@caelo-cms/provisioning 0.10.69 → 0.10.70

package/src/adopt-existing.ts

@@ -0,0 +1,228 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Adopt cloud resources the stack declares but its Pulumi state lacks
+ * (#1079), before the installer's `pulumi up`.
+ *
+ * `cms-provision upgrade` converges an install through gcloud and never runs
+ * Pulumi (stack-converge.ts), so it creates some resources the stack also
+ * declares — the gateway's service account (runtime-secrets.ts), the MCP
+ * service account (mcp-iap.ts) — without them entering the state. The next
+ * installer run then plans to CREATE them, and `state migrate` refuses an
+ * install whose preview plans anything. So, after the preview and before
+ * the review:
+ *
+ *   1. {@link adoptionCandidates}: the planned creates of a kind in
+ *      {@link ADOPTABLE_KINDS} whose inputs name the cloud resource. Only
+ *      planned steps are looked at, so nothing the stack does not declare is
+ *      ever adopted; every other kind is left to Pulumi.
+ *   2. {@link existingCandidates}: a gcloud describe per candidate. Exists →
+ *      adopt; NOT_FOUND → a plain create; anything else stops the run (we
+ *      can't tell, and guessing either way is wrong).
+ *   3. `pulumi import` of the existing ones into the stack, under the
+ *      stack's explicit GCP provider (wizards/gcp-pulumi.ts). State only: the
+ *      cloud resources are not touched.
+ *   4. A second preview: what the review shows and `up` applies. An adopted
+ *      resource that is still planned as a create stops the run.
+ *
+ * Why only service accounts ({@link ADOPTABLE_KINDS}). A kind is adopted
+ * when the stack declares it AND the CLI also creates it through gcloud, and
+ * its name is unique in the project. Checked per kind against both stacks:
+ *
+ *   - Secret Manager secrets: the stack declares only `postgres-password` and
+ *     `secret-kek`, which the CLI never creates; the secrets the CLI makes
+ *     (stack-contract.ts CLI_GENERATED_SECRETS) the stack only references by
+ *     id. Adopting a secret without its value resource would also make `up`
+ *     add a version with a freshly generated value — a new KEK.
+ *   - Buckets, Cloud Run jobs, custom roles: the stack's buckets are made by
+ *     Pulumi alone; the CLI's own (ops, audit results, the upgrader, converge,
+ *     audit and operator-access jobs, their custom roles) are not declared.
+ *   - The admin's Cloud Run domain mapping: owned by `admin-domain enable`
+ *     (admin-domain.ts), the stack's copy stays off; Pulumi, running as the
+ *     provisioner, could not manage it.
+ *   - IAM member resources (`*IamMember`, `IAMMember`): non-authoritative.
+ *     Their create is a read-modify-write that merges the member into the
+ *     policy and succeeds when it is there already, so a planned create of
+ *     one is an adoption already.
+ *   - Cloud SQL users: the CLI's are IAM users named after service accounts,
+ *     the stack's are the built-in `admin_role` / `public_role`.
+ */
+
+import type { GcloudRunner } from "./gcloud-retry.js";
+import type { PlannedStep } from "./preview-plan.js";
+
+/** The cloud identity of a resource a planned create would make. */
+export interface AdoptionTarget {
+  /** How the operator knows it, e.g. the service account's email. */
+  readonly display: string;
+  /** gcloud args that succeed exactly when it exists. */
+  readonly describeArgs: readonly string[];
+  /** The id `pulumi import` takes for the kind. */
+  readonly importId: string;
+}
+
+/** A resource kind the installer adopts when it exists already. */
+export interface AdoptableKind {
+  /** What it is, for messages (`service account`). */
+  readonly label: string;
+  /**
+   * The resource a create with these inputs would make, or null when the
+   * inputs don't pin it down (then the create is left to Pulumi).
+   */
+  target(inputs: Readonly<Record<string, unknown>>, projectId: string): AdoptionTarget | null;
+}
+
+/** Kinds adopted before `up`, by Pulumi type token. See the file comment for the rest. */
+export const ADOPTABLE_KINDS: Readonly<Record<string, AdoptableKind>> = {
+  "gcp:serviceaccount/account:Account": {
+    label: "service account",
+    target(inputs, projectId) {
+      // GCP's account-id format; also keeps out the engine's placeholder
+      // for a value only known after apply.
+      const accountId = inputs.accountId;
+      if (typeof accountId !== "string" || !/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(accountId)) {
+        return null;
+      }
+      // Unset means the provider's project, which is the install's
+      // (assertStackProject). Another project is never adopted.
+      const project = inputs.project ?? projectId;
+      if (project !== projectId) return null;
+      const email = `${accountId}@${projectId}.iam.gserviceaccount.com`;
+      return {
+        display: email,
+        describeArgs: [
+          "iam",
+          "service-accounts",
+          "describe",
