@caelo-cms/provisioning 0.10.69 → 0.10.71

package/src/remote-mcp.ts

@@ -3,13 +3,15 @@
 /**
  * #806 — the CLI's part of remote MCP on a Google IAP install (`gcp`,
  * `gcp-firebase`), run as the operator's (or the provisioner's) gcloud
- * identity by the wizard after `pulumi up` and by `cms-provision upgrade`
- * after the roll. Every step is idempotent.
+ * identity by the wizard around `pulumi up`, by `state migrate`'s preview
+ * and by `cms-provision upgrade` around the roll. Every step is idempotent.
  *
- *   - {@link ensureRemoteMcpIdentityEnv}: the env vars that name generated
- *     identities ({@link RemoteMcpIdentity} — why the stacks cannot declare
- *     them is in stack-contract.ts), applied with `gcloud run services
- *     update` only where they differ.
+ *   - {@link resolveStackRemoteMcpIdentity}: the env vars that name
+ *     generated identities ({@link RemoteMcpIdentity}), resolved from the
+ *     live install for the stack config the installer writes before `up`
+ *     (#1082: the stack is their one owner — stack-contract.ts says why
+ *     they cannot be plain resource inputs), and
+ *     {@link checkRemoteMcpIdentityEnv}, the read-only check after it.
  *   - {@link ensureRemoteMcpEdge} (`gcp` only): the load balancer's part for
  *     installs whose URL map / Cloud Armor policy predate it — the
  *     `/.well-known/oauth-*` path rules (the stack ignores `pathRules` after
@@ -43,11 +45,13 @@ import type { HttpFetch } from "./runtime-secrets.js";
 import {
   type CloudRunSlug,
   type GcpProvider,
+  REMOTE_MCP_ENV,
   type RemoteMcpIdentity,
   remoteMcpIdentity,
   remoteMcpIdentityEnv,
 } from "./stack-contract.js";
 import { type EnvChange, liveContainerEnv, planEnvUpdate } from "./stack-converge.js";
+import { lookupFailure, resolveGcpResourceName } from "./upgrade/gcp-lookup.js";
 
 /** The install remote MCP is set up on. */
 export interface RemoteMcpTarget {
@@ -226,76 +230,118 @@ async function resolveServiceIdentity(
   };
 }
 
+/** `gcloud run services describe --format=json` of one service, or why it failed. */
+async function describeService(
+  target: RemoteMcpTarget,
+  service: string,
+  run: GcloudRunner,
+): Promise<RemoteMcpResult<{ readonly json: string }>> {
+  const describe = await run([
+    "run",
+    "services",
+    "describe",
+    service,
+    `--region=${target.region}`,
+    `--project=${target.projectId}`,
+    "--format=json",
+  ]);
+  if (!describe.ok) return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
+  if (parseJson(describe.stdout) === null) {
+    return { ok: false, error: `describe ${service}: output is not JSON` };
+  }
+  return { ok: true, json: describe.stdout };
+}
+
 /**
- * Bring both services' {@link RemoteMcpIdentity} env vars to `identity`
- * with one `gcloud run services update` per service that differs (a new
- * revision only then). Vars already right are left alone.
+ * #1082 — the deployed install remote MCP is resolved on: the Pulumi-suffixed
+ * admin and gateway Cloud Run services found by prefix. Read-only.
  */
-export async function applyRemoteMcpIdentityEnv(
-  target: RemoteMcpTarget,
-  identity: RemoteMcpIdentity,
+export async function findRemoteMcpTarget(
+  base: Omit<RemoteMcpTarget, "services">,
   deps: { run?: GcloudRunner } = {},
-): Promise<RemoteMcpResult<{ readonly changes: Record<CloudRunSlug, EnvChange[]> }>> {
+): Promise<RemoteMcpResult<{ readonly target: RemoteMcpTarget }>> {
   const run = deps.run ?? defaultGcloud;
-  const desired = remoteMcpIdentityEnv(identity);
-  const changes: Record<CloudRunSlug, EnvChange[]> = { admin: [], gateway: [] };
+  const services: Partial<Record<CloudRunSlug, string>> = {};
   for (const slug of ["admin", "gateway"] as const) {
-    const service = target.services[slug];
-    const describe = await run([
-      "run",
-      "services",
-      "describe",
-      service,
-      `--region=${target.region}`,
-      `--project=${target.projectId}`,
-      "--format=json",
-    ]);
-    if (!describe.ok) return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
-    if (parseJson(describe.stdout) === null) {
-      return { ok: false, error: `describe ${service}: output is not JSON` };
+    const prefix = `${gcpNamePrefix(base.env)}-${slug}`;
+    const lookup = await resolveGcpResourceName(
+      run,
+      "run-service",
+      prefix,
+      base.projectId,
+      base.region,
+    );
+    if (lookup.status !== "found") {
+      return {
+        ok: false,
+        error: lookupFailure(lookup, `${prefix}* Cloud Run service`, "operator"),
+      };
     }
-    const plan = planEnvUpdate(liveContainerEnv(describe.stdout), desired[slug]);
-    if (!plan.ok) return { ok: false, error: `${slug}: ${plan.error}` };
-    if (plan.flags.length === 0) continue;
-    const update = await run([
-      "run",
-      "services",
-      "update",
-      service,
-      `--region=${target.region}`,
-      `--project=${target.projectId}`,
-      ...plan.flags,
-      "--quiet",
-    ]);
-    if (!update.ok) return { ok: false, error: `update ${service}: ${update.stderr.trim()}` };
-    changes[slug] = plan.changes;
+    services[slug] = lookup.name;
   }
-  return { ok: true, changes };
+  return {
+    ok: true,
+    target: { ...base, services: services as Record<CloudRunSlug, string> },
+  };
 }
 
