@caelo-cms/provisioning 0.10.47 → 0.10.48

package/src/admin-domain.test.ts

@@ -0,0 +1,254 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { enableAdminDomain } from "./admin-domain.js";
+import type { GcloudResult } from "./gcloud.js";
+
+const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
+const fail = (stderr: string): GcloudResult => ({ ok: false, stdout: "", stderr, exitCode: 1 });
+
+/** Fake gcloud; the `beta` component is installed unless a test answers `components list`. */
+function fakeGcloud(overrides: Record<string, GcloudResult[]>) {
+  const answers: Record<string, GcloudResult[]> = {
+    "components list": [ok("beta\n")],
+    ...overrides,
+  };
+  const calls: string[][] = [];
+  const run = async (args: string[]) => {
+    calls.push(args);
+    const key = Object.keys(answers).find((k) => args.join(" ").startsWith(k));
+    return (key && answers[key]?.shift()) || ok();
+  };
+  return { run, calls };
+}
+
+const MAPPING = JSON.stringify({
+  status: { resourceRecords: [{ name: "admin", type: "CNAME", rrdata: "ghs.googlehosted.com." }] },
+});
+const base = { projectId: "p", region: "europe-west1", domain: "example.com", log: () => {} };
+
+describe("enableAdminDomain", () => {
+  it("creates the mapping as the operator once the domain is verified, and prints the record", async () => {
+    const { run, calls } = fakeGcloud({
+      "run services list": [ok("caelo-production-admin-abc\n")],
+      "beta run domain-mappings describe": [fail("NOT_FOUND"), ok(MAPPING)],
+      "domains list-user-verified": [ok("example.com\n")],
+    });
+    const r = await enableAdminDomain({ ...base, run });
+    expect(r).toEqual({
+      status: "mapped",
+      hostname: "admin.example.com",
+      created: true,
+      records: [{ name: "admin.example.com", type: "CNAME", value: "ghs.googlehosted.com." }],
+    });
+    expect(calls).toContainEqual([
+      "beta",
+      "run",
+      "domain-mappings",
+      "create",
+      "--service=caelo-production-admin-abc",
+      "--domain=admin.example.com",
+      "--region=europe-west1",
+      "--project=p",
+      "--quiet",
+    ]);
+  });
+
+  it("is idempotent: an existing mapping is reported, not recreated", async () => {
+    const { run, calls } = fakeGcloud({
+      "run services list": [ok("caelo-production-admin-abc\n")],
+      "beta run domain-mappings describe": [ok(MAPPING)],
+    });
+    const r = await enableAdminDomain({ ...base, run });
+    expect(r.status === "mapped" && !r.created).toBe(true);
+    expect(calls.some((c) => c.includes("create"))).toBe(false);
+  });
+
+  it("starts Search Console verification and stops when the operator has not verified the domain", async () => {
+    const { run, calls } = fakeGcloud({
+      "run services list": [ok("caelo-production-admin-abc\n")],
+      "beta run domain-mappings describe": [fail("NOT_FOUND")],
+      "domains list-user-verified": [ok("other.org\n")],
+    });
+    const r = await enableAdminDomain({ ...base, run });
+    expect(r).toEqual({
+      status: "needs-verification",
+      hostname: "admin.example.com",
+      verifyDomain: "example.com",
+    });
+    expect(calls).toContainEqual(["domains", "verify", "example.com"]);
+    expect(calls.some((c) => c.includes("create"))).toBe(false);
+  });
+
+  it("refuses to pick when more than one admin service matches", async () => {
+    const { run, calls } = fakeGcloud({
+      "run services list": [ok("caelo-production-admin-abc\ncaelo-production-admin-old\n")],
+    });
+    const r = await enableAdminDomain({ ...base, run });
+    expect(r.status === "failed" && r.error).toContain("exactly one");
+    expect(calls.some((c) => c.includes("create"))).toBe(false);
+  });
+
+  it("fails (not needs-verification) when gcloud cannot list or start verification", async () => {
+    const listFails = fakeGcloud({
+      "run services list": [ok("caelo-production-admin-abc\n")],
