@caelo-cms/provisioning 0.10.70 → 0.10.72

package/src/remote-mcp.ts

@@ -3,13 +3,15 @@
 /**
  * #806 — the CLI's part of remote MCP on a Google IAP install (`gcp`,
  * `gcp-firebase`), run as the operator's (or the provisioner's) gcloud
- * identity by the wizard after `pulumi up` and by `cms-provision upgrade`
- * after the roll. Every step is idempotent.
+ * identity by the wizard around `pulumi up`, by `state migrate`'s preview
+ * and by `cms-provision upgrade` around the roll. Every step is idempotent.
  *
- *   - {@link ensureRemoteMcpIdentityEnv}: the env vars that name generated
- *     identities ({@link RemoteMcpIdentity} — why the stacks cannot declare
- *     them is in stack-contract.ts), applied with `gcloud run services
- *     update` only where they differ.
+ *   - {@link resolveStackRemoteMcpIdentity}: the env vars that name
+ *     generated identities ({@link RemoteMcpIdentity}), resolved from the
+ *     live install for the stack config the installer writes before `up`
+ *     (#1082: the stack is their one owner — stack-contract.ts says why
+ *     they cannot be plain resource inputs), and
+ *     {@link checkRemoteMcpIdentityEnv}, the read-only check after it.
  *   - {@link ensureRemoteMcpEdge} (`gcp` only): the load balancer's part for
  *     installs whose URL map / Cloud Armor policy predate it — the
  *     `/.well-known/oauth-*` path rules (the stack ignores `pathRules` after
@@ -43,11 +45,13 @@ import type { HttpFetch } from "./runtime-secrets.js";
 import {
   type CloudRunSlug,
   type GcpProvider,
+  REMOTE_MCP_ENV,
   type RemoteMcpIdentity,
   remoteMcpIdentity,
   remoteMcpIdentityEnv,
 } from "./stack-contract.js";
 import { type EnvChange, liveContainerEnv, planEnvUpdate } from "./stack-converge.js";
+import { lookupFailure, resolveGcpResourceName } from "./upgrade/gcp-lookup.js";
 
 /** The install remote MCP is set up on. */
 export interface RemoteMcpTarget {
@@ -226,76 +230,118 @@ async function resolveServiceIdentity(
   };
 }
 
+/** `gcloud run services describe --format=json` of one service, or why it failed. */
+async function describeService(
+  target: RemoteMcpTarget,
+  service: string,
+  run: GcloudRunner,
+): Promise<RemoteMcpResult<{ readonly json: string }>> {
+  const describe = await run([
+    "run",
+    "services",
+    "describe",
+    service,
+    `--region=${target.region}`,
+    `--project=${target.projectId}`,
+    "--format=json",
+  ]);
+  if (!describe.ok) return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
+  if (parseJson(describe.stdout) === null) {
+    return { ok: false, error: `describe ${service}: output is not JSON` };
+  }
+  return { ok: true, json: describe.stdout };
+}
+
 /**
- * Bring both services' {@link RemoteMcpIdentity} env vars to `identity`
- * with one `gcloud run services update` per service that differs (a new
- * revision only then). Vars already right are left alone.
+ * #1082 — the deployed install remote MCP is resolved on: the Pulumi-suffixed
+ * admin and gateway Cloud Run services found by prefix. Read-only.
  */
-export async function applyRemoteMcpIdentityEnv(
-  target: RemoteMcpTarget,
-  identity: RemoteMcpIdentity,
+export async function findRemoteMcpTarget(
+  base: Omit<RemoteMcpTarget, "services">,
   deps: { run?: GcloudRunner } = {},
-): Promise<RemoteMcpResult<{ readonly changes: Record<CloudRunSlug, EnvChange[]> }>> {
+): Promise<RemoteMcpResult<{ readonly target: RemoteMcpTarget }>> {
   const run = deps.run ?? defaultGcloud;
-  const desired = remoteMcpIdentityEnv(identity);
-  const changes: Record<CloudRunSlug, EnvChange[]> = { admin: [], gateway: [] };
+  const services: Partial<Record<CloudRunSlug, string>> = {};
   for (const slug of ["admin", "gateway"] as const) {
-    const service = target.services[slug];
-    const describe = await run([
-      "run",
-      "services",
-      "describe",
-      service,
-      `--region=${target.region}`,
-      `--project=${target.projectId}`,
-      "--format=json",
-    ]);
-    if (!describe.ok) return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
-    if (parseJson(describe.stdout) === null) {
-      return { ok: false, error: `describe ${service}: output is not JSON` };
+    const prefix = `${gcpNamePrefix(base.env)}-${slug}`;
+    const lookup = await resolveGcpResourceName(
+      run,
+      "run-service",
+      prefix,
+      base.projectId,
+      base.region,
+    );
+    if (lookup.status !== "found") {
+      return {
+        ok: false,
+        error: lookupFailure(lookup, `${prefix}* Cloud Run service`, "operator"),
+      };
     }
-    const plan = planEnvUpdate(liveContainerEnv(describe.stdout), desired[slug]);
-    if (!plan.ok) return { ok: false, error: `${slug}: ${plan.error}` };
-    if (plan.flags.length === 0) continue;
-    const update = await run([
-      "run",
-      "services",
-      "update",
-      service,
-      `--region=${target.region}`,
-      `--project=${target.projectId}`,
-      ...plan.flags,
-      "--quiet",
-    ]);
-    if (!update.ok) return { ok: false, error: `update ${service}: ${update.stderr.trim()}` };
-    changes[slug] = plan.changes;
+    services[slug] = lookup.name;
   }
-  return { ok: true, changes };
+  return {
+    ok: true,
+    target: { ...base, services: services as Record<CloudRunSlug, string> },
+  };
 }
 
