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAmB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,8IAA8I,KAAK,CAAC,MAAM,CAAC,QAAQ,4CAA4C,GAAG,EAAE,CAAC;IAC9N,CAAC;IACD,OAAO,uBAAuB,KAAK,CAAC,MAAM,CAAC,QAAQ,qBAAqB,IAAI,4CAA4C,GAAG,EAAE,CAAC;AAChI,CAAC"}

package/dist/upgrade/backup.d.ts

@@ -0,0 +1,48 @@
+/**
+ * On-demand Cloud SQL backups (epic #696): the `backup` lifecycle command and
+ * the backup every upgrade takes before its migrations. Both GCP providers
+ * (`gcp`, `gcp-firebase`) keep their data in the same `caelo-<env>-pg*` Cloud
+ * SQL instance, so one implementation serves both.
+ *
+ * The backup id is what makes the pre-upgrade backup useful: it lands in the
+ * upgrade's output and in the restore hint printed when the upgrade has to
+ * roll back after migrations ran.
+ */
+import type { GcloudRunner } from "../gcloud-retry.js";
+/** A finished on-demand backup. */
+export interface SqlBackup {
+    readonly projectId: string;
+    /** Cloud SQL instance name (Pulumi-suffixed). */
+    readonly instance: string;
+    /** Cloud SQL backup run id. */
+    readonly backupId: string;
+}
+export type SqlBackupResult = {
+    readonly ok: true;
+    readonly backup: SqlBackup;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Take an on-demand backup of the install's Cloud SQL instance and return its
+ * id. `gcloud sql backups create` waits for the backup to finish but does not
+ * print the id in a stable shape, so the backup carries a unique description
+ * and is looked up by it afterwards.
+ *
+ * @param purpose short reason recorded in the backup's description, e.g. "pre-upgrade to 0.11.0"
+ */
+export declare function takeSqlBackup(run: GcloudRunner, install: {
+    readonly projectId: string;
+    readonly env: string;
+}, purpose: string, now?: () => Date): Promise<SqlBackupResult>;
+/** The command that restores `backup` over its instance (overwrites the current data). */
+export declare function restoreCommand(backup: SqlBackup): string;
+/**
+ * What to tell the operator when a pre-upgrade backup failed: why nothing
+ * happened, and how to get past it.
+ */
+export declare function backupFailureHelp(install: {
+    readonly projectId: string;
+}): string;
+//# sourceMappingURL=backup.d.ts.map