-/** {@link resolveRemoteMcpIdentity} then {@link applyRemoteMcpIdentityEnv}. */
-export async function ensureRemoteMcpIdentityEnv(
+/**
+ * #1082 — the identity the installer writes into the stack config before
+ * `up` (stack-contract.ts REMOTE_MCP_IDENTITY_CONFIG), so the stack declares
+ * the vars the services carry and `up` keeps them.
+ *
+ * {@link resolveRemoteMcpIdentity}, except for the organisation domain when
+ * it cannot be read: then the admin's live `CAELO_GOOGLE_ORG_DOMAIN` is
+ * carried over (an earlier run as an account with the Organization Viewer
+ * role set it). The stack would otherwise remove it, where a gcloud roll
+ * leaves it as it is. `orgDomainError` still says why it was not read.
+ */
+export async function resolveStackRemoteMcpIdentity(
   target: RemoteMcpTarget,
   deps: { run?: GcloudRunner } = {},
 ): Promise<
-  RemoteMcpResult<{
-    readonly identity: RemoteMcpIdentity;
-    readonly changes: Record<CloudRunSlug, EnvChange[]>;
-    readonly orgDomainError?: string;
-  }>
+  RemoteMcpResult<{ readonly identity: RemoteMcpIdentity; readonly orgDomainError?: string }>
 > {
-  const resolved = await resolveRemoteMcpIdentity(target, deps);
-  if (!resolved.ok) return resolved;
-  const applied = await applyRemoteMcpIdentityEnv(target, resolved.identity, deps);
-  if (!applied.ok) return applied;
+  const run = deps.run ?? defaultGcloud;
+  const resolved = await resolveRemoteMcpIdentity(target, { run });
+  if (!resolved.ok || !resolved.orgDomainError) return resolved;
+  const admin = await describeService(target, target.services.admin, run);
+  if (!admin.ok) return admin;
+  const live = liveContainerEnv(admin.json).get(REMOTE_MCP_ENV.googleOrgDomain);
   return {
     ok: true,
-    identity: resolved.identity,
-    changes: applied.changes,
-    ...(resolved.orgDomainError ? { orgDomainError: resolved.orgDomainError } : {}),
+    identity:
+      live?.kind === "value"
+        ? { ...resolved.identity, googleOrgDomain: live.value }
+        : resolved.identity,
+    orgDomainError: resolved.orgDomainError,
   };
 }
 