-/** {@link resolveRemoteMcpIdentity} then {@link applyRemoteMcpIdentityEnv}. */
-export async function ensureRemoteMcpIdentityEnv(
+/**
+ * #1082 — the identity the installer writes into the stack config before
+ * `up` (stack-contract.ts REMOTE_MCP_IDENTITY_CONFIG), so the stack declares
+ * the vars the services carry and `up` keeps them.
+ *
+ * {@link resolveRemoteMcpIdentity}, except for the organisation domain when
+ * it cannot be read: then the admin's live `CAELO_GOOGLE_ORG_DOMAIN` is
+ * carried over (an earlier run as an account with the Organization Viewer
+ * role set it). The stack would otherwise remove it, where a gcloud roll
+ * leaves it as it is. `orgDomainError` still says why it was not read.
+ */
+export async function resolveStackRemoteMcpIdentity(
   target: RemoteMcpTarget,
   deps: { run?: GcloudRunner } = {},
 ): Promise<
-  RemoteMcpResult<{
-    readonly identity: RemoteMcpIdentity;
-    readonly changes: Record<CloudRunSlug, EnvChange[]>;
-    readonly orgDomainError?: string;
-  }>
+  RemoteMcpResult<{ readonly identity: RemoteMcpIdentity; readonly orgDomainError?: string }>
 > {
-  const resolved = await resolveRemoteMcpIdentity(target, deps);
-  if (!resolved.ok) return resolved;
-  const applied = await applyRemoteMcpIdentityEnv(target, resolved.identity, deps);
-  if (!applied.ok) return applied;
+  const run = deps.run ?? defaultGcloud;
+  const resolved = await resolveRemoteMcpIdentity(target, { run });
+  if (!resolved.ok || !resolved.orgDomainError) return resolved;
+  const admin = await describeService(target, target.services.admin, run);
+  if (!admin.ok) return admin;
+  const live = liveContainerEnv(admin.json).get(REMOTE_MCP_ENV.googleOrgDomain);
   return {
     ok: true,
-    identity: resolved.identity,
-    changes: applied.changes,
-    ...(resolved.orgDomainError ? { orgDomainError: resolved.orgDomainError } : {}),
+    identity:
+      live?.kind === "value"
+        ? { ...resolved.identity, googleOrgDomain: live.value }
+        : resolved.identity,
+    orgDomainError: resolved.orgDomainError,
   };
 }
 