+      "beta run domain-mappings describe": [fail("NOT_FOUND")],
+      "domains list-user-verified": [fail("Reauthentication required")],
+    });
+    expect(await enableAdminDomain({ ...base, run: listFails.run })).toEqual({
+      status: "failed",
+      error: "list verified domains: Reauthentication required",
+    });
+
+    const verifyFails = fakeGcloud({
+      "run services list": [ok("caelo-production-admin-abc\n")],
+      "beta run domain-mappings describe": [fail("NOT_FOUND")],
+      "domains list-user-verified": [ok("other.org\n")],
+      "domains verify": [fail("could not open a browser")],
+    });
+    expect(await enableAdminDomain({ ...base, run: verifyFails.run })).toEqual({
+      status: "failed",
+      error: "start domain verification for example.com: could not open a browser",
+    });
+  });
+
+  it("fails loudly when the admin service cannot be found or the create is refused", async () => {
+    const missing = fakeGcloud({ "run services list": [ok("")] });
+    expect((await enableAdminDomain({ ...base, run: missing.run })).status).toBe("failed");
+
+    const refused = fakeGcloud({
+      "run services list": [ok("caelo-production-admin-abc\n")],
+      "beta run domain-mappings describe": [fail("NOT_FOUND")],
+      "domains list-user-verified": [ok("admin.example.com\n")],
+      "beta run domain-mappings create": [
+        fail("Caller is not authorized to administer the domain"),
+      ],
+    });
+    expect(await enableAdminDomain({ ...base, run: refused.run })).toEqual({
+      status: "failed",
+      error: "create domain mapping: Caller is not authorized to administer the domain",
+    });
+  });
+
+  it("installs the missing beta component before the first beta command (regression: hidden gcloud prompt hung the CLI)", async () => {
+    const logs: string[] = [];
+    const { run, calls } = fakeGcloud({
+      "components list": [ok("")],
+      "run services list": [ok("caelo-production-admin-abc\n")],
+      "beta run domain-mappings describe": [ok(MAPPING)],
+    });
+    const r = await enableAdminDomain({ ...base, run, log: (m) => logs.push(m) });
+    expect(r.status).toBe("mapped");
+    const install = calls.findIndex((c) => c.join(" ") === "components install beta --quiet");
+    const firstBeta = calls.findIndex((c) => c[0] === "beta");
+    expect(install).toBeGreaterThanOrEqual(0);
+    expect(install).toBeLessThan(firstBeta);
+    expect(logs.join("\n")).toContain('Installing the gcloud "beta" component');
+  });
+
+  it("fails with the package-manager command when gcloud cannot install the beta component", async () => {
+    const { run, calls } = fakeGcloud({
+      "components list": [ok("")],
+      "run services list": [ok("caelo-production-admin-abc\n")],
+      "components install": [
+        fail(
+          "ERROR: (gcloud.components.install)\nYou cannot perform this action because the Google Cloud CLI component manager \nis disabled for this installation. You can run the following command \nto achieve the same result for this installation: \n\nsudo apt-get install google-cloud-cli",
+        ),
+      ],
+    });
+    const r = await enableAdminDomain({ ...base, run });
+    expect(r.status).toBe("failed");
+    expect(r.status === "failed" && r.error).toContain("sudo apt-get install google-cloud-cli");
+    expect(calls.some((c) => c[0] === "beta")).toBe(false);
+  });
+});
+
+describe("enableStagingDomain (#650)", () => {
+  const STAGING_MAPPING = JSON.stringify({
+    status: {
+      resourceRecords: [{ name: "staging", type: "CNAME", rrdata: "ghs.googlehosted.com." }],
+    },
+  });
+
+  it("opens the gateway's ingress, maps staging.<domain> to the gateway and prints the record", async () => {
+    const { run, calls } = fakeGcloud({
+      "run services list": [ok("caelo-production-gateway-xyz\n")],
+      "run services describe": [ok("internal-and-cloud-load-balancing\n")],
