@caelo-cms/provisioning 0.10.46 → 0.10.47

package/dist/state-attach.js

@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * `cms-provision attach --project <id>` (#696): make an install whose state
+ * lives in its ops bucket manageable from this machine (a new laptop, Cloud
+ * Shell). It reads `gs://<project>-caelo-ops/install/install.json`, checks
+ * it, and mirrors install.json + progress.json into `~/.caelo-<id>/`. No
+ * secret is copied, because none exists outside the operator's Google
+ * login: Pulumi reaches the state and its KMS key with that login.
+ *
+ * Refuses rather than overwrites: an install directory here that holds this
+ * install's local state (it was never migrated) or another backend.
+ */
+import { existsSync, mkdirSync } from "node:fs";
+import { selfCommand } from "./self-command.js";
+import { opsBucketName, parseStateBackend } from "./state-backend.js";
+import { GcsStateStore, LocalStateStore } from "./state-store.js";
+/** Install ids are `<provider>-<slug>` (install-state.ts deriveInstallId). */
+const INSTALL_ID = /^[a-z0-9][a-z0-9-]{0,80}$/;
+/**
+ * Attach the install in `projectId` to this machine.
+ *
+ * @param deps.run gcloud runner (tests pass a fake bucket)
+ * @param deps.rootFor `~/.caelo-<id>` for an install id
+ * @param deps.hasLocalState whether a dir holds a local Pulumi stack
+ */
+export function attachInstall(projectId, deps) {
+    const bucket = opsBucketName(projectId);
+    let text;
+    try {
+        // Peek: the directory to mirror into isn't known (or checked) yet.
+        text = new GcsStateStore(bucket, "/nonexistent", deps.run).peek("install.json");
+    }
+    catch (e) {
+        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+    }
+    if (text === null) {
+        return {
+            ok: false,
+            error: `gs://${bucket} holds no install.json. If this install's state is still on the machine that installed it, run \`${selfCommand("state", "migrate")}\` there first.`,
+        };
+    }
+    let remote;
+    try {
+        remote = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, error: `gs://${bucket}/install/install.json is not valid JSON.` };
+    }
+    const installId = typeof remote.installId === "string" ? remote.installId : "";
+    if (!INSTALL_ID.test(installId) || remote.projectId !== projectId) {
+        return {
+            ok: false,
+            error: `gs://${bucket}/install/install.json does not describe an install in project ${projectId}; refusing to attach.`,
+        };
+    }
+    let backend;
+    try {
+        backend = parseStateBackend(remote.stateBackend);
+    }
+    catch (e) {
+        return { ok: false, error: e instanceof Error ? e.message : String(e) };
+    }
+    if (backend?.kind !== "gcs") {
+        return {
+            ok: false,
+            error: `${installId}'s state was moved back to a machine (state migrate --to local); there is nothing in gs://${bucket} to attach to. Run \`state migrate --to remote\` on that machine first.`,
+        };
+    }
+    if (backend.bucket !== bucket) {
+        return {
+            ok: false,
+            error: `install.json in gs://${bucket} names another bucket (${backend.bucket}); refusing to attach.`,
+        };
+    }
+    const root = deps.rootFor(installId);
+    const localText = new LocalStateStore(root).read("install.json");
+    // Local Pulumi state blocks the attach whether or not an install.json
+    // sits next to it: attaching would hide it.
+    if (deps.hasLocalState(root)) {
+        return {
+            ok: false,
+            error: `${root} holds a local Pulumi state of this install. Attaching would hide it; run \`${selfCommand("state", "migrate", "--install", installId)}\` instead, or move ${root} aside if that state is stale.`,
+        };
+    }
+    let status = "attached";
+    if (localText !== null) {
+        const local = JSON.parse(localText);
+        const localBackend = parseStateBackend(local.stateBackend);
+        if (localBackend?.kind === "gcs" && localBackend.bucket === bucket) {
+            status = "refreshed";
+        }
+        else {
+            return {
+                ok: false,
+                error: `${root}/install.json exists and names another backend. Move ${root} aside, then re-run attach.`,
+            };
+        }
+    }
+    if (!existsSync(root))
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+    // Mirror exactly the install.json validated above (a re-read could fetch
+    // a different one written meanwhile); progress.json is bookkeeping.
+    new LocalStateStore(root).write("install.json", JSON.parse(text));
+    new GcsStateStore(bucket, root, deps.run).read("progress.json");
+    return {
+        ok: true,
+        installId,
+        domain: typeof remote.domain === "string" ? remote.domain : installId,
+        status,
+    };
+}
+//# sourceMappingURL=state-attach.js.map

