@caelo-cms/provisioning 0.10.69 → 0.10.71

package/dist/adopt-existing.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Adopt cloud resources the stack declares but its Pulumi state lacks
+ * (#1079), before the installer's `pulumi up`.
+ *
+ * `cms-provision upgrade` converges an install through gcloud and never runs
+ * Pulumi (stack-converge.ts), so it creates some resources the stack also
+ * declares — the gateway's service account (runtime-secrets.ts), the MCP
+ * service account (mcp-iap.ts) — without them entering the state. The next
+ * installer run then plans to CREATE them, and `state migrate` refuses an
+ * install whose preview plans anything. So, after the preview and before
+ * the review:
+ *
+ *   1. {@link adoptionCandidates}: the planned creates of a kind in
+ *      {@link ADOPTABLE_KINDS} whose inputs name the cloud resource. Only
+ *      planned steps are looked at, so nothing the stack does not declare is
+ *      ever adopted; every other kind is left to Pulumi.
+ *   2. {@link existingCandidates}: a gcloud describe per candidate. Exists →
+ *      adopt; NOT_FOUND → a plain create; anything else stops the run (we
+ *      can't tell, and guessing either way is wrong).
+ *   3. `pulumi import` of the existing ones into the stack, under the
+ *      stack's explicit GCP provider (wizards/gcp-pulumi.ts). State only: the
+ *      cloud resources are not touched.
+ *   4. A second preview: what the review shows and `up` applies. An adopted
+ *      resource that is still planned as a create stops the run.
+ *
+ * Why only service accounts ({@link ADOPTABLE_KINDS}). A kind is adopted
+ * when the stack declares it AND the CLI also creates it through gcloud, and
+ * its name is unique in the project. Checked per kind against both stacks:
+ *
+ *   - Secret Manager secrets: the stack declares only `postgres-password` and
+ *     `secret-kek`, which the CLI never creates; the secrets the CLI makes
+ *     (stack-contract.ts CLI_GENERATED_SECRETS) the stack only references by
+ *     id. Adopting a secret without its value resource would also make `up`
+ *     add a version with a freshly generated value — a new KEK.
+ *   - Buckets, Cloud Run jobs, custom roles: the stack's buckets are made by
+ *     Pulumi alone; the CLI's own (ops, audit results, the upgrader, converge,
+ *     audit and operator-access jobs, their custom roles) are not declared.
+ *   - The admin's Cloud Run domain mapping: owned by `admin-domain enable`
+ *     (admin-domain.ts), the stack's copy stays off; Pulumi, running as the
+ *     provisioner, could not manage it.
+ *   - IAM member resources (`*IamMember`, `IAMMember`): non-authoritative.
+ *     Their create is a read-modify-write that merges the member into the
+ *     policy and succeeds when it is there already, so a planned create of
+ *     one is an adoption already.
+ *   - Cloud SQL users: the CLI's are IAM users named after service accounts,
+ *     the stack's are the built-in `admin_role` / `public_role`.
+ */
+import type { GcloudRunner } from "./gcloud-retry.js";
+import type { PlannedStep } from "./preview-plan.js";
+/** The cloud identity of a resource a planned create would make. */
+export interface AdoptionTarget {
