@caelo-cms/provisioning 0.10.46 → 0.10.48

package/dist/state-migrate.js

@@ -0,0 +1,290 @@
+// SPDX-License-Identifier: MPL-2.0
+import { selfCommand } from "./self-command.js";
+import { describeBackend, gcsBackendRecord, installBackend, } from "./state-backend.js";
+/** First Pulumi CLI release with `pulumi stack migrate` between DIY backends. */
+export const STACK_MIGRATE_MIN_VERSION = "3.254.0";
+/** What the ops bucket + KMS key cost (wizards/gcp-cost.ts carries the same line). */
+export const OPS_BACKEND_COST_NOTE = "Creates (if missing) a versioned Cloud Storage bucket + one Cloud KMS key in the install's project: < $0.10/mo (KMS key version $0.06/mo, a few MB of state).";
+/** a >= b for dotted numeric versions (`3.254.0`). */
+export function versionAtLeast(a, b) {
+    const pa = a.replace(/^v/, "").split(/[.+-]/).map(Number);
+    const pb = b.replace(/^v/, "").split(".").map(Number);
+    for (let i = 0; i < 3; i++) {
+        const x = pa[i] ?? 0;
+        const y = pb[i] ?? 0;
+        if (Number.isNaN(x))
+            return false;
+        if (x !== y)
+            return x > y;
+    }
+    return true;
+}
+const errorText = (e) => (e instanceof Error ? e.message : String(e));
+/**
+ * Run the migration. Never throws for an expected failure: the result says
+ * what failed, and at every failure point the source backend is still the
+ * one install.json names.
+ */
+export async function migrateState(meta, opts, deps) {
+    const { report, pulumi } = deps;
+    if (meta.provider !== "gcp" && meta.provider !== "gcp-firebase") {
+        return {
+            ok: false,
+            error: `${meta.provider} installs keep their state on the host; there is nothing to migrate.`,
+        };
+    }
+    if (!meta.projectId || !meta.region) {
+        return {
+            ok: false,
+            error: `install.json of ${meta.installId} has no projectId/region; re-run the installer first.`,
+        };
+    }
+    const projectId = meta.projectId;
+    const current = installBackend(meta);
+    const wantKind = opts.to === "remote" ? "gcs" : "local";
+    if (current.kind === wantKind) {
+        report.success(`Already ${opts.to}: ${describeBackend(meta, `~/.caelo-${meta.installId}`)}. Nothing to do.`);
+        return { ok: true, changed: false };
+    }
+    const remoteRecord = current.kind === "gcs" ? current : gcsBackendRecord(meta.projectId, meta.region);
+    const targetRecord = opts.to === "remote" ? remoteRecord : { kind: "local" };
+    // --- 1. Preflight (read-only) ------------------------------------------
+    if (opts.to === "remote") {
+        let recorded;
+        try {
+            recorded = deps.remoteRecordedBackend();
+        }
+        catch (e) {
+            return { ok: false, error: `${errorText(e)}. Nothing was changed.` };
+        }
+        if (recorded === "gcs") {
+            return {
+                ok: false,
+                error: `gs://${remoteRecord.bucket}/install/install.json says this install's state already lives in the bucket — another machine migrated it, so the local state here is out of date. Nothing was changed. Use the bucket instead: ${selfCommand("attach", "--project", projectId)} (after moving ~/.caelo-${meta.installId} aside).`,
+            };
+        }
+    }
+    const pre = report.step("Preflight: Pulumi CLI, source stack, pending operations, drift");
+    let from;
+    let mode;
+    let sourceDigest;
+    /** The source's checkpoint, to notice another run writing it meanwhile. */
+    let sourceState;
+    try {
+        const version = await pulumi.cliVersion();
+        if (!version) {
+            pre.failed("The pulumi CLI is not installed");
+            return {
+                ok: false,
+                error: "Install the Pulumi CLI (https://www.pulumi.com/docs/install/) and re-run.",
+            };
+        }
+        mode = versionAtLeast(version, STACK_MIGRATE_MIN_VERSION) ? "stack-migrate" : "export-import";
+        from = deps.resolve(current);
+        if (!(await pulumi.stackExists(from))) {
+            pre.failed("No stack in the source backend");
+            return {
+                ok: false,
+                error: `The install's stack is not in ${from.url}. Nothing was changed.`,
+            };
+        }
+        if (await pulumi.locked(from)) {
+            pre.failed("A Pulumi run holds the stack's lock");
+            return {
+                ok: false,
+                error: "A Pulumi run (installer) is updating this stack right now. Migrate once it has finished. Nothing was changed.",
+            };
+        }
+        const pending = await pulumi.pendingOperations(from);
+        if (pending > 0) {
+            pre.failed(`${pending} pending operation(s) from an interrupted run`);
+            return {
+                ok: false,
+                error: `The stack records ${pending} pending operation(s) from an interrupted Pulumi run. Run upgrade first, then re-run the installer (${selfCommand()}, pick this install) so the stack is refreshed, and migrate after that. Nothing was changed.`,
+            };
+        }
+        const drift = await pulumi.previewChanges(from);
+        if (drift > 0) {
+            pre.failed(`A preview shows ${drift} change(s)`);
+            return {
+                ok: false,