package/dist/state-attach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-attach.js","sourceRoot":"","sources":["../src/state-attach.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAmB,MAAM,kBAAkB,CAAC;AAWnF,8EAA8E;AAC9E,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,IAIC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,IAAmB,CAAC;IACxB,IAAI,CAAC;QACH,mEAAmE;QACnE,IAAI,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ,MAAM,oGAAoG,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB;SAC1K,CAAC;IACJ,CAAC;IACD,IAAI,MAKH,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,MAAM,0CAA0C,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ,MAAM,iEAAiE,SAAS,uBAAuB;SACvH,CAAC;IACJ,CAAC;IACD,IAAI,OAA6C,CAAC;IAClD,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,SAAS,6FAA6F,MAAM,yEAAyE;SAChM,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,MAAM,0BAA0B,OAAO,CAAC,MAAM,wBAAwB;SACtG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjE,sEAAsE;IACtE,4CAA4C;IAC5C,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,IAAI,+EAA+E,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,uBAAuB,IAAI,gCAAgC;SAChN,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAA6B,UAAU,CAAC;IAClD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA+B,CAAC;QAClE,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,YAAY,EAAE,IAAI,KAAK,KAAK,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnE,MAAM,GAAG,WAAW,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,IAAI,wDAAwD,IAAI,6BAA6B;aACxG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS;QACT,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACrE,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/state-backend.d.ts

@@ -100,4 +100,15 @@ export declare function chooseInstallBackend(meta: {
     readonly provider: string;
     readonly stateBackend?: StateBackendRecord;
 }, localStateExists: boolean, deployed?: boolean): StateBackendRecord["kind"];
+/**
+ * What `upgrade` tells the operator about an install whose Pulumi state is
+ * still on this machine (#696), or null when it lives in the install's own
+ * cloud. `upgrade` never moves state itself: the move has its own
+ * preflight, backup and verification (`state migrate`).
+ */
+export declare function localStateNotice(meta: {
+    readonly installId: string;
+    readonly provider: string;
+    readonly stateBackend?: StateBackendRecord;
+}): string | null;
 //# sourceMappingURL=state-backend.d.ts.map

package/dist/state-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state-backend.d.ts","sourceRoot":"","sources":["../src/state-backend.ts"],"names":[],"mappings":"AA6BA,kFAAkF;AAClF,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,0EAA0E;AAC1E,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAC5C,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN,4DAA4D;AAC5D,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAE5E,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAMpF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAE,sBAElF;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAiBhF;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAE,EAChF,IAAI,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;CAAE,GACnF,eAAe,CA+BjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAE,EACpD,WAAW,EAAE,MAAM,GAClB,MAAM,CAMR;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAE,EACpD,WAAW,EAAE,MAAM,GAClB,MAAM,CAKR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAMhE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C,EACD,gBAAgB,EAAE,OAAO,EACzB,QAAQ,UAAQ,GACf,kBAAkB,CAAC,MAAM,CAAC,CAY5B"}
+{"version":3,"file":"state-backend.d.ts","sourceRoot":"","sources":["../src/state-backend.ts"],"names":[],"mappings":"AA8BA,kFAAkF;AAClF,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,0EAA0E;AAC1E,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAC5C,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAC1C,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN,4DAA4D;AAC5D,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC,CAAC;AAE5E,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC1C,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAMpF;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAE,sBAElF;AAMD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAiBhF;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAE,EAChF,IAAI,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,MAAM,GAAG,IAAI,CAAA;CAAE,GACnF,eAAe,CA+BjB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAE,EACpD,WAAW,EAAE,MAAM,GAClB,MAAM,CAMR;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;CAAE,EACpD,WAAW,EAAE,MAAM,GAClB,MAAM,CAKR;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAMhE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C,EACD,gBAAgB,EAAE,OAAO,EACzB,QAAQ,UAAQ,GACf,kBAAkB,CAAC,MAAM,CAAC,CAY5B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C,GAAG,MAAM,GAAG,IAAI,CAUhB"}

package/dist/state-backend.js

@@ -24,6 +24,7 @@
  */
 import { existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
+import { selfCommand } from "./self-command.js";
 /** Name of the Cloud KMS key ring holding Caelo's keys in the install project. */
 export const OPS_KEY_RING = "caelo";
 /** Name of the Cloud KMS key Pulumi encrypts the stack's secrets with. */
@@ -177,4 +178,23 @@ export function chooseInstallBackend(meta, localStateExists, deployed = false) {
     }
     return "gcs";
 }
+/**
+ * What `upgrade` tells the operator about an install whose Pulumi state is
+ * still on this machine (#696), or null when it lives in the install's own
+ * cloud. `upgrade` never moves state itself: the move has its own
+ * preflight, backup and verification (`state migrate`).
+ */
+export function localStateNotice(meta) {
+    if (installBackend(meta).kind !== "local")
+        return null;
+    if (meta.provider !== "gcp" && meta.provider !== "gcp-firebase")
+        return null;
+    return [
+        `This install's Pulumi state and passphrase live only on this machine (~/.caelo-${meta.installId}/).`,
+        "Lose this machine and the install's infrastructure can no longer be converged from anywhere.",
+        "Move them into the install's own GCP project (versioned bucket + Cloud KMS key, < $0.10/mo):",
+        `  ${selfCommand("state", "migrate", "--install", meta.installId, "--dry-run")}`,
+        `  ${selfCommand("state", "migrate", "--install", meta.installId)}`,
+    ].join("\n");
+}
 //# sourceMappingURL=state-backend.js.map