+    /** How the operator knows it, e.g. the service account's email. */
+    readonly display: string;
+    /** gcloud args that succeed exactly when it exists. */
+    readonly describeArgs: readonly string[];
+    /** The id `pulumi import` takes for the kind. */
+    readonly importId: string;
+}
+/** A resource kind the installer adopts when it exists already. */
+export interface AdoptableKind {
+    /** What it is, for messages (`service account`). */
+    readonly label: string;
+    /**
+     * The resource a create with these inputs would make, or null when the
+     * inputs don't pin it down (then the create is left to Pulumi).
+     */
+    target(inputs: Readonly<Record<string, unknown>>, projectId: string): AdoptionTarget | null;
+}
+/** Kinds adopted before `up`, by Pulumi type token. See the file comment for the rest. */
+export declare const ADOPTABLE_KINDS: Readonly<Record<string, AdoptableKind>>;
+/** A planned create the installer may adopt instead. */
+export interface AdoptionCandidate extends AdoptionTarget {
+    readonly step: PlannedStep;
+    readonly label: string;
+}
+/** Thrown when adoption cannot finish; nothing was applied. */
+export declare class AdoptionError extends Error {
+    readonly name = "AdoptionError";
+}
+/** The planned creates of an adoptable kind, with what each would create. */
+export declare function adoptionCandidates(steps: readonly PlannedStep[], projectId: string): AdoptionCandidate[];
+/**
+ * The candidates that exist in the project.
+ *
+ * @throws AdoptionError when a describe fails for another reason than NOT_FOUND
+ */
+export declare function existingCandidates(candidates: readonly AdoptionCandidate[], run: GcloudRunner): Promise<AdoptionCandidate[]>;
+/** What adoption needs from Pulumi and gcloud; fakes in tests. */
+export interface AdoptionDeps {
+    readonly projectId: string;
+    readonly gcloud: GcloudRunner;
+    /** A fresh preview of the stack. */
+    preview(): Promise<readonly PlannedStep[]>;
+    /** `pulumi import` the candidates into the stack (state only). */
+    importResources(candidates: readonly AdoptionCandidate[]): Promise<void>;
+}
+/** The plan to review after adoption, and what was adopted into it. */
+export interface AdoptionResult {
+    readonly adopted: readonly AdoptionCandidate[];
+    readonly steps: readonly PlannedStep[];
+}
+/**
+ * The line of a failed Pulumi call that says what went wrong. The
+ * Automation API's error starts with `code: 255` and carries the CLI's
+ * stderr below; its first `error:` line is the reason.
+ */
+export declare function pulumiErrorReason(e: unknown): string;
+/**
+ * Adopt the planned creates of `steps` that exist in the project already,
+ * and return the plan after it. With nothing to adopt, `steps` comes back
+ * unchanged and nothing else runs.
+ *
+ * @throws AdoptionError when a probe or the import fails, or a re-plan still
+ *   creates an adopted resource; `up` must not run then
+ */
+export declare function adoptExistingResources(steps: readonly PlannedStep[], deps: AdoptionDeps): Promise<AdoptionResult>;
+/** The adopted resources as lines for the review, or none. */
+export declare function formatAdopted(adopted: readonly AdoptionCandidate[]): string[];
+//# sourceMappingURL=adopt-existing.d.ts.map

