@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/wizards/gcp-cost.ts

@@ -11,7 +11,12 @@
  * + AI calls + storage growth on top.
  */
 
-import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  memoryQuantityMiB,
+  parseSchedulerIntervalMinutes,
+  SERVICE_CPU_IDLE,
+} from "../stack-contract.js";
 
 export interface CostLine {
   name: string;
@@ -41,6 +46,82 @@ export interface CostEstimateInputs {
   provider?: "gcp" | "gcp-firebase";
   /** #607 — the install region; shown in the table (prices are {@link PRICED_REGION} rates). */
   region: string;
+  /** #1140 — the `schedulerIntervalMinutes` knob (1–15); undefined: the default. */
+  schedulerIntervalMinutes?: number;
+}
+
+/**
+ * #1140 — Workflows steps one scheduler tick costs (scheduler-setup.ts
+ * schedulerWorkflowSource): the claims `assign`, the signJwt call (a Google
+ * API, billed as an internal step), the `return` — and the POST to the
+ * admin, the one external HTTP step.
+ */
+export const SCHEDULER_TICK_STEPS = { internal: 3, external: 1 } as const;
+
+/**
+ * Workflows list prices (USD, cloud.google.com/workflows/pricing, as of
+ * 2026-11) and the monthly free tier per billing account.
+ */
+const WORKFLOWS_PRICE = {
+  internalPer1000: 0.01,
+  externalPer1000: 0.025,
+  freeInternal: 5_000,
+  freeExternal: 2_000,
+} as const;
+
+/** Cloud Scheduler: $0.10 per job a month; the first 3 per billing account are free. */
+const SCHEDULER_JOB_USD = 0.1;
+
+/**
+ * #1140 — what the scheduler tick costs a month at `minutes` between ticks:
+ * the Cloud Scheduler job (priced as paid — the 3 free jobs are shared
+ * with every other project on the billing account) plus the Workflows
+ * steps past the free tier. What the tick costs on the admin's side is
+ * priced on the admin's own line ({@link adminKeptWarmByTicks}).
+ */
+export function schedulerTickMonthlyUsd(minutes: number): number {
+  const ticks = Math.ceil((30 * 24 * 60) / parseSchedulerIntervalMinutes(minutes));
+  const internal = Math.max(
+    0,
+    ticks * SCHEDULER_TICK_STEPS.internal - WORKFLOWS_PRICE.freeInternal,
+  );
+  const external = Math.max(
+    0,
+    ticks * SCHEDULER_TICK_STEPS.external - WORKFLOWS_PRICE.freeExternal,
+  );
+  const usd =
+    SCHEDULER_JOB_USD +
+    (internal / 1000) * WORKFLOWS_PRICE.internalPer1000 +
+    (external / 1000) * WORKFLOWS_PRICE.externalPer1000;
+  return Math.round(usd * 100) / 100;
+}
+
+/**
+ * Cloud Run instance-based billing (CPU always allocated) list rates, USD,
+ * tier-1 region, cloud.google.com/run/pricing as of 2026-11. The free tier
+ * is left out: it is shared by every service on the billing account.
+ */
+const CLOUD_RUN_INSTANCE_PRICE = { vcpuSecond: 0.000018, gibSecond: 0.000002 } as const;
+
+/** Seconds in the 30-day month the table prices. */
+const MONTH_SECONDS = 30 * 24 * 60 * 60;
+
+/**
+ * #1140 — whether the scheduler tick keeps a scale-to-zero admin instance
+ * up around the clock. Cloud Run keeps an idle instance for up to 15
+ * minutes after its last request, and the tick comes at most every 15
+ * minutes, so with CPU always allocated (`SERVICE_CPU_IDLE.admin` false
+ * until #1361) the instance never stops and is billed every second. With
+ * request-billed CPU an idle instance costs nothing between ticks.
+ */
+export function adminKeptWarmByTicks(adminMinInstances: number): boolean {
+  return adminMinInstances === 0 && !SERVICE_CPU_IDLE.admin;
+}
+
+/** One always-on admin instance (1 vCPU, `gib` memory) a month at instance-based list rates. */
+export function alwaysOnAdminInstanceUsd(gib: number): number {
+  const perSecond = CLOUD_RUN_INSTANCE_PRICE.vcpuSecond + gib * CLOUD_RUN_INSTANCE_PRICE.gibSecond;
+  return Math.round(perSecond * MONTH_SECONDS);
 }
 
