@caelo-cms/provisioning 0.10.44 → 0.10.47

package/dist/state-command.d.ts

@@ -0,0 +1,20 @@
+/** Where install-dir archives go: `~/.caelo-backups/` (mode 700). */
+export declare function backupsDir(home?: string): string;
+/**
+ * Archive `~/.caelo-<id>/` (secrets and state included) to
+ * `~/.caelo-backups/<id>-<time>.tar.zst`, or `.tar.gz` when `zstd` is not
+ * installed. The archive and its directory are private (600 / 700): it
+ * holds the passphrase. Throws when the archive can't be made.
+ *
+ * @returns the archive's path
+ */
+export declare function backupInstallDir(installId: string, opts?: {
+    home?: string;
+    now?: Date;
+    hasZstd?: boolean;
+}): string;
+/** `cms-provision state migrate …`. */
+export declare function stateCommand(argv: readonly string[]): Promise<void>;
+/** `cms-provision attach --project <id>`. */
+export declare function attachCommand(argv: readonly string[]): Promise<void>;
+//# sourceMappingURL=state-command.d.ts.map

package/dist/state-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-command.d.ts","sourceRoot":"","sources":["../src/state-command.ts"],"names":[],"mappings":"AAiDA,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1D,MAAM,CAiCR;AAeD,uCAAuC;AACvC,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuJzE;AAED,6CAA6C;AAC7C,wBAAsB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB1E"}

