@caelo-cms/provisioning 0.10.43 → 0.10.46

package/dist/upgrade/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/upgrade/backup.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIvD,mCAAmC;AACnC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+BAA+B;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACjD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAM,IAAuB,GACjC,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAExD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAQjF"}

package/dist/upgrade/backup.js

@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: MPL-2.0
+import { gcpNamePrefix } from "../gcp-names.js";
+import { resolveGcpResourceName } from "./gcp-lookup.js";
+/**
+ * Take an on-demand backup of the install's Cloud SQL instance and return its
+ * id. `gcloud sql backups create` waits for the backup to finish but does not
+ * print the id in a stable shape, so the backup carries a unique description
+ * and is looked up by it afterwards.
+ *
+ * @param purpose short reason recorded in the backup's description, e.g. "pre-upgrade to 0.11.0"
+ */
+export async function takeSqlBackup(run, install, purpose, now = () => new Date()) {
+    const instance = await resolveGcpResourceName(run, "sql-instance", `${gcpNamePrefix(install.env)}-pg`, install.projectId);
+    if (!instance) {
+        return {
+            ok: false,
+            error: `no ${gcpNamePrefix(install.env)}-pg* Cloud SQL instance in project ${install.projectId} (or listing it was denied)`,
+        };
+    }
+    const description = `caelo-cms ${purpose} ${now().toISOString()}`;
+    const project = ["--project", install.projectId];
+    const create = await run([
+        "sql",
+        "backups",
+        "create",
+        "--instance",
+        instance,
+        ...project,
+        "--description",
+        description,
+    ]);
+    if (!create.ok) {
+        return { ok: false, error: `backup of ${instance} failed: ${create.stderr.trim()}` };
+    }
+    const list = await run([
+        "sql",
+        "backups",
+        "list",
+        "--instance",
+        instance,
+        ...project,
+        `--filter=description="${description}"`,
+        "--format=value(id)",
+    ]);
+    const backupId = list.ok ? list.stdout.trim().split("\n")[0]?.trim() : "";
+    if (!backupId) {
+        return {
+            ok: false,
+            error: `backup of ${instance} was created but its id could not be read (${list.ok ? "no backup carries the description" : list.stderr.trim()}); find it with: gcloud sql backups list --instance=${instance} --project=${install.projectId}`,
+        };
+    }
+    return { ok: true, backup: { projectId: install.projectId, instance, backupId } };
+}
+/** The command that restores `backup` over its instance (overwrites the current data). */
+export function restoreCommand(backup) {
+    return `gcloud sql backups restore ${backup.backupId} --restore-instance=${backup.instance} --project=${backup.projectId}`;
+}
+/**
+ * What to tell the operator when a pre-upgrade backup failed: why nothing
+ * happened, and how to get past it.