package/dist/state-backend.js.map

@@ -1 +1 @@
-{"version":3,"file":"state-backend.js","sourceRoot":"","sources":["../src/state-backend.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,kFAAkF;AAClF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AACpC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAC5C,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAC1C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AA2B5C,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,GAAG,SAAS,YAAY,CAAC;AAClC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAc;IAC7D,OAAO,YAAY,SAAS,cAAc,MAAM,aAAa,YAAY,eAAe,aAAa,EAAE,CAAC;AAC1G,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc;IAChE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;QAChC,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,IAAoD;IACjF,OAAO,IAAI,CAAC,YAAY,IAAK,EAAE,IAAI,EAAE,OAAO,EAAY,CAAC;AAC3D,CAAC;AAED,MAAM,MAAM,GAAG,qCAAqC,CAAC;AACrD,MAAM,OAAO,GACX,yHAAyH,CAAC;AAE5H;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,KAAuC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtD,IACE,CAAC;QACD,CAAC,CAAC,IAAI,KAAK,KAAK;QAChB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACrB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EACtB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gHAAgH,aAAa,KAAK,CACnM,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAgF,EAChF,IAAoF;IAEpF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,GAAG;YACH,eAAe,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE;YAC5C,OAAO,EAAE;gBACP,kBAAkB,EAAE,GAAG;gBACvB,wCAAwC,EAAE,MAAM;aACjD;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,SAAS,0IAA0I,IAAI,CAAC,SAAS,IAAI,CACvL,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;IACxD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG;QACH,eAAe,EAAE,YAAY;QAC7B,OAAO,EAAE;YACP,kBAAkB,EAAE,GAAG;YACvB,wBAAwB,EAAE,UAAU;YACpC,wCAAwC,EAAE,MAAM;SACjD;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAoD,EACpD,WAAmB;IAEnB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,2BAA2B,MAAM,CAAC,MAAM,IAAI,iBAAiB,gDAAgD,CAAC;IACvH,CAAC;IACD,OAAO,6BAA6B,aAAa,CAAC,WAAW,CAAC,oCAAoC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,mBAAmB,CAAC,kDAAkD,CAAC;AACxM,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAC7B,IAAoD,EACpD,WAAmB;IAEnB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK;QAC1B,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,wBAAwB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC9F,CAAC,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,6CAA6C,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,sEAAsE;IACtE,iCAAiC;IACjC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAIC,EACD,gBAAyB,EACzB,QAAQ,GAAG,KAAK;IAEhB,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc;QAAE,OAAO,OAAO,CAAC;IAChF,IAAI,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,SAAS,IAAI,EAAE,2FAA2F,IAAI,CAAC,SAAS,IAAI,cAAc,6DAA6D,CACxN,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"state-backend.js","sourceRoot":"","sources":["../src/state-backend.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,kFAAkF;AAClF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AACpC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAC5C,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAC1C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AA2B5C,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,GAAG,SAAS,YAAY,CAAC;AAClC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAc;IAC7D,OAAO,YAAY,SAAS,cAAc,MAAM,aAAa,YAAY,eAAe,aAAa,EAAE,CAAC;AAC1G,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,MAAc;IAChE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;QAChC,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,IAAoD;IACjF,OAAO,IAAI,CAAC,YAAY,IAAK,EAAE,IAAI,EAAE,OAAO,EAAY,CAAC;AAC3D,CAAC;AAED,MAAM,MAAM,GAAG,qCAAqC,CAAC;AACrD,MAAM,OAAO,GACX,yHAAyH,CAAC;AAE5H;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,KAAuC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtD,IACE,CAAC;QACD,CAAC,CAAC,IAAI,KAAK,KAAK;QAChB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QACrB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EACtB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2CAA2C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,gHAAgH,aAAa,KAAK,CACnM,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAgF,EAChF,IAAoF;IAEpF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,MAAM,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,GAAG;YACH,eAAe,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE;YAC5C,OAAO,EAAE;gBACP,kBAAkB,EAAE,GAAG;gBACvB,wCAAwC,EAAE,MAAM;aACjD;SACF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,CAAC,SAAS,0IAA0I,IAAI,CAAC,SAAS,IAAI,CACvL,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;IACxD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG;QACH,eAAe,EAAE,YAAY;QAC7B,OAAO,EAAE;YACP,kBAAkB,EAAE,GAAG;YACvB,wBAAwB,EAAE,UAAU;YACpC,wCAAwC,EAAE,MAAM;SACjD;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAoD,EACpD,WAAmB;IAEnB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,2BAA2B,MAAM,CAAC,MAAM,IAAI,iBAAiB,gDAAgD,CAAC;IACvH,CAAC;IACD,OAAO,6BAA6B,aAAa,CAAC,WAAW,CAAC,oCAAoC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,mBAAmB,CAAC,kDAAkD,CAAC;AACxM,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAC7B,IAAoD,EACpD,WAAmB;IAEnB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK;QAC1B,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,wBAAwB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC9F,CAAC,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,6CAA6C,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,sEAAsE;IACtE,iCAAiC;IACjC,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAIC,EACD,gBAAyB,EACzB,QAAQ,GAAG,KAAK;IAEhB,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc;QAAE,OAAO,OAAO,CAAC;IAChF,IAAI,gBAAgB;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,QAAQ,EAAE,CAAC;QACb,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,SAAS,IAAI,EAAE,2FAA2F,IAAI,CAAC,SAAS,IAAI,cAAc,6DAA6D,CACxN,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAIhC;IACC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO;QACL,kFAAkF,IAAI,CAAC,SAAS,KAAK;QACrG,8FAA8F;QAC9F,8FAA8F;QAC9F,KAAK,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE;QAChF,KAAK,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE;KACpE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/state-command.d.ts