package/dist/state-command.js

@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * CLI wiring for `cms-provision state migrate` and `cms-provision attach`
+ * (#696): parses the flags, picks the install, and hands the engines
+ * (state-migrate.ts, state-attach.ts) the real gcloud, Pulumi and file
+ * system.
+ */
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, renameSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { confirm, isCancel, log, note } from "@clack/prompts";
+import { bold, red } from "kleur/colors";
+import { activeAccount } from "./gcloud.js";
+import { adoptStateBackend, currentMetadata, ensureInstallDir, installFlag, installRoot, installStagingHost, listInstalls, readSecret, recordedImageDigests, selectInstall, writeSecret, } from "./install-state.js";
+import { installIapAllowlist } from "./operator-access.js";
+import { ensureOpsBackend } from "./ops-backend.js";
+import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
+import { selfCommand } from "./self-command.js";
+import { attachInstall } from "./state-attach.js";
+import { gcsBackendRecord, hasLocalPulumiState, installBackend, localStateDir, parseStateBackend, resolveBackend, } from "./state-backend.js";
+import { migrateState } from "./state-migrate.js";
+import { realStatePulumiOps } from "./state-pulumi.js";
+import { acquireStateLock, GcsStateStore, realSyncGcloud } from "./state-store.js";
+import { clackReporter } from "./upgrade/reporter.js";
+import { GCP_STACK_KNOB_DEFAULTS } from "./wizards/gcp-pulumi.js";
+/** Where install-dir archives go: `~/.caelo-backups/` (mode 700). */
+export function backupsDir(home = homedir()) {
+    return join(home, ".caelo-backups");
+}
+/**
+ * Archive `~/.caelo-<id>/` (secrets and state included) to
+ * `~/.caelo-backups/<id>-<time>.tar.zst`, or `.tar.gz` when `zstd` is not
+ * installed. The archive and its directory are private (600 / 700): it
+ * holds the passphrase. Throws when the archive can't be made.
+ *
+ * @returns the archive's path
+ */
+export function backupInstallDir(installId, opts = {}) {
+    const home = opts.home ?? homedir();
+    const dir = backupsDir(home);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const stamp = (opts.now ?? new Date()).toISOString().replace(/[:.]/g, "-");
+    const base = join(dir, `${installId}-${stamp}`);
+    const zstd = opts.hasZstd ?? spawnSync("zstd", ["--version"], { stdio: "ignore" }).status === 0;
+    const source = ["-C", home, `.caelo-${installId}`];
+    const run = (cmd, args) => {
+        const r = spawnSync(cmd, args, { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
+        if (r.status !== 0) {
+            throw new Error(`${cmd} failed while archiving ~/.caelo-${installId}: ${(r.stderr ?? "").trim()}`);
+        }
+    };
+    if (zstd) {
+        const tar = `${base}.tar`;
+        try {
+            run("tar", ["-cf", tar, ...source]);
+            chmodSync(tar, 0o600);
+            run("zstd", ["-q", "--rm", "-o", `${tar}.zst`, tar]);
+        }
+        finally {
+            rmSync(tar, { force: true });
+        }
+        chmodSync(`${tar}.zst`, 0o600);
+        return `${tar}.zst`;
+    }
+    const out = `${base}.tar.gz`;
+    run("tar", ["-czf", out, ...source]);
+    chmodSync(out, 0o600);
+    return out;
+}
+/** The value of `--<name> <v>` / `--<name>=<v>` on argv. */
+function flagValue(argv, name) {
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i] ?? "";
+        if (a === `--${name}`)
+            return argv[i + 1];
+        if (a.startsWith(`--${name}=`))
+            return a.slice(name.length + 3);
+    }
+    return undefined;
+}
+const USAGE = "Usage: cms-provision state migrate [--install <install-id or domain>] [--to remote|local] [--dry-run] [--yes]";
+/** `cms-provision state migrate …`. */
+export async function stateCommand(argv) {
+    if (argv[3] !== "migrate") {
+        console.log(USAGE);
+        process.exit(2);
+    }
+    const to = flagValue(argv, "to") ?? "remote";
+    if (to !== "remote" && to !== "local") {
+        console.error(`--to must be remote or local.\n${USAGE}`);
+        process.exit(2);
+    }
+    const dryRun = argv.includes("--dry-run");
+    const selected = selectInstall(listInstalls(), installFlag(argv));
+    if (!selected.ok) {
+        console.error(selected.message);
+        process.exit(1);
+    }
+    const meta = currentMetadata(selected.meta);
+    const { installId } = meta;
+    const root = installRoot(installId);
+    if ((meta.provider !== "gcp" && meta.provider !== "gcp-firebase") ||
+        !meta.projectId ||
+        !meta.region) {
+        log.error(red(`${installId} (${meta.provider}) keeps its state on the host or has no project/region recorded; state migrate is for gcp and gcp-firebase installs.`));
+        process.exit(1);
+    }
+    const { projectId, region, provider } = meta;
+    const imageDigests = recordedImageDigests(meta);
+    if (!imageDigests) {
+        log.error(red(`install.json of ${installId} records no image digests. Run ${bold(selfCommand("upgrade", "--install", installId))} first, then migrate.`));
+        process.exit(1);
+    }
+    const operator = await activeAccount();
+    if (!operator) {
+        log.error(red("No active gcloud account. Run `gcloud auth login`, then re-run."));