package/dist/adopt-existing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt-existing.d.ts","sourceRoot":"","sources":["../src/adopt-existing.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAAC;CAC7F;AAED,0FAA0F;AAC1F,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CA6BnE,CAAC;AAEF,wDAAwD;AACxD,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,+DAA+D;AAC/D,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAkB,IAAI,mBAAmB;CAC1C;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,SAAS,EAAE,MAAM,GAChB,iBAAiB,EAAE,CAUrB;AAID;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,SAAS,iBAAiB,EAAE,EACxC,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAY9B;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,oCAAoC;IACpC,OAAO,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAC3C,kEAAkE;IAClE,eAAe,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAMpD;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CAqBzB;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,EAAE,CAM7E"}

package/dist/adopt-existing.js

@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: MPL-2.0
+/** Kinds adopted before `up`, by Pulumi type token. See the file comment for the rest. */
+export const ADOPTABLE_KINDS = {
+    "gcp:serviceaccount/account:Account": {
+        label: "service account",
+        target(inputs, projectId) {
+            // GCP's account-id format; also keeps out the engine's placeholder
+            // for a value only known after apply.
+            const accountId = inputs.accountId;
+            if (typeof accountId !== "string" || !/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(accountId)) {
+                return null;
+            }
+            // Unset means the provider's project, which is the install's
+            // (assertStackProject). Another project is never adopted.
+            const project = inputs.project ?? projectId;
+            if (project !== projectId)
+                return null;
+            const email = `${accountId}@${projectId}.iam.gserviceaccount.com`;
+            return {
+                display: email,
+                describeArgs: [
+                    "iam",
+                    "service-accounts",
+                    "describe",
+                    email,
+                    `--project=${projectId}`,
+                    "--format=value(email)",
+                ],
+                importId: `projects/${projectId}/serviceAccounts/${email}`,
+            };
+        },
+    },
+};
+/** Thrown when adoption cannot finish; nothing was applied. */
+export class AdoptionError extends Error {
+    name = "AdoptionError";
+}
+/** The planned creates of an adoptable kind, with what each would create. */
+export function adoptionCandidates(steps, projectId) {
+    const out = [];
+    for (const step of steps) {
+        if (step.op !== "create")
+            continue;
+        const kind = ADOPTABLE_KINDS[step.type];
+        if (!kind || !step.inputs)
+            continue;
+        const target = kind.target(step.inputs, projectId);
+        if (target)
+            out.push({ ...target, step, label: kind.label });
+    }
+    return out;
+}
+const NOT_FOUND = /NOT_FOUND|not found|does not exist/i;
+/**
+ * The candidates that exist in the project.
+ *
+ * @throws AdoptionError when a describe fails for another reason than NOT_FOUND
+ */
+export async function existingCandidates(candidates, run) {
+    const existing = [];
+    for (const c of candidates) {
+        const r = await run([...c.describeArgs]);
+        if (r.ok)
+            existing.push(c);
+        else if (!NOT_FOUND.test(r.stderr)) {
+            throw new AdoptionError(`could not tell whether the ${c.label} ${c.display} exists (gcloud: ${r.stderr.trim()}). Nothing was imported or applied. Check that gcloud is signed in as the Owner (gcloud auth login) and re-run the installer.`);
+        }
+    }
+    return existing;
+}
+/**
+ * The line of a failed Pulumi call that says what went wrong. The
+ * Automation API's error starts with `code: 255` and carries the CLI's
+ * stderr below; its first `error:` line is the reason.
+ */
+export function pulumiErrorReason(e) {
+    const lines = (e instanceof Error ? e.message : String(e))
+        .split("\n")
+        .map((l) => l.trim().replace(/^stderr:\s*/, ""))
+        .filter((l) => l !== "");
+    return lines.find((l) => /^error:/i.test(l)) ?? lines[0] ?? "no output";
+}
+/**
+ * Adopt the planned creates of `steps` that exist in the project already,
+ * and return the plan after it. With nothing to adopt, `steps` comes back
+ * unchanged and nothing else runs.
+ *
+ * @throws AdoptionError when a probe or the import fails, or a re-plan still
+ *   creates an adopted resource; `up` must not run then
+ */
+export async function adoptExistingResources(steps, deps) {
+    const existing = await existingCandidates(adoptionCandidates(steps, deps.projectId), deps.gcloud);
+    if (existing.length === 0)
+        return { adopted: [], steps };
+    const names = existing.map((c) => `${c.label} ${c.display}`).join(", ");
+    try {
+        await deps.importResources(existing);
+    }
+    catch (e) {
+        throw new AdoptionError(`could not adopt ${names} (already in the project) into the stack: pulumi import says "${pulumiErrorReason(e)}". Nothing was applied. Re-run the installer: what was adopted stays adopted. If it fails the same way, report it with this message.`);
+    }
+    const after = await deps.preview();
+    const stillCreated = after.filter((s) => s.op === "create" && existing.some((c) => c.step.urn === s.urn));
+    if (stillCreated.length > 0) {
+        throw new AdoptionError(`imported ${names}, but the next preview still creates ${stillCreated.map((s) => s.name).join(", ")}. Nothing was applied. Report this with the message; re-running the installer does not fix it.`);
+    }
+    return { adopted: existing, steps: after };
+}
+/** The adopted resources as lines for the review, or none. */
+export function formatAdopted(adopted) {
+    if (adopted.length === 0)
+        return [];
+    return [
+        `Adopted (${adopted.length}) — already in the project, now in the stack instead of created again:`,
+        ...adopted.map((c) => `  ${c.label} ${c.display} (${c.step.name})`),
+    ];
+}
+//# sourceMappingURL=adopt-existing.js.map