+                error: `The stack is not converged (a preview shows ${drift} change(s)), so a copy can't be proven identical. Run upgrade first, then re-run the installer (${selfCommand()}, pick this install) until it reports no changes, and migrate after that. Nothing was changed.`,
+            };
+        }
+        sourceDigest = await pulumi.outputsDigest(from);
+        sourceState = await pulumi.stateDigest(from);
+        pre.done(`Source ok: ${from.url}, no pending operations, no drift (Pulumi ${version}, ${mode === "stack-migrate" ? "pulumi stack migrate" : "export/import fallback"})`);
+    }
+    catch (e) {
+        pre.failed("Preflight failed");
+        return { ok: false, error: `${errorText(e)}. Nothing was changed.` };
+    }
+    // --- Dry run: report and stop -----------------------------------------
+    if (opts.dryRun) {
+        const plan = [`back up ~/.caelo-${meta.installId}/ (mode 600 archive)`];
+        if (opts.to === "remote") {
+            const r = await deps.ensureRemote(true);
+            if (!r.ok)
+                return { ok: false, error: r.error };
+            plan.push(...r.actions);
+        }
+        else {
+            if (!deps.localStateEmpty()) {
+                plan.push("would move the unused stack in ~/.caelo-<id>/state aside (state.migrated-<time>, kept) — a leftover of an interrupted migration");
+            }
+            plan.push("would create ~/.caelo-<id>/state and secrets/pulumi-passphrase if missing");
+        }
+        plan.push(`would copy the stack ${from.url} → ${opts.to === "remote" ? `gs://${remoteRecord.bucket}` : "~/.caelo-<id>/state"} (${mode}), re-encrypting its secrets`, "would verify: preview shows no changes, outputs hash identical", `would record stateBackend=${targetRecord.kind} in install.json${opts.to === "remote" ? " (locally and in the bucket)" : ""}`, ...(opts.to === "remote"
+            ? ["would rename ~/.caelo-<id>/state to state.migrated-<time> (kept)"]
+            : []));
+        report.info(["Dry run — nothing changed. The migration would:", ...plan.map((p) => `  ${p}`)].join("\n"));
+        return { ok: true, changed: false };
+    }
+    // --- 2. Backup -----------------------------------------------------------
+    const bk = report.step(`Backing up ~/.caelo-${meta.installId}/`);
+    try {
+        bk.done(`Backup: ${await deps.backup()} (mode 600; holds the passphrase — keep it private)`);
+    }
+    catch (e) {
+        bk.failed("Backup failed");
+        return { ok: false, error: `${errorText(e)}. Nothing was changed.` };
+    }
+    // --- 3a. Ops bucket + KMS key (remote), then the migration lock ----------
+    if (opts.to === "remote") {
+        // CLAUDE.md §11.C — nothing billable without the operator's yes.
+        if (!(await deps.confirmCost(OPS_BACKEND_COST_NOTE))) {
+            return { ok: false, error: "Cancelled at the cost confirmation. Only the backup was taken." };
+        }
+        const en = report.step(`Ensuring gs://${remoteRecord.bucket} + KMS key ${remoteRecord.kmsKey.split("/").slice(-3).join("/")}`);
+        const r = await deps.ensureRemote(false);
+        if (!r.ok) {
+            en.failed("Could not ensure the ops bucket + KMS key");
+            return { ok: false, error: `${r.error} Nothing else was changed.` };
+        }
+        en.done(`gs://${remoteRecord.bucket} + KMS key ready`);
+    }
+    // The install's state lock, shared with installer runs (`pulumi up`) and
+    // other migrations: held from the authority check through the flip, so
+    // nobody writes the source after it was copied, and no concurrent
+    // migration takes a copy the other just made authoritative for a leftover.
+    let release;
+    try {
+        release = await deps.lock();
+    }
+    catch (e) {
+        return { ok: false, error: `${errorText(e)}. Nothing else was changed.` };
+    }
+    try {
+        const recorded = deps.remoteRecordedBackend();
+        if (opts.to === "remote" && recorded === "gcs") {
+            return {
+                ok: false,
+                error: `Another machine just finished migrating this install into gs://${remoteRecord.bucket}; the local state here is out of date. Nothing else was changed. Use: ${selfCommand("attach", "--project", projectId)}`,
+            };
+        }
+        if (opts.to === "local" && recorded !== "gcs") {
+            return {
+                ok: false,
+                error: `gs://${remoteRecord.bucket}/install/install.json no longer names the bucket as this install's state (another machine moved it back to itself). Nothing else was changed; manage the install from that machine.`,
+            };
+        }
+        return await finish();
+    }
+    finally {
+        await release().catch((e) => report.warn(errorText(e)));
+    }
+    async function finish() {
+        // --- 3. Target -----------------------------------------------------------
+        const tg = report.step(opts.to === "remote" ? "Preparing the bucket target" : "Preparing the local state dir");
+        let to;
+        try {
+            if (opts.to === "local" && !deps.localStateEmpty()) {
+                // install.json names the bucket, so a stack here is not in use: the
+                // leftover of an interrupted `--to local`. Kept, never deleted.