+/**
+ * #1082 — what each service's identity env lacks against `identity`
+ * (read-only). The stack owns these vars now; this is the installer's check
+ * that the `up` it just ran put them in place. An empty list per service is
+ * the expected answer.
+ */
+export async function checkRemoteMcpIdentityEnv(
+  target: RemoteMcpTarget,
+  identity: RemoteMcpIdentity,
+  deps: { run?: GcloudRunner } = {},
+): Promise<RemoteMcpResult<{ readonly drift: Record<CloudRunSlug, EnvChange[]> }>> {
+  const run = deps.run ?? defaultGcloud;
+  const desired = remoteMcpIdentityEnv(identity);
+  const drift: Record<CloudRunSlug, EnvChange[]> = { admin: [], gateway: [] };
+  for (const slug of ["admin", "gateway"] as const) {
+    const described = await describeService(target, target.services[slug], run);
+    if (!described.ok) return described;
+    const plan = planEnvUpdate(liveContainerEnv(described.json), desired[slug]);
+    if (!plan.ok) return { ok: false, error: `${slug}: ${plan.error}` };
+    drift[slug] = plan.changes;
+  }
+  return { ok: true, drift };
+}
+
 // ===========================================================================
 // Load balancer (gcp)
 // ===========================================================================

package/src/stack-contract-parity.test.ts

@@ -15,6 +15,7 @@ import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import {
+  CLOUD_RUN_IGNORE_CHANGES,
   type GcpProvider,
   type IamInvariant,
   runtimeSecretBindings,
@@ -131,11 +132,35 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
   });
 
   it("builds the admin + gateway env from the shared contracts", () => {
-    expect(src).toMatch(/serviceName: "admin",[\s\S]*?contractEnv: adminEnvContract\(/);
-    expect(src).toMatch(/serviceName: "gateway",[\s\S]*?contractEnv: gatewayEnvContract\(/);
+    expect(src).toMatch(
+      /serviceName: "admin",[\s\S]*?contractEnv: \[\s*\.\.\.adminEnvContract\([\s\S]*?\.\.\.remoteMcpEnv\.admin,?\s*\]/,
+    );
+    expect(src).toMatch(
+      /serviceName: "gateway",[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\([\s\S]*?\.\.\.remoteMcpEnv\.gateway,?\s*\]/,
+    );
     expect(src).toContain("envs: [...args.contractEnv],");
   });
 
+  it("#1082 — declares the remote-MCP identity env from the config the CLI writes", () => {
+    // The stack is the vars' one owner: `pulumi up` keeps what the CLI used
+    // to add with gcloud after every `up` (and every `up` removed again).
+    expect(src).toContain(
+      "const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));",
+    );
+    expect(src.match(/remoteMcpEnv\.(admin|gateway)/g)?.sort()).toEqual([
+      "remoteMcpEnv.admin",
+      "remoteMcpEnv.gateway",
+    ]);
+  });
+
+  it("#1082 — leaves client / clientVersion (who deployed last) to gcloud on both services", () => {
+    expect(src.match(/new gcp\.cloudrunv2\.Service\(/g)).toHaveLength(1);
+    expect(src).toMatch(
+      /new gcp\.cloudrunv2\.Service\([\s\S]*?\.\.\.opts,\s*\/\/[^\n]*\n\s*ignoreChanges: \[\.\.\.CLOUD_RUN_IGNORE_CHANGES\],/,
+    );
+    expect(CLOUD_RUN_IGNORE_CHANGES).toEqual(["client", "clientVersion"]);
+  });
+
   it("mounts the media bucket on the admin, and only there, from the contract upgrade applies", () => {
     // The stack's admin gets adminMediaVolume() — the same volume
     // stack-converge.ts planMediaVolume adds to installs that lack it.
@@ -166,7 +191,7 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
 
   it("#806 — gives the gateway the contract's request timeout upgrade applies", () => {
     expect(src).toMatch(
-      /serviceName: "gateway",[\s\S]*?timeout: `\$\{GATEWAY_TIMEOUT_SECONDS\}s`,[\s\S]*?contractEnv: gatewayEnvContract\(/,
+      /serviceName: "gateway",[\s\S]*?timeout: `\$\{GATEWAY_TIMEOUT_SECONDS\}s`,[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\(/,
     );
   });
 