package/dist/adopt-existing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt-existing.js","sourceRoot":"","sources":["../src/adopt-existing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA0EnC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,eAAe,GAA4C;IACtE,oCAAoC,EAAE;QACpC,KAAK,EAAE,iBAAiB;QACxB,MAAM,CAAC,MAAM,EAAE,SAAS;YACtB,mEAAmE;YACnE,sCAAsC;YACtC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,6DAA6D;YAC7D,0DAA0D;YAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;YAC5C,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACvC,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,SAAS,0BAA0B,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EAAE;oBACZ,KAAK;oBACL,kBAAkB;oBAClB,UAAU;oBACV,KAAK;oBACL,aAAa,SAAS,EAAE;oBACxB,uBAAuB;iBACxB;gBACD,QAAQ,EAAE,YAAY,SAAS,oBAAoB,KAAK,EAAE;aAC3D,CAAC;QACJ,CAAC;KACF;CACF,CAAC;AAQF,+DAA+D;AAC/D,MAAM,OAAO,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;CAC1C;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAChC,KAA6B,EAC7B,SAAiB;IAEjB,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,SAAS,GAAG,qCAAqC,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAwC,EACxC,GAAiB;IAEjB,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACtB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,aAAa,CACrB,8BAA8B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,+HAA+H,CACrN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAU;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACvD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA6B,EAC7B,IAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CACrB,mBAAmB,KAAK,iEAAiE,iBAAiB,CAAC,CAAC,CAAC,sIAAsI,CACpP,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACnC,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CACvE,CAAC;IACF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CACrB,YAAY,KAAK,wCAAwC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gGAAgG,CACpM,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,OAAqC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO;QACL,YAAY,OAAO,CAAC,MAAM,wEAAwE;QAClG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;KACpE,CAAC;AACJ,CAAC"}

package/dist/preview-plan.d.ts

@@ -13,6 +13,13 @@ export interface PlannedStep {
     readonly diffs: readonly string[];
     /** Properties that force the replace (replace steps only). */
     readonly replaceReasons: readonly string[];
+    /**
+     * The inputs the program declares, for create steps only (#1079: they name
+     * the cloud resource a create would make, e.g. a service account's
+     * `accountId`, so adopt-existing.ts can tell whether it exists already).
+     * Secret values arrive masked by the engine. Never written to a plan file.
+     */
+    readonly inputs?: Readonly<Record<string, unknown>>;
 }
 /** What a data-bearing resource holds, or null for any other type. */
 export declare function dataBearingKind(type: string): string | null;

package/dist/preview-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview-plan.d.ts","sourceRoot":"","sources":["../src/preview-plan.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,WAAW,EAAU,MAAM,2BAA2B,CAAC;AAErE,kFAAkF;AAClF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9E,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAkCD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAEpD;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAEzE;AAOD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IAC/C,KAAK,IAAI,WAAW,EAAE,CAAC;CACxB;AAED,wCAAwC;AACxC,wBAAgB,mBAAmB,IAAI,gBAAgB,CAwBtD;AAuBD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,EAAE,CAgBlE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,GAAG,GAAE,IAAiB,GACrB,MAAM,CAqBR;AAED,qEAAqE;AACrE,MAAM,MAAM,QAAQ;AAClB,6CAA6C;AAC3C;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,8EAA8E;GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE;AAC3D,yEAAyE;GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEhC;;;;;GAKG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,IAAI,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GACtC,QAAQ,CAKV"}
+{"version":3,"file":"preview-plan.d.ts","sourceRoot":"","sources":["../src/preview-plan.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,WAAW,EAAU,MAAM,2BAA2B,CAAC;AAErE,kFAAkF;AAClF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE9E,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAkCD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE3D;AAED,yFAAyF;AACzF,wBAAgB,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAEpD;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAEzE;AAOD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;IAC/C,KAAK,IAAI,WAAW,EAAE,CAAC;CACxB;AAED,wCAAwC;AACxC,wBAAgB,mBAAmB,IAAI,gBAAgB,CAyBtD;AAuBD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,EAAE,CAgBlE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,GAAG,GAAE,IAAiB,GACrB,MAAM,CAqBR;AAED,qEAAqE;AACrE,MAAM,MAAM,QAAQ;AAClB,6CAA6C;AAC3C;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AAC9B,8EAA8E;GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAAE;AAC3D,yEAAyE;GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEhC;;;;;GAKG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,IAAI,EAAE;IAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GACtC,QAAQ,CAKV"}

package/dist/preview-plan.js

@@ -81,6 +81,7 @@ export function collectPreviewSteps() {
                 urn: m.urn,
                 diffs: [...(m.diffs ?? [])],
                 replaceReasons: op === "replace" ? [...(m.keys ?? [])] : [],
+                ...(op === "create" && m.new?.inputs ? { inputs: { ...m.new.inputs } } : {}),
             });
         },
         steps: () => [...byUrn.values()],