+                const moved = deps.retireLocalState();
+                report.info(`Moved an unused local stack (interrupted migration?) aside to ${moved}`);
+            }
+            if (opts.to === "local")
+                deps.prepareLocalTarget();
+            to = deps.resolve(targetRecord);
+            // A remote stack here is not authoritative (checked in the preflight:
+            // the bucket's install.json doesn't name it), so it is the leftover of
+            // an interrupted migration or of an earlier `--to local`.
+            if (await pulumi.stackExists(to)) {
+                report.info(`Replacing an unused copy in ${to.url} (left by an earlier or interrupted migration)`);
+                await pulumi.removeStack(to);
+            }
+            tg.done(`Target ready: ${to.url}`);
+        }
+        catch (e) {
+            tg.failed("Could not prepare the target");
+            return { ok: false, error: `${errorText(e)}. The source is unchanged and still in use.` };
+        }
+        // --- 4 + 5. Copy and verify ----------------------------------------------
+        const cp = report.step(`Copying the stack to ${to.url} and verifying it`);
+        const abandon = async (why) => {
+            cp.failed(why);
+            try {
+                await pulumi.removeStack(to);
+            }
+            catch (e) {
+                report.warn(`Could not remove the partial copy in ${to.url}: ${errorText(e)}`);
+            }
+            return {
+                ok: false,
+                error: `${why}. The copy was discarded; install.json still names ${from.url}, which stays authoritative.`,
+            };
+        };
+        try {
+            if (mode === "stack-migrate")
+                await pulumi.stackMigrate(from, to);
+            else
+                await pulumi.exportImport(from, to);
+        }
+        catch (e) {
+            return abandon(`Copy failed: ${errorText(e)}`);
+        }
+        try {
+            const changes = await pulumi.previewChanges(to);
+            if (changes > 0)
+                return abandon(`Verification failed: a preview of the copy shows ${changes} change(s)`);
+            if ((await pulumi.outputsDigest(to)) !== sourceDigest) {
+                return abandon("Verification failed: the copy's outputs differ from the source's");
+            }
+            // An installer run elsewhere may have updated the source since the
+            // preflight (only migrations take the lock): the copy would then miss
+            // that update. Checked last, right before the switch.
+            if ((await pulumi.locked(from)) || (await pulumi.stateDigest(from)) !== sourceState) {
+                return abandon("The source stack changed during the migration (another run updated it); migrate again once it is idle");
+            }
+        }
+        catch (e) {
+            return abandon(`Verification failed: ${errorText(e)}`);
+        }
+        cp.done("Copied; preview shows no changes and the outputs match");
+        // --- 6. Flip ---------------------------------------------------------------
+        const fl = report.step("Recording the new backend in install.json");
+        try {
+            deps.adopt(targetRecord);
+        }
+        catch (e) {
+            fl.failed("Could not record the new backend");
+            return {
+                ok: false,
+                error: `${errorText(e)}. The copy in ${to.url} is complete, but install.json still names ${from.url}; re-run state migrate to finish.`,
+            };
+        }
+        fl.done(`install.json: stateBackend=${targetRecord.kind}`);
+        if (opts.to === "remote") {
+            const moved = deps.retireLocalState();
+            if (moved)
+                report.info(`Old local state kept at ${moved} (not used any more; delete it once you are confident)`);
+            report.success(`Done. Pulumi state + install metadata now live in gs://${remoteRecord.bucket}; secrets are encrypted with Cloud KMS. Other machines: ${selfCommand("attach", "--project", projectId)}`);
+        }
+        else {
+            report.success(`Done. Pulumi state is back in ~/.caelo-${meta.installId}/state (passphrase in secrets/). The copy in gs://${remoteRecord.bucket}/pulumi is no longer used; the bucket's install.json now says so.`);
+        }
+        return { ok: true, changed: true };
+    }
+}
+//# sourceMappingURL=state-migrate.js.map