+/**
+ * #1082 — what each service's identity env lacks against `identity`
+ * (read-only). The stack owns these vars now; this is the installer's check
+ * that the `up` it just ran put them in place. An empty list per service is
+ * the expected answer.
+ */
+export async function checkRemoteMcpIdentityEnv(
+  target: RemoteMcpTarget,
+  identity: RemoteMcpIdentity,
+  deps: { run?: GcloudRunner } = {},
+): Promise<RemoteMcpResult<{ readonly drift: Record<CloudRunSlug, EnvChange[]> }>> {
+  const run = deps.run ?? defaultGcloud;
+  const desired = remoteMcpIdentityEnv(identity);
+  const drift: Record<CloudRunSlug, EnvChange[]> = { admin: [], gateway: [] };
+  for (const slug of ["admin", "gateway"] as const) {
+    const described = await describeService(target, target.services[slug], run);
+    if (!described.ok) return described;
+    const plan = planEnvUpdate(liveContainerEnv(described.json), desired[slug]);
+    if (!plan.ok) return { ok: false, error: `${slug}: ${plan.error}` };
+    drift[slug] = plan.changes;
+  }
+  return { ok: true, drift };
+}
+
 // ===========================================================================
 // Load balancer (gcp)
 // ===========================================================================

package/src/stack-contract-parity.test.ts

@@ -15,6 +15,7 @@ import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import {
+  CLOUD_RUN_IGNORE_CHANGES,
   type GcpProvider,
   type IamInvariant,
   runtimeSecretBindings,
@@ -131,11 +132,35 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
   });
 
   it("builds the admin + gateway env from the shared contracts", () => {
-    expect(src).toMatch(/serviceName: "admin",[\s\S]*?contractEnv: adminEnvContract\(/);
-    expect(src).toMatch(/serviceName: "gateway",[\s\S]*?contractEnv: gatewayEnvContract\(/);
+    expect(src).toMatch(
+      /serviceName: "admin",[\s\S]*?contractEnv: \[\s*\.\.\.adminEnvContract\([\s\S]*?\.\.\.remoteMcpEnv\.admin,?\s*\]/,
+    );
+    expect(src).toMatch(
+      /serviceName: "gateway",[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\([\s\S]*?\.\.\.remoteMcpEnv\.gateway,?\s*\]/,
+    );
     expect(src).toContain("envs: [...args.contractEnv],");
   });
 
+  it("#1082 — declares the remote-MCP identity env from the config the CLI writes", () => {
+    // The stack is the vars' one owner: `pulumi up` keeps what the CLI used
+    // to add with gcloud after every `up` (and every `up` removed again).
+    expect(src).toContain(
+      "const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));",
+    );
+    expect(src.match(/remoteMcpEnv\.(admin|gateway)/g)?.sort()).toEqual([
+      "remoteMcpEnv.admin",
+      "remoteMcpEnv.gateway",
+    ]);
+  });
+
+  it("#1082 — leaves client / clientVersion (who deployed last) to gcloud on both services", () => {
+    expect(src.match(/new gcp\.cloudrunv2\.Service\(/g)).toHaveLength(1);
+    expect(src).toMatch(
+      /new gcp\.cloudrunv2\.Service\([\s\S]*?\.\.\.opts,\s*\/\/[^\n]*\n\s*ignoreChanges: \[\.\.\.CLOUD_RUN_IGNORE_CHANGES\],/,
+    );
+    expect(CLOUD_RUN_IGNORE_CHANGES).toEqual(["client", "clientVersion"]);
+  });
+
   it("mounts the media bucket on the admin, and only there, from the contract upgrade applies", () => {
     // The stack's admin gets adminMediaVolume() — the same volume
     // stack-converge.ts planMediaVolume adds to installs that lack it.
@@ -166,7 +191,7 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
 
   it("#806 — gives the gateway the contract's request timeout upgrade applies", () => {
     expect(src).toMatch(
-      /serviceName: "gateway",[\s\S]*?timeout: `\$\{GATEWAY_TIMEOUT_SECONDS\}s`,[\s\S]*?contractEnv: gatewayEnvContract\(/,
+      /serviceName: "gateway",[\s\S]*?timeout: `\$\{GATEWAY_TIMEOUT_SECONDS\}s`,[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\(/,
     );
   });
 