package/dist/preview-plan.js.map

@@ -1 +1 @@
-{"version":3,"file":"preview-plan.js","sourceRoot":"","sources":["../src/preview-plan.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAoBjC;;;;GAIG;AACH,MAAM,OAAO,GAAiD;IAC5D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,oBAAoB,EAAE,SAAS;CAChC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAqC;IACrD,2CAA2C,EAAE,oCAAoC;IACjF,2BAA2B,EAAE,oBAAoB;IACjD,2BAA2B,EAAE,uDAAuD;IACpF,iCAAiC,EAAE,uBAAuB;IAC1D,+CAA+C,EAAE,6BAA6B;IAC9E,8BAA8B,EAAE,kBAAkB;IAClD,sCAAsC,EAAE,uBAAuB;IAC/D,yBAAyB,EAAE,oBAAoB;IAC/C,6BAA6B,EAAE,8CAA8C;IAC7E,8BAA8B,EAAE,8BAA8B;CAC/D,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAChG,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAAC,KAA6B;IAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AACvC,CAAC;AAYD,wCAAwC;AACxC,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC;YAC3C,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,8EAA8E;YAC9E,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,EAAE,EAAE,KAAK,SAAS;gBAAE,OAAO;YACpC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACf,EAAE;gBACF,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC3B,cAAc,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAkE;IAC5E,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;IAClC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,4BAA4B,EAAE;IACtD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC3C,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;IAClC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;CACnC,CAAC;AAEF,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,IAAiB;IACjC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GACP,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAC,sBAAsB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;QACjE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ;YAC7C,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC/B,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAA6B;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,IAAI,CAAC,MAAM,iCAAiC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,KAAa,EACb,KAA6B,EAC7B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG;QACX,mBAAmB,KAAK,MAAM,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,YAAY;QAC5E,EAAE;QACF,GAAG,UAAU,CAAC,KAAK,CAAC;QACpB,EAAE;QACF,aAAa;QACb,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB;YACE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE;YACpB,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;QACD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,KAA6B,EAC7B,IAAuC;IAEvC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"preview-plan.js","sourceRoot":"","sources":["../src/preview-plan.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA2BjC;;;;GAIG;AACH,MAAM,OAAO,GAAiD;IAC5D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,oBAAoB,EAAE,SAAS;CAChC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAqC;IACrD,2CAA2C,EAAE,oCAAoC;IACjF,2BAA2B,EAAE,oBAAoB;IACjD,2BAA2B,EAAE,uDAAuD;IACpF,iCAAiC,EAAE,uBAAuB;IAC1D,+CAA+C,EAAE,6BAA6B;IAC9E,8BAA8B,EAAE,kBAAkB;IAClD,sCAAsC,EAAE,uBAAuB;IAC/D,yBAAyB,EAAE,oBAAoB;IAC/C,6BAA6B,EAAE,8CAA8C;IAC7E,8BAA8B,EAAE,8BAA8B;CAC/D,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAChG,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAAC,KAA6B;IAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AACvC,CAAC;AAYD,wCAAwC;AACxC,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC;YAC3C,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,8EAA8E;YAC9E,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,EAAE,EAAE,KAAK,SAAS;gBAAE,OAAO;YACpC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACf,EAAE;gBACF,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC3B,cAAc,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC3D,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAkE;IAC5E,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;IAClC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,4BAA4B,EAAE;IACtD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC3C,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;IAClC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;CACnC,CAAC;AAEF,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,IAAiB;IACjC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GACP,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAC,sBAAsB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;QACjE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ;YAC7C,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC/B,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAA6B;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,IAAI,CAAC,MAAM,iCAAiC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,KAAa,EACb,KAA6B,EAC7B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG;QACX,mBAAmB,KAAK,MAAM,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,YAAY;QAC5E,EAAE;QACF,GAAG,UAAU,CAAC,KAAK,CAAC;QACpB,EAAE;QACF,aAAa;QACb,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB;YACE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE;YACpB,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;QACD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,KAA6B,EAC7B,IAAuC;IAEvC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC"}