@@ -0,0 +1,20 @@
+/** Where install-dir archives go: `~/.caelo-backups/` (mode 700). */
+export declare function backupsDir(home?: string): string;
+/**
+ * Archive `~/.caelo-<id>/` (secrets and state included) to
+ * `~/.caelo-backups/<id>-<time>.tar.zst`, or `.tar.gz` when `zstd` is not
+ * installed. The archive and its directory are private (600 / 700): it
+ * holds the passphrase. Throws when the archive can't be made.
+ *
+ * @returns the archive's path
+ */
+export declare function backupInstallDir(installId: string, opts?: {
+    home?: string;
+    now?: Date;
+    hasZstd?: boolean;
+}): string;
+/** `cms-provision state migrate …`. */
+export declare function stateCommand(argv: readonly string[]): Promise<void>;
+/** `cms-provision attach --project <id>`. */
+export declare function attachCommand(argv: readonly string[]): Promise<void>;
+//# sourceMappingURL=state-command.d.ts.map

package/dist/state-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-command.d.ts","sourceRoot":"","sources":["../src/state-command.ts"],"names":[],"mappings":"AAiDA,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE3D;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1D,MAAM,CAiCR;AAeD,uCAAuC;AACvC,wBAAsB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuJzE;AAED,6CAA6C;AAC7C,wBAAsB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAwB1E"}