package/src/stack-contract.ts

@@ -34,6 +34,7 @@
  * Pure module — the stacks import it from `dist/`.
  */
 
+import { z } from "zod";
 import type { SupportedProvider } from "./adapter.js";
 import {
   auditJobResource,
@@ -642,12 +643,21 @@ export function operatorOAuthClientSecretResource(projectId: string, env: string
  * its own name; the gateway's public URL is its own URL; the admin's URL is
  * a service created after the gateway), and on `gcp` the audience is the
  * numeric id of a backend service created after the admin. A resource
- * cannot take its own (or a later resource's) output as input. So the CLI
- * reads the live identities after deploy and applies these vars with gcloud
- * — the wizard after every `pulumi up`, `upgrade` after every roll
- * (remote-mcp.ts `ensureRemoteMcpIdentityEnv`). A roll that does not set
- * them leaves them as they are (planEnvUpdate never removes a var the
- * contract does not own).
+ * cannot take its own (or a later resource's) output as input.
+ *
+ * So the CLI reads the live identities and hands them to the stack as
+ * config ({@link REMOTE_MCP_IDENTITY_CONFIG}, the way the image digests are
+ * pinned), and the stacks declare the vars from it
+ * ({@link remoteMcpIdentityStackEnv}): the stack is their one owner, and a
+ * `pulumi up` keeps them (#1082 — before, the CLI set them with gcloud
+ * after every `up`, every `up` removed them again, and `state migrate`'s
+ * preview could never come back clean). The installer resolves them before
+ * every `up` of a deployed install, and on a fresh one after the first `up`
+ * followed by a second (wizards/gcp.ts); `state migrate`'s preview resolves
+ * them the same way (state-pulumi.ts). `upgrade`, which does not run
+ * Pulumi, applies the same derived values with its gcloud roll (like the
+ * rest of the env contract); a roll that does not set them leaves them as
+ * they are (planEnvUpdate never removes a var the contract does not own).
  *
  * #914 adds two the admin's Google sign-in needs: its own URL (the
  * self-check opens it signed out) and the project's Google organisation
@@ -752,6 +762,97 @@ export function remoteMcpIdentityEnv(
   };
 }
 
+/**
+ * #1082 — stack config key (`caelo-<provider>:remoteMcpIdentity`) carrying
+ * the {@link RemoteMcpIdentity} as JSON. Written by the CLI before `up`,
+ * read by the stacks ({@link remoteMcpIdentityStackEnv}).
+ */
+export const REMOTE_MCP_IDENTITY_CONFIG = "remoteMcpIdentity";
+
+const remoteMcpIdentitySchema = z
+  .object({
+    adminUrl: z.string().regex(/^https:\/\/[^\s/]+$/),
+    mcpPublicUrl: z.string().regex(/^https:\/\/[^\s/]+$/),
+    iapAudience: z.string().regex(/^\/projects\/\d+\/[^\s]+$/),
+    googleOrgDomain: z
+      .string()
+      .regex(/^([a-z0-9.-]+\.[a-z]{2,}|none)$/)
+      .optional(),
+  })
+  .strict();
+
+/** {@link RemoteMcpIdentity} as the value of {@link REMOTE_MCP_IDENTITY_CONFIG}. */
+export function serializeRemoteMcpIdentity(id: RemoteMcpIdentity): string {
+  return JSON.stringify(remoteMcpIdentitySchema.parse(id));
+}
+
+/**
+ * Parse the {@link REMOTE_MCP_IDENTITY_CONFIG} value; null when unset (a
+ * fresh install before its first `up`).
+ *
+ * @throws Error naming the key when the value is not a valid identity — a
+ *   hand-edited or corrupt config must stop the `up`, not silently drop
+ *   the vars.
+ */
+export function parseRemoteMcpIdentityConfig(raw: string | undefined): RemoteMcpIdentity | null {
+  if (raw === undefined || raw === "") return null;
+  let json: unknown;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `stack config ${REMOTE_MCP_IDENTITY_CONFIG} is not JSON; delete the key and re-run the installer, which writes it again from the live install`,
+    );
+  }
+  const parsed = remoteMcpIdentitySchema.safeParse(json);
+  if (!parsed.success) {
+    throw new Error(
+      `stack config ${REMOTE_MCP_IDENTITY_CONFIG} is not a remote-MCP identity (${parsed.error.issues.map((i) => i.path.join(".") || i.message).join(", ")}); delete the key and re-run the installer, which writes it again from the live install`,
+    );
+  }
+  return parsed.data;
+}
+
+/**
+ * The remote-MCP identity env each Cloud Run service declares in the stacks:
+ * {@link remoteMcpIdentityEnv} of the configured identity, nothing while the
+ * config is unset.
+ */
+export function remoteMcpIdentityStackEnv(
+  raw: string | undefined,
+): Record<CloudRunSlug, CloudRunEnvVar[]> {
+  const id = parseRemoteMcpIdentityConfig(raw);
+  return id ? remoteMcpIdentityEnv(id) : { admin: [], gateway: [] };
+}
+
+/** Whether two identities would give the services the same env. */
+export function sameRemoteMcpIdentity(
+  a: RemoteMcpIdentity | null,
+  b: RemoteMcpIdentity | null,
+): boolean {
+  if (a === null || b === null) return a === b;
+  return (
+    a.adminUrl === b.adminUrl &&
+    a.mcpPublicUrl === b.mcpPublicUrl &&
+    a.iapAudience === b.iapAudience &&
+    a.googleOrgDomain === b.googleOrgDomain
+  );
+}
+
+/**
+ * #1082 — Pulumi options both stacks give the Cloud Run v2 services.
+ * `client` / `clientVersion` only record which tool deployed the service
+ * last: `gcloud` sets them on every `upgrade` roll, and the provider
+ * (terraform-provider-google `google_cloud_run_v2_service`: `Optional`, not
+ * `Computed`) reads them back on refresh, so the stack, which leaves them
+ * unset, would plan an update on every service `upgrade` ever rolled. They
+ * affect nothing that runs. `ignoreChanges` is Pulumi's way to leave a
+ * property to another writer. (The env itself needs no such option: the
+ * provider holds `containers.env` as a set, so gcloud's reordering is no
+ * diff — only a missing or different var is.)
+ */
+export const CLOUD_RUN_IGNORE_CHANGES: readonly string[] = ["client", "clientVersion"];
+
 /**
  * The env of the admin service.
  *