package/dist/remote-mcp.d.ts

@@ -51,23 +51,42 @@ export declare function resolveRemoteMcpIdentity(target: RemoteMcpTarget, deps?:
     readonly orgDomainError?: string;
 }>>;
 /**
- * Bring both services' {@link RemoteMcpIdentity} env vars to `identity`
- * with one `gcloud run services update` per service that differs (a new
- * revision only then). Vars already right are left alone.
+ * #1082 — the deployed install remote MCP is resolved on: the Pulumi-suffixed
+ * admin and gateway Cloud Run services found by prefix. Read-only.
  */
-export declare function applyRemoteMcpIdentityEnv(target: RemoteMcpTarget, identity: RemoteMcpIdentity, deps?: {
+export declare function findRemoteMcpTarget(base: Omit<RemoteMcpTarget, "services">, deps?: {
     run?: GcloudRunner;
 }): Promise<RemoteMcpResult<{
-    readonly changes: Record<CloudRunSlug, EnvChange[]>;
+    readonly target: RemoteMcpTarget;
 }>>;
-/** {@link resolveRemoteMcpIdentity} then {@link applyRemoteMcpIdentityEnv}. */
-export declare function ensureRemoteMcpIdentityEnv(target: RemoteMcpTarget, deps?: {
+/**
+ * #1082 — the identity the installer writes into the stack config before
+ * `up` (stack-contract.ts REMOTE_MCP_IDENTITY_CONFIG), so the stack declares
+ * the vars the services carry and `up` keeps them.
+ *
+ * {@link resolveRemoteMcpIdentity}, except for the organisation domain when
+ * it cannot be read: then the admin's live `CAELO_GOOGLE_ORG_DOMAIN` is
+ * carried over (an earlier run as an account with the Organization Viewer
+ * role set it). The stack would otherwise remove it, where a gcloud roll
+ * leaves it as it is. `orgDomainError` still says why it was not read.
+ */
+export declare function resolveStackRemoteMcpIdentity(target: RemoteMcpTarget, deps?: {
     run?: GcloudRunner;
 }): Promise<RemoteMcpResult<{
     readonly identity: RemoteMcpIdentity;
-    readonly changes: Record<CloudRunSlug, EnvChange[]>;
     readonly orgDomainError?: string;
 }>>;
+/**
+ * #1082 — what each service's identity env lacks against `identity`
+ * (read-only). The stack owns these vars now; this is the installer's check
+ * that the `up` it just ran put them in place. An empty list per service is
+ * the expected answer.
+ */
+export declare function checkRemoteMcpIdentityEnv(target: RemoteMcpTarget, identity: RemoteMcpIdentity, deps?: {
+    run?: GcloudRunner;
+}): Promise<RemoteMcpResult<{
+    readonly drift: Record<CloudRunSlug, EnvChange[]>;
+}>>;
 /** A path rule / matcher / URL map as the Compute API returns them (the parts used here). */
 interface UrlMapPathRule {
     readonly paths: string[];

package/dist/remote-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../src/remote-mcp.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,SAAS,EAAmC,MAAM,qBAAqB,CAAC;AAEtF,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,CAAC,CAAC,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBnD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAmBvD;AAED,4GAA4G;AAC5G,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAC5F,CAOA;AAoFD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC,CAoCnF;AAED,+EAA+E;AAC/E,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IACd,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;IACpD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,CAAC,CACH,CAWA;AAMD,6FAA6F;AAC7F,UAAU,cAAc;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AACD,UAAU,iBAAiB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;CACvC;AACD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5C,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC9F;AAKD;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,QAAQ,CAAC,EACrD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAuDxD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,KAAK,CAAC,EAClD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC,CACjG,CAqDA;AAED,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC,EAC1E,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAcvD"}
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../src/remote-mcp.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,WAAW,EAEhB,KAAK,iBAAiB,EAGvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,SAAS,EAAmC,MAAM,qBAAqB,CAAC;AAGtF,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,CAAC,CAAC,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAsBnD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAmBvD;AAED,4GAA4G;AAC5G,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAC5F,CAOA;AA0GD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EACvC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC,CAwBhE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,eAAe,EACvB,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAC5F,CAeA;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC,CAYjF;AAMD,6FAA6F;AAC7F,UAAU,cAAc;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AACD,UAAU,iBAAiB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;CACvC;AACD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAClF,QAAQ,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAC5C,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAuC9F;AAKD;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,QAAQ,CAAC,EACrD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAuDxD;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,KAAK,CAAC,EAClD,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAA;CAAO,GAChC,OAAO,CACR,eAAe,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC,CACjG,CAqDA;AAED,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC,EAC1E,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACzF,OAAO,CAAC,eAAe,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC,CAcvD"}