package/dist/state-command.js

@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * CLI wiring for `cms-provision state migrate` and `cms-provision attach`
+ * (#696): parses the flags, picks the install, and hands the engines
+ * (state-migrate.ts, state-attach.ts) the real gcloud, Pulumi and file
+ * system.
+ */
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, renameSync, rmSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { confirm, isCancel, log, note } from "@clack/prompts";
+import { bold, red } from "kleur/colors";
+import { activeAccount } from "./gcloud.js";
+import { adoptStateBackend, currentMetadata, ensureInstallDir, installFlag, installRoot, installStagingHost, listInstalls, readSecret, recordedImageDigests, selectInstall, writeSecret, } from "./install-state.js";
+import { installIapAllowlist } from "./operator-access.js";
+import { ensureOpsBackend } from "./ops-backend.js";
+import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
+import { selfCommand } from "./self-command.js";
+import { attachInstall } from "./state-attach.js";
+import { gcsBackendRecord, hasLocalPulumiState, installBackend, localStateDir, parseStateBackend, resolveBackend, } from "./state-backend.js";
+import { migrateState } from "./state-migrate.js";
+import { realStatePulumiOps } from "./state-pulumi.js";
+import { acquireStateLock, GcsStateStore, realSyncGcloud } from "./state-store.js";
+import { clackReporter } from "./upgrade/reporter.js";
+import { GCP_STACK_KNOB_DEFAULTS } from "./wizards/gcp-pulumi.js";
+/** Where install-dir archives go: `~/.caelo-backups/` (mode 700). */
+export function backupsDir(home = homedir()) {
+    return join(home, ".caelo-backups");
+}
+/**
+ * Archive `~/.caelo-<id>/` (secrets and state included) to
+ * `~/.caelo-backups/<id>-<time>.tar.zst`, or `.tar.gz` when `zstd` is not
+ * installed. The archive and its directory are private (600 / 700): it
+ * holds the passphrase. Throws when the archive can't be made.
+ *
+ * @returns the archive's path
+ */
+export function backupInstallDir(installId, opts = {}) {
+    const home = opts.home ?? homedir();
+    const dir = backupsDir(home);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const stamp = (opts.now ?? new Date()).toISOString().replace(/[:.]/g, "-");
+    const base = join(dir, `${installId}-${stamp}`);
+    const zstd = opts.hasZstd ?? spawnSync("zstd", ["--version"], { stdio: "ignore" }).status === 0;
+    const source = ["-C", home, `.caelo-${installId}`];
+    const run = (cmd, args) => {
+        const r = spawnSync(cmd, args, { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8" });
+        if (r.status !== 0) {
+            throw new Error(`${cmd} failed while archiving ~/.caelo-${installId}: ${(r.stderr ?? "").trim()}`);
+        }
+    };
+    if (zstd) {
+        const tar = `${base}.tar`;
+        try {
+            run("tar", ["-cf", tar, ...source]);
+            chmodSync(tar, 0o600);
+            run("zstd", ["-q", "--rm", "-o", `${tar}.zst`, tar]);
+        }
+        finally {
+            rmSync(tar, { force: true });
+        }
+        chmodSync(`${tar}.zst`, 0o600);
+        return `${tar}.zst`;
+    }
+    const out = `${base}.tar.gz`;
+    run("tar", ["-czf", out, ...source]);
+    chmodSync(out, 0o600);
+    return out;
+}
+/** The value of `--<name> <v>` / `--<name>=<v>` on argv. */
+function flagValue(argv, name) {
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i] ?? "";
+        if (a === `--${name}`)
+            return argv[i + 1];
+        if (a.startsWith(`--${name}=`))
+            return a.slice(name.length + 3);
+    }
+    return undefined;
+}
+const USAGE = "Usage: cms-provision state migrate [--install <install-id or domain>] [--to remote|local] [--dry-run] [--yes]";
+/** `cms-provision state migrate …`. */
+export async function stateCommand(argv) {
+    if (argv[3] !== "migrate") {
+        console.log(USAGE);
+        process.exit(2);
+    }
+    const to = flagValue(argv, "to") ?? "remote";
+    if (to !== "remote" && to !== "local") {
+        console.error(`--to must be remote or local.\n${USAGE}`);
+        process.exit(2);
+    }
+    const dryRun = argv.includes("--dry-run");
+    const selected = selectInstall(listInstalls(), installFlag(argv));
+    if (!selected.ok) {
+        console.error(selected.message);
+        process.exit(1);
+    }
+    const meta = currentMetadata(selected.meta);
+    const { installId } = meta;
+    const root = installRoot(installId);
+    if ((meta.provider !== "gcp" && meta.provider !== "gcp-firebase") ||
+        !meta.projectId ||
+        !meta.region) {
+        log.error(red(`${installId} (${meta.provider}) keeps its state on the host or has no project/region recorded; state migrate is for gcp and gcp-firebase installs.`));
+        process.exit(1);
+    }
+    const { projectId, region, provider } = meta;
+    const imageDigests = recordedImageDigests(meta);
+    if (!imageDigests) {
+        log.error(red(`install.json of ${installId} records no image digests. Run ${bold(selfCommand("upgrade", "--install", installId))} first, then migrate.`));
+        process.exit(1);
+    }
+    const operator = await activeAccount();
+    if (!operator) {
+        log.error(red("No active gcloud account. Run `gcloud auth login`, then re-run."));