+ */
+export function backupFailureHelp(install) {
+    return [
+        "Nothing was changed: no migrations ran and no traffic moved.",
+        "Fix the cause and re-run upgrade. Common causes:",
+        `  - the account lacks Cloud SQL backup rights (roles/cloudsql.editor or owner on ${install.projectId})`,
+        "  - another backup or maintenance operation is running on the instance (wait, then retry)",
+        `  - the instance is stopped: gcloud sql instances describe <instance> --project=${install.projectId}`,
+    ].join("\n");
+}
+//# sourceMappingURL=backup.js.map

package/dist/upgrade/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/upgrade/backup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAcnC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAezD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAiB,EACjB,OAA6D,EAC7D,OAAe,EACf,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAC3C,GAAG,EACH,cAAc,EACd,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAClC,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,CAAC,SAAS,6BAA6B;SAC5H,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,aAAa,OAAO,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,QAAQ;QACR,GAAG,OAAO;QACV,eAAe;QACf,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,QAAQ,YAAY,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC;QACrB,KAAK;QACL,SAAS;QACT,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,GAAG,OAAO;QACV,yBAAyB,WAAW,GAAG;QACvC,oBAAoB;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa,QAAQ,8CAA8C,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,uDAAuD,QAAQ,cAAc,OAAO,CAAC,SAAS,EAAE;SAC7O,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;AACpF,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,MAAiB;IAC9C,OAAO,8BAA8B,MAAM,CAAC,QAAQ,uBAAuB,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,SAAS,EAAE,CAAC;AAC7H,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuC;IACvE,OAAO;QACL,8DAA8D;QAC9D,kDAAkD;QAClD,oFAAoF,OAAO,CAAC,SAAS,GAAG;QACxG,2FAA2F;QAC3F,mFAAmF,OAAO,CAAC,SAAS,EAAE;KACvG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/upgrade/converge.d.ts

@@ -0,0 +1,45 @@
+import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
+import type { InstallMetadata } from "../install-state.js";
+import { type HttpFetch } from "../runtime-secrets.js";
+import type { AppRollHooks, AppRollPlan } from "./app-roll.js";
+import type { UpgradeReporter } from "./reporter.js";
+/**
+ * Whether the install must converge before an app-roll to a release that
+ * expects infrastructure contract `targetVersion` (infra-contract.ts). An
+ * install with no recorded version has never completed a converge under
+ * this scheme and always needs one.
+ */
+export declare function needsConverge(install: Pick<InstallMetadata, "infraContractVersion">, targetVersion: number): boolean;
+export interface ConvergeDeps {
+    readonly run: GcloudRunner;
+    readonly sleep?: Sleep;
+    /** Cloud SQL Admin API calls (database role passwords). */
+    readonly http?: HttpFetch;
+    readonly reporter: UpgradeReporter;
+    /**
+     * The operator's own identity step, run first: the CLI moves the
+     * provisioner SA to keyless impersonation (provisioner-identity.ts), which
+     * needs the operator's gcloud account and local install dir. False aborts.
+     */
+    readonly provisionerIdentity?: () => Promise<boolean>;
+}
+export interface ConvergeSession {
+    /**
+     * Before the app-roll: runtime identities + secrets, stack invariants, MCP
+     * access. False when a step the install cannot work without failed —
+     * nothing app-side changed then.
+     */
+    beforeAppRoll(): Promise<boolean>;
+    /** The steps the app-roll runs between its own. */
+    readonly hooks: AppRollHooks;
+    /** After a successful app-roll: retire bindings nothing reads any more. */
+    afterAppRoll(): Promise<void>;
+    /**
+     * Whether every converge step succeeded — only then may the install's
+     * infrastructure contract version be recorded.
+     */
+    complete(): boolean;
+}
+/** Start a converge for the install `plan` rolls. */
+export declare function startConverge(plan: AppRollPlan, ownerEmail: string, deps: ConvergeDeps): ConvergeSession;
+//# sourceMappingURL=converge.d.ts.map

package/dist/upgrade/converge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge.d.ts","sourceRoot":"","sources":["../../src/upgrade/converge.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,uBAAuB,CAAC;AAQ/B,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,sBAAsB,CAAC,EACtD,aAAa,EAAE,MAAM,GACpB,OAAO,CAET;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,2EAA2E;IAC3E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;;;OAGG;IACH,QAAQ,IAAI,OAAO,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,YAAY,GACjB,eAAe,CAmQjB"}

package/dist/upgrade/converge.js

@@ -0,0 +1,287 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The converge half of an upgrade (epic #696): everything that changes IAM,
+ * service accounts, secrets or other cloud resources so the install matches
+ * what the release's stacks declare — the gateway's run SA and the
+ * CLI-generated runtime secrets, the stack's IAM/CDN/firewall invariants,
+ * MCP access through IAP, the gateway's and public_role's database logins,
+ * the operator-access sync job, and dropping bindings nothing reads any more.
+ *
+ * It needs the rights of whoever provisioned the install, so only
+ * `cms-provision upgrade` (the operator's own identity) runs it — never the
+ * in-cloud upgrader job, which only app-rolls and refuses while
+ * {@link needsConverge} says the install is behind.