+        process.exit(1);
+    }
+    const provisioner = provisionerServiceAccountEmail(projectId);
+    note([
+        `Install:   ${bold(meta.domain)} (${installId}, project ${projectId}, ${region})`,
+        `Direction: ${to === "remote" ? `this machine → gs://${gcsBackendRecord(projectId, region).bucket} + Cloud KMS` : "the install's bucket → this machine"}`,
+        dryRun
+            ? "Dry run:   nothing will be changed"
+            : "The source stays in use until the copy is verified.",
+    ].join("\n"), "state migrate");
+    const result = await migrateState(meta, { to, dryRun }, {
+        pulumi: realStatePulumiOps({
+            provider,
+            installRoot: root,
+            impersonateServiceAccount: provisioner,
+            stackConfig: {
+                ...GCP_STACK_KNOB_DEFAULTS,
+                provider,
+                projectId,
+                domain: meta.domain,
+                stagingDomain: installStagingHost(meta),
+                ownerEmail: meta.ownerEmail,
+                region,
+                iapAllowlist: installIapAllowlist(meta.ownerEmail),
+                imageDigests,
+            },
+        }),
+        report: clackReporter(),
+        resolve: (record) => resolveBackend({ installId, stateBackend: record }, { installRoot: root, readPassphrase: () => readSecret(installId, "pulumi-passphrase") }),
+        confirmCost: async (costNote) => {
+            log.info(costNote);
+            if (argv.includes("--yes"))
+                return true;
+            if (!process.stdin.isTTY) {
+                log.error(red("Not a terminal: pass --yes to accept the cost above."));
+                return false;
+            }
+            const yes = await confirm({ message: "Create them and continue?", initialValue: true });
+            return !isCancel(yes) && yes === true;
+        },
+        ensureRemote: (dry) => ensureOpsBackend({ projectId, region, operatorAccount: operator, provisionerEmail: provisioner }, { dryRun: dry }),
+        backup: async () => backupInstallDir(installId),
+        localStateEmpty: () => !hasLocalPulumiState(root),
+        prepareLocalTarget: () => {
+            mkdirSync(localStateDir(root), { recursive: true, mode: 0o700 });
+            if (!readSecret(installId, "pulumi-passphrase")) {
+                writeSecret(installId, "pulumi-passphrase", randomBytes(32).toString("hex"));
+            }
+        },
+        lock: async () => {
+            // The source's lock (local file or bucket object) keeps installer
+            // runs out; the bucket's also keeps out a migration started on
+            // another machine when the bucket is the target.
+            const source = meta.stateBackend ?? { kind: "local" };
+            const releases = [acquireStateLock(source, root, "state migrate")];
+            if (source.kind === "local" && to === "remote") {
+                try {
+                    releases.push(acquireStateLock(gcsBackendRecord(projectId, region), root, "state migrate"));
+                }
+                catch (e) {
+                    for (const r of releases)
+                        r();
+                    throw e;
+                }
+            }
+            return async () => {
+                for (const r of releases.reverse())
+                    r();
+            };
+        },
+        remoteRecordedBackend: () => {
+            const text = new GcsStateStore(gcsBackendRecord(projectId, region).bucket, root).peek("install.json");
+            if (text === null)
+                return null;
+            return installBackend({ stateBackend: parseStateBackend(JSON.parse(text).stateBackend) })
+                .kind;
+        },
+        adopt: (record) => {
+            adoptStateBackend(installId, record);
+        },
+        retireLocalState: () => {
+            const dir = localStateDir(root);
+            if (!existsSync(dir))
+                return null;
+            const moved = `${dir}.migrated-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+            renameSync(dir, moved);
+            return moved;
+        },
+    });
+    if (!result.ok) {
+        log.error(red(result.error));
+        process.exit(1);
+    }
+}
+/** `cms-provision attach --project <id>`. */
+export async function attachCommand(argv) {
+    const projectId = flagValue(argv, "project");
+    if (!projectId || projectId.startsWith("-")) {
+        console.log("Usage: cms-provision attach --project <gcp-project-id>");
+        process.exit(2);
+    }
+    const r = attachInstall(projectId, {
+        run: realSyncGcloud,
+        rootFor: installRoot,
+        hasLocalState: hasLocalPulumiState,
+    });
+    if (!r.ok) {
+        log.error(red(r.error));
+        process.exit(1);
+    }
+    ensureInstallDir(r.installId);
+    log.success(r.status === "refreshed"
+        ? `${r.domain} was already attached; its local copy of install.json is up to date.`
+        : `Attached ${bold(r.domain)} (${r.installId}). status, upgrade, backup and re-running the installer now work from this machine.`);
+    log.info("Infrastructure runs need Application Default Credentials once on this machine: gcloud auth application-default login");
+}
+//# sourceMappingURL=state-command.js.map

