@caelo-cms/provisioning 0.10.68 → 0.10.70

package/dist/admin-domain.d.ts

@@ -76,5 +76,33 @@ export declare function enableAdminDomain(opts: DomainOpts): Promise<AdminDomain
 export declare function enableStagingDomain(opts: DomainOpts & {
     stagingHost: string;
 }): Promise<StagingDomainResult>;
+/** What {@link setAdminStagingHostEnv} did. */
+export type AdminStagingEnvResult = {
+    readonly status: "set";
+    readonly service: string;
+    readonly previous: string | null;
+} | {
+    readonly status: "unchanged";
+    readonly service: string;
+} | {
+    readonly status: "failed";
+    readonly error: string;
+};
+/**
+ * #1058 — point the admin's `CAELO_STAGING_HOST` at the host
+ * `staging-domain enable` just mapped. The database row
+ * (`staging_access.staging_host`) is the admin's truth and is set through
+ * `staging_access.provision` (staging-admin.ts), but the env var is what
+ * provisioning recorded: left on the old host, the seed would restore the
+ * old host on a fresh database, and the converge job refuses every
+ * cloud-setup update because install.json and the deployed admin disagree
+ * (converge-job-gcp.ts `deployedSiteMismatch`). Same variable the upgrade's
+ * env contract sets (stack-contract.ts STAGING_HOST_ENV); updating only it
+ * keeps every other var exactly as deployed. A new revision only when the
+ * value differs, so a re-run is a no-op.
+ */
+export declare function setAdminStagingHostEnv(opts: Pick<DomainOpts, "projectId" | "region" | "run"> & {
+    stagingHost: string;
+}): Promise<AdminStagingEnvResult>;
 export {};
 //# sourceMappingURL=admin-domain.d.ts.map

package/dist/admin-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-domain.d.ts","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAGzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAepD,UAAU,UAAU;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAMD,0GAA0G;AAC1G,wBAAsB,WAAW,CAC/B,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,OAAO,GAAG,SAAS,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BvE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAMpF;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,mBAAmB,CAAC,CAwC9B"}
+{"version":3,"file":"admin-domain.d.ts","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAKzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,cAAc,EAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACxE;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,uEAAuE;AACvE,MAAM,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAepD,UAAU,UAAU;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,kFAAkF;IAClF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAMD,0GAA0G;AAC1G,wBAAsB,WAAW,CAC/B,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,EAAE,OAAO,GAAG,SAAS,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BvE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAMpF;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,UAAU,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC,mBAAmB,CAAC,CAwC9B;AAED,+CAA+C;AAC/C,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACtF;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,QAAQ,GAAG,KAAK,CAAC,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC/E,OAAO,CAAC,qBAAqB,CAAC,CA8ChC"}