package/src/stack-contract.ts

@@ -34,6 +34,7 @@
  * Pure module — the stacks import it from `dist/`.
  */
 
+import { z } from "zod";
 import type { SupportedProvider } from "./adapter.js";
 import {
   auditJobResource,
@@ -642,12 +643,21 @@ export function operatorOAuthClientSecretResource(projectId: string, env: string
  * its own name; the gateway's public URL is its own URL; the admin's URL is
  * a service created after the gateway), and on `gcp` the audience is the
  * numeric id of a backend service created after the admin. A resource
- * cannot take its own (or a later resource's) output as input. So the CLI
- * reads the live identities after deploy and applies these vars with gcloud
- * — the wizard after every `pulumi up`, `upgrade` after every roll
- * (remote-mcp.ts `ensureRemoteMcpIdentityEnv`). A roll that does not set
- * them leaves them as they are (planEnvUpdate never removes a var the
- * contract does not own).
+ * cannot take its own (or a later resource's) output as input.
+ *
+ * So the CLI reads the live identities and hands them to the stack as
+ * config ({@link REMOTE_MCP_IDENTITY_CONFIG}, the way the image digests are
+ * pinned), and the stacks declare the vars from it
+ * ({@link remoteMcpIdentityStackEnv}): the stack is their one owner, and a
+ * `pulumi up` keeps them (#1082 — before, the CLI set them with gcloud
+ * after every `up`, every `up` removed them again, and `state migrate`'s
+ * preview could never come back clean). The installer resolves them before
+ * every `up` of a deployed install, and on a fresh one after the first `up`
+ * followed by a second (wizards/gcp.ts); `state migrate`'s preview resolves
+ * them the same way (state-pulumi.ts). `upgrade`, which does not run
+ * Pulumi, applies the same derived values with its gcloud roll (like the
+ * rest of the env contract); a roll that does not set them leaves them as
+ * they are (planEnvUpdate never removes a var the contract does not own).
  *
  * #914 adds two the admin's Google sign-in needs: its own URL (the
  * self-check opens it signed out) and the project's Google organisation
@@ -752,6 +762,97 @@ export function remoteMcpIdentityEnv(
   };
 }
 
+/**
+ * #1082 — stack config key (`caelo-<provider>:remoteMcpIdentity`) carrying
+ * the {@link RemoteMcpIdentity} as JSON. Written by the CLI before `up`,
+ * read by the stacks ({@link remoteMcpIdentityStackEnv}).
+ */
+export const REMOTE_MCP_IDENTITY_CONFIG = "remoteMcpIdentity";
+
+const remoteMcpIdentitySchema = z
+  .object({
+    adminUrl: z.string().regex(/^https:\/\/[^\s/]+$/),
+    mcpPublicUrl: z.string().regex(/^https:\/\/[^\s/]+$/),
+    iapAudience: z.string().regex(/^\/projects\/\d+\/[^\s]+$/),
+    googleOrgDomain: z
+      .string()
+      .regex(/^([a-z0-9.-]+\.[a-z]{2,}|none)$/)
+      .optional(),
+  })
+  .strict();
+
+/** {@link RemoteMcpIdentity} as the value of {@link REMOTE_MCP_IDENTITY_CONFIG}. */
+export function serializeRemoteMcpIdentity(id: RemoteMcpIdentity): string {
+  return JSON.stringify(remoteMcpIdentitySchema.parse(id));
+}
+
+/**
+ * Parse the {@link REMOTE_MCP_IDENTITY_CONFIG} value; null when unset (a
+ * fresh install before its first `up`).
+ *
+ * @throws Error naming the key when the value is not a valid identity — a
+ *   hand-edited or corrupt config must stop the `up`, not silently drop
+ *   the vars.
+ */
+export function parseRemoteMcpIdentityConfig(raw: string | undefined): RemoteMcpIdentity | null {
+  if (raw === undefined || raw === "") return null;
+  let json: unknown;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `stack config ${REMOTE_MCP_IDENTITY_CONFIG} is not JSON; delete the key and re-run the installer, which writes it again from the live install`,
+    );
+  }
+  const parsed = remoteMcpIdentitySchema.safeParse(json);
+  if (!parsed.success) {
+    throw new Error(
+      `stack config ${REMOTE_MCP_IDENTITY_CONFIG} is not a remote-MCP identity (${parsed.error.issues.map((i) => i.path.join(".") || i.message).join(", ")}); delete the key and re-run the installer, which writes it again from the live install`,
+    );
+  }
+  return parsed.data;
+}
+
+/**
+ * The remote-MCP identity env each Cloud Run service declares in the stacks:
+ * {@link remoteMcpIdentityEnv} of the configured identity, nothing while the
+ * config is unset.
+ */
+export function remoteMcpIdentityStackEnv(
+  raw: string | undefined,
+): Record<CloudRunSlug, CloudRunEnvVar[]> {
+  const id = parseRemoteMcpIdentityConfig(raw);
+  return id ? remoteMcpIdentityEnv(id) : { admin: [], gateway: [] };
+}
+
+/** Whether two identities would give the services the same env. */
+export function sameRemoteMcpIdentity(
+  a: RemoteMcpIdentity | null,
+  b: RemoteMcpIdentity | null,
+): boolean {
+  if (a === null || b === null) return a === b;
+  return (
+    a.adminUrl === b.adminUrl &&
+    a.mcpPublicUrl === b.mcpPublicUrl &&
+    a.iapAudience === b.iapAudience &&
+    a.googleOrgDomain === b.googleOrgDomain
+  );
+}
+
+/**
+ * #1082 — Pulumi options both stacks give the Cloud Run v2 services.
+ * `client` / `clientVersion` only record which tool deployed the service
+ * last: `gcloud` sets them on every `upgrade` roll, and the provider
+ * (terraform-provider-google `google_cloud_run_v2_service`: `Optional`, not
+ * `Computed`) reads them back on refresh, so the stack, which leaves them
+ * unset, would plan an update on every service `upgrade` ever rolled. They
+ * affect nothing that runs. `ignoreChanges` is Pulumi's way to leave a
+ * property to another writer. (The env itself needs no such option: the
+ * provider holds `containers.env` as a set, so gcloud's reordering is no
+ * diff — only a missing or different var is.)
+ */
+export const CLOUD_RUN_IGNORE_CHANGES: readonly string[] = ["client", "clientVersion"];
+
 /**
  * The env of the admin service.
  *