+ *
+ * The keyless-provisioner step (#696, provisioner-identity.ts) is converge
+ * too; it needs the operator's local install dir, so the CLI injects it as
+ * {@link ConvergeDeps.provisionerIdentity}.
+ *
+ * Some steps must sit between app-roll steps (a role migration 0248 creates
+ * gets its password after migrations, before the gateway rolls onto it), so
+ * a converge is a {@link ConvergeSession}: a part before the app-roll, the
+ * {@link AppRollHooks} the app-roll calls in between, and a part after it.
+ */
+import { ensureGatewayRolePassword, findSqlInstance, planPublicRoleSwitch, } from "../gateway-credentials.js";
+import { ensureMcpIapAccess } from "../mcp-iap.js";
+import { ensureOperatorAccessSync, resolveOperatorAccessTarget } from "../operator-access.js";
+import { ensureGatewayServiceAccount, ensureGeneratedSecrets, plainGeneratedSecretSeed, readSecretReplication, } from "../runtime-secrets.js";
+import { selfCommand } from "../self-command.js";
+import { MCP_ENV_VAR, OPERATOR_ACCESS_JOB_ENV_VAR } from "../stack-contract.js";
+import { ensureStackInvariants, liveEnvHasInlinePassword, removeRetiredIamBindings, } from "../stack-converge.js";
+/**
+ * Whether the install must converge before an app-roll to a release that
+ * expects infrastructure contract `targetVersion` (infra-contract.ts). An
+ * install with no recorded version has never completed a converge under
+ * this scheme and always needs one.
+ */
+export function needsConverge(install, targetVersion) {
+    return (install.infraContractVersion ?? 0) < targetVersion;
+}
+/** Start a converge for the install `plan` rolls. */
+export function startConverge(plan, ownerEmail, deps) {
+    const { install } = plan;
+    const { reporter: r, run } = deps;
+    const runDeps = { run, ...(deps.sleep ? { sleep: deps.sleep } : {}) };
+    const service = (slug) => plan.services.find((s) => s.slug === slug);
+    const services = { admin: service("admin").serviceName, gateway: service("gateway").serviceName };
+    const target = {
+        provider: install.provider,
+        projectId: install.projectId,
+        region: install.region,
+        env: install.env,
+        services,
+    };
+    let incomplete = false;
+    // Env vars the rolls must leave as the services have them, because the
+    // thing they point at could not be set up.
+    const leaveUntouched = [];
+    let publicRole = null;
+    async function runtimeIdentities() {
+        // The gateway's own run SA and the CLI-generated secrets the env
+        // contract references. Created once, never overwritten; must exist
+        // before the invariants bind them and the rolls reference them.
+        const s = r.step("Ensuring the gateway service account + generated runtime secrets...");
+        const secretsTarget = { projectId: install.projectId, env: install.env };
+        const replication = await readSecretReplication(secretsTarget, runDeps);
+        const outcomes = [
+            await ensureGatewayServiceAccount(secretsTarget, runDeps),
+            ...(replication.ok
+                ? await ensureGeneratedSecrets({
+                    ...secretsTarget,
+                    region: install.region,
+                    replication: replication.replication,
+                    seed: plainGeneratedSecretSeed(service("admin").liveEnv),
+                }, runDeps)
+                : [{ id: "secret replication", status: "failed", error: replication.error }]),
+        ];
+        const failed = outcomes.filter((o) => o.status === "failed");
+        if (failed.length > 0) {
+            s.failed("Runtime identities/secrets could not be ensured. Aborting upgrade.");
+            for (const o of failed)
+                r.error(`  FAILED: ${o.id}\n    ${o.error ?? ""}`);
+            r.warn("No traffic was shifted and no migrations ran. Fix the above and re-run.");
+            return false;
+        }
+        s.done("Gateway service account + runtime secrets ok");
+        for (const o of outcomes.filter((o) => o.status === "applied")) {
+            r.info(`  created: ${o.id}${o.detail ? ` (${o.detail})` : ""}`);
+        }
+        return true;
+    }
+    async function stackInvariants() {
+        // IAM bindings + CDN policy added to the stacks after this install was
+        // provisioned (stack-contract.ts), and GCP's SSH/RDP-from-anywhere
+        // firewall rules removed (default-firewall.ts). Additive + idempotent.