package/dist/admin-domain.js

@@ -29,6 +29,8 @@
  */
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { ensureGcloudComponent } from "./gcloud-components.js";
+import { STAGING_HOST_ENV } from "./stack-contract.js";
+import { liveContainerEnv } from "./stack-converge.js";
 function recordsOf(json, hostname) {
     const parsed = JSON.parse(json);
     return (parsed.status?.resourceRecords ?? []).map((r) => ({
@@ -128,6 +130,69 @@ export async function enableStagingDomain(opts) {
         : opts.stagingHost;
     return mapDomain(run, logOf(opts), scope, verifyDomain, opts.stagingHost, found.service);
 }
+/**
+ * #1058 — point the admin's `CAELO_STAGING_HOST` at the host
+ * `staging-domain enable` just mapped. The database row
+ * (`staging_access.staging_host`) is the admin's truth and is set through
+ * `staging_access.provision` (staging-admin.ts), but the env var is what
+ * provisioning recorded: left on the old host, the seed would restore the
+ * old host on a fresh database, and the converge job refuses every
+ * cloud-setup update because install.json and the deployed admin disagree
+ * (converge-job-gcp.ts `deployedSiteMismatch`). Same variable the upgrade's
+ * env contract sets (stack-contract.ts STAGING_HOST_ENV); updating only it
+ * keeps every other var exactly as deployed. A new revision only when the
+ * value differs, so a re-run is a no-op.
+ */
+export async function setAdminStagingHostEnv(opts) {
+    const run = opts.run ?? defaultGcloud;
+    const scope = [`--region=${opts.region}`, `--project=${opts.projectId}`];
+    const found = await findService(run, scope, "admin");
+    if (!found.ok)
+        return { status: "failed", error: found.error };
+    const described = await run([
+        "run",
+        "services",
+        "describe",
+        found.service,
+        ...scope,
+        "--format=json",
+    ]);
+    if (!described.ok) {
+        return { status: "failed", error: `read the admin's env: ${described.stderr.trim()}` };
+    }
+    let live;
+    try {
+        live = liveContainerEnv(described.stdout);
+    }
+    catch {
+        return { status: "failed", error: "read the admin's env: gcloud's answer is not JSON" };
+    }
+    const current = live.get(STAGING_HOST_ENV);
+    if (current?.kind === "secret") {
+        return {
+            status: "failed",
+            error: `the admin reads ${STAGING_HOST_ENV} from secret ${current.secret}, not a plain value; run \`cms-provision upgrade\` to bring its env back to the contract, then re-run`,
+        };
+    }
+    if (current?.value === opts.stagingHost)
+        return { status: "unchanged", service: found.service };
+    const update = await run([
+        "run",
+        "services",
+        "update",
+        found.service,
+        ...scope,
+        `--update-env-vars=${STAGING_HOST_ENV}=${opts.stagingHost}`,
+        "--quiet",
+    ]);
+    if (!update.ok) {
+        return {
+            status: "failed",
+            error: `set ${STAGING_HOST_ENV} on the admin: ${update.stderr.trim()}`,
+        };
+    }
+    return { status: "set", service: found.service, previous: current?.value ?? null };
+}
 /** Steps 2–4 of the module doc for `hostname` → `service`. */
 async function mapDomain(run, log, scope, domain, hostname, service) {
     // Fully managed Cloud Run domain mappings exist only on the beta track: the

package/dist/admin-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-domain.js","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAsB/D,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/E,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAWD,SAAS,KAAK,CAAC,IAAgB;IAC7B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAQ,EACR,KAAe,EACf,IAAyB;IAEzB,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,MAAM;QACN,GAAG,KAAK;QACR,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM;SAC5B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,GAAG,IAAI,oCAAoC,MAAM,WAAW;gBAC9D,CAAC,CAAC,wBAAwB,MAAM,8BAA8B,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;SACvI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAgB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