package/dist/state-migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-migrate.js","sourceRoot":"","sources":["../src/state-migrate.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAiCnC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,eAAe,EAEf,gBAAgB,EAChB,cAAc,GAGf,MAAM,oBAAoB,CAAC;AAG5B,iFAAiF;AACjF,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAEnD,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAChC,+JAA+J,CAAC;AA+ElK,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAAC,CAAS,EAAE,CAAS;IACjD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAoB,EACpB,IAAoB,EACpB,IAAiB;IAEjB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,sEAAsE;SAC9F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mBAAmB,IAAI,CAAC,SAAS,uDAAuD;SAChG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,OAAO,CACZ,WAAW,IAAI,CAAC,EAAE,KAAK,eAAe,CAAC,IAAI,EAAE,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC,kBAAkB,CAC7F,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,YAAY,GAChB,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACnF,MAAM,YAAY,GAAuB,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAEjG,0EAA0E;IAC1E,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,QAA2C,CAAC;QAChD,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;QACvE,CAAC;QACD,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,QAAQ,YAAY,CAAC,MAAM,mMAAmM,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,2BAA2B,IAAI,CAAC,SAAS,UAAU;aACtU,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC1F,IAAI,IAAqB,CAAC;IAC1B,IAAI,IAAuC,CAAC;IAC5C,IAAI,YAAoB,CAAC;IACzB,2EAA2E;IAC3E,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,2EAA2E;aACnF,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC;QAC9F,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;YAC7C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,iCAAiC,IAAI,CAAC,GAAG,wBAAwB;aACzE,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;YAClD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,+GAA+G;aAClH,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,+CAA+C,CAAC,CAAC;YACtE,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,qBAAqB,OAAO,uGAAuG,WAAW,EAAE,8FAA8F;aACtP,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,mBAAmB,KAAK,YAAY,CAAC,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,+CAA+C,KAAK,mGAAmG,WAAW,EAAE,gGAAgG;aAC5Q,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAChD,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,CACN,cAAc,IAAI,CAAC,GAAG,6CAA6C,OAAO,KAAK,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAC/J,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;IACvE,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,GAAa,CAAC,oBAAoB,IAAI,CAAC,SAAS,sBAAsB,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,CACP,iIAAiI,CAClI,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,IAAI,CACP,wBAAwB,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,qBAAqB,KAAK,IAAI,8BAA8B,EACzJ,gEAAgE,EAChE,6BAA6B,YAAY,CAAC,IAAI,mBAAmB,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,EAAE,EAC7H,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,kEAAkE,CAAC;YACtE,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;QACF,MAAM,CAAC,IAAI,CACT,CAAC,iDAAiD,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7F,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IAED,4EAA4E;IAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,WAAW,MAAM,IAAI,CAAC,MAAM,EAAE,qDAAqD,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;IACvE,CAAC;IAED,4EAA4E;IAC5E,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QACzB,iEAAiE;QACjE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gEAAgE,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CACpB,iBAAiB,YAAY,CAAC,MAAM,cAAc,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACvG,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,4BAA4B,EAAE,CAAC;QACtE,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,QAAQ,YAAY,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACzD,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,2EAA2E;IAC3E,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,kEAAkE,YAAY,CAAC,MAAM,yEAAyE,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE;aACrN,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,QAAQ,YAAY,CAAC,MAAM,qLAAqL;aACxN,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,UAAU,MAAM;QACnB,4EAA4E;QAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CACpB,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,+BAA+B,CACvF,CAAC;QACF,IAAI,EAAmB,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;gBACnD,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,iEAAiE,KAAK,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO;gBAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnD,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAChC,sEAAsE;YACtE,uEAAuE;YACvE,0DAA0D;YAC1D,IAAI,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,+BAA+B,EAAE,CAAC,GAAG,gDAAgD,CACtF,CAAC;gBACF,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,6CAA6C,EAAE,CAAC;QAC5F,CAAC;QAED,4EAA4E;QAC5E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAA0B,EAAE;YAC5D,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,GAAG,sDAAsD,IAAI,CAAC,GAAG,8BAA8B;aAC1G,CAAC;QACJ,CAAC,CAAC;QACF,IAAI,CAAC;YACH,IAAI,IAAI,KAAK,eAAe;gBAAE,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;;gBAC7D,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,gBAAgB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAChD,IAAI,OAAO,GAAG,CAAC;gBACb,OAAO,OAAO,CAAC,oDAAoD,OAAO,YAAY,CAAC,CAAC;YAC1F,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;gBACtD,OAAO,OAAO,CAAC,kEAAkE,CAAC,CAAC;YACrF,CAAC;YACD,mEAAmE;YACnE,sEAAsE;YACtE,sDAAsD;YACtD,IAAI,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBACpF,OAAO,OAAO,CACZ,uGAAuG,CACxG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,wBAAwB,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAElE,8EAA8E;QAC9E,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,EAAE,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;YAC9C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,GAAG,8CAA8C,IAAI,CAAC,GAAG,mCAAmC;aACvI,CAAC;QACJ,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,8BAA8B,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtC,IAAI,KAAK;gBACP,MAAM,CAAC,IAAI,CACT,2BAA2B,KAAK,wDAAwD,CACzF,CAAC;YACJ,MAAM,CAAC,OAAO,CACZ,0DAA0D,YAAY,CAAC,MAAM,2DAA2D,WAAW,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CACxL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,CACZ,0CAA0C,IAAI,CAAC,SAAS,qDAAqD,YAAY,CAAC,MAAM,mEAAmE,CACpM,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/state-pulumi.d.ts