+        const s = r.step("Ensuring the IAM bindings + CDN settings the stack declares, removing the default network's pre-populated firewall rules...");
+        const report = await ensureStackInvariants(target, runDeps);
+        const applied = report.outcomes.filter((o) => o.status === "applied");
+        const failed = report.outcomes.filter((o) => o.status === "failed");
+        if (report.mustAbort)
+            s.failed("Stack invariants could not be ensured. Aborting upgrade.");
+        else {
+            s.done(`Stack invariants ok (${report.outcomes.length - failed.length}/${report.outcomes.length}, ${applied.length} applied)`);
+        }
+        for (const o of applied)
+            r.info(`  applied: ${o.id} (${o.why})`);
+        for (const o of failed) {
+            const line = `  ${o.onFailure === "abort" ? "FAILED" : "not applied"}: ${o.id} — ${o.why}\n    ${o.error ?? ""}`;
+            if (o.onFailure === "abort")
+                r.error(line);
+            else
+                r.warn(line);
+        }
+        if (failed.length > 0)
+            incomplete = true;
+        if (report.mustAbort) {
+            r.warn("No traffic was shifted and no migrations ran. Fix the bindings above and re-run.");
+            return false;
+        }
+        return true;
+    }
+    async function mcpAccess() {
+        // Issue #37 — the MCP service account + its IAP/token-creator bindings.
+        // Also what the deep health check signs its IAP credential as. A failure
+        // costs MCP access, so it warns and the admin keeps its current value.
+        const s = r.step("Ensuring MCP access through IAP...");
+        // Signing as the MCP account goes through the IAM Credentials API, which
+        // installs from before #678 may not have enabled.
+        const api = await run([
+            "services",
+            "enable",
+            "iamcredentials.googleapis.com",
+            `--project=${install.projectId}`,
+        ]);
+        const resource = api.ok ? await adminIapResource() : null;
+        const mcp = !api.ok
+            ? {
+                ok: false,
+                error: `enable the IAM Credentials API (iamcredentials.googleapis.com): ${api.stderr.trim()}`,
+            }
+            : resource
+                ? await ensureMcpIapAccess({ projectId: install.projectId, resource, ...runDeps })
+                : { ok: false, error: "admin IAP backend service not found" };
+        if (mcp.ok) {
+            s.done(`MCP access ready (${mcp.serviceAccount}; ${mcp.operators.length} operator(s))`);
+            return;
+        }
+        s.warned(`MCP access not configured: ${mcp.error}`);
+        r.warn("The upgrade continues; external MCP clients stay blocked by IAP until this succeeds.");
+        incomplete = true;
+        leaveUntouched.push(MCP_ENV_VAR);
+    }
+    /** The admin's IAP resource: the service on gcp-firebase, the LB backend on gcp. */
+    async function adminIapResource() {
+        if (install.provider === "gcp-firebase") {
+            return { kind: "cloud-run", service: services.admin, region: install.region };
+        }
+        const res = await run([
+            "compute",
+            "backend-services",
+            "list",
+            "--global",
+            `--project=${install.projectId}`,
+            `--filter=name~^caelo-${install.env}-admin-backend`,
+            "--format=value(name)",
+        ]);
+        const name = res.ok ? res.stdout.trim().split("\n")[0]?.trim() : "";
+        return name ? { kind: "backend-services", service: name } : null;
+    }
+    async function databaseLogins() {
+        // #613 — migration 0248 creates gateway_role without a password; it gets
+        // its secret's value before the gateway rolls onto it. public_role
+        // moves onto its own password right before the gateway's roll.