+          email,
+          `--project=${projectId}`,
+          "--format=value(email)",
+        ],
+        importId: `projects/${projectId}/serviceAccounts/${email}`,
+      };
+    },
+  },
+};
+
+/** A planned create the installer may adopt instead. */
+export interface AdoptionCandidate extends AdoptionTarget {
+  readonly step: PlannedStep;
+  readonly label: string;
+}
+
+/** Thrown when adoption cannot finish; nothing was applied. */
+export class AdoptionError extends Error {
+  override readonly name = "AdoptionError";
+}
+
+/** The planned creates of an adoptable kind, with what each would create. */
+export function adoptionCandidates(
+  steps: readonly PlannedStep[],
+  projectId: string,
+): AdoptionCandidate[] {
+  const out: AdoptionCandidate[] = [];
+  for (const step of steps) {
+    if (step.op !== "create") continue;
+    const kind = ADOPTABLE_KINDS[step.type];
+    if (!kind || !step.inputs) continue;
+    const target = kind.target(step.inputs, projectId);
+    if (target) out.push({ ...target, step, label: kind.label });
+  }
+  return out;
+}
+
+const NOT_FOUND = /NOT_FOUND|not found|does not exist/i;
+
+/**
+ * The candidates that exist in the project.
+ *
+ * @throws AdoptionError when a describe fails for another reason than NOT_FOUND
+ */
+export async function existingCandidates(
+  candidates: readonly AdoptionCandidate[],
+  run: GcloudRunner,
+): Promise<AdoptionCandidate[]> {
+  const existing: AdoptionCandidate[] = [];
+  for (const c of candidates) {
+    const r = await run([...c.describeArgs]);
+    if (r.ok) existing.push(c);
+    else if (!NOT_FOUND.test(r.stderr)) {
+      throw new AdoptionError(
+        `could not tell whether the ${c.label} ${c.display} exists (gcloud: ${r.stderr.trim()}). Nothing was imported or applied. Check that gcloud is signed in as the Owner (gcloud auth login) and re-run the installer.`,
+      );
+    }
+  }
+  return existing;
+}
+
+/** What adoption needs from Pulumi and gcloud; fakes in tests. */
+export interface AdoptionDeps {
+  readonly projectId: string;
+  readonly gcloud: GcloudRunner;
+  /** A fresh preview of the stack. */
+  preview(): Promise<readonly PlannedStep[]>;
+  /** `pulumi import` the candidates into the stack (state only). */
+  importResources(candidates: readonly AdoptionCandidate[]): Promise<void>;
+}
+
+/** The plan to review after adoption, and what was adopted into it. */
+export interface AdoptionResult {
+  readonly adopted: readonly AdoptionCandidate[];
+  readonly steps: readonly PlannedStep[];
+}
+
+/**
+ * The line of a failed Pulumi call that says what went wrong. The
+ * Automation API's error starts with `code: 255` and carries the CLI's
+ * stderr below; its first `error:` line is the reason.
+ */
+export function pulumiErrorReason(e: unknown): string {
+  const lines = (e instanceof Error ? e.message : String(e))
+    .split("\n")
+    .map((l) => l.trim().replace(/^stderr:\s*/, ""))
+    .filter((l) => l !== "");
+  return lines.find((l) => /^error:/i.test(l)) ?? lines[0] ?? "no output";
+}
+
+/**
+ * Adopt the planned creates of `steps` that exist in the project already,
+ * and return the plan after it. With nothing to adopt, `steps` comes back
+ * unchanged and nothing else runs.
+ *
+ * @throws AdoptionError when a probe or the import fails, or a re-plan still
+ *   creates an adopted resource; `up` must not run then
+ */
+export async function adoptExistingResources(
+  steps: readonly PlannedStep[],
+  deps: AdoptionDeps,
+): Promise<AdoptionResult> {
+  const existing = await existingCandidates(adoptionCandidates(steps, deps.projectId), deps.gcloud);
+  if (existing.length === 0) return { adopted: [], steps };
+  const names = existing.map((c) => `${c.label} ${c.display}`).join(", ");
+  try {
+    await deps.importResources(existing);
+  } catch (e) {
+    throw new AdoptionError(
+      `could not adopt ${names} (already in the project) into the stack: pulumi import says "${pulumiErrorReason(e)}". Nothing was applied. Re-run the installer: what was adopted stays adopted. If it fails the same way, report it with this message.`,
+    );
+  }
+  const after = await deps.preview();
+  const stillCreated = after.filter(
+    (s) => s.op === "create" && existing.some((c) => c.step.urn === s.urn),
+  );
+  if (stillCreated.length > 0) {
+    throw new AdoptionError(
+      `imported ${names}, but the next preview still creates ${stillCreated.map((s) => s.name).join(", ")}. Nothing was applied. Report this with the message; re-running the installer does not fix it.`,
+    );
+  }
+  return { adopted: existing, steps: after };
+}
+
+/** The adopted resources as lines for the review, or none. */
+export function formatAdopted(adopted: readonly AdoptionCandidate[]): string[] {
+  if (adopted.length === 0) return [];
+  return [
+    `Adopted (${adopted.length}) — already in the project, now in the stack instead of created again:`,
+    ...adopted.map((c) => `  ${c.label} ${c.display} (${c.step.name})`),
+  ];
+}