package/src/state-command.ts

@@ -14,7 +14,9 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { confirm, isCancel, log, note } from "@clack/prompts";
 import { bold, red } from "kleur/colors";
-import { checkGcloudAuth } from "./gcloud.js";
+import { adoptionCandidates, existingCandidates } from "./adopt-existing.js";
+import { checkGcloudAuth, gcloud } from "./gcloud.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
 import {
   adoptStateBackend,
   currentMetadata,
@@ -32,7 +34,13 @@ import { installIapAllowlist } from "./operator-access.js";
 import { ensureOpsBackend } from "./ops-backend.js";
 import { writePlanFile } from "./preview-plan.js";
 import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
+import {
+  findRemoteMcpTarget,
+  type RemoteMcpTarget,
+  resolveStackRemoteMcpIdentity,
+} from "./remote-mcp.js";
 import { selfCommand } from "./self-command.js";
+import type { RemoteMcpIdentity } from "./stack-contract.js";
 import { attachInstall } from "./state-attach.js";
 import {
   gcsBackendRecord,
@@ -191,6 +199,14 @@ export async function stateCommand(argv: readonly string[]): Promise<void> {
           iapAllowlist: installIapAllowlist(meta.ownerEmail),
           imageDigests,
         },
+        resolveRemoteMcpIdentity: () =>
+          resolveRemoteMcpIdentityForPreview({
+            provider,
+            projectId,
+            region,
+            env: GCP_STACK_ENV,
+            domain: meta.domain,
+          }),
       }),
       report: clackReporter(),
       resolve: (record) =>
@@ -260,6 +276,10 @@ export async function stateCommand(argv: readonly string[]): Promise<void> {
         return moved;
       },
       writePlan: (label, steps) => writePlanFile(root, label, steps),
+      existingInProject: async (steps) =>
+        (await existingCandidates(adoptionCandidates(steps, projectId), gcloud)).map(
+          (c) => `${c.label} ${c.display}`,
+        ),
     },
   );
   if (!result.ok) {
@@ -318,3 +338,20 @@ export function adcNote(run: SyncGcloud): string | null {
   if (r.ok) return null;
   return "No Application Default Credentials on this machine. upgrade, status and backup don't need them; re-running the installer or `state migrate` does: gcloud auth application-default login";
 }
+
+/**
+ * #1082 — the remote-MCP identity a preview gives the stack, read from the
+ * live install exactly as the installer reads it before `up`
+ * (remote-mcp.ts resolveStackRemoteMcpIdentity). Unreadable: null, with a
+ * warning — the stack's recorded config then stands, and the preview shows
+ * any difference from what the services carry.
+ */
+async function resolveRemoteMcpIdentityForPreview(
+  base: Omit<RemoteMcpTarget, "services">,
+): Promise<RemoteMcpIdentity | null> {
+  const found = await findRemoteMcpTarget(base);
+  const resolved = found.ok ? await resolveStackRemoteMcpIdentity(found.target) : found;
+  if (resolved.ok) return resolved.identity;
+  log.warn(`Could not read the remote-MCP URLs and IAP audience: ${resolved.error}`);
+  return null;
+}