;QACxB,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,oEAAoE;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,+BAA+B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,UAAU;YACV,QAAQ;YACR,KAAK,CAAC,OAAO;YACb,GAAG,KAAK;YACR,eAAe;YACf,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,sDAAsD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,iEAAiE;IACjE,2DAA2D;IAC3D,MAAM,YAAY,GAChB,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9E,CAAC,CAAC,IAAI,CAAC,MAAM;QACb,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACvB,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,GAA8B,EAC9B,KAAe,EACf,MAAc,EACd,QAAgB,EAChB,OAAe;IAEf,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAE7D,MAAM,YAAY,GAAG;QACnB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,UAAU;QACV,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,eAAe;KAChB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,wEAAwE;QACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,iCAAiC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aAC1E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,QAAQ;QACR,aAAa,OAAO,EAAE;QACtB,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"admin-domain.js","sourceRoot":"","sources":["../src/admin-domain.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAsBvD,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;QAC/E,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,OAAO;QACvB,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAWD,SAAS,KAAK,CAAC,IAAgB;IAC7B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAQ,EACR,KAAe,EACf,IAAyB;IAEzB,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,UAAU;QACV,MAAM;QACN,GAAG,KAAK;QACR,2BAA2B,MAAM,EAAE;QACnC,+BAA+B;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM;SAC5B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,GAAG,IAAI,oCAAoC,MAAM,WAAW;gBAC9D,CAAC,CAAC,wBAAwB,MAAM,8BAA8B,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;SACvI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAgB;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAChG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA0C;IAE1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;QACxB,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,oEAAoE;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,+BAA+B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,UAAU;YACV,QAAQ;YACR,KAAK,CAAC,OAAO;YACb,GAAG,KAAK;YACR,eAAe;YACf,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,sDAAsD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,iEAAiE;IACjE,2DAA2D;IAC3D,MAAM,YAAY,GAChB,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9E,CAAC,CAAC,IAAI,CAAC,MAAM;QACb,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IACvB,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAgF;IAEhF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;QAC1B,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,IAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,mBAAmB,gBAAgB,gBAAgB,OAAO,CAAC,MAAM,uGAAuG;SAChL,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,KAAK,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,UAAU;QACV,QAAQ;QACR,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,qBAAqB,gBAAgB,IAAI,IAAI,CAAC,WAAW,EAAE;QAC3D,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,OAAO,gBAAgB,kBAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;AACrF,CAAC;AAED,8DAA8D;AAC9D,KAAK,UAAU,SAAS,CACtB,GAAQ,EACR,GAA8B,EAC9B,KAAe,EACf,MAAc,EACd,QAAgB,EAChB,OAAe;IAEf,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAE7D,MAAM,YAAY,GAAG;QACnB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,UAAU;QACV,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,eAAe;KAChB,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,QAAQ;YACR,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,wEAAwE;QACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,iCAAiC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aAC1E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,MAAM;QACN,KAAK;QACL,iBAAiB;QACjB,QAAQ;QACR,aAAa,OAAO,EAAE;QACtB,YAAY,QAAQ,EAAE;QACtB,GAAG,KAAK;QACR,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;AACJ,CAAC"}