package/src/state-command.test.ts

@@ -28,4 +28,16 @@ describe("adcNote (#816)", () => {
     expect(note).toContain("gcloud auth application-default login");
     expect(note).toContain("upgrade, status and backup don't need them");
   });
+
+  it("expired ADC say so instead of 'no ADC' (#1078)", () => {
+    const note = adcNote(() => ({
+      ok: false,
+      stdout: "",
+      stderr:
+        "ERROR: (gcloud.auth.application-default.print-access-token) Reauthentication failed. cannot prompt during non-interactive execution.",
+      exitCode: 1,
+    }));
+    expect(note).toContain("have expired");
+    expect(note).toContain("gcloud auth application-default login");
+  });
 });

package/src/state-command.ts

@@ -14,8 +14,11 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { confirm, isCancel, log, note } from "@clack/prompts";
 import { bold, red } from "kleur/colors";
+import { ADC_LOGIN_COMMAND, ADC_PROBE_ARGS, adcProbeFromResult } from "./adc-check.js";
+import { checkAdcImpersonation } from "./adc-impersonation.js";
 import { adoptionCandidates, existingCandidates } from "./adopt-existing.js";
 import { checkGcloudAuth, gcloud } from "./gcloud.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
 import {
   adoptStateBackend,
   currentMetadata,
@@ -33,7 +36,13 @@ import { installIapAllowlist } from "./operator-access.js";
 import { ensureOpsBackend } from "./ops-backend.js";
 import { writePlanFile } from "./preview-plan.js";
 import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
+import {
+  findRemoteMcpTarget,
+  type RemoteMcpTarget,
+  resolveStackRemoteMcpIdentity,
+} from "./remote-mcp.js";
 import { selfCommand } from "./self-command.js";
+import type { RemoteMcpIdentity } from "./stack-contract.js";
 import { attachInstall } from "./state-attach.js";
 import {
   gcsBackendRecord,
@@ -192,8 +201,18 @@ export async function stateCommand(argv: readonly string[]): Promise<void> {
           iapAllowlist: installIapAllowlist(meta.ownerEmail),
           imageDigests,
         },
+        resolveRemoteMcpIdentity: () =>
+          resolveRemoteMcpIdentityForPreview({
+            provider,
+            projectId,
+            region,
+            env: GCP_STACK_ENV,
+            domain: meta.domain,
+          }),
       }),
       report: clackReporter(),
+      checkAdc: () =>
+        checkAdcImpersonation({ projectId, operatorAccount: operator, freshGrant: false }),
       resolve: (record) =>
         resolveBackend(
           { installId, stateBackend: record },
@@ -319,7 +338,28 @@ export function attachProject(projectId: string): string {
  * do not, so a note on every attach sent Owners on a detour (#816).
  */
 export function adcNote(run: SyncGcloud): string | null {
-  const r = run(["auth", "application-default", "print-access-token"]);
-  if (r.ok) return null;
-  return "No Application Default Credentials on this machine. upgrade, status and backup don't need them; re-running the installer or `state migrate` does: gcloud auth application-default login";
+  const probe = adcProbeFromResult(run([...ADC_PROBE_ARGS]));
+  if (probe.ok) return null;
+  const state =
+    probe.reason === "expired"
+      ? "The Application Default Credentials on this machine have expired."
+      : "No Application Default Credentials on this machine.";
+  return `${state} upgrade, status and backup don't need them; re-running the installer or \`state migrate\` does: ${ADC_LOGIN_COMMAND}`;
+}
+
+/**
+ * #1082 — the remote-MCP identity a preview gives the stack, read from the
+ * live install exactly as the installer reads it before `up`
+ * (remote-mcp.ts resolveStackRemoteMcpIdentity). Unreadable: null, with a
+ * warning — the stack's recorded config then stands, and the preview shows
+ * any difference from what the services carry.
+ */
+async function resolveRemoteMcpIdentityForPreview(
+  base: Omit<RemoteMcpTarget, "services">,
+): Promise<RemoteMcpIdentity | null> {
+  const found = await findRemoteMcpTarget(base);
+  const resolved = found.ok ? await resolveStackRemoteMcpIdentity(found.target) : found;
+  if (resolved.ok) return resolved.identity;
+  log.warn(`Could not read the remote-MCP URLs and IAP audience: ${resolved.error}`);
+  return null;
 }