package/src/preview-plan.ts

@@ -31,6 +31,13 @@ export interface PlannedStep {
   readonly diffs: readonly string[];
   /** Properties that force the replace (replace steps only). */
   readonly replaceReasons: readonly string[];
+  /**
+   * The inputs the program declares, for create steps only (#1079: they name
+   * the cloud resource a create would make, e.g. a service account's
+   * `accountId`, so adopt-existing.ts can tell whether it exists already).
+   * Secret values arrive masked by the engine. Never written to a plan file.
+   */
+  readonly inputs?: Readonly<Record<string, unknown>>;
 }
 
 /**
@@ -116,6 +123,7 @@ export function collectPreviewSteps(): PreviewCollector {
         urn: m.urn,
         diffs: [...(m.diffs ?? [])],
         replaceReasons: op === "replace" ? [...(m.keys ?? [])] : [],
+        ...(op === "create" && m.new?.inputs ? { inputs: { ...m.new.inputs } } : {}),
       });
     },
     steps: () => [...byUrn.values()],

package/src/state-command.ts

@@ -14,7 +14,8 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { confirm, isCancel, log, note } from "@clack/prompts";
 import { bold, red } from "kleur/colors";
-import { checkGcloudAuth } from "./gcloud.js";
+import { adoptionCandidates, existingCandidates } from "./adopt-existing.js";
+import { checkGcloudAuth, gcloud } from "./gcloud.js";
 import {
   adoptStateBackend,
   currentMetadata,
@@ -260,6 +261,10 @@ export async function stateCommand(argv: readonly string[]): Promise<void> {
         return moved;
       },
       writePlan: (label, steps) => writePlanFile(root, label, steps),
+      existingInProject: async (steps) =>
+        (await existingCandidates(adoptionCandidates(steps, projectId), gcloud)).map(
+          (c) => `${c.label} ${c.display}`,
+        ),
     },
   );
   if (!result.ok) {

package/src/state-migrate.test.ts

@@ -154,6 +154,8 @@ function machine(initial: StateBackendRecord = { kind: "local" }) {
     acceptCost: true,
     bucketRecord: (initial.kind === "gcs" ? "gcs" : null) as "gcs" | "local" | null,
     planFiles: [] as { label: string; steps: number }[],
+    /** What existingInProject answers (#1079); an Error is thrown. */
+    existing: [] as readonly string[] | Error,
   };
   const meta = (): MigrateInstall => ({
     installId: "gcp-firebase-acme",
@@ -209,6 +211,10 @@ function machine(initial: StateBackendRecord = { kind: "local" }) {
       m.planFiles.push({ label, steps: steps.length });
       return `${ROOT}/plan-${label}.txt`;
     },
+    existingInProject: async () => {
+      if (m.existing instanceof Error) throw m.existing;
+      return m.existing;
+    },
   };
   p.stacks.set(localUrl, {
     outputs: {
@@ -380,6 +386,38 @@ describe("migrateState — failures leave the source authoritative", () => {
     expect(t.m.backups).toBe(0);
   });
 