package/dist/adopt-existing.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Adopt cloud resources the stack declares but its Pulumi state lacks
+ * (#1079), before the installer's `pulumi up`.
+ *
+ * `cms-provision upgrade` converges an install through gcloud and never runs
+ * Pulumi (stack-converge.ts), so it creates some resources the stack also
+ * declares — the gateway's service account (runtime-secrets.ts), the MCP
+ * service account (mcp-iap.ts) — without them entering the state. The next
+ * installer run then plans to CREATE them, and `state migrate` refuses an
+ * install whose preview plans anything. So, after the preview and before
+ * the review:
+ *
+ *   1. {@link adoptionCandidates}: the planned creates of a kind in
+ *      {@link ADOPTABLE_KINDS} whose inputs name the cloud resource. Only
+ *      planned steps are looked at, so nothing the stack does not declare is
+ *      ever adopted; every other kind is left to Pulumi.
+ *   2. {@link existingCandidates}: a gcloud describe per candidate. Exists →
+ *      adopt; NOT_FOUND → a plain create; anything else stops the run (we
+ *      can't tell, and guessing either way is wrong).
+ *   3. `pulumi import` of the existing ones into the stack, under the
+ *      stack's explicit GCP provider (wizards/gcp-pulumi.ts). State only: the
+ *      cloud resources are not touched.
+ *   4. A second preview: what the review shows and `up` applies. An adopted
+ *      resource that is still planned as a create stops the run.
+ *
+ * Why only service accounts ({@link ADOPTABLE_KINDS}). A kind is adopted
+ * when the stack declares it AND the CLI also creates it through gcloud, and
+ * its name is unique in the project. Checked per kind against both stacks:
+ *
+ *   - Secret Manager secrets: the stack declares only `postgres-password` and
+ *     `secret-kek`, which the CLI never creates; the secrets the CLI makes
+ *     (stack-contract.ts CLI_GENERATED_SECRETS) the stack only references by
+ *     id. Adopting a secret without its value resource would also make `up`
+ *     add a version with a freshly generated value — a new KEK.
+ *   - Buckets, Cloud Run jobs, custom roles: the stack's buckets are made by
+ *     Pulumi alone; the CLI's own (ops, audit results, the upgrader, converge,
+ *     audit and operator-access jobs, their custom roles) are not declared.
+ *   - The admin's Cloud Run domain mapping: owned by `admin-domain enable`
+ *     (admin-domain.ts), the stack's copy stays off; Pulumi, running as the
+ *     provisioner, could not manage it.
+ *   - IAM member resources (`*IamMember`, `IAMMember`): non-authoritative.
+ *     Their create is a read-modify-write that merges the member into the
+ *     policy and succeeds when it is there already, so a planned create of
+ *     one is an adoption already.
+ *   - Cloud SQL users: the CLI's are IAM users named after service accounts,
+ *     the stack's are the built-in `admin_role` / `public_role`.
+ */
+import type { GcloudRunner } from "./gcloud-retry.js";
+import type { PlannedStep } from "./preview-plan.js";
+/** The cloud identity of a resource a planned create would make. */
+export interface AdoptionTarget {
+    /** How the operator knows it, e.g. the service account's email. */
+    readonly display: string;
+    /** gcloud args that succeed exactly when it exists. */
+    readonly describeArgs: readonly string[];
+    /** The id `pulumi import` takes for the kind. */
+    readonly importId: string;
+}
+/** A resource kind the installer adopts when it exists already. */
+export interface AdoptableKind {
+    /** What it is, for messages (`service account`). */
+    readonly label: string;
+    /**
+     * The resource a create with these inputs would make, or null when the
+     * inputs don't pin it down (then the create is left to Pulumi).
+     */
+    target(inputs: Readonly<Record<string, unknown>>, projectId: string): AdoptionTarget | null;
+}
+/** Kinds adopted before `up`, by Pulumi type token. See the file comment for the rest. */
+export declare const ADOPTABLE_KINDS: Readonly<Record<string, AdoptableKind>>;
+/** A planned create the installer may adopt instead. */
+export interface AdoptionCandidate extends AdoptionTarget {
+    readonly step: PlannedStep;
+    readonly label: string;
+}
+/** Thrown when adoption cannot finish; nothing was applied. */
+export declare class AdoptionError extends Error {
+    readonly name = "AdoptionError";
+}
+/** The planned creates of an adoptable kind, with what each would create. */
+export declare function adoptionCandidates(steps: readonly PlannedStep[], projectId: string): AdoptionCandidate[];
+/**
+ * The candidates that exist in the project.
+ *
+ * @throws AdoptionError when a describe fails for another reason than NOT_FOUND
+ */
+export declare function existingCandidates(candidates: readonly AdoptionCandidate[], run: GcloudRunner): Promise<AdoptionCandidate[]>;
+/** What adoption needs from Pulumi and gcloud; fakes in tests. */
+export interface AdoptionDeps {
+    readonly projectId: string;
+    readonly gcloud: GcloudRunner;
+    /** A fresh preview of the stack. */
+    preview(): Promise<readonly PlannedStep[]>;
+    /** `pulumi import` the candidates into the stack (state only). */
+    importResources(candidates: readonly AdoptionCandidate[]): Promise<void>;
+}
+/** The plan to review after adoption, and what was adopted into it. */
+export interface AdoptionResult {
+    readonly adopted: readonly AdoptionCandidate[];
+    readonly steps: readonly PlannedStep[];
+}
+/**
+ * The line of a failed Pulumi call that says what went wrong. The
+ * Automation API's error starts with `code: 255` and carries the CLI's
+ * stderr below; its first `error:` line is the reason.
+ */
+export declare function pulumiErrorReason(e: unknown): string;
+/**
+ * Adopt the planned creates of `steps` that exist in the project already,
+ * and return the plan after it. With nothing to adopt, `steps` comes back
+ * unchanged and nothing else runs.
+ *
+ * @throws AdoptionError when a probe or the import fails, or a re-plan still
+ *   creates an adopted resource; `up` must not run then
+ */
+export declare function adoptExistingResources(steps: readonly PlannedStep[], deps: AdoptionDeps): Promise<AdoptionResult>;
+/** The adopted resources as lines for the review, or none. */
+export declare function formatAdopted(adopted: readonly AdoptionCandidate[]): string[];
+//# sourceMappingURL=adopt-existing.d.ts.map