@@ -0,0 +1,17 @@
+import type { StatePulumiOps } from "./state-migrate.js";
+import { type StackConfigInputs } from "./wizards/gcp-pulumi.js";
+/** Canonical JSON (sorted keys) so equal outputs hash equally. */
+export declare function canonicalJson(value: unknown): string;
+/** Steps of a preview's change summary other than "same". */
+export declare function changeCount(summary: Readonly<Record<string, number | undefined>>): number;
+export interface RealPulumiOpsInputs {
+    readonly provider: "gcp" | "gcp-firebase";
+    readonly installRoot: string;
+    /** The service account the GCP provider impersonates during previews. */
+    readonly impersonateServiceAccount: string;
+    /** The config a wizard run sets, so a preview shows real drift only. */
+    readonly stackConfig: StackConfigInputs;
+}
+/** {@link StatePulumiOps} backed by the `pulumi` CLI + Automation API. */
+export declare function realStatePulumiOps(inputs: RealPulumiOpsInputs): StatePulumiOps;
+//# sourceMappingURL=state-pulumi.d.ts.map

package/dist/state-pulumi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-pulumi.d.ts","sourceRoot":"","sources":["../src/state-pulumi.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAKL,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AASjC,kEAAkE;AAClE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CASpD;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM,CAIzF;AAWD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,wEAAwE;IACxE,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;CACzC;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,cAAc,CAmN9E"}

package/dist/state-pulumi.js

@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The real {@link StatePulumiOps} for `state migrate` (#696): the Pulumi CLI
+ * (state operations) and the Automation API (previews), always in the
+ * install's stack dir and with exactly the backend's environment. The
+ * operator never runs `pulumi` by hand (CLAUDE.md §11.C).
+ *
+ * Secrets: outputs are read with `--show-secrets` only to hash them; the
+ * values never leave {@link outputsDigest}. The export/import fallback
+ * writes the deployment without `--show-secrets` (ciphertext only) to a
+ * mode-600 file in the install dir and deletes it afterwards.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import * as automation from "@pulumi/pulumi/automation";
+import { redactCredentials } from "./checkpoint-secrets.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
+import { alignStackSettingsFile, applyStackConfig, gcpStackWorkDir, pulumiGcpEnv, stateOnlyEnv, } from "./wizards/gcp-pulumi.js";
+/** Every file below `dir`. */
+function listFilesRecursive(dir) {
+    return readdirSync(dir, { recursive: true, withFileTypes: true })
+        .filter((e) => e.isFile())
+        .map((e) => e.name);
+}
+/** Canonical JSON (sorted keys) so equal outputs hash equally. */
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+/** Steps of a preview's change summary other than "same". */
+export function changeCount(summary) {
+    return Object.entries(summary)
+        .filter(([op]) => op !== "same")
+        .reduce((n, [, c]) => n + (c ?? 0), 0);
+}
+/** {@link StatePulumiOps} backed by the `pulumi` CLI + Automation API. */
+export function realStatePulumiOps(inputs) {
+    const workDir = gcpStackWorkDir(inputs.provider);
+    const cli = async (args, env) => {
+        const p = Bun.spawn(["pulumi", ...args, "--cwd", workDir, "--non-interactive"], {
+            env: { ...process.env, ...env, PULUMI_SKIP_UPDATE_CHECK: "true" },
+            stdout: "pipe",
+            stderr: "pipe",
+        });
+        const [stdout, stderr] = await Promise.all([
+            new Response(p.stdout).text(),
+            new Response(p.stderr).text(),
+        ]);
+        if ((await p.exited) !== 0) {
+            throw new Error(`pulumi ${args[0]} ${args[1] ?? ""} failed: ${redactCredentials(stderr.trim().split("\n").slice(-3).join(" "))}`);
+        }
+        return { stdout, stderr };
+    };
+    // The read-only steps (preflight, verification) align the package's
+    // stack settings file and may set config to run a preview; the file is
+    // put back exactly as it was afterwards, so a refused migration or a dry
+    // run leaves it untouched.
+    const settingsFile = join(workDir, `Pulumi.${GCP_STACK_ENV}.yaml`);
+    const preserved = async (fn) => {
+        // Read without a separate existence check (no check-then-use race), and
+        // put the file back atomically (temp file + rename).