 /** The region the price table's list rates are for. */
@@ -71,6 +152,7 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
   const sqlMonthly = Math.round(sqlBase * sqlMultiplier);
 
   const provider = inputs.provider ?? "gcp";
+  const schedulerMinutes = parseSchedulerIntervalMinutes(inputs.schedulerIntervalMinutes);
   const adminMemory = inputs.adminMemory ?? ADMIN_MEMORY_DEFAULT;
   const adminMiB = memoryQuantityMiB(adminMemory);
   if (adminMiB === null) {
@@ -91,17 +173,20 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
     },
     {
       name: `Cloud Run admin (${adminMemory})`,
-      // FIXME(issue #1140): ~$1 once the admin runs request-billed CPU
-      // (SERVICE_CPU_IDLE). Until then each editing session is billed for
-      // as long as the instance stays up, ~15 minutes past its last request.
-      monthlyUsd:
-        inputs.adminMinInstances === 0
+      // FIXME(issue #1361): with request-billed CPU (SERVICE_CPU_IDLE) the
+      // ticks stop keeping the instance up and this line drops to ~$7 of
+      // editing sessions. Until then the scheduler tick (#1140) keeps one
+      // instance up around the clock, billed at the always-on rate.
+      monthlyUsd: adminKeptWarmByTicks(inputs.adminMinInstances)
+        ? alwaysOnAdminInstanceUsd(adminGiB)
+        : inputs.adminMinInstances === 0
           ? 7
           : Math.round(1 + inputs.adminMinInstances * perMinInstanceUsd),
-      notes:
-        inputs.adminMinInstances === 0
-          ? "scale-to-zero, CPU always allocated while running; ~$7/mo light editorial use"
-          : `${inputs.adminMinInstances} min-instance${inputs.adminMinInstances > 1 ? "s" : ""} (no cold start)`,
+      notes: adminKeptWarmByTicks(inputs.adminMinInstances)
+        ? `scale-to-zero, but CPU is always allocated and the scheduler tick (every ${schedulerMinutes} min) comes before Cloud Run's 15-minute idle shutdown, so one instance (1 vCPU, ${adminMemory}) runs around the clock until request-billed CPU lands (#1361)`
+        : inputs.adminMinInstances === 0
+          ? "scale-to-zero, request-billed CPU; ~$7/mo light editorial use, ticks inside the free tier"
+          : `${inputs.adminMinInstances} min-instance${inputs.adminMinInstances > 1 ? "s" : ""} (no cold start); the scheduler tick adds nothing, the instance is up anyway`,
     },
     {
       name: "Quality checks (Cloud Run audit job)",
@@ -116,13 +201,24 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
         "one short container per server-side screenshot or page render (~20-40 s at 1 vCPU / 2 GiB): ~$0.001 each, a 50-page site import ~$0.05; mostly in the free tier; capture bucket ~$0",
     },
     {
-      name: "Cloud Run gateway",
+      // #1328 — on gcp-firebase the visitor gateway is the new
+      // `caelo-<env>-data-gateway` service; same billing either way.
+      name: provider === "gcp" ? "Cloud Run gateway" : "Cloud Run data gateway",
       monthlyUsd: inputs.gatewayMinInstances === 0 ? 1 : 1 + inputs.gatewayMinInstances * 15,
       notes:
         inputs.gatewayMinInstances === 0
           ? "scale-to-zero; ~$1/mo light traffic"
           : `${inputs.gatewayMinInstances} min-instance${inputs.gatewayMinInstances > 1 ? "s" : ""}`,
     },
+    {