+        process.exit(1);
+    }
+    const provisioner = provisionerServiceAccountEmail(projectId);
+    note([
+        `Install:   ${bold(meta.domain)} (${installId}, project ${projectId}, ${region})`,
+        `Direction: ${to === "remote" ? `this machine → gs://${gcsBackendRecord(projectId, region).bucket} + Cloud KMS` : "the install's bucket → this machine"}`,
+        dryRun
+            ? "Dry run:   nothing will be changed"
+            : "The source stays in use until the copy is verified.",
+    ].join("\n"), "state migrate");
+    const result = await migrateState(meta, { to, dryRun }, {
+        pulumi: realStatePulumiOps({
+            provider,
+            installRoot: root,
+            impersonateServiceAccount: provisioner,
+            stackConfig: {
+                ...GCP_STACK_KNOB_DEFAULTS,
+                provider,
+                projectId,
+                domain: meta.domain,
+                stagingDomain: installStagingHost(meta),
+                ownerEmail: meta.ownerEmail,
+                region,
+                iapAllowlist: installIapAllowlist(meta.ownerEmail),
+                imageDigests,
+            },
+        }),
+        report: clackReporter(),
+        resolve: (record) => resolveBackend({ installId, stateBackend: record }, { installRoot: root, readPassphrase: () => readSecret(installId, "pulumi-passphrase") }),
+        confirmCost: async (costNote) => {
+            log.info(costNote);
+            if (argv.includes("--yes"))
+                return true;
+            if (!process.stdin.isTTY) {
+                log.error(red("Not a terminal: pass --yes to accept the cost above."));
+                return false;
+            }
+            const yes = await confirm({ message: "Create them and continue?", initialValue: true });
+            return !isCancel(yes) && yes === true;
+        },
+        ensureRemote: (dry) => ensureOpsBackend({ projectId, region, operatorAccount: operator, provisionerEmail: provisioner }, { dryRun: dry }),
+        backup: async () => backupInstallDir(installId),
+        localStateEmpty: () => !hasLocalPulumiState(root),
+        prepareLocalTarget: () => {
+            mkdirSync(localStateDir(root), { recursive: true, mode: 0o700 });
+            if (!readSecret(installId, "pulumi-passphrase")) {
+                writeSecret(installId, "pulumi-passphrase", randomBytes(32).toString("hex"));
+            }
+        },
+        lock: async () => {
+            // The source's lock (local file or bucket object) keeps installer
+            // runs out; the bucket's also keeps out a migration started on
+            // another machine when the bucket is the target.
+            const source = meta.stateBackend ?? { kind: "local" };
+            const releases = [acquireStateLock(source, root, "state migrate")];
+            if (source.kind === "local" && to === "remote") {
+                try {
+                    releases.push(acquireStateLock(gcsBackendRecord(projectId, region), root, "state migrate"));
+                }
+                catch (e) {
+                    for (const r of releases)
+                        r();
+                    throw e;
+                }
+            }
+            return async () => {
+                for (const r of releases.reverse())
+                    r();
+            };
+        },
+        remoteRecordedBackend: () => {
+            const text = new GcsStateStore(gcsBackendRecord(projectId, region).bucket, root).peek("install.json");
+            if (text === null)
+                return null;
+            return installBackend({ stateBackend: parseStateBackend(JSON.parse(text).stateBackend) })
+                .kind;
+        },
+        adopt: (record) => {
+            adoptStateBackend(installId, record);
+        },
+        retireLocalState: () => {
+            const dir = localStateDir(root);
+            if (!existsSync(dir))
+                return null;
+            const moved = `${dir}.migrated-${new Date().toISOString().replace(/[:.]/g, "-")}`;
+            renameSync(dir, moved);
+            return moved;
+        },
+    });
+    if (!result.ok) {
+        log.error(red(result.error));
+        process.exit(1);
+    }
+}
+/** `cms-provision attach --project <id>`. */
+export async function attachCommand(argv) {
+    const projectId = flagValue(argv, "project");
+    if (!projectId || projectId.startsWith("-")) {
+        console.log("Usage: cms-provision attach --project <gcp-project-id>");
+        process.exit(2);
+    }
+    const r = attachInstall(projectId, {
+        run: realSyncGcloud,
+        rootFor: installRoot,
+        hasLocalState: hasLocalPulumiState,
+    });
+    if (!r.ok) {
+        log.error(red(r.error));
+        process.exit(1);
+    }
+    ensureInstallDir(r.installId);
+    log.success(r.status === "refreshed"
+        ? `${r.domain} was already attached; its local copy of install.json is up to date.`
+        : `Attached ${bold(r.domain)} (${r.installId}). status, upgrade, backup and re-running the installer now work from this machine.`);
+    log.info("Infrastructure runs need Application Default Credentials once on this machine: gcloud auth application-default login");
+}
+//# sourceMappingURL=state-command.js.map