+        let before;
+        try {
+            before = readFileSync(settingsFile);
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+            before = null;
+        }
+        try {
+            return await fn();
+        }
+        finally {
+            if (before === null)
+                rmSync(settingsFile, { force: true });
+            else {
+                const tmp = `${settingsFile}.restore-${process.pid}`;
+                writeFileSync(tmp, before, { flag: "w" });
+                renameSync(tmp, settingsFile);
+            }
+        }
+    };
+    const exportDeployment = async (b) => {
+        await alignStackSettingsFile(b, inputs.provider);
+        const { stdout } = await cli(["stack", "export", "--stack", GCP_STACK_ENV], stateOnlyEnv(b));
+        return (JSON.parse(stdout).deployment ?? {});
+    };
+    /** Env for an operation that reads one backend and writes another. */
+    const bothEnv = (from, to) => ({
+        ...stateOnlyEnv(from),
+        ...stateOnlyEnv(to),
+    });
+    const ops = {
+        async cliVersion() {
+            const p = Bun.spawnSync(["pulumi", "version"], { stdout: "pipe", stderr: "pipe" });
+            if (p.exitCode !== 0)
+                return null;
+            return new TextDecoder().decode(p.stdout).trim().replace(/^v/, "") || null;
+        },
+        async stackExists(b) {
+            const { stdout } = await cli(["stack", "ls", "--json"], stateOnlyEnv(b));
+            const stacks = JSON.parse(stdout || "[]");
+            return stacks.some((s) => s.name === GCP_STACK_ENV || s.name?.endsWith(`/${GCP_STACK_ENV}`));
+        },
+        async locked(b) {
+            // Pulumi's DIY backends keep one lock file per running operation under
+            // .pulumi/locks/ (file:// and gs:// alike).
+            if (b.url.startsWith("file://")) {
+                const dir = join(b.url.slice("file://".length), ".pulumi", "locks");
+                return existsSync(dir) && listFilesRecursive(dir).length > 0;
+            }
+            const r = Bun.spawnSync(["gcloud", "storage", "ls", `${b.url}/.pulumi/locks/**`], {
+                stdout: "pipe",
+                stderr: "pipe",
+                env: { ...process.env, CLOUDSDK_CORE_DISABLE_PROMPTS: "1" },
+            });
+            if (r.exitCode === 0)
+                return new TextDecoder().decode(r.stdout).trim().length > 0;
+            const err = new TextDecoder().decode(r.stderr);
+            if (/matched no objects|No URLs matched|NotFound|404/i.test(err))
+                return false;
+            throw new Error(`Could not check the stack lock in ${b.url}: ${err.trim()}`);
+        },
+        async stateDigest(b) {
+            const deployment = await exportDeployment(b);
+            return createHash("sha256").update(canonicalJson(deployment)).digest("hex");
+        },
+        async pendingOperations(b) {
+            return (await exportDeployment(b)).pending_operations?.length ?? 0;
+        },
+        async previewChanges(b) {
+            await alignStackSettingsFile(b, inputs.provider);
+            const stack = await automation.LocalWorkspace.selectStack({ stackName: GCP_STACK_ENV, workDir }, {
+                envVars: pulumiGcpEnv(process.env, {
+                    backend: b,
+                    impersonateServiceAccount: inputs.impersonateServiceAccount,
+                }),
+            });
+            // The stack's own config wins: an operator may have tuned a knob
+            // (`pulumi config set`), and resetting it would show as drift. Only a
+            // stack dir without the install's config (a fresh `bunx` version)
+            // gets what the wizard sets — as does one holding another install's
+            // config (installs of one provider share the package's stack dir).
+            const config = await stack.getAllConfig().catch(() => ({}));
+            if (config[`caelo-${inputs.provider}:project`]?.value !== inputs.stackConfig.projectId) {
+                const resources = ((await stack.exportStack()).deployment?.resources ??
+                    []);
+                await applyStackConfig(stack, inputs.stackConfig, resources);
+            }
+            const r = await stack.preview({ refresh: true });
+            return changeCount(r.changeSummary);
+        },
+        async outputsDigest(b) {
+            await alignStackSettingsFile(b, inputs.provider);
+            const { stdout } = await cli(["stack", "output", "--stack", GCP_STACK_ENV, "--json", "--show-secrets"], stateOnlyEnv(b));
+            return createHash("sha256")
+                .update(canonicalJson(JSON.parse(stdout || "{}")))
+                .digest("hex");
+        },
+        async stackMigrate(from, to) {
+            await alignStackSettingsFile(from, inputs.provider);
+            await cli([
+                "stack",
+                "migrate",
+                from.url,
+                GCP_STACK_ENV,
+                "--secrets-provider",
+                to.secretsProvider,
+                "--yes",
+            ], bothEnv(from, to));
+        },
+        async exportImport(from, to) {
+            const deployment = await exportDeployment(from);
+            const file = join(inputs.installRoot, `.migrate-export-${process.pid}.json`);
+            try {
+                const { stdout } = await cli(["stack", "export", "--stack", GCP_STACK_ENV], stateOnlyEnv(from));
+                writeFileSync(file, stdout, { mode: 0o600 });
+                // The target stack starts with the source's secrets manager, so the
+                // imported ciphertext decrypts; change-secrets-provider re-encrypts.