+        const s = r.step("Ensuring the gateway's database login (gateway_role)...");
+        const sqlInstance = await findSqlInstance(install, { run });
+        if (!sqlInstance) {
+            s.failed("Could not find the Cloud SQL instance. Aborting upgrade.");
+            r.warn("Migrations ran; no traffic was shifted. Re-run upgrade once the instance is found.");
+            return false;
+        }
+        const roleTarget = { projectId: install.projectId, env: install.env, sqlInstance };
+        const roleDeps = { ...runDeps, ...(deps.http ? { http: deps.http } : {}) };
+        const gatewayRole = await ensureGatewayRolePassword(roleTarget, roleDeps);
+        if (gatewayRole.status === "failed") {
+            s.failed("gateway_role could not be given its password. Aborting upgrade.");
+            r.error(`  ${gatewayRole.error ?? ""}`);
+            r.warn("Migrations ran (0248 creates gateway_role); no traffic was shifted. Fix the above and re-run upgrade.");
+            return false;
+        }
+        s.done("gateway_role ready");
+        publicRole = planPublicRoleSwitch(roleTarget, service("gateway").liveEnv, roleDeps);
+        return true;
+    }
+    async function operatorAccess() {
+        // The job that keeps IAP in step with the user list (operator-access.ts).
+        // After migrations: its database user gets the role migration 0239
+        // creates. A failure only costs IAP following the user list, so it warns.
+        const s = r.step("Ensuring the operator-access sync job...");
+        const resolved = await resolveOperatorAccessTarget({
+            provider: install.provider,
+            projectId: install.projectId,
+            region: install.region,
+            env: install.env,
+            ownerEmail,
+            imageRef: service("admin").imageRef,
+        }, { run });
+        const oa = resolved.ok
+            ? await ensureOperatorAccessSync(resolved.target, runDeps)
+            : { ok: false, done: [], error: resolved.error };
+        for (const step of oa.done)
+            r.info(`  ${step}`);
+        if (oa.ok) {
+            s.done("Operator-access sync job ready (IAP follows the user list)");
+            return;
+        }
+        s.warned(`Operator-access sync job not set up: ${oa.error}`);
+        r.warn("The upgrade continues; user changes will report that Google IAP could not be updated until this succeeds. Re-run upgrade once the cause is fixed.");
+        incomplete = true;
+        leaveUntouched.push(OPERATOR_ACCESS_JOB_ENV_VAR);
+    }
+    return {
+        async beforeAppRoll() {
+            if (deps.provisionerIdentity && !(await deps.provisionerIdentity()))
+                return false;
+            if (!(await runtimeIdentities()))
+                return false;
+            if (!(await stackInvariants()))
+                return false;
+            await mcpAccess();
+            return true;
+        },
+        hooks: {
+            async afterMigrations() {
+                if (!(await databaseLogins()))
+                    return { ok: false };
+                await operatorAccess();
+                return { ok: true, leaveUntouched: [...leaveUntouched] };
+            },
+            async beforeRoll(slug) {
+                if (slug !== "gateway" || !publicRole)
+                    return { ok: true };
+                const moved = await publicRole.beforeGatewayRoll();
+                return moved.status === "failed"
+                    ? {
+                        ok: false,
+                        error: `public_role could not be moved onto its own password: ${moved.error ?? ""}`,
+                    }
+                    : { ok: true };
+            },
+            async afterRollback(slug) {
+                // The prior gateway revision reads public_role's old password.
+                if (slug !== "gateway" || !publicRole)
+                    return;
+                const outcome = await publicRole.afterGatewayRollFailed();
+                if (outcome.startsWith("could NOT"))
+                    r.error(`  ${outcome}`);
+                else
+                    r.info(`  ${outcome}`);
+            },
+        },
+        async afterAppRoll() {
+            // #613 — with both services on their new revisions, drop the bindings
+            // nothing reads through any more (above all the gateway SA's access to
+            // admin_role's password). Loud on failure.