package/dist/remote-mcp.js

@@ -2,13 +2,15 @@
 /**
  * #806 — the CLI's part of remote MCP on a Google IAP install (`gcp`,
  * `gcp-firebase`), run as the operator's (or the provisioner's) gcloud
- * identity by the wizard after `pulumi up` and by `cms-provision upgrade`
- * after the roll. Every step is idempotent.
+ * identity by the wizard around `pulumi up`, by `state migrate`'s preview
+ * and by `cms-provision upgrade` around the roll. Every step is idempotent.
  *
- *   - {@link ensureRemoteMcpIdentityEnv}: the env vars that name generated
- *     identities ({@link RemoteMcpIdentity} — why the stacks cannot declare
- *     them is in stack-contract.ts), applied with `gcloud run services
- *     update` only where they differ.
+ *   - {@link resolveStackRemoteMcpIdentity}: the env vars that name
+ *     generated identities ({@link RemoteMcpIdentity}), resolved from the
+ *     live install for the stack config the installer writes before `up`
+ *     (#1082: the stack is their one owner — stack-contract.ts says why
+ *     they cannot be plain resource inputs), and
+ *     {@link checkRemoteMcpIdentityEnv}, the read-only check after it.
  *   - {@link ensureRemoteMcpEdge} (`gcp` only): the load balancer's part for
  *     installs whose URL map / Cloud Armor policy predate it — the
  *     `/.well-known/oauth-*` path rules (the stack ignores `pathRules` after
@@ -31,8 +33,9 @@ import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { gcpNamePrefix } from "./gcp-names.js";
 import { isMcpArmorRule, MCP_ARMOR_RULE, mcpArmorRuleFlags, } from "./remote-mcp-edge.js";
-import { remoteMcpIdentity, remoteMcpIdentityEnv, } from "./stack-contract.js";
+import { REMOTE_MCP_ENV, remoteMcpIdentity, remoteMcpIdentityEnv, } from "./stack-contract.js";
 import { liveContainerEnv, planEnvUpdate } from "./stack-converge.js";
+import { lookupFailure, resolveGcpResourceName } from "./upgrade/gcp-lookup.js";
 /** Parse gcloud JSON output; null (never a throw) when it is not JSON. */
 function parseJson(stdout) {
     try {
@@ -181,67 +184,96 @@ async function resolveServiceIdentity(target, deps = {}) {
         }),
     };
 }
+/** `gcloud run services describe --format=json` of one service, or why it failed. */
+async function describeService(target, service, run) {
+    const describe = await run([
+        "run",
+        "services",
+        "describe",
+        service,
+        `--region=${target.region}`,
+        `--project=${target.projectId}`,
+        "--format=json",
+    ]);
+    if (!describe.ok)
+        return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
+    if (parseJson(describe.stdout) === null) {
+        return { ok: false, error: `describe ${service}: output is not JSON` };
+    }
+    return { ok: true, json: describe.stdout };
+}
 /**
- * Bring both services' {@link RemoteMcpIdentity} env vars to `identity`
- * with one `gcloud run services update` per service that differs (a new
- * revision only then). Vars already right are left alone.
+ * #1082 — the deployed install remote MCP is resolved on: the Pulumi-suffixed
+ * admin and gateway Cloud Run services found by prefix. Read-only.
  */
-export async function applyRemoteMcpIdentityEnv(target, identity, deps = {}) {
+export async function findRemoteMcpTarget(base, deps = {}) {
     const run = deps.run ?? defaultGcloud;
-    const desired = remoteMcpIdentityEnv(identity);
-    const changes = { admin: [], gateway: [] };
+    const services = {};
     for (const slug of ["admin", "gateway"]) {
-        const service = target.services[slug];
-        const describe = await run([
-            "run",
-            "services",
-            "describe",
-            service,
-            `--region=${target.region}`,
-            `--project=${target.projectId}`,
-            "--format=json",
-        ]);
-        if (!describe.ok)
-            return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
-        if (parseJson(describe.stdout) === null) {
-            return { ok: false, error: `describe ${service}: output is not JSON` };