package/src/state-migrate.test.ts

@@ -154,6 +154,8 @@ function machine(initial: StateBackendRecord = { kind: "local" }) {
     acceptCost: true,
     bucketRecord: (initial.kind === "gcs" ? "gcs" : null) as "gcs" | "local" | null,
     planFiles: [] as { label: string; steps: number }[],
+    /** What existingInProject answers (#1079); an Error is thrown. */
+    existing: [] as readonly string[] | Error,
   };
   const meta = (): MigrateInstall => ({
     installId: "gcp-firebase-acme",
@@ -209,6 +211,10 @@ function machine(initial: StateBackendRecord = { kind: "local" }) {
       m.planFiles.push({ label, steps: steps.length });
       return `${ROOT}/plan-${label}.txt`;
     },
+    existingInProject: async () => {
+      if (m.existing instanceof Error) throw m.existing;
+      return m.existing;
+    },
   };
   p.stacks.set(localUrl, {
     outputs: {
@@ -380,6 +386,38 @@ describe("migrateState — failures leave the source authoritative", () => {
     expect(t.m.backups).toBe(0);
   });
 
+  it("the refusal names the planned creates the installer adopts (#1079)", async () => {
+    const t = machine();
+    const local = t.p.stacks.get(t.localUrl);
+    if (local) local.drift = 2;
+    t.m.existing = ["service account caelo-production-gateway-sa@acme.iam.gserviceaccount.com"];
+    const r = await migrateState(t.meta(), { to: "remote", dryRun: false }, t.deps);
+    expect(r.ok).toBe(false);
+    if (r.ok) return;
+    expect(r.error).toContain(
+      "1 of the planned creates exist in the project already (service account caelo-production-gateway-sa@acme.iam.gserviceaccount.com): upgrade made them without Pulumi. The installer adopts them into the stack first",
+    );
+    expect(r.error.indexOf("adopts them")).toBeLessThan(r.error.indexOf("Run upgrade first"));
+  });
+
+  it("the refusal says nothing about adopting when nothing exists, and says so when it can't check", async () => {
+    const t = machine();
+    const local = t.p.stacks.get(t.localUrl);
+    if (local) local.drift = 1;
+    const none = await migrateState(t.meta(), { to: "remote", dryRun: false }, t.deps);
+    expect(none.ok).toBe(false);
+    if (none.ok) return;
+    expect(none.error).not.toContain("adopt");
+    t.m.existing = new Error("gcloud: PERMISSION_DENIED");
+    const failed = await migrateState(t.meta(), { to: "remote", dryRun: false }, t.deps);
+    expect(failed.ok).toBe(false);
+    if (failed.ok) return;
+    expect(failed.error).toContain(
+      "(Could not check which planned creates exist in the project already: gcloud: PERMISSION_DENIED. The installer checks again.)",
+    );
+    expect(failed.error).toContain("Run upgrade first");
+  });
+
   it("refuses a stack with pending operations", async () => {
     const t = machine();
     const local = t.p.stacks.get(t.localUrl);

package/src/state-migrate.ts

@@ -117,6 +117,13 @@ export interface MigrateDeps {
    * writePlanFile); returns its path.
    */
   writePlan(label: string, steps: readonly PlannedStep[]): string;
+  /**
+   * #1079 — the planned creates whose resource exists in the project already
+   * (adopt-existing.ts: made by `upgrade` through gcloud), one
+   * `<kind> <name>` each. The installer adopts these into the stack before it
+   * applies anything. Throws when it can't tell.
+   */
+  existingInProject(steps: readonly PlannedStep[]): Promise<readonly string[]>;
 }
 
 export interface MigrateOptions {
@@ -167,6 +174,22 @@ function planReport(deps: MigrateDeps, label: string, steps: readonly PlannedSte
   return [...formatPlan(steps).map((l) => `  ${l}`), where].join("\n");
 }
 