+      "beta run domain-mappings describe": [fail("NOT_FOUND"), ok(STAGING_MAPPING)],
+      "domains list-user-verified": [ok("example.com\n")],
+    });
+    const { enableStagingDomain } = await import("./admin-domain.js");
+    const r = await enableStagingDomain({ ...base, stagingHost: "staging.example.com", run });
+    expect(r).toEqual({
+      status: "mapped",
+      hostname: "staging.example.com",
+      created: true,
+      records: [{ name: "staging.example.com", type: "CNAME", value: "ghs.googlehosted.com." }],
+    });
+    expect(calls).toContainEqual([
+      "run",
+      "services",
+      "update",
+      "caelo-production-gateway-xyz",
+      "--region=europe-west1",
+      "--project=p",
+      "--ingress=all",
+      "--quiet",
+    ]);
+    expect(calls.find((c) => c.includes("create"))).toContain(
+      "--service=caelo-production-gateway-xyz",
+    );
+    expect(calls[0]).toContain("--filter=metadata.name~^caelo-production-gateway");
+  });
+
+  it("is idempotent: ingress already open and mapping present ⇒ no update, no create", async () => {
+    const { run, calls } = fakeGcloud({
+      "run services list": [ok("caelo-production-gateway-xyz\n")],
+      "run services describe": [ok("all\n")],
+      "beta run domain-mappings describe": [ok(STAGING_MAPPING)],
+    });
+    const { enableStagingDomain } = await import("./admin-domain.js");
+    const r = await enableStagingDomain({ ...base, stagingHost: "staging.example.com", run });
+    expect(r.status === "mapped" && !r.created).toBe(true);
+    expect(calls.some((c) => c.includes("update") || c.includes("create"))).toBe(false);
+  });
+
+  it("maps a host the operator chose on another domain, verifying that host itself", async () => {
+    const { run, calls } = fakeGcloud({
+      "run services list": [ok("caelo-production-gateway-xyz\n")],
+      "run services describe": [ok("all\n")],
+      "beta run domain-mappings describe": [fail("NOT_FOUND")],
+      "domains list-user-verified": [ok("example.com\n")],
+    });
+    const { enableStagingDomain } = await import("./admin-domain.js");
+    const r = await enableStagingDomain({ ...base, stagingHost: "preview.other.de", run });
+    expect(r).toEqual({
+      status: "needs-verification",
+      hostname: "preview.other.de",
+      verifyDomain: "preview.other.de",
+    });
+    expect(calls).toContainEqual(["domains", "verify", "preview.other.de"]);
+  });
+
+  it("fails closed without exactly one gateway service", async () => {
+    const { run } = fakeGcloud({ "run services list": [ok("a\nb\n")] });
+    const { enableStagingDomain } = await import("./admin-domain.js");
+    const r = await enableStagingDomain({ ...base, stagingHost: "staging.example.com", run });
+    expect(r.status).toBe("failed");
+  });
+
+  it("installs the missing beta component before its first beta command", async () => {
+    const { run, calls } = fakeGcloud({
+      "components list": [ok("")],
+      "run services list": [ok("caelo-production-gateway-xyz\n")],
+      "run services describe": [ok("all\n")],
+      "beta run domain-mappings describe": [ok(STAGING_MAPPING)],
+    });
+    const { enableStagingDomain } = await import("./admin-domain.js");
+    const r = await enableStagingDomain({ ...base, stagingHost: "staging.example.com", run });
+    expect(r.status).toBe("mapped");
+    const install = calls.findIndex((c) => c.join(" ") === "components install beta --quiet");
+    expect(install).toBeGreaterThanOrEqual(0);
+    expect(install).toBeLessThan(calls.findIndex((c) => c[0] === "beta"));
+  });
+});

package/src/admin-domain.ts

@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * `cms-provision admin-domain enable` — serve a gcp-firebase admin at
+ * `admin.<domain>` instead of its `*.run.app` URL — and, the same way,
+ * `cms-provision staging-domain enable` (#650): serve the protected staging
+ * site at `staging.<domain>` from the gateway, which gates and proxies it.