+  it("the refusal names the planned creates the installer adopts (#1079)", async () => {
+    const t = machine();
+    const local = t.p.stacks.get(t.localUrl);
+    if (local) local.drift = 2;
+    t.m.existing = ["service account caelo-production-gateway-sa@acme.iam.gserviceaccount.com"];
+    const r = await migrateState(t.meta(), { to: "remote", dryRun: false }, t.deps);
+    expect(r.ok).toBe(false);
+    if (r.ok) return;
+    expect(r.error).toContain(
+      "1 of the planned creates exist in the project already (service account caelo-production-gateway-sa@acme.iam.gserviceaccount.com): upgrade made them without Pulumi. The installer adopts them into the stack first",
+    );
+    expect(r.error.indexOf("adopts them")).toBeLessThan(r.error.indexOf("Run upgrade first"));
+  });
+
+  it("the refusal says nothing about adopting when nothing exists, and says so when it can't check", async () => {
+    const t = machine();
+    const local = t.p.stacks.get(t.localUrl);
+    if (local) local.drift = 1;
+    const none = await migrateState(t.meta(), { to: "remote", dryRun: false }, t.deps);
+    expect(none.ok).toBe(false);
+    if (none.ok) return;
+    expect(none.error).not.toContain("adopt");
+    t.m.existing = new Error("gcloud: PERMISSION_DENIED");
+    const failed = await migrateState(t.meta(), { to: "remote", dryRun: false }, t.deps);
+    expect(failed.ok).toBe(false);
+    if (failed.ok) return;
+    expect(failed.error).toContain(
+      "(Could not check which planned creates exist in the project already: gcloud: PERMISSION_DENIED. The installer checks again.)",
+    );
+    expect(failed.error).toContain("Run upgrade first");
+  });
+
   it("refuses a stack with pending operations", async () => {
     const t = machine();
     const local = t.p.stacks.get(t.localUrl);

package/src/state-migrate.ts

@@ -117,6 +117,13 @@ export interface MigrateDeps {
    * writePlanFile); returns its path.
    */
   writePlan(label: string, steps: readonly PlannedStep[]): string;
+  /**
+   * #1079 — the planned creates whose resource exists in the project already
+   * (adopt-existing.ts: made by `upgrade` through gcloud), one
+   * `<kind> <name>` each. The installer adopts these into the stack before it
+   * applies anything. Throws when it can't tell.
+   */
+  existingInProject(steps: readonly PlannedStep[]): Promise<readonly string[]>;
 }
 
 export interface MigrateOptions {
@@ -167,6 +174,22 @@ function planReport(deps: MigrateDeps, label: string, steps: readonly PlannedSte
   return [...formatPlan(steps).map((l) => `  ${l}`), where].join("\n");
 }
 
+/**
+ * The refusal's line about planned creates the installer adopts instead
+ * (#1079), or "" when there are none. A failed check is said, not fatal: the
+ * installer checks again before it applies anything.
+ */
+async function adoptionNote(deps: MigrateDeps, steps: readonly PlannedStep[]): Promise<string> {
+  let existing: readonly string[];
+  try {
+    existing = await deps.existingInProject(steps);
+  } catch (e) {
+    return `(Could not check which planned creates exist in the project already: ${errorText(e)}. The installer checks again.)\n`;
+  }
+  if (existing.length === 0) return "";
+  return `${existing.length} of the planned creates exist in the project already (${existing.join(", ")}): upgrade made them without Pulumi. The installer adopts them into the stack first instead of creating them again, then shows what is left.\n`;
+}
+
 /**
  * Run the migration. Never throws for an expected failure: the result says
  * what failed, and at every failure point the source backend is still the
@@ -264,7 +287,7 @@ export async function migrateState(
       pre.failed(`A preview shows ${sourcePlan.length} change(s)`);
       return {
         ok: false,
-        error: `The stack is not converged (a preview shows ${sourcePlan.length} change(s)), so a copy can't be proven identical. Nothing was changed. The planned changes:\n${planReport(deps, "state-migrate", sourcePlan)}\nRun upgrade first, then re-run the installer (${selfCommand()}, pick this install): it shows this list again and asks before it replaces or deletes anything. Migrate once it reports no changes.`,
+        error: `The stack is not converged (a preview shows ${sourcePlan.length} change(s)), so a copy can't be proven identical. Nothing was changed. The planned changes:\n${planReport(deps, "state-migrate", sourcePlan)}\n${await adoptionNote(deps, sourcePlan)}Run upgrade first, then re-run the installer (${selfCommand()}, pick this install): it shows this list again and asks before it replaces or deletes anything. Migrate once it reports no changes.`,
       };
     }
     sourceDigest = await pulumi.outputsDigest(from);