+/**
+ * The refusal's line about planned creates the installer adopts instead
+ * (#1079), or "" when there are none. A failed check is said, not fatal: the
+ * installer checks again before it applies anything.
+ */
+async function adoptionNote(deps: MigrateDeps, steps: readonly PlannedStep[]): Promise<string> {
+  let existing: readonly string[];
+  try {
+    existing = await deps.existingInProject(steps);
+  } catch (e) {
+    return `(Could not check which planned creates exist in the project already: ${errorText(e)}. The installer checks again.)\n`;
+  }
+  if (existing.length === 0) return "";
+  return `${existing.length} of the planned creates exist in the project already (${existing.join(", ")}): upgrade made them without Pulumi. The installer adopts them into the stack first instead of creating them again, then shows what is left.\n`;
+}
+
 /**
  * Run the migration. Never throws for an expected failure: the result says
  * what failed, and at every failure point the source backend is still the
@@ -264,7 +287,7 @@ export async function migrateState(
       pre.failed(`A preview shows ${sourcePlan.length} change(s)`);
       return {
         ok: false,
-        error: `The stack is not converged (a preview shows ${sourcePlan.length} change(s)), so a copy can't be proven identical. Nothing was changed. The planned changes:\n${planReport(deps, "state-migrate", sourcePlan)}\nRun upgrade first, then re-run the installer (${selfCommand()}, pick this install): it shows this list again and asks before it replaces or deletes anything. Migrate once it reports no changes.`,
+        error: `The stack is not converged (a preview shows ${sourcePlan.length} change(s)), so a copy can't be proven identical. Nothing was changed. The planned changes:\n${planReport(deps, "state-migrate", sourcePlan)}\n${await adoptionNote(deps, sourcePlan)}Run upgrade first, then re-run the installer (${selfCommand()}, pick this install): it shows this list again and asks before it replaces or deletes anything. Migrate once it reports no changes.`,
       };
     }
     sourceDigest = await pulumi.outputsDigest(from);

package/src/state-pulumi.ts

@@ -20,6 +20,11 @@ import * as automation from "@pulumi/pulumi/automation";
 import { redactCredentials } from "./checkpoint-secrets.js";
 import { GCP_STACK_ENV } from "./gcp-names.js";
 import { collectPreviewSteps } from "./preview-plan.js";
+import {
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "./stack-contract.js";
 import type { ResolvedBackend } from "./state-backend.js";
 import type { StatePulumiOps } from "./state-migrate.js";
 import {
@@ -68,6 +73,12 @@ export interface RealPulumiOpsInputs {
   readonly impersonateServiceAccount: string;
   /** The config a wizard run sets, so a preview shows real drift only. */
   readonly stackConfig: StackConfigInputs;
+  /**
+   * #1082 — the remote-MCP identity read from the live install, as the
+   * installer reads it before its `up` (null when it cannot be read: the
+   * stack's config then stays as it is). Asked once per preview.
+   */
+  readonly resolveRemoteMcpIdentity: () => Promise<RemoteMcpIdentity | null>;
 }
 
 /** {@link StatePulumiOps} backed by the `pulumi` CLI + Automation API. */
@@ -195,6 +206,16 @@ export function realStatePulumiOps(inputs: RealPulumiOpsInputs): StatePulumiOps
           []) as StateResource[];
         await applyStackConfig(stack, inputs.stackConfig, resources);
       }
+      // #1082 — the identity env the stack declares, set the way the
+      // installer sets it before every `up`: from the live install. A stack
+      // last applied before the stack owned it has no such config yet, and
+      // its preview would show the vars removed.
+      const identity = await inputs.resolveRemoteMcpIdentity();
+      if (identity) {
+        await stack.setConfig(`caelo-${inputs.provider}:${REMOTE_MCP_IDENTITY_CONFIG}`, {
+          value: serializeRemoteMcpIdentity(identity),
+        });
+      }
       await assertStackProject(stack, inputs.provider, inputs.stackConfig.projectId);
       // #737 — the steps themselves, not just the summary's count: a
       // refusal lists what would change, replaces and deletes first.

package/src/upgrade/converge.ts

@@ -364,8 +364,10 @@ export function startConverge(
     // name identities the env contract cannot (stack-contract.ts
     // RemoteMcpIdentity). Resolved here, read-only, and set by the rolls
     // (AppRollHooks.afterMigrations `extraEnv`), so they ride the new
-    // revisions. A failure leaves the vars as the services have them and
-    // warns: only remote MCP depends on them.
+    // revisions. The stack declares the same derived values from the config
+    // the installer writes before `up` (#1082), so neither writer undoes the
+    // other. A failure leaves the vars as the services have them and warns:
+    // only remote MCP depends on them.
     const s = r.step("Resolving the remote-MCP URLs and IAP audience...");
     const resolved = await resolveRemoteMcpIdentity(
       {