+      // #1328 — remote MCP's sign-in service, its own service on every
+      // install (E14 a of #763): always provisioned, zero minimum instances,
+      // CPU only during requests, so it costs nothing while nobody connects.
+      name: "Cloud Run MCP-Auth-Proxy",
+      monthlyUsd: 0,
+      notes:
+        "scale-to-zero, request-based CPU; only external AI apps' sign-in and MCP calls wake it, mostly in the free tier",
+    },
     // v0.3.3 — LB / Cloud CDN / Cloud Armor lines apply only to the
     // gcp variant. gcp-firebase has no LB (Firebase Hosting is the
     // edge); no Cloud CDN line (Firebase Hosting has its own CDN
@@ -148,12 +244,18 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
               : "Free tier — rate limit + OWASP basic rules",
           },
           {
-            // #806 — the remote-MCP throttle (src/remote-mcp-edge.ts) is one
-            // more rule on the gateway's policy; Cloud Armor Standard bills
-            // each rule at about $1/mo.
-            name: "Cloud Armor rule: remote MCP throttle",
-            monthlyUsd: 1,
-            notes: "Per-IP throttle for /api/mcp/* (remote MCP clients)",
+            // #1328 — the MCP-Auth-Proxy's own backend (serverless NEG +
+            // backend service, no extra LB fee: same URL map) with its own
+            // Cloud Armor policy carrying the remote-MCP throttle
+            // (src/remote-mcp-edge.ts) and the default rule. Cloud Armor
+            // Standard: $0.006849315/policy-hour (~$5/mo) and
+            // $0.001369863/rule-hour (~$1/mo), plus $0.75 per million
+            // requests on a global policy — cloud.google.com/armor/pricing,
+            // checked 2026-11-02.
+            name: "MCP-Auth-Proxy backend + Cloud Armor policy",
+            monthlyUsd: 7,
+            notes:
+              "own policy ($5) with 2 rules ($2): per-IP throttle for remote MCP clients; requests ~$0",
           },
         ] satisfies CostLine[])
       : ([
@@ -175,7 +277,7 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       name: "Secret Manager (runtime secrets)",
       monthlyUsd: 0.2,
       notes:
-        "6 active versions free, then ~$0.06 each; the Google sign-in client (#914) and the remote-MCP seal key (#806)",
+        "6 active versions free, then ~$0.06 each; the Google sign-in client (#914), the remote-MCP seal key (#806) and the staging database login's password (#1329; the staging database itself shares the Cloud SQL instance at no extra cost)",
     },
     {
       name: "BigQuery edge log sink",
@@ -194,6 +296,11 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       notes:
         "Hourly ~20 s job keeps Google IAP in step with the user list; within the Cloud Run free tier, 1 of 3 free scheduler jobs",
     },
+    {
+      name: `Scheduler tick (Cloud Scheduler + Workflows, every ${schedulerMinutes} min)`,
+      monthlyUsd: schedulerTickMonthlyUsd(schedulerMinutes),
+      notes: `one job starts a ${SCHEDULER_TICK_STEPS.internal + SCHEDULER_TICK_STEPS.external}-step workflow that calls the admin's periodic work and plugin workers; ~${Math.ceil((30 * 24 * 60) / schedulerMinutes)} ticks/mo; what the ticks cost on the admin is on the admin line`,
+    },
   ];
 
   // Cents, so a sub-dollar line (the KMS key) doesn't print float noise.