package/dist/adopt-existing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt-existing.d.ts","sourceRoot":"","sources":["../src/adopt-existing.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC;CAC7F;AAED,0FAA0F;AAC1F,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CA6BnE,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,+DAA+D;AAC/D,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAkB,IAAI,mBAAmB;CAC1C;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,SAAS,EAAE,MAAM,GAChB,iBAAiB,EAAE,CAUrB;AAID;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAY9B;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,oCAAoC;IACpC,OAAO,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAC3C,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAMpD;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CAqBzB;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAM7E"}

package/dist/adopt-existing.js

@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: MPL-2.0
+/** Kinds adopted before `up`, by Pulumi type token. See the file comment for the rest. */
+export const ADOPTABLE_KINDS = {
+    "gcp:serviceaccount/account:Account": {
+        label: "service account",
+        target(inputs, projectId) {
+            // GCP's account-id format; also keeps out the engine's placeholder
+            // for a value only known after apply.
+            const accountId = inputs.accountId;
+            if (typeof accountId !== "string" || !/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(accountId)) {
+                return null;
+            }
+            // Unset means the provider's project, which is the install's
+            // (assertStackProject). Another project is never adopted.
+            const project = inputs.project ?? projectId;
+            if (project !== projectId)
+                return null;
+            const email = `${accountId}@${projectId}.iam.gserviceaccount.com`;
+            return {
+                display: email,
+                describeArgs: [
+                    "iam",
+                    "service-accounts",
+                    "describe",
+                    email,
+                    `--project=${projectId}`,
+                    "--format=value(email)",
+                ],
+                importId: `projects/${projectId}/serviceAccounts/${email}`,
+            };
+        },
+    },
+};
+/** Thrown when adoption cannot finish; nothing was applied. */
+export class AdoptionError extends Error {
+    name = "AdoptionError";
+}
+/** The planned creates of an adoptable kind, with what each would create. */
+export function adoptionCandidates(steps, projectId) {
+    const out = [];
+    for (const step of steps) {
+        if (step.op !== "create")
+            continue;
+        const kind = ADOPTABLE_KINDS[step.type];
+        if (!kind || !step.inputs)
+            continue;
+        const target = kind.target(step.inputs, projectId);
+        if (target)
+            out.push({ ...target, step, label: kind.label });
+    }
+    return out;
+}
+const NOT_FOUND = /NOT_FOUND|not found|does not exist/i;
+/**
+ * The candidates that exist in the project.
+ *
+ * @throws AdoptionError when a describe fails for another reason than NOT_FOUND
+ */
+export async function existingCandidates(candidates, run) {
+    const existing = [];
+    for (const c of candidates) {
+        const r = await run([...c.describeArgs]);
+        if (r.ok)
+            existing.push(c);
+        else if (!NOT_FOUND.test(r.stderr)) {
+            throw new AdoptionError(`could not tell whether the ${c.label} ${c.display} exists (gcloud: ${r.stderr.trim()}). Nothing was imported or applied. Check that gcloud is signed in as the Owner (gcloud auth login) and re-run the installer.`);
+        }
+    }
+    return existing;
+}
+/**
+ * The line of a failed Pulumi call that says what went wrong. The
+ * Automation API's error starts with `code: 255` and carries the CLI's
+ * stderr below; its first `error:` line is the reason.
+ */
+export function pulumiErrorReason(e) {
+    const lines = (e instanceof Error ? e.message : String(e))
+        .split("\n")
+        .map((l) => l.trim().replace(/^stderr:\s*/, ""))
+        .filter((l) => l !== "");
+    return lines.find((l) => /^error:/i.test(l)) ?? lines[0] ?? "no output";
+}
+/**
+ * Adopt the planned creates of `steps` that exist in the project already,
+ * and return the plan after it. With nothing to adopt, `steps` comes back
+ * unchanged and nothing else runs.
+ *
+ * @throws AdoptionError when a probe or the import fails, or a re-plan still
+ *   creates an adopted resource; `up` must not run then
+ */
+export async function adoptExistingResources(steps, deps) {
+    const existing = await existingCandidates(adoptionCandidates(steps, deps.projectId), deps.gcloud);
+    if (existing.length === 0)
+        return { adopted: [], steps };
+    const names = existing.map((c) => `${c.label} ${c.display}`).join(", ");
+    try {
+        await deps.importResources(existing);
+    }
+    catch (e) {
+        throw new AdoptionError(`could not adopt ${names} (already in the project) into the stack: pulumi import says "${pulumiErrorReason(e)}". Nothing was applied. Re-run the installer: what was adopted stays adopted. If it fails the same way, report it with this message.`);
+    }
+    const after = await deps.preview();
+    const stillCreated = after.filter((s) => s.op === "create" && existing.some((c) => c.step.urn === s.urn));
+    if (stillCreated.length > 0) {
+        throw new AdoptionError(`imported ${names}, but the next preview still creates ${stillCreated.map((s) => s.name).join(", ")}. Nothing was applied. Report this with the message; re-running the installer does not fix it.`);
+    }
+    return { adopted: existing, steps: after };
+}
+/** The adopted resources as lines for the review, or none. */
+export function formatAdopted(adopted) {
+    if (adopted.length === 0)
+        return [];
+    return [
+        `Adopted (${adopted.length}) — already in the project, now in the stack instead of created again:`,
+        ...adopted.map((c) => `  ${c.label} ${c.display} (${c.step.name})`),
+    ];
+}
+//# sourceMappingURL=adopt-existing.js.map