package/dist/state-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-command.js","sourceRoot":"","sources":["../src/state-command.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,OAAyD,EAAE;IAE3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,SAAS,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,SAAS,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,IAAI,CAAC;YACH,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;YACpC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,SAAS,CAAC,GAAG,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,GAAG,GAAG,MAAM,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,CAAC;IAC7B,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IACrC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,SAAS,SAAS,CAAC,IAAuB,EAAE,IAAY;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,KAAK,GACT,+GAA+G,CAAC;AAElH,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAuB;IACxD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC7C,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,IACE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC;QAC7D,CAAC,IAAI,CAAC,SAAS;QACf,CAAC,IAAI,CAAC,MAAM,EACZ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,GAAG,CACD,GAAG,SAAS,KAAK,IAAI,CAAC,QAAQ,sHAAsH,CACrJ,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC7C,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,GAAG,CACD,mBAAmB,SAAS,kCAAkC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,uBAAuB,CAC1I,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CACF;QACE,cAAc,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,aAAa,SAAS,KAAK,MAAM,GAAG;QACjF,cAAc,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC,qCAAqC,EAAE;QACzJ,MAAM;YACJ,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,qDAAqD;KAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,eAAe,CAChB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,EACJ,EAAE,EAAE,EAAE,MAAM,EAAE,EACd;QACE,MAAM,EAAE,kBAAkB,CAAC;YACzB,QAAQ;YACR,WAAW,EAAE,IAAI;YACjB,yBAAyB,EAAE,WAAW;YACtC,WAAW,EAAE;gBACX,GAAG,uBAAuB;gBAC1B,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC;gBACvC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM;gBACN,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;gBAClD,YAAY;aACb;SACF,CAAC;QACF,MAAM,EAAE,aAAa,EAAE;QACvB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,cAAc,CACZ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EACnC,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,CACxF;QACH,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC9B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;gBACvE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC;QACxC,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CACpB,gBAAgB,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;QACH,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAC/C,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACjD,kBAAkB,EAAE,GAAG,EAAE;YACvB,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBAChD,WAAW,CAAC,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,kEAAkE;YAClE,+DAA+D;YAC/D,iDAAiD;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,QAAQ,CAAC,IAAI,CACX,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAC7E,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,MAAM,CAAC,IAAI,QAAQ;wBAAE,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;YACD,OAAO,KAAK,IAAI,EAAE;gBAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE;oBAAE,CAAC,EAAE,CAAC;YAC1C,CAAC,CAAC;QACJ,CAAC;QACD,qBAAqB,EAAE,GAAG,EAAE;YAC1B,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CACnF,cAAc,CACf,CAAC;YACF,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,OAAO,cAAc,CAAC,EAAE,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;iBACtF,IAAI,CAAC;QACV,CAAC;QACD,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,KAAK,GAAG,GAAG,GAAG,aAAa,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAClF,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE;QACjC,GAAG,EAAE,cAAc;QACnB,OAAO,EAAE,WAAW;QACpB,aAAa,EAAE,mBAAmB;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9B,GAAG,CAAC,OAAO,CACT,CAAC,CAAC,MAAM,KAAK,WAAW;QACtB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,sEAAsE;QACnF,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,qFAAqF,CACpI,CAAC;IACF,GAAG,CAAC,IAAI,CACN,sHAAsH,CACvH,CAAC;AACJ,CAAC"}