+ *
+ * The gcp-firebase stack only creates that Cloud Run domain mapping behind
+ * `provisionAdminDomain=true`, off by default: Google refuses a mapping
+ * unless the CALLER is a verified owner of the domain in Search Console, and
+ * the stack runs as the provisioner service account, which never is. So the
+ * mapping is created here, as the operator's own gcloud identity — the one
+ * that verified (or now verifies) the domain:
+ *
+ *   1. find the admin Cloud Run service (`caelo-production-admin*`);
+ *   2. if the mapping exists already, just report its DNS records;
+ *   3. check `gcloud domains list-user-verified`; if neither the apex nor
+ *      `admin.<domain>` is verified, start `gcloud domains verify <apex>`
+ *      (opens Search Console) and stop — verifying means adding a TXT record,
+ *      the one step only the domain's owner can take;
+ *   4. create the mapping and print the DNS records to add.
+ *
+ * The mapping is then owned by this command, not by Pulumi: leave
+ * `provisionAdminDomain` false, or the next `pulumi up` tries to create a
+ * second one and fails with "already exists".
+ *
+ * `gcp` installs need none of this — the load balancer serves admin.<domain>
+ * from the start.
+ */
+
+import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
+import { ensureGcloudComponent } from "./gcloud-components.js";
+
+type Run = (args: string[]) => Promise<GcloudResult>;
+
+export interface DnsRecordToAdd {
+  readonly name: string;
+  readonly type: string;
+  readonly value: string;
+}
+
+export type AdminDomainResult =
+  | { status: "mapped"; hostname: string; created: boolean; records: DnsRecordToAdd[] }
+  | { status: "needs-verification"; hostname: string; verifyDomain: string }
+  | { status: "failed"; error: string };
+
+/** What `staging-domain enable` reports; same shape as the admin's. */
+export type StagingDomainResult = AdminDomainResult;
+
+interface DomainMappingJson {
+  status?: { resourceRecords?: { name?: string; type?: string; rrdata?: string }[] };
+}
+
+function recordsOf(json: string, hostname: string): DnsRecordToAdd[] {
+  const parsed = JSON.parse(json) as DomainMappingJson;
+  return (parsed.status?.resourceRecords ?? []).map((r) => ({
+    name: r.name ? `${r.name}.${hostname.split(".").slice(1).join(".")}` : hostname,
+    type: r.type ?? "CNAME",
+    value: r.rrdata ?? "",
+  }));
+}
+
+interface DomainOpts {
+  projectId: string;
+  region: string;
+  domain: string;
+  run?: Run;
+  /** Progress lines (the one-time `beta` component install); defaults to stdout. */
+  log?: (message: string) => void;
+}
+
+function logOf(opts: DomainOpts): (message: string) => void {
+  return opts.log ?? ((message: string) => console.log(message));
+}
+
+/** The one deployed Cloud Run service of `slug` (Pulumi-suffixed name); also used by staging-admin.ts. */
+export async function findService(
+  run: Run,
+  scope: string[],
+  slug: "admin" | "gateway",
+): Promise<{ ok: true; service: string } | { ok: false; error: string }> {
+  const prefix = `caelo-production-${slug}`;
+  const services = await run([
+    "run",
+    "services",
+    "list",
+    ...scope,
+    `--filter=metadata.name~^${prefix}`,
+    "--format=value(metadata.name)",
+  ]);
+  if (!services.ok) {
+    return { ok: false, error: `list Cloud Run services: ${services.stderr.trim()}` };
+  }
+  const matches = services.stdout
+    .split("\n")
+    .map((s) => s.trim())
+    .filter(Boolean);
+  // Fail closed like the other service lookups: with a leftover service from
+  // a failed deploy, picking one would bind the domain to the wrong revision.