package/src/state-migrate.test.ts

@@ -156,6 +156,9 @@ function machine(initial: StateBackendRecord = { kind: "local" }) {
     planFiles: [] as { label: string; steps: number }[],
     /** What existingInProject answers (#1079); an Error is thrown. */
     existing: [] as readonly string[] | Error,
+    /** What checkAdc answers (#1078). */
+    adc: { ok: true } as { ok: true } | { ok: false; error: string },
+    adcChecks: 0,
   };
   const meta = (): MigrateInstall => ({
     installId: "gcp-firebase-acme",
@@ -169,6 +172,10 @@ function machine(initial: StateBackendRecord = { kind: "local" }) {
   const deps: MigrateDeps = {
     pulumi: p.ops,
     report,
+    checkAdc: async () => {
+      m.adcChecks++;
+      return m.adc;
+    },
     resolve: (record) =>
       resolveBackend(
         { installId: "gcp-firebase-acme", stateBackend: record },
@@ -566,3 +573,49 @@ describe("helpers", () => {
     expect(localStateNotice({ installId: "x", provider: "self-hosted" })).toBeNull();
   });
 });
+
+describe("migrateState — Application Default Credentials (#1078)", () => {
+  /** A Pulumi workspace that fails the test on any call. */
+  const untouchable = (): StatePulumiOps =>
+    new Proxy({} as StatePulumiOps, {
+      get: (_t, name) => () => {
+        throw new Error(`Pulumi ${String(name)} must not run without working ADC`);
+      },
+    });
+
+  for (const [what, error] of [
+    [
+      "missing",
+      "No Application Default Credentials on this machine; Pulumi needs them. Run `gcloud auth application-default login` and re-run this command.",
+    ],
+    [
+      "expired",
+      "The Application Default Credentials on this machine have expired (gcloud: invalid_grant: reauth related error (invalid_rapt)). Run `gcloud auth application-default login` and re-run this command.",
+    ],
+  ] as const) {
+    for (const dryRun of [false, true]) {
+      it(`${what} ADC stop the run before any Pulumi call${dryRun ? " (dry run)" : ""}`, async () => {
+        const t = machine();
+        t.m.adc = { ok: false, error };
+        const r = await migrateState(
+          t.meta(),
+          { to: "remote", dryRun },
+          { ...t.deps, pulumi: untouchable() },
+        );
+        expect(r).toEqual({ ok: false, error: `${error} Nothing was changed.` });
+        expect(t.m.adcChecks).toBe(1);
+        expect(t.m.backend).toEqual({ kind: "local" });
+        expect(t.m.backups).toBe(0);
+        expect(t.m.ensureRemoteCalls).toEqual([]);
+        expect(t.m.locked).toBe(false);
+      });
+    }
+  }
+
+  it("working ADC let the migration run", async () => {
+    const t = machine();
+    const r = await migrateState(t.meta(), { to: "remote", dryRun: false }, t.deps);
+    expect(r).toEqual({ ok: true, changed: true });
+    expect(t.m.adcChecks).toBe(1);
+  });
+});