package/src/wizards/gcp.ts

@@ -30,6 +30,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { CLOUD_SQL_CA_BUNDLE, verifyFullQuery } from "@caelo-cms/shared";
 import { cancel, confirm, isCancel, log, note, select, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { checkAdcImpersonation } from "../adc-impersonation.js";
@@ -67,7 +68,11 @@ import {
   REQUIRED_API_LIST,
   serviceAccountExists,
 } from "../gcloud.js";
-import { GCP_STACK_ENV, upgraderServiceAccountEmail } from "../gcp-names.js";
+import {
+  GCP_STACK_ENV,
+  schedulerServiceAccountEmail,
+  upgraderServiceAccountEmail,
+} from "../gcp-names.js";
 import { INFRA_CONTRACT_VERSION } from "../infra-contract.js";
 import {
   INSTALL_JOB_NAME,
@@ -115,9 +120,12 @@ import {
   resolveStackRemoteMcpIdentity,
 } from "../remote-mcp.js";
 import type { RunMode } from "../run-mode.js";
+import { ensureSchedulerTick } from "../scheduler-setup.js";
 import { selfCommand } from "../self-command.js";
 import {
   ABSENT_DEFAULT_FIREWALL_RULES,
+  cloudSqlPrivateDnsName,
+  parseSchedulerIntervalMinutes,
   type RemoteMcpIdentity,
   sameRemoteMcpIdentity,
 } from "../stack-contract.js";
@@ -134,6 +142,7 @@ import {
 import { acquireStateLock, GcsStateStore } from "../state-store.js";
 import { createReleaseImageForms, platformDigestsOf } from "../upgrade/image-forms.js";
 import {
+  releaseImageRef,
   releaseVersionForDigest,
   resolveOpsImageRef,
   verifyCosignAll,
@@ -231,7 +240,15 @@ export async function runGcpWizard(opts: GcpWizardOpts): Promise<void> {
   // drops the LB / Cloud CDN / Cloud Armor lines (saves ~$19/mo
   // vs gcp). Default 'gcp' for backwards compatibility with
   // installs that don't set the field.
-  const estimate = estimateGcpCost({ ...GCP_STACK_KNOB_DEFAULTS, provider, region });
+  const estimate = estimateGcpCost({
+    ...GCP_STACK_KNOB_DEFAULTS,
+    provider,
+    region,
+    // #1140 — the tick's line follows the knob the wizard recorded.
+    ...(meta?.schedulerIntervalMinutes !== undefined
+      ? { schedulerIntervalMinutes: meta.schedulerIntervalMinutes }
+      : {}),
+  });
   note(
     [
       bold(
@@ -357,7 +374,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   const deployed = isStepDone(installId, `pulumi-up-${projectId}`);
   if (deployed) {
     // The kept release must be able to use the env the stack deploys.
-    const runtimeEnv = await checkDeployedRuntimeEnv({ projectId, region });
+    const runtimeEnv = await checkDeployedRuntimeEnv({ provider, projectId, region });
     if (!runtimeEnv.ok) {
       cancel(runtimeEnv.error);
       process.exit(1);
@@ -366,7 +383,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   const choice = await chooseImageDigests({
     recorded: recordedImageDigests(meta),
     deployed,
-    readLive: () => readDeployedImageDigests({ projectId, region }),
+    readLive: () => readDeployedImageDigests({ provider, projectId, region }),
     resolveLatest: resolveImageDigests,
   });
   if (!choice.ok) {
@@ -520,6 +537,18 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // === 11.45. The converge job: releases that change the cloud setup (#819) ===
   const convergeReady = await stepConvergeJob(projectId, region, releaseVersion);
 
+  // === 11.47. The scheduler tick: periodic work + plugin workers (#1140) ===
+  // Before operator access, which keeps the scheduler's account on IAP.
+  const schedulerReady = await stepSchedulerTick(
+    projectId,
+    region,
+    provider,
+    ownerEmail,
+    identity?.identity.adminUrl ?? null,
+    meta.schedulerIntervalMinutes,
+  );
+  const keepScheduler = schedulerReady || (await schedulerExists(projectId));
+
   // === 11.5. Operator access: IAP follows the Caelo user list ===
   await stepOperatorAccessSync(
     projectId,
@@ -527,18 +556,27 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     provider,
     ownerEmail,
     keepSigner ? [`serviceAccount:${upgraderServiceAccountEmail(projectId, GCP_STACK_ENV)}`] : [],
+    keepScheduler ? [schedulerServiceAccountEmail(projectId, GCP_STACK_ENV)] : [],
   );
 