+            const retired = await removeRetiredIamBindings(target, runDeps);
+            for (const o of retired) {
+                if (o.status === "removed")
+                    r.info(`  removed: ${o.id} (${o.why})`);
+                if (o.status === "failed") {
+                    incomplete = true;
+                    r.error(`  NOT removed: ${o.id} — ${o.why}\n    ${o.error ?? ""}\n    Re-run upgrade with an account that may change IAM, or remove the binding by hand.`);
+                }
+            }
+            if (publicRole?.moves) {
+                // Until this upgrade the gateway held admin_role's password; anyone
+                // who ever compromised it could have kept a copy.
+                r.warn(`The gateway no longer holds admin_role's password, but it did until now. Rotate it: ${selfCommand("rotate-secret", "postgres-password", "--install", install.domain)}`);
+            }
+            if (plan.services.some((s) => liveEnvHasInlinePassword(s.liveEnv))) {
+                // The services moved their database password to Secret Manager, but
+                // every earlier revision still shows it in its env.
+                r.warn(`The database password was stored in plain env vars before this upgrade and stays readable in the services' old revisions. Rotate it now: ${selfCommand("rotate-secret", "postgres-password", "--install", install.domain)}`);
+            }
+        },
+        complete: () => !incomplete,
+    };
+}
+//# sourceMappingURL=converge.js.map

package/dist/upgrade/converge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge.js","sourceRoot":"","sources":["../../src/upgrade/converge.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAoB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EAEtB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAI9B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsD,EACtD,aAAqB;IAErB,OAAO,CAAC,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,GAAG,aAAa,CAAC;AAC7D,CAAC;AAkCD,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAC3B,IAAiB,EACjB,UAAkB,EAClB,IAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAa,CAAC;IAC3F,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ;KACT,CAAC;IACF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,UAAU,GAAmD,IAAI,CAAC;IAEtE,KAAK,UAAU,iBAAiB;QAC9B,iEAAiE;QACjE,mEAAmE;QACnE,gEAAgE;QAChE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACxF,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG;YACf,MAAM,2BAA2B,CAAC,aAAa,EAAE,OAAO,CAAC;YACzD,GAAG,CAAC,WAAW,CAAC,EAAE;gBAChB,CAAC,CAAC,MAAM,sBAAsB,CAC1B;oBACE,GAAG,aAAa;oBAChB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,IAAI,EAAE,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;iBACzD,EACD,OAAO,CACR;gBACH,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;SACzF,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,oEAAoE,CAAC,CAAC;YAC/E,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,uEAAuE;QACvE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACd,6HAA6H,CAC9H,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,SAAS;YAAE,CAAC,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;aACtF,CAAC;YACJ,CAAC,CAAC,IAAI,CACJ,wBAAwB,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,WAAW,CACvH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACjH,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;gBAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;gBACtC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QACzC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACvD,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,UAAU;YACV,QAAQ;YACR,+BAA+B;YAC/B,aAAa,OAAO,CAAC,SAAS,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE;YACjB,CAAC,CAAC;gBACE,EAAE,EAAE,KAAc;gBAClB,KAAK,EAAE,mEAAmE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aAC9F;YACH,CAAC,CAAC,QAAQ;gBACR,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;gBAClF,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC3E,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,8BAA8B,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QAC/F,UAAU,GAAG,IAAI,CAAC;QAClB,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,gBAAgB;QAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,SAAS;YACT,kBAAkB;YAClB,MAAM;YACN,UAAU;YACV,aAAa,OAAO,CAAC,SAAS,EAAE;YAChC,wBAAwB,OAAO,CAAC,GAAG,gBAAgB;YACnD,sBAAsB;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,yEAAyE;QACzE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;YACrE,CAAC,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1E,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,iEAAiE,CAAC,CAAC;YAC5E,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,IAAI,CACJ,uGAAuG,CACxG,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC7B,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,0EAA0E;QAC1E,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD;YACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU;YACV,