package/src/state-migrate.ts

@@ -82,6 +82,13 @@ export interface StatePulumiOps {
 export interface MigrateDeps {
   readonly pulumi: StatePulumiOps;
   readonly report: UpgradeReporter;
+  /**
+   * #1078 — whether this machine's Application Default Credentials (which
+   * every Pulumi call here uses) work now. Checked before the first Pulumi
+   * call, so missing or expired ones stop the run with the login command
+   * instead of a page of per-resource provider errors.
+   */
+  checkAdc(): Promise<{ readonly ok: true } | { readonly ok: false; readonly error: string }>;
   /** The install's backend resolved for Pulumi. */
   resolve(record: StateBackendRecord): ResolvedBackend;
   /** Ask the operator to accept the ops backend's cost; false = cancel. */
@@ -241,6 +248,10 @@ export async function migrateState(
       };
     }
   }
+  const adc = await deps.checkAdc();
+  if (!adc.ok) {
+    return { ok: false, error: `${adc.error} Nothing was changed.` };
+  }
   const pre = report.step("Preflight: Pulumi CLI, source stack, pending operations, drift");
   let from: ResolvedBackend;
   let mode: "stack-migrate" | "export-import";

package/src/state-pulumi.ts

@@ -20,6 +20,11 @@ import * as automation from "@pulumi/pulumi/automation";
 import { redactCredentials } from "./checkpoint-secrets.js";
 import { GCP_STACK_ENV } from "./gcp-names.js";
 import { collectPreviewSteps } from "./preview-plan.js";
+import {
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "./stack-contract.js";
 import type { ResolvedBackend } from "./state-backend.js";
 import type { StatePulumiOps } from "./state-migrate.js";
 import {
@@ -68,6 +73,12 @@ export interface RealPulumiOpsInputs {
   readonly impersonateServiceAccount: string;
   /** The config a wizard run sets, so a preview shows real drift only. */
   readonly stackConfig: StackConfigInputs;
+  /**
+   * #1082 — the remote-MCP identity read from the live install, as the
+   * installer reads it before its `up` (null when it cannot be read: the
+   * stack's config then stays as it is). Asked once per preview.
+   */
+  readonly resolveRemoteMcpIdentity: () => Promise<RemoteMcpIdentity | null>;
 }
 
 /** {@link StatePulumiOps} backed by the `pulumi` CLI + Automation API. */
@@ -195,6 +206,16 @@ export function realStatePulumiOps(inputs: RealPulumiOpsInputs): StatePulumiOps
           []) as StateResource[];
         await applyStackConfig(stack, inputs.stackConfig, resources);
       }
+      // #1082 — the identity env the stack declares, set the way the
+      // installer sets it before every `up`: from the live install. A stack
+      // last applied before the stack owned it has no such config yet, and
+      // its preview would show the vars removed.
+      const identity = await inputs.resolveRemoteMcpIdentity();
+      if (identity) {
+        await stack.setConfig(`caelo-${inputs.provider}:${REMOTE_MCP_IDENTITY_CONFIG}`, {
+          value: serializeRemoteMcpIdentity(identity),
+        });
+      }
       await assertStackProject(stack, inputs.provider, inputs.stackConfig.projectId);
       // #737 — the steps themselves, not just the summary's count: a
       // refusal lists what would change, replaces and deletes first.

package/src/upgrade/converge.ts

@@ -364,8 +364,10 @@ export function startConverge(
     // name identities the env contract cannot (stack-contract.ts
     // RemoteMcpIdentity). Resolved here, read-only, and set by the rolls
     // (AppRollHooks.afterMigrations `extraEnv`), so they ride the new
-    // revisions. A failure leaves the vars as the services have them and
-    // warns: only remote MCP depends on them.
+    // revisions. The stack declares the same derived values from the config
+    // the installer writes before `up` (#1082), so neither writer undoes the
+    // other. A failure leaves the vars as the services have them and warns:
+    // only remote MCP depends on them.
     const s = r.step("Resolving the remote-MCP URLs and IAP audience...");
     const resolved = await resolveRemoteMcpIdentity(
       {