+        const prefix = `${gcpNamePrefix(base.env)}-${slug}`;
+        const lookup = await resolveGcpResourceName(run, "run-service", prefix, base.projectId, base.region);
+        if (lookup.status !== "found") {
+            return {
+                ok: false,
+                error: lookupFailure(lookup, `${prefix}* Cloud Run service`, "operator"),
+            };
         }
-        const plan = planEnvUpdate(liveContainerEnv(describe.stdout), desired[slug]);
-        if (!plan.ok)
-            return { ok: false, error: `${slug}: ${plan.error}` };
-        if (plan.flags.length === 0)
-            continue;
-        const update = await run([
-            "run",
-            "services",
-            "update",
-            service,
-            `--region=${target.region}`,
-            `--project=${target.projectId}`,
-            ...plan.flags,
-            "--quiet",
-        ]);
-        if (!update.ok)
-            return { ok: false, error: `update ${service}: ${update.stderr.trim()}` };
-        changes[slug] = plan.changes;
+        services[slug] = lookup.name;
     }
-    return { ok: true, changes };
+    return {
+        ok: true,
+        target: { ...base, services: services },
+    };
 }
-/** {@link resolveRemoteMcpIdentity} then {@link applyRemoteMcpIdentityEnv}. */
-export async function ensureRemoteMcpIdentityEnv(target, deps = {}) {
-    const resolved = await resolveRemoteMcpIdentity(target, deps);
-    if (!resolved.ok)
+/**
+ * #1082 — the identity the installer writes into the stack config before
+ * `up` (stack-contract.ts REMOTE_MCP_IDENTITY_CONFIG), so the stack declares
+ * the vars the services carry and `up` keeps them.
+ *
+ * {@link resolveRemoteMcpIdentity}, except for the organisation domain when
+ * it cannot be read: then the admin's live `CAELO_GOOGLE_ORG_DOMAIN` is
+ * carried over (an earlier run as an account with the Organization Viewer
+ * role set it). The stack would otherwise remove it, where a gcloud roll
+ * leaves it as it is. `orgDomainError` still says why it was not read.
+ */
+export async function resolveStackRemoteMcpIdentity(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const resolved = await resolveRemoteMcpIdentity(target, { run });
+    if (!resolved.ok || !resolved.orgDomainError)
         return resolved;
-    const applied = await applyRemoteMcpIdentityEnv(target, resolved.identity, deps);
-    if (!applied.ok)
-        return applied;
+    const admin = await describeService(target, target.services.admin, run);
+    if (!admin.ok)
+        return admin;
+    const live = liveContainerEnv(admin.json).get(REMOTE_MCP_ENV.googleOrgDomain);
     return {
         ok: true,
-        identity: resolved.identity,
-        changes: applied.changes,
-        ...(resolved.orgDomainError ? { orgDomainError: resolved.orgDomainError } : {}),
+        identity: live?.kind === "value"
+            ? { ...resolved.identity, googleOrgDomain: live.value }
+            : resolved.identity,
+        orgDomainError: resolved.orgDomainError,
     };
 }
+/**
+ * #1082 — what each service's identity env lacks against `identity`
+ * (read-only). The stack owns these vars now; this is the installer's check
+ * that the `up` it just ran put them in place. An empty list per service is
+ * the expected answer.
+ */
+export async function checkRemoteMcpIdentityEnv(target, identity, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const desired = remoteMcpIdentityEnv(identity);
+    const drift = { admin: [], gateway: [] };
+    for (const slug of ["admin", "gateway"]) {
+        const described = await describeService(target, target.services[slug], run);
+        if (!described.ok)
+            return described;
+        const plan = planEnvUpdate(liveContainerEnv(described.json), desired[slug]);
+        if (!plan.ok)
+            return { ok: false, error: `${slug}: ${plan.error}` };
+        drift[slug] = plan.changes;
+    }
+    return { ok: true, drift };
+}
 /**
  * The URL map with every {@link GCP_PUBLIC_BASE_PATHS} entry routed like
  * `/api/*` (to the gateway). Only the rule that carries `/api/*` changes;