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ;SACpC,EACD,EAAE,GAAG,EAAE,CACR,CAAC;QACF,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE;YACpB,CAAC,CAAC,MAAM,wBAAwB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;YAC1D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACV,CAAC,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,wCAAwC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,IAAI,CACJ,mJAAmJ,CACpJ,CAAC;QACF,UAAU,GAAG,IAAI,CAAC;QAClB,cAAc,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa;YACjB,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAClF,IAAI,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/C,IAAI,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7C,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,EAAE;YACL,KAAK,CAAC,eAAe;gBACnB,IAAI,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;gBACpD,MAAM,cAAc,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC;YAC3D,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,IAAI;gBACnB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU;oBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAC9B,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,yDAAyD,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE;qBACpF;oBACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACnB,CAAC;YACD,KAAK,CAAC,aAAa,CAAC,IAAI;gBACtB,+DAA+D;gBAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAC9C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBAC1D,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;oBAAE,CAAC,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;;oBACxD,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC9B,CAAC;SACF;QAED,KAAK,CAAC,YAAY;YAChB,sEAAsE;YACtE,uEAAuE;YACvE,2CAA2C;YAC3C,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;oBAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBACpE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC1B,UAAU,GAAG,IAAI,CAAC;oBAClB,CAAC,CAAC,KAAK,CACL,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,0FAA0F,CAClJ,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,UAAU,EAAE,KAAK,EAAE,CAAC;gBACtB,oEAAoE;gBACpE,kDAAkD;gBAClD,CAAC,CAAC,IAAI,CACJ,uFAAuF,WAAW,CAAC,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CACxK,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACnE,oEAAoE;gBACpE,oDAAoD;gBACpD,CAAC,CAAC,IAAI,CACJ,4IAA4I,WAAW,CAAC,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAC7N,CAAC;YACJ,CAAC;QACH,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC"}

package/dist/upgrade/gcp-lookup.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Read-only lookups of a deployed GCP install, plus the one traffic move an
+ * app-roll needs to undo itself. Every function takes the {@link GcloudRunner}
+ * it runs through, so the upgrade phases can be driven by a fake in tests and
+ * by a different identity in the in-cloud upgrader job (epic #696).
+ */
+import type { GcloudRunner } from "../gcloud-retry.js";
+/**
+ * Pulumi auto-naming appends a random 7-char suffix to every resource
+ * (e.g. `caelo-production-admin-3efcfea`), so lifecycle commands find the
+ * deployed name by prefix. Returns the first match, or null when the listing
+ * fails or finds nothing.
+ */
+export declare function resolveGcpResourceName(run: GcloudRunner, kind: "run-service" | "sql-instance", prefix: string, projectId: string, region?: string): Promise<string | null>;
+/** The deployed service as `gcloud run services describe --format=json` returns it. */
+export declare function describeServiceJson(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<string | null>;
+/** The revision serving traffic now, so a failed roll can go back to it. */
+export declare function findCurrentRevision(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<string | null>;
+/** The service's own `run.app` URL. */
+export declare function findServiceUrl(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<string | null>;
+/** Pin all of a service's traffic to `revision`. */
+export declare function pinTraffic(run: GcloudRunner, projectId: string, region: string, serviceName: string, revision: string): Promise<boolean>;
+//# sourceMappingURL=gcp-lookup.d.ts.map

package/dist/upgrade/gcp-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-lookup.d.ts","sourceRoot":"","sources":["../../src/upgrade/gcp-lookup.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAAG,cAAc,EACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCxB;AAsBD,uFAAuF;AACvF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED,uCAAuC;AACvC,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,oDAAoD;AACpD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/upgrade/gcp-lookup.js

@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Pulumi auto-naming appends a random 7-char suffix to every resource
+ * (e.g. `caelo-production-admin-3efcfea`), so lifecycle commands find the
+ * deployed name by prefix. Returns the first match, or null when the listing
+ * fails or finds nothing.