+  const service = matches.length === 1 ? matches[0] : undefined;
+  if (!service) {
+    return {
+      ok: false,
+      error:
+        matches.length === 0
+          ? `${slug} Cloud Run service not found: no ${prefix}* service`
+          : `expected exactly one ${prefix}* Cloud Run service, found ${matches.length} (${matches.join(", ")}); delete the stale one first`,
+    };
+  }
+  return { ok: true, service };
+}
+
+export async function enableAdminDomain(opts: DomainOpts): Promise<AdminDomainResult> {
+  const run = opts.run ?? defaultGcloud;
+  const scope = [`--region=${opts.region}`, `--project=${opts.projectId}`];
+  const found = await findService(run, scope, "admin");
+  if (!found.ok) return { status: "failed", error: found.error };
+  return mapDomain(run, logOf(opts), scope, opts.domain, `admin.${opts.domain}`, found.service);
+}
+
+/**
+ * #650 — map the install's staging host (its setting, default
+ * `staging.<domain>`; any FQDN) to the gateway, which serves the protected
+ * staging site. Cloud Run refuses domain-mapped requests while a service's
+ * ingress is internal-only, so the gateway's ingress is opened first (the
+ * stack declares the same since #650; installs from before keep the old
+ * value until this runs). Idempotent like the admin mapping.
+ */
+export async function enableStagingDomain(
+  opts: DomainOpts & { stagingHost: string },
+): Promise<StagingDomainResult> {
+  const run = opts.run ?? defaultGcloud;
+  const scope = [`--region=${opts.region}`, `--project=${opts.projectId}`];
+  const found = await findService(run, scope, "gateway");
+  if (!found.ok) return { status: "failed", error: found.error };
+  const ingress = await run([
+    "run",
+    "services",
+    "describe",
+    found.service,
+    ...scope,
+    '--format=value(metadata.annotations["run.googleapis.com/ingress"])',
+  ]);
+  if (!ingress.ok) {
+    return { status: "failed", error: `read the gateway's ingress: ${ingress.stderr.trim()}` };
+  }
+  if (ingress.stdout.trim() !== "all") {
+    const update = await run([
+      "run",
+      "services",
+      "update",
+      found.service,
+      ...scope,
+      "--ingress=all",
+      "--quiet",
+    ]);
+    if (!update.ok) {
+      return {
+        status: "failed",
+        error: `open the gateway's ingress for the domain mapping: ${update.stderr.trim()}`,
+      };
+    }
+  }
+  // Search Console verification: the install domain covers its own
+  // subdomains; a host on another domain is verified itself.
+  const verifyDomain =
+    opts.stagingHost === opts.domain || opts.stagingHost.endsWith(`.${opts.domain}`)
+      ? opts.domain
+      : opts.stagingHost;
+  return mapDomain(run, logOf(opts), scope, verifyDomain, opts.stagingHost, found.service);
+}
+
+/** Steps 2–4 of the module doc for `hostname` → `service`. */
+async function mapDomain(
+  run: Run,
+  log: (message: string) => void,
+  scope: string[],
+  domain: string,
+  hostname: string,
+  service: string,
+): Promise<AdminDomainResult> {
+  // Fully managed Cloud Run domain mappings exist only on the beta track: the
+  // GA `gcloud run domain-mappings` is Cloud Run for Anthos only. Install the
+  // component up front instead of letting gcloud ask for it mid-command.
+  const beta = await ensureGcloudComponent("beta", { run, log });
+  if (!beta.ok) return { status: "failed", error: beta.error };
+
+  const describeArgs = [
+    "beta",
+    "run",
+    "domain-mappings",
+    "describe",
+    `--domain=${hostname}`,
+    ...scope,
+    "--format=json",
+  ];
+  const existing = await run(describeArgs);
+  if (existing.ok) {
+    return {
+      status: "mapped",
+      hostname,
+      created: false,
+      records: recordsOf(existing.stdout, hostname),
+    };
+  }
+
+  const verified = await run(["domains", "list-user-verified", "--format=value(id)"]);
+  if (!verified.ok) {
+    // Expired credentials or a missing gcloud component — not "unverified".