package/dist/state-migrate.d.ts

@@ -0,0 +1,121 @@
+/**
+ * `cms-provision state migrate` (#696): move an existing install's Pulumi
+ * state, secrets provider and install metadata between this machine
+ * (`~/.caelo-<id>/state` + passphrase) and the install's own GCP project
+ * (`gs://<project>-caelo-ops` + Cloud KMS), in either direction.
+ *
+ * The source stays authoritative until the very end:
+ *
+ *   1. preflight — Pulumi CLI version (`pulumi stack migrate` from
+ *      {@link STACK_MIGRATE_MIN_VERSION}, else export/import +
+ *      change-secrets-provider), the source stack exists, has no pending
+ *      operations, and a preview of it shows no changes (an unconverged
+ *      stack can't prove the copy is identical, so it is refused);
+ *   2. a mode-600 archive of `~/.caelo-<id>/` (tar.zst, else tar.gz);
+ *   3. the target: bucket + KMS key ensured (remote) or an empty local
+ *      state dir + passphrase (local); a leftover copy from an interrupted
+ *      run is removed — it was never authoritative;
+ *   4. copy, re-encrypting the secrets for the target's provider;
+ *   5. verify — a preview of the target shows no changes and its outputs
+ *      (secrets included) hash identically to the source's; on any
+ *      mismatch the target copy is removed and nothing else changes;
+ *   6. flip — install.json records the new backend (locally and in the
+ *      bucket); the old local state dir is renamed, never deleted.
+ *
+ * `--dry-run` runs the read-only preflight and reports what it would do.
+ * The engine takes its side effects as {@link MigrateDeps} so the whole
+ * sequence is tested against fakes (state-migrate.test.ts); state-command.ts
+ * wires the real Pulumi CLI, gcloud and file system.
+ */
+import type { OpsBackendResult } from "./ops-backend.js";
+import { type ResolvedBackend, type StateBackendRecord } from "./state-backend.js";
+import type { UpgradeReporter } from "./upgrade/reporter.js";
+/** First Pulumi CLI release with `pulumi stack migrate` between DIY backends. */
+export declare const STACK_MIGRATE_MIN_VERSION = "3.254.0";
+/** What the ops bucket + KMS key cost (wizards/gcp-cost.ts carries the same line). */
+export declare const OPS_BACKEND_COST_NOTE = "Creates (if missing) a versioned Cloud Storage bucket + one Cloud KMS key in the install's project: < $0.10/mo (KMS key version $0.06/mo, a few MB of state).";
+/** The Pulumi operations a migration needs, against one backend at a time. */
+export interface StatePulumiOps {
+    /** `pulumi version` without the `v`, or null when the CLI is missing. */
+    cliVersion(): Promise<string | null>;
+    stackExists(backend: ResolvedBackend): Promise<boolean>;
+    /** Pending operations recorded in the stack's state (an interrupted run). */
+    pendingOperations(backend: ResolvedBackend): Promise<number>;
+    /** Steps a preview would take other than "same". */
+    previewChanges(backend: ResolvedBackend): Promise<number>;
+    /** sha256 of the stack outputs, secrets included. Never the values. */
+    outputsDigest(backend: ResolvedBackend): Promise<string>;
+    /** Whether a Pulumi operation holds the stack's lock in `backend` right now. */
+    locked(backend: ResolvedBackend): Promise<boolean>;
+    /** sha256 of the stack's exported checkpoint (ciphertext; never decrypted). */
+    stateDigest(backend: ResolvedBackend): Promise<string>;
+    /** `pulumi stack migrate <from> --secrets-provider <to's>` into `to`. */
+    stackMigrate(from: ResolvedBackend, to: ResolvedBackend): Promise<void>;
+    /** export → init → import → change-secrets-provider (older CLIs). */
+    exportImport(from: ResolvedBackend, to: ResolvedBackend): Promise<void>;
+    /** Remove the stack's state from `backend` (cloud resources untouched). */
+    removeStack(backend: ResolvedBackend): Promise<void>;
+}
+/** Everything the migration touches outside Pulumi. */
+export interface MigrateDeps {
+    readonly pulumi: StatePulumiOps;
+    readonly report: UpgradeReporter;
+    /** The install's backend resolved for Pulumi. */
+    resolve(record: StateBackendRecord): ResolvedBackend;
+    /** Ask the operator to accept the ops backend's cost; false = cancel. */
+    confirmCost(note: string): Promise<boolean>;
+    /** Ensure (or, dry, inspect) the ops bucket + KMS key. */
+    ensureRemote(dryRun: boolean): Promise<OpsBackendResult>;
+    /** Archive `~/.caelo-<id>/`; returns the archive's path. */
+    backup(): Promise<string>;
+    /** Whether the local state dir is absent or holds no stack. */
+    localStateEmpty(): boolean;
+    /** Create the local state dir (mode 700) and `secrets/pulumi-passphrase` if missing. */
+    prepareLocalTarget(): void;
+    /**
+     * The backend the bucket's install.json names (`null` when the bucket or
+     * the document doesn't exist). `gcs` there means the bucket copy is
+     * authoritative — some machine finished a migration — and must never be
+     * replaced from this machine's (then stale) local state.
+     */
+    remoteRecordedBackend(): StateBackendRecord["kind"] | null;
+    /** Record the new backend (install-state.ts adoptStateBackend). */
+    adopt(record: StateBackendRecord): void;
+    /**
+     * Take the install's state lock (state-store.ts acquireStateLock: the
+     * source's, plus the bucket's when it is the target), which installer
+     * runs hold through `pulumi up` too; throws when another run holds it.
+     * Returns the release function.
+     */
+    lock(): Promise<() => Promise<void>>;
+    /** Rename the local state dir out of the way; returns where it went. */
+    retireLocalState(): string | null;
+}
+export interface MigrateOptions {
+    readonly to: "remote" | "local";
+    readonly dryRun: boolean;
+}
+export type MigrateResult = {
+    readonly ok: true;
+    readonly changed: boolean;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/** The subset of install metadata a migration reads. */
+export interface MigrateInstall {
+    readonly installId: string;
+    readonly provider: string;
+    readonly projectId: string | null;
+    readonly region: string | null;
+    readonly stateBackend?: StateBackendRecord;
+}
+/** a >= b for dotted numeric versions (`3.254.0`). */
+export declare function versionAtLeast(a: string, b: string): boolean;
+/**
+ * Run the migration. Never throws for an expected failure: the result says
+ * what failed, and at every failure point the source backend is still the
+ * one install.json names.
+ */
+export declare function migrateState(meta: MigrateInstall, opts: MigrateOptions, deps: MigrateDeps): Promise<MigrateResult>;
+//# sourceMappingURL=state-migrate.d.ts.map

package/dist/state-migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-migrate.d.ts","sourceRoot":"","sources":["../src/state-migrate.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,kKAC+H,CAAC;AAElK,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,6EAA6E;IAC7E,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,oDAAoD;IACpD,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,gFAAgF;IAChF,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,+EAA+E;IAC/E,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,yEAAyE;IACzE,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,qEAAqE;IACrE,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,2EAA2E;IAC3E,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,iDAAiD;IACjD,OAAO,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,CAAC;IACrD,yEAAyE;IACzE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,0DAA0D;IAC1D,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzD,4DAA4D;IAC5D,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,+DAA+D;IAC/D,eAAe,IAAI,OAAO,CAAC;IAC3B,wFAAwF;IACxF,kBAAkB,IAAI,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,qBAAqB,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3D,mEAAmE;IACnE,KAAK,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,IAAI,IAAI,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,wEAAwE;IACxE,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C;AAED,sDAAsD;AACtD,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAU5D;AAID;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CAyRxB"}