+ */
+export async function resolveGcpResourceName(run, kind, prefix, projectId, region) {
+    const args = kind === "run-service"
+        ? [
+            "run",
+            "services",
+            "list",
+            "--region",
+            requiredRegion(region),
+            "--project",
+            projectId,
+            "--filter",
+            `metadata.name~^${prefix}`,
+            "--format=value(metadata.name)",
+        ]
+        : [
+            "sql",
+            "instances",
+            "list",
+            "--project",
+            projectId,
+            "--filter",
+            `name~^${prefix}`,
+            "--format=value(name)",
+        ];
+    const r = await run(args);
+    if (!r.ok)
+        return null;
+    return (r.stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .find((s) => s.length > 0) ?? null);
+}
+/** A Cloud Run lookup is regional; there is no default region to guess. */
+function requiredRegion(region) {
+    if (!region)
+        throw new Error("a Cloud Run lookup needs the install region (install.json)");
+    return region;
+}
+function describeArgs(serviceName, region, projectId, format) {
+    return [
+        "run",
+        "services",
+        "describe",
+        serviceName,
+        "--region",
+        region,
+        "--project",
+        projectId,
+        `--format=${format}`,
+    ];
+}
+/** The deployed service as `gcloud run services describe --format=json` returns it. */
+export async function describeServiceJson(run, projectId, region, serviceName) {
+    const r = await run(describeArgs(serviceName, region, projectId, "json"));
+    return r.ok ? r.stdout : null;
+}
+/** The revision serving traffic now, so a failed roll can go back to it. */
+export async function findCurrentRevision(run, projectId, region, serviceName) {
+    const r = await run(describeArgs(serviceName, region, projectId, "value(status.traffic[0].revisionName)"));
+    if (!r.ok)
+        return null;
+    return r.stdout.trim().split("\n")[0]?.trim() || null;
+}
+/** The service's own `run.app` URL. */
+export async function findServiceUrl(run, projectId, region, serviceName) {
+    const r = await run(describeArgs(serviceName, region, projectId, "value(status.url)"));
+    if (!r.ok)
+        return null;
+    return r.stdout.trim() || null;
+}
+/** Pin all of a service's traffic to `revision`. */
+export async function pinTraffic(run, projectId, region, serviceName, revision) {
+    const r = await run([
+        "run",
+        "services",
+        "update-traffic",
+        serviceName,
+        "--region",
+        region,
+        "--project",
+        projectId,
+        "--to-revisions",
+        `${revision}=100`,
+        "--quiet",
+    ]);
+    return r.ok;
+}
+//# sourceMappingURL=gcp-lookup.js.map

package/dist/upgrade/gcp-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-lookup.js","sourceRoot":"","sources":["../../src/upgrade/gcp-lookup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAWnC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAiB,EACjB,IAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GACR,IAAI,KAAK,aAAa;QACpB,CAAC,CAAC;YACE,KAAK;YACL,UAAU;YACV,MAAM;YACN,UAAU;YACV,cAAc,CAAC,MAAM,CAAC;YACtB,WAAW;YACX,SAAS;YACT,UAAU;YACV,kBAAkB,MAAM,EAAE;YAC1B,+BAA+B;SAChC;QACH,CAAC,CAAC;YACE,KAAK;YACL,WAAW;YACX,MAAM;YACN,WAAW;YACX,SAAS;YACT,UAAU;YACV,SAAS,MAAM,EAAE;YACjB,sBAAsB;SACvB,CAAC;IACR,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CACL,CAAC,CAAC,MAAM;SACL,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CACrC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,MAAc,EAAE,SAAiB,EAAE,MAAc;IAC1F,OAAO;QACL,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,YAAY,MAAM,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CACjB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,uCAAuC,CAAC,CACtF,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACxD,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB,EACnB,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,GAAG,QAAQ,MAAM;QACjB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC"}