package/src/wizards/gcp-pulumi.ts

@@ -14,8 +14,14 @@
 import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
 import { join, relative, resolve as resolvePath } from "node:path";
 import * as pulumi from "@pulumi/pulumi/automation";
+import {
+  type AdoptionCandidate,
+  AdoptionError,
+  adoptExistingResources,
+} from "../adopt-existing.js";
 import { AUDIT_PARALLELISM_DEFAULT } from "../audit-job-setup.js";
 import { checkpointableOutputs } from "../checkpoint-secrets.js";
+import { gcloud } from "../gcloud.js";
 import { GCP_STACK_ENV } from "../gcp-names.js";
 import { type ImageDigests, stackWorkDir } from "../install-state.js";
 import { collectPreviewSteps, type PlannedStep } from "../preview-plan.js";
@@ -395,6 +401,7 @@ export function resolveSecretReplication(
 
 /** A resource as `pulumi stack export` lists it. */
 export interface StateResource {
+  urn?: string;
   type?: string;
   inputs?: Record<string, unknown>;
   outputs?: Record<string, unknown>;
@@ -534,6 +541,54 @@ export function pulumiGcpEnv(
   };
 }
 
+/**
+ * The URN of the stack's explicit GCP provider (`new gcp.Provider` in both
+ * stacks), which every stack resource uses. An adopted resource is imported
+ * under it (#1079): under Pulumi's default provider instead, the next `up`
+ * would see a provider change on it.
+ *
+ * @throws AdoptionError unless the state holds exactly one
+ */
+export function stackGcpProviderUrn(resources: ReadonlyArray<StateResource>): string {
+  const urns = resources
+    .filter((r) => r.type === "pulumi:providers:gcp" && typeof r.urn === "string")
+    .map((r) => r.urn as string);
+  if (urns.length !== 1) {
+    throw new AdoptionError(
+      `the stack's state holds ${urns.length} GCP providers, so it is unclear which one resources that already exist would be adopted under. Nothing was imported or applied. Report this; the stack needs a look before the installer can run.`,
+    );
+  }
+  return urns[0] as string;
+}
+
+/** The name {@link importIntoStack} gives the stack's provider in the import's name table. */
+const IMPORT_PROVIDER_NAME = "gcpProvider";
+
+/**
+ * `pulumi import` the candidates into the stack under its explicit provider.
+ * State only: nothing in the project changes. Not protected (the program
+ * does not protect them either) and no code generated.
+ */
+async function importIntoStack(
+  stack: pulumi.Stack,
+  providerUrn: string,
+  candidates: readonly AdoptionCandidate[],
+  onOutput: (msg: string) => void,
+): Promise<void> {
+  await stack.import({
+    resources: candidates.map((c) => ({
+      type: c.step.type,
+      name: c.step.name,
+      id: c.importId,
+      provider: IMPORT_PROVIDER_NAME,
+    })),
+    nameTable: { [IMPORT_PROVIDER_NAME]: providerUrn },
+    protect: false,
+    generateCode: false,
+    onOutput,
+  });
+}
+
 /** Thrown when the review (preview-plan.ts planGate) stops `pulumi up` after the preview. */
 export class PulumiUpDeclinedError extends Error {
   override readonly name = "PulumiUpDeclinedError";
@@ -544,16 +599,23 @@ export class PulumiUpDeclinedError extends Error {
  * Streams resource-create events to the supplied onEvent callback so
  * the wizard can render a live progress bar.
  *
- * On a stack that already holds resources, a preview runs first (#737) and
- * `review` sees its planned steps: it lists them and decides (planGate)
- * whether `up` may apply them. Nothing is applied when it says no.
+ * On a stack that already holds resources, a preview runs first (#737).
+ * Planned creates of resources that exist in the project already (made by
+ * `upgrade` through gcloud) are adopted into the stack and the stack is
+ * previewed again (adopt-existing.ts, #1079). `review` sees that plan and
+ * what was adopted: it lists them and decides (planGate) whether `up` may
+ * apply the plan. Nothing is applied when it says no.
  *
  * @throws PulumiUpDeclinedError when `review` declines the plan
+ * @throws AdoptionError when adopting fails; nothing was applied
  */
 export async function pulumiUpGcp(
   inputs: PulumiUpInputs,
   onEvent: (kind: "resource" | "error" | "log", message: string) => void,
-  review: (steps: readonly PlannedStep[]) => Promise<boolean>,
+  review: (
+    steps: readonly PlannedStep[],
+    adopted: readonly AdoptionCandidate[],
+  ) => Promise<boolean>,
 ): Promise<PulumiUpResult> {
   const env = pulumiGcpEnv(process.env, inputs);
 