package/dist/adopt-existing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt-existing.js","sourceRoot":"","sources":["../src/adopt-existing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA0EnC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,eAAe,GAA4C;IACtE,oCAAoC,EAAE;QACpC,KAAK,EAAE,iBAAiB;QACxB,MAAM,CAAC,MAAM,EAAE,SAAS;YACtB,mEAAmE;YACnE,sCAAsC;YACtC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,6DAA6D;YAC7D,0DAA0D;YAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;YAC5C,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,SAAS,0BAA0B,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE;oBACZ,KAAK;oBACL,kBAAkB;oBAClB,UAAU;oBACV,KAAK;oBACL,aAAa,SAAS,EAAE;oBACxB,uBAAuB;iBACxB;gBACD,QAAQ,EAAE,YAAY,SAAS,oBAAoB,KAAK,EAAE;aAC3D,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAQF,+DAA+D;AAC/D,MAAM,OAAO,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;CAC1C;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAChC,KAA6B,EAC7B,SAAiB;IAEjB,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,SAAS,GAAG,qCAAqC,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAwC,EACxC,GAAiB;IAEjB,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,aAAa,CACrB,8BAA8B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,+HAA+H,CACrN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACvD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA6B,EAC7B,IAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CACrB,mBAAmB,KAAK,iEAAiE,iBAAiB,CAAC,CAAC,CAAC,sIAAsI,CACpP,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACnC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CACvE,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CACrB,YAAY,KAAK,wCAAwC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gGAAgG,CACpM,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,OAAqC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO;QACL,YAAY,OAAO,CAAC,MAAM,wEAAwE;QAClG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;KACpE,CAAC;AACJ,CAAC"}

package/dist/cli.js

@@ -1253,6 +1253,24 @@ async function domainMappingCommand(kind) {
         // Prints the staging basic-auth password ON PURPOSE (#678): the operator
         // asked for it to be shown once; it is never written to disk or logs.
         console.log(describeStagingApply(applied.value).join("\n"));
+        // #1058 — and the admin's CAELO_STAGING_HOST, so the provisioned value
+        // agrees with install.json and the stored host (the converge job
+        // refuses an install whose records and admin disagree). After the
+        // provision call: the update starts a new admin revision.
+        const { setAdminStagingHostEnv } = await import("./admin-domain.js");
+        const env = await setAdminStagingHostEnv({
+            projectId: meta.projectId,
+            region: meta.region,
+            stagingHost: r.hostname,
+        });
+        if (env.status === "failed") {
+            console.error(`${command}: ${r.hostname} is mapped and stored in the admin, but its CAELO_STAGING_HOST could not be updated: ${env.error}\n` +
+                `Run \`${retry}\` again once that is fixed (it is idempotent).`);
+            process.exit(5);
+        }
+        if (env.status === "set") {
+            console.log(`The admin (${env.service}) now runs with CAELO_STAGING_HOST=${r.hostname}${env.previous ? ` (was ${env.previous})` : ""}.`);
+        }
     }
     if (r.records.length === 0) {
         console.log(`Google has not published the DNS records yet; run \`cms-provision ${command} enable\` again in a minute.`);