+    return { status: "failed", error: `list verified domains: ${verified.stderr.trim()}` };
+  }
+  const verifiedIds = verified.stdout.split("\n").map((s) => s.trim());
+  if (!verifiedIds.includes(domain) && !verifiedIds.includes(hostname)) {
+    const verify = await run(["domains", "verify", domain]);
+    if (!verify.ok) {
+      return {
+        status: "failed",
+        error: `start domain verification for ${domain}: ${verify.stderr.trim()}`,
+      };
+    }
+    return { status: "needs-verification", hostname, verifyDomain: domain };
+  }
+
+  const create = await run([
+    "beta",
+    "run",
+    "domain-mappings",
+    "create",
+    `--service=${service}`,
+    `--domain=${hostname}`,
+    ...scope,
+    "--quiet",
+  ]);
+  if (!create.ok) {
+    return { status: "failed", error: `create domain mapping: ${create.stderr.trim()}` };
+  }
+  const created = await run(describeArgs);
+  return {
+    status: "mapped",
+    hostname,
+    created: true,
+    records: created.ok ? recordsOf(created.stdout, hostname) : [],
+  };
+}

package/src/admin-memory.test.ts

@@ -0,0 +1,151 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #553 — the admin memory knob (it runs the Lighthouse quality audit):
+ * one default for every adapter, upgrade raises existing installs to it
+ * (never lowers), and the cost table prices it.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { generateDockerCompose } from "./compose.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  azureContainerAppResources,
+  memoryQuantityMiB,
+} from "./stack-contract.js";
+import { liveContainerMemory, planAdminMemory, serviceRollArgs } from "./stack-converge.js";
+import { estimateGcpCost } from "./wizards/gcp-cost.js";
+
+describe("memoryQuantityMiB", () => {
+  it("parses the notations the stacks and gcloud use", () => {
+    expect(memoryQuantityMiB("512Mi")).toBe(512);
+    expect(memoryQuantityMiB("2Gi")).toBe(2048);
+    expect(memoryQuantityMiB("1.5Gi")).toBe(1536);
+    expect(memoryQuantityMiB("2G")).toBe(1907);
+    expect(memoryQuantityMiB("2 GB")).toBeNull();
+    expect(memoryQuantityMiB("lots")).toBeNull();
+  });
+
+  it("the default is 2Gi", () => {
+    expect(ADMIN_MEMORY_DEFAULT).toBe("2Gi");
+  });
+});
+
+describe("planAdminMemory (upgrade)", () => {
+  it("raises an admin below the default, including Cloud Run's implicit 512Mi", () => {
+    expect(planAdminMemory("1Gi")).toEqual({ ok: true, flags: ["--memory=2Gi"], from: "1Gi" });
+    expect(planAdminMemory(null)).toEqual({ ok: true, flags: ["--memory=2Gi"], from: null });
+  });
+
+  it("never lowers an operator's larger value", () => {
+    expect(planAdminMemory("4Gi")).toEqual({ ok: true, flags: [], from: "4Gi" });
+    expect(planAdminMemory("2Gi")).toEqual({ ok: true, flags: [], from: "2Gi" });
+  });
+
+  it("leaves a value it cannot parse alone, with a reason", () => {
+    const r = planAdminMemory("lots");
+    expect(r.ok).toBe(false);
+  });
+
+  it("reads the live limit from `services describe` JSON", () => {
+    const json = JSON.stringify({
+      spec: { template: { spec: { containers: [{ resources: { limits: { memory: "1Gi" } } }] } } },
+    });
+    expect(liveContainerMemory(json)).toBe("1Gi");
+    expect(liveContainerMemory(JSON.stringify({ spec: {} }))).toBeNull();
+  });
+
+  it("rides the same `services update` as the image roll", () => {