+                const ws = await automation.LocalWorkspace.create({ workDir, envVars: stateOnlyEnv(to) });
+                const settings = await ws.stackSettings(GCP_STACK_ENV).catch(() => ({}));
+                const sp = deployment.secrets_providers;
+                const { secretsProvider: _p, encryptedKey: _k, encryptionSalt: _s, ...rest } = settings;
+                await ws.saveStackSettings(GCP_STACK_ENV, {
+                    ...rest,
+                    ...(sp?.type === "passphrase" && sp.state?.salt ? { encryptionSalt: sp.state.salt } : {}),
+                    ...(sp?.type === "cloud" && sp.state?.url
+                        ? { secretsProvider: sp.state.url, encryptedKey: sp.state.encryptedkey }
+                        : {}),
+                });
+                await cli(["stack", "init", GCP_STACK_ENV, "--secrets-provider", from.secretsProvider], bothEnv(from, to));
+                await cli(["stack", "import", "--stack", GCP_STACK_ENV, "--file", file], bothEnv(from, to));
+                await cli(["stack", "change-secrets-provider", "--stack", GCP_STACK_ENV, to.secretsProvider], bothEnv(from, to));
+            }
+            finally {
+                rmSync(file, { force: true });
+            }
+        },
+        async removeStack(b) {
+            await cli(["stack", "rm", GCP_STACK_ENV, "--force", "--yes", "--preserve-config"], stateOnlyEnv(b));
+        },
+    };
+    return {
+        ...ops,
+        pendingOperations: (b) => preserved(() => ops.pendingOperations(b)),
+        stateDigest: (b) => preserved(() => ops.stateDigest(b)),
+        previewChanges: (b) => preserved(() => ops.previewChanges(b)),
+        outputsDigest: (b) => preserved(() => ops.outputsDigest(b)),
+    };
+}
+//# sourceMappingURL=state-pulumi.js.map

package/dist/state-pulumi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-pulumi.js","sourceRoot":"","sources":["../src/state-pulumi.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,KAAK,UAAU,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,YAAY,EAGZ,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,8BAA8B;AAC9B,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC9D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3B,CAAC;QACF,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,OAAqD;IAC/E,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,MAAM,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC;AAoBD,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,MAA2B;IAC5D,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,GAAG,GAAG,KAAK,EACf,IAAc,EACd,GAA2B,EACkB,EAAE;QAC/C,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,EAAE;YAC9E,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,wBAAwB,EAAE,MAAM,EAAE;YACjE,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;YAC7B,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CACjH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,oEAAoE;IACpE,uEAAuE;IACvE,yEAAyE;IACzE,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,aAAa,OAAO,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,KAAK,EAAK,EAAoB,EAAc,EAAE;QAC9D,wEAAwE;QACxE,qDAAqD;QACrD,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,IAAI,MAAM,KAAK,IAAI;gBAAE,MAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtD,CAAC;gBACJ,MAAM,GAAG,GAAG,GAAG,YAAY,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC;gBACrD,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1C,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,CAAkB,EAAuB,EAAE;QACzE,MAAM,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAiC,CAAC,UAAU,IAAI,EAAE,CAAe,CAAC;IAC9F,CAAC,CAAC;IAEF,sEAAsE;IACtE,MAAM,OAAO,GAAG,CAAC,IAAqB,EAAE,EAAmB,EAA0B,EAAE,CAAC,CAAC;QACvF,GAAG,YAAY,CAAC,IAAI,CAAC;QACrB,GAAG,YAAY,CAAC,EAAE,CAAC;KACpB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAmB;QAC1B,KAAK,CAAC,UAAU;YACd,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;QAC7E,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAwB,CAAC;YACjE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC;QAC/F,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,CAAC;YACZ,uEAAuE;YACvE,4CAA4C;YAC5C,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpE,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,6BAA6B,EAAE,GAAG,EAAE;aAC5D,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,kDAAkD,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACvB,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC;QACrE,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,CAAC;YACpB,MAAM,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,WAAW,CACvD,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,EACrC;gBACE,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;oBACjC,OAAO,EAAE,CAAC;oBACV,yBAAyB,EAAE,MAAM,CAAC,yBAAyB;iBAC5D,CAAC;aACH,CACF,CAAC;YACF,iEAAiE;YACjE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,MAAM,MAAM,GAAyB,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClF,IAAI,MAAM,CAAC,SAAS,MAAM,CAAC,QAAQ,UAAU,CAAC,EAAE,KAAK,KAAK,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBACvF,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS;oBAClE,EAAE,CAAoB,CAAC;gBACzB,MAAM,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,CAAC;YACnB,MAAM,sBAAsB,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EACzE,YAAY,CAAC,CAAC,CAAC,CAChB,CAAC;YACF,OAAO,UAAU,CAAC,QAAQ,CAAC;iBACxB,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;iBACjD,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,GAAG,CACP;gBACE,OAAO;gBACP,SAAS;gBACT,IAAI,CAAC,GAAG;gBACR,aAAa;gBACb,oBAAoB;gBACpB,EAAE,CAAC,eAAe;gBAClB,OAAO;aACR,EACD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAClB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE;YACzB,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;YAC7E,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAC1B,