package/dist/state-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-command.js","sourceRoot":"","sources":["../src/state-command.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,8BAA8B,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,OAAe,OAAO,EAAE;IACjD,OAAO,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,OAAyD,EAAE;IAE3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,SAAS,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,EAAE;QAC1C,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,oCAAoC,SAAS,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,IAAI,CAAC;YACH,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;YACpC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,SAAS,CAAC,GAAG,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,GAAG,GAAG,MAAM,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,CAAC;IAC7B,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IACrC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,SAAS,SAAS,CAAC,IAAuB,EAAE,IAAY;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,KAAK,GACT,+GAA+G,CAAC;AAElH,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAuB;IACxD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC7C,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,EAAE,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,IACE,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC;QAC7D,CAAC,IAAI,CAAC,SAAS;QACf,CAAC,IAAI,CAAC,MAAM,EACZ,CAAC;QACD,GAAG,CAAC,KAAK,CACP,GAAG,CACD,GAAG,SAAS,KAAK,IAAI,CAAC,QAAQ,sHAAsH,CACrJ,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC7C,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,GAAG,CAAC,KAAK,CACP,GAAG,CACD,mBAAmB,SAAS,kCAAkC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,uBAAuB,CAC1I,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CACF;QACE,cAAc,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,aAAa,SAAS,KAAK,MAAM,GAAG;QACjF,cAAc,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC,qCAAqC,EAAE;QACzJ,MAAM;YACJ,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,qDAAqD;KAC1D,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,eAAe,CAChB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,EACJ,EAAE,EAAE,EAAE,MAAM,EAAE,EACd;QACE,MAAM,EAAE,kBAAkB,CAAC;YACzB,QAAQ;YACR,WAAW,EAAE,IAAI;YACjB,yBAAyB,EAAE,WAAW;YACtC,WAAW,EAAE;gBACX,GAAG,uBAAuB;gBAC1B,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa,EAAE,kBAAkB,CAAC,IAAI,CAAC;gBACvC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM;gBACN,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC;gBAClD,YAAY;aACb;SACF,CAAC;QACF,MAAM,EAAE,aAAa,EAAE;QACvB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAClB,cAAc,CACZ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EACnC,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,CACxF;QACH,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC9B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;gBACvE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC;QACxC,CAAC;QACD,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CACpB,gBAAgB,CACd,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,EAC/E,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;QACH,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAC/C,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACjD,kBAAkB,EAAE,GAAG,EAAE;YACvB,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,CAAC;gBAChD,WAAW,CAAC,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,kEAAkE;YAClE,+DAA+D;YAC/D,iDAAiD;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC/C,IAAI,CAAC;oBACH,QAAQ,CAAC,IAAI,CACX,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,CAC7E,CAAC;gBACJ,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,MAAM,CAAC,IAAI,QAAQ;wBAAE,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;YACD,OAAO,KAAK,IAAI,EAAE;gBAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE;oBAAE,CAAC,EAAE,CAAC;YAC1C,CAAC,CAAC;QACJ,CAAC;QACD,qBAAqB,EAAE,GAAG,EAAE;YAC1B,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CACnF,cAAc,CACf,CAAC;YACF,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,OAAO,cAAc,CAAC,EAAE,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;iBACtF,IAAI,CAAC;QACV,CAAC;QACD,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,KAAK,GAAG,GAAG,GAAG,aAAa,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YAClF,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IACzD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE;QACjC,GAAG,EAAE,cAAc;QACnB,OAAO,EAAE,WAAW;QACpB,aAAa,EAAE,mBAAmB;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9B,GAAG,CAAC,OAAO,CACT,CAAC,CAAC,MAAM,KAAK,WAAW;QACtB,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,sEAAsE;QACnF,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,qFAAqF,CACpI,CAAC;IACF,GAAG,CAAC,IAAI,CACN,sHAAsH,CACvH,CAAC;AACJ,CAAC"}