+    const args = serviceRollArgs({
+      serviceName: "caelo-production-admin",
+      region: "europe-west1",
+      projectId: "acme",
+      imageRef: "img@sha256:abc",
+      serviceAccount: "sa@acme.iam.gserviceaccount.com",
+      envFlags: ["--update-env-vars=A=b"],
+      resourceFlags: ["--memory=2Gi"],
+    });
+    expect(args).toContain("--memory=2Gi");
+    expect(args.indexOf("--memory=2Gi")).toBeLessThan(args.indexOf("--quiet"));
+  });
+});
+
+describe("self-hosted compose", () => {
+  const base = {
+    domain: "acme.com",
+    postgresPassword: "pw",
+    rolePasswords: { admin: "a", public: "b", gateway: "g" },
+    minioRootUser: "caelo",
+    minioRootPassword: "pw",
+    caeloSecretKek: "0".repeat(64),
+    diskSize: "20Gi",
+    images: {
+      mode: "release" as const,
+      admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,
+      gateway: `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`,
+    },
+  };
+
+  it("reserves the default admin memory, or the configured one", () => {
+    expect(generateDockerCompose(base)).toContain("mem_reservation: 2048m");
+    expect(generateDockerCompose({ ...base, adminMemory: "3Gi" })).toContain(
+      "mem_reservation: 3072m",
+    );
+  });
+
+  it("refuses a value that is not a memory quantity", () => {
+    expect(() => generateDockerCompose({ ...base, adminMemory: "plenty" })).toThrow(
+      /not a memory quantity/,
+    );
+  });
+});
+
+describe("GCP cost table", () => {
+  const inputs = {
+    cloudSqlTier: "db-f1-micro",
+    cloudSqlHa: false,
+    adminMinInstances: 0,
+    gatewayMinInstances: 0,
+    wafAdaptiveProtection: false,
+    region: "europe-west1",
+  };
+
+  it("shows the admin memory and a line for the quality checks", () => {
+    const { lines } = estimateGcpCost(inputs);
+    expect(lines.map((l) => l.name)).toContain("Cloud Run admin (2Gi)");
+    expect(lines.some((l) => l.name.startsWith("Quality checks"))).toBe(true);
+  });
+
+  it("prices the extra memory of always-on admin instances", () => {
+    const admin = (memory: string) =>
+      estimateGcpCost({ ...inputs, adminMinInstances: 1, adminMemory: memory }).lines.find((l) =>
+        l.name.startsWith("Cloud Run admin"),
+      )?.monthlyUsd;
+    expect(admin("1Gi")).toBe(16);
+    expect(admin("2Gi")).toBe(23);
+  });
+
+  it("refuses a memory value provisioning would refuse", () => {
+    expect(() => estimateGcpCost({ ...inputs, adminMemory: "lots" })).toThrow("adminMemory");
+  });
+
+  it("shows the install region, and flags rates priced for another region (#607)", () => {
+    expect(estimateGcpCost(inputs).regionNote).toBe("Region: europe-west1 (fixed after install)");
+    const other = estimateGcpCost({ ...inputs, region: "us-east4" }).regionNote;
+    expect(other).toContain("Region: us-east4");
+    expect(other).toContain("europe-west1 list rates");
+  });
+});
+
+describe("Azure Container Apps sizes", () => {
+  it("pairs the memory with its vCPU", () => {
+    expect(azureContainerAppResources("2Gi")).toEqual({ cpu: 1, memory: "2.0Gi" });
+    expect(azureContainerAppResources("1536Mi")).toEqual({ cpu: 0.75, memory: "1.5Gi" });
+  });
+
+  it("refuses sizes Container Apps does not offer", () => {
+    for (const q of ["2G", "3.2Gi", "16Gi", "256Mi", "lots"]) {
+      expect(() => azureContainerAppResources(q)).toThrow("0.5Gi to 8Gi");
+    }
+  });
+});