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC,EAC7C,YAAY,CAAC,IAAI,CAAC,CACnB,CAAC;gBACF,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,oEAAoE;gBACpE,qEAAqE;gBACrE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzE,MAAM,EAAE,GAAG,UAAU,CAAC,iBAAiB,CAAC;gBACxC,MAAM,EACJ,eAAe,EAAE,EAAE,EACnB,YAAY,EAAE,EAAE,EAChB,cAAc,EAAE,EAAE,EAClB,GAAG,IAAI,EACR,GAAG,QAAoC,CAAC;gBACzC,MAAM,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE;oBACxC,GAAG,IAAI;oBACP,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzF,GAAG,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG;wBACvC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE;wBACxE,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;gBACH,MAAM,GAAG,CACP,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,IAAI,CAAC,eAAe,CAAC,EAC5E,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAClB,CAAC;gBACF,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5F,MAAM,GAAG,CACP,CAAC,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,eAAe,CAAC,EAClF,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAClB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,CAAC;YACjB,MAAM,GAAG,CACP,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,CAAC,EACvE,YAAY,CAAC,CAAC,CAAC,CAChB,CAAC;QACJ,CAAC;KACF,CAAC;IACF,OAAO;QACL,GAAG,GAAG;QACN,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACnE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACvD,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7D,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/state-store.d.ts

@@ -52,4 +52,31 @@ export declare class GcsStateStore implements StateStore {
     read(file: StateFile): string | null;
     write(file: StateFile, value: unknown): void;
 }
+/** `gs://<bucket>/install/state.lock` — see {@link acquireBucketStateLock}. */
+export declare function bucketStateLockUrl(bucket: string): string;
+/**
+ * The install's state lock in its ops bucket, created only if absent
+ * (`--if-generation-match=0`). Held by every writer of a bucket-backed
+ * install's state — an installer run's `pulumi up`, `state migrate` — so
+ * none writes a backend another is switching away from. A lock left by a
+ * crashed run is reported with the command to remove it, never broken
+ * automatically.
+ *
+ * @returns the release function
+ */
+export declare function acquireBucketStateLock(bucket: string, purpose: string, run?: SyncGcloud): () => void;
+/**
+ * The same lock for an install whose state is on this machine:
+ * `~/.caelo-<id>/state.lock`, created exclusively.
+ *
+ * @returns the release function
+ */
+export declare function acquireLocalStateLock(root: string, purpose: string): () => void;
+/** The state lock for whichever backend `bucket` (gcs) or `root` (local) names. */
+export declare function acquireStateLock(backend: {
+    readonly kind: "local";
+} | {
+    readonly kind: "gcs";
+    readonly bucket: string;
+}, root: string, purpose: string, run?: SyncGcloud): () => void;
 //# sourceMappingURL=state-store.d.ts.map

package/dist/state-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,KAAK,YAAY,EAAa,MAAM,aAAa,CAAC;AAG3D,uCAAuC;AACvC,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,eAAe,CAAC;AAEzD,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IAC/B,2DAA2D;IAC3D,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C;AAED,mFAAmF;AACnF,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,YAAY,CAAC;AAE1E,mEAAmE;AACnE,eAAO,MAAM,cAAc,EAAE,UAc5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAIxE;AAcD,wDAAwD;AACxD,qBAAa,eAAgB,YAAW,UAAU;IAEpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;gBACJ,IAAI,EAAE,MAAM;IAEzC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI;IAKpC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;CAG7C;AAKD;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,UAAU;IAK5C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;gBAG1C,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,UAA2B;IAGnD,sCAAsC;IACtC,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM;IAIlC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI;IASpC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI;IAQpC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;CAc7C"}
+{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../src/state-store.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,KAAK,YAAY,EAAa,MAAM,aAAa,CAAC;AAG3D,uCAAuC;AACvC,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG,eAAe,CAAC;AAEzD,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IAC/B,2DAA2D;IAC3D,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C;AAED,mFAAmF;AACnF,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,YAAY,CAAC;AAE1E,mEAAmE;AACnE,eAAO,MAAM,cAAc,EAAE,UAc5B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAIxE;AAcD,wDAAwD;AACxD,qBAAa,eAAgB,YAAW,UAAU;IAEpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;gBACJ,IAAI,EAAE,MAAM;IAEzC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI;IAKpC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;CAG7C;AAKD;;;;;;GAMG;AACH,qBAAa,aAAc,YAAW,UAAU;IAK5C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;gBAG1C,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,GAAG,GAAE,UAA2B;IAGnD,sCAAsC;IACtC,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM;IAIlC;;;;OAIG;IACH,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI;IASpC,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI;IAQpC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;CAc7C;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAYD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,UAA2B,GAC/B,MAAM,IAAI,CAgBZ;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,IAAI,CAa/E;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACvF,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,UAA2B,GAC/B,MAAM,IAAI,CAIZ"}