package/dist/state-migrate.d.ts

@@ -0,0 +1,121 @@
+/**
+ * `cms-provision state migrate` (#696): move an existing install's Pulumi
+ * state, secrets provider and install metadata between this machine
+ * (`~/.caelo-<id>/state` + passphrase) and the install's own GCP project
+ * (`gs://<project>-caelo-ops` + Cloud KMS), in either direction.
+ *
+ * The source stays authoritative until the very end:
+ *
+ *   1. preflight — Pulumi CLI version (`pulumi stack migrate` from
+ *      {@link STACK_MIGRATE_MIN_VERSION}, else export/import +
+ *      change-secrets-provider), the source stack exists, has no pending
+ *      operations, and a preview of it shows no changes (an unconverged
+ *      stack can't prove the copy is identical, so it is refused);
+ *   2. a mode-600 archive of `~/.caelo-<id>/` (tar.zst, else tar.gz);
+ *   3. the target: bucket + KMS key ensured (remote) or an empty local
+ *      state dir + passphrase (local); a leftover copy from an interrupted
+ *      run is removed — it was never authoritative;
+ *   4. copy, re-encrypting the secrets for the target's provider;
+ *   5. verify — a preview of the target shows no changes and its outputs
+ *      (secrets included) hash identically to the source's; on any
+ *      mismatch the target copy is removed and nothing else changes;
+ *   6. flip — install.json records the new backend (locally and in the
+ *      bucket); the old local state dir is renamed, never deleted.
+ *
+ * `--dry-run` runs the read-only preflight and reports what it would do.
+ * The engine takes its side effects as {@link MigrateDeps} so the whole
+ * sequence is tested against fakes (state-migrate.test.ts); state-command.ts
+ * wires the real Pulumi CLI, gcloud and file system.
+ */
+import type { OpsBackendResult } from "./ops-backend.js";
+import { type ResolvedBackend, type StateBackendRecord } from "./state-backend.js";
+import type { UpgradeReporter } from "./upgrade/reporter.js";
+/** First Pulumi CLI release with `pulumi stack migrate` between DIY backends. */
+export declare const STACK_MIGRATE_MIN_VERSION = "3.254.0";
+/** What the ops bucket + KMS key cost (wizards/gcp-cost.ts carries the same line). */
+export declare const OPS_BACKEND_COST_NOTE = "Creates (if missing) a versioned Cloud Storage bucket + one Cloud KMS key in the install's project: < $0.10/mo (KMS key version $0.06/mo, a few MB of state).";
+/** The Pulumi operations a migration needs, against one backend at a time. */
+export interface StatePulumiOps {
+    /** `pulumi version` without the `v`, or null when the CLI is missing. */
+    cliVersion(): Promise<string | null>;
+    stackExists(backend: ResolvedBackend): Promise<boolean>;
+    /** Pending operations recorded in the stack's state (an interrupted run). */
+    pendingOperations(backend: ResolvedBackend): Promise<number>;
+    /** Steps a preview would take other than "same". */
+    previewChanges(backend: ResolvedBackend): Promise<number>;
+    /** sha256 of the stack outputs, secrets included. Never the values. */
+    outputsDigest(backend: ResolvedBackend): Promise<string>;
+    /** Whether a Pulumi operation holds the stack's lock in `backend` right now. */
+    locked(backend: ResolvedBackend): Promise<boolean>;
+    /** sha256 of the stack's exported checkpoint (ciphertext; never decrypted). */
+    stateDigest(backend: ResolvedBackend): Promise<string>;
+    /** `pulumi stack migrate <from> --secrets-provider <to's>` into `to`. */
+    stackMigrate(from: ResolvedBackend, to: ResolvedBackend): Promise<void>;
+    /** export → init → import → change-secrets-provider (older CLIs). */
+    exportImport(from: ResolvedBackend, to: ResolvedBackend): Promise<void>;
+    /** Remove the stack's state from `backend` (cloud resources untouched). */
+    removeStack(backend: ResolvedBackend): Promise<void>;
+}
+/** Everything the migration touches outside Pulumi. */
+export interface MigrateDeps {
+    readonly pulumi: StatePulumiOps;
+    readonly report: UpgradeReporter;
+    /** The install's backend resolved for Pulumi. */
+    resolve(record: StateBackendRecord): ResolvedBackend;
+    /** Ask the operator to accept the ops backend's cost; false = cancel. */
+    confirmCost(note: string): Promise<boolean>;
+    /** Ensure (or, dry, inspect) the ops bucket + KMS key. */
+    ensureRemote(dryRun: boolean): Promise<OpsBackendResult>;
+    /** Archive `~/.caelo-<id>/`; returns the archive's path. */
+    backup(): Promise<string>;
+    /** Whether the local state dir is absent or holds no stack. */
+    localStateEmpty(): boolean;
+    /** Create the local state dir (mode 700) and `secrets/pulumi-passphrase` if missing. */
+    prepareLocalTarget(): void;
+    /**
+     * The backend the bucket's install.json names (`null` when the bucket or
+     * the document doesn't exist). `gcs` there means the bucket copy is
+     * authoritative — some machine finished a migration — and must never be
+     * replaced from this machine's (then stale) local state.
+     */
+    remoteRecordedBackend(): StateBackendRecord["kind"] | null;
+    /** Record the new backend (install-state.ts adoptStateBackend). */
+    adopt(record: StateBackendRecord): void;
+    /**
+     * Take the install's state lock (state-store.ts acquireStateLock: the
+     * source's, plus the bucket's when it is the target), which installer
+     * runs hold through `pulumi up` too; throws when another run holds it.
+     * Returns the release function.
+     */
+    lock(): Promise<() => Promise<void>>;
+    /** Rename the local state dir out of the way; returns where it went. */
+    retireLocalState(): string | null;
+}
+export interface MigrateOptions {
+    readonly to: "remote" | "local";
+    readonly dryRun: boolean;
+}
+export type MigrateResult = {
+    readonly ok: true;
+    readonly changed: boolean;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/** The subset of install metadata a migration reads. */
+export interface MigrateInstall {
+    readonly installId: string;
+    readonly provider: string;
+    readonly projectId: string | null;
+    readonly region: string | null;
+    readonly stateBackend?: StateBackendRecord;
+}
+/** a >= b for dotted numeric versions (`3.254.0`). */
+export declare function versionAtLeast(a: string, b: string): boolean;
+/**
+ * Run the migration. Never throws for an expected failure: the result says
+ * what failed, and at every failure point the source backend is still the
+ * one install.json names.
+ */
+export declare function migrateState(meta: MigrateInstall, opts: MigrateOptions, deps: MigrateDeps): Promise<MigrateResult>;
+//# sourceMappingURL=state-migrate.d.ts.map

package/dist/state-migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-migrate.d.ts","sourceRoot":"","sources":["../src/state-migrate.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,iFAAiF;AACjF,eAAO,MAAM,yBAAyB,YAAY,CAAC;AAEnD,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,kKAC+H,CAAC;AAElK,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrC,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,6EAA6E;IAC7E,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,oDAAoD;IACpD,cAAc,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,uEAAuE;IACvE,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,gFAAgF;IAChF,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,+EAA+E;IAC/E,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,yEAAyE;IACzE,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,qEAAqE;IACrE,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,2EAA2E;IAC3E,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,iDAAiD;IACjD,OAAO,CAAC,MAAM,EAAE,kBAAkB,GAAG,eAAe,CAAC;IACrD,yEAAyE;IACzE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,0DAA0D;IAC1D,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACzD,4DAA4D;IAC5D,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,+DAA+D;IAC/D,eAAe,IAAI,OAAO,CAAC;IAC3B,wFAAwF;IACxF,kBAAkB,IAAI,IAAI,CAAC;IAC3B;;;;;OAKG;IACH,qBAAqB,IAAI,kBAAkB,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC3D,mEAAmE;IACnE,KAAK,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,IAAI,IAAI,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,wEAAwE;IACxE,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC;CAC5C;AAED,sDAAsD;AACtD,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAU5D;AAID;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,aAAa,CAAC,CAyRxB"}