@@ -608,11 +670,25 @@ export async function pulumiUpGcp(
 
   // #737 — never `up` a deployed stack blind: list what it would change
   // (replaces and deletes first) and let the review stop it. A first run
-  // on an empty stack only creates, so it skips the extra preview.
+  // on an empty stack only creates, so it skips the extra preview (and has
+  // no provider in its state to adopt anything under).
   if (stateResources.length > 0) {
-    const collector = collectPreviewSteps();
-    await stack.preview({ onEvent: collector.onEvent });
-    if (!(await review(collector.steps()))) {
+    const preview = async () => {
+      const collector = collectPreviewSteps();
+      await stack.preview({ onEvent: collector.onEvent });
+      return collector.steps();
+    };
+    // #1079 — what `upgrade` created through gcloud joins the state first.
+    const { steps, adopted } = await adoptExistingResources(await preview(), {
+      projectId: inputs.projectId,
+      gcloud,
+      preview,
+      importResources: (candidates) =>
+        importIntoStack(stack, stackGcpProviderUrn(stateResources), candidates, (msg) =>
+          onEvent("log", msg),
+        ),
+    });
+    if (!(await review(steps, adopted))) {
       throw new PulumiUpDeclinedError("pulumi up was not run: the planned changes were declined.");
     }
   }

package/src/wizards/gcp.ts

@@ -33,6 +33,7 @@ import { join } from "node:path";
 import { cancel, confirm, isCancel, log, note, select, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { checkAdcImpersonation } from "../adc-impersonation.js";
+import { type AdoptionCandidate, AdoptionError, formatAdopted } from "../adopt-existing.js";
 import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
 import { CERT_WAIT_TIMEOUT_MS, lbCertProbe, waitForCert } from "../cert-wait.js";
 import { redactCredentials } from "../checkpoint-secrets.js";
@@ -1486,16 +1487,21 @@ interface PulumiUpOpts {
  * The installer's review of a deployed stack's plan before `pulumi up`
  * (#737): the grouped list, the full diff in the install dir, and a y/N
  * for any replace or delete. A data-bearing one is asked about by name and
- * defaults to No; without a terminal it is refused (planGate).
+ * defaults to No; without a terminal it is refused (planGate). Resources
+ * adopted into the stack before this preview (adopt-existing.ts, #1079) are
+ * listed first; they are no longer in the plan.
  *
  * @returns whether `pulumi up` may apply the plan
  */
 async function reviewPulumiPlan(
   installId: string,
   steps: readonly PlannedStep[],
+  adopted: readonly AdoptionCandidate[],
   nonInteractive: boolean,
 ): Promise<boolean> {
   const gate = planGate(steps, { interactive: !nonInteractive && process.stdin.isTTY === true });
+  const adoptedLines = formatAdopted(adopted);
+  if (adoptedLines.length > 0) log.info(adoptedLines.join("\n"));
   if (steps.length === 0) {
     log.info(dim("Preview: no changes planned."));
     return true;
@@ -1601,11 +1607,12 @@ async function stepPulumiUp(installId: string, opts: PulumiUpOpts): Promise<void
         // logs: silent — too noisy for a live progress UI; pulumi
         // diagnostics will print on failure via the SDK's onOutput.
       },
-      (steps) => reviewPulumiPlan(installId, steps, opts.nonInteractive),
+      (steps, adopted) => reviewPulumiPlan(installId, steps, adopted, opts.nonInteractive),
     );
   } catch (e) {
-    if (!(e instanceof PulumiUpDeclinedError)) throw e;
-    declined = e.message;
+    if (e instanceof AdoptionError) declined = `pulumi up was not run: ${e.message}`;
+    else if (e instanceof PulumiUpDeclinedError) declined = e.message;
+    else throw e;
   } finally {
     releaseLock();
   }