   // === 11.6. Remote MCP (#806): LB rules (gcp) + a check of the identity env ===
   // The env itself came with `pulumi up` (step 10.05, #1082).
-  const remoteMcpReady = await stepRemoteMcp(projectId, provider, domain, identity);
+  const remoteMcpReady = await stepRemoteMcp(
+    projectId,
+    region,
+    provider,
+    domain,
+    identity,
+    imageDigests,
+  );
 
   // A fresh install ran every converge step above, so it is at this CLI's
   // infrastructure contract — recorded only when the upgrader and the
   // converge job are in place (the steps contract bumps 2 and 9 added) and
-  // remote MCP's steps (#806, bump 10) succeeded. With the release version,
-  // the admin can install the next update itself.
-  if (upgraderReady && convergeReady && remoteMcpReady) {
+  // remote MCP's steps (#806, bump 10) and the scheduler tick (#1140, bump
+  // 18) succeeded. With the release version, the admin can install the next
+  // update itself.
+  if (upgraderReady && convergeReady && remoteMcpReady && schedulerReady) {
     const version = releaseVersion;
     // #1025 — the linux/amd64 forms Cloud Run reports, next to the indexes,
     // so the upgrader recognises what serves without a registry lookup.
@@ -603,8 +641,12 @@ async function resolveImageDigests(): Promise<ImageDigests> {
   const project = "caelo-website";
   const registryRegion = "europe-west1";
   const repo = "caelo-cms-images";
-  const out = { admin: "", gateway: "" };
-  for (const service of ["admin", "gateway"] as const) {
+  const out: Record<"admin" | "gateway" | "mcp-auth-proxy", string> = {
+    admin: "",
+    gateway: "",
+    "mcp-auth-proxy": "",
+  };
+  for (const service of ["admin", "gateway", "mcp-auth-proxy"] as const) {
     const s = spinner();
     s.start(`Resolving ${service}:latest → digest...`);
     // gcloud's --filter='tag=latest' is in a transitional state (warns +
@@ -984,7 +1026,7 @@ async function stepGrantBaseRoles(
  */
 async function stepPublicRoleIsolation(projectId: string): Promise<void> {
   const s = spinner();
-  s.start("Removing public_role from the Cloud SQL superuser group...");
+  s.start("Removing the gateway logins from the Cloud SQL superuser group...");
   const r = await revokePublicRoleMemberships({
     projectId,
     env: GCP_STACK_ENV,
@@ -996,7 +1038,7 @@ async function stepPublicRoleIsolation(projectId: string): Promise<void> {
     cancel("Aborted.");
     process.exit(1);
   }
-  s.stop(green("public_role holds no database roles"));
+  s.stop(green("The gateway logins (public_role, public_staging_role) hold no database roles"));
 }
 
 /**
@@ -1202,6 +1244,78 @@ async function upgraderExists(projectId: string): Promise<boolean> {
   return r.ok;
 }
 
+/** Whether the scheduler tick's account exists from an earlier run (it keeps its IAP access). */
+async function schedulerExists(projectId: string): Promise<boolean> {
+  const r = await gcloud([
+    "iam",
+    "service-accounts",
+    "describe",
+    schedulerServiceAccountEmail(projectId, GCP_STACK_ENV),
+    `--project=${projectId}`,
+    "--format=value(email)",
+  ]);
+  return r.ok;
+}
+
+/**
+ * #1140 — set up the scheduler tick (scheduler-setup.ts): the one Cloud
+ * Scheduler job that calls the admin's tick every `schedulerIntervalMinutes`
+ * through IAP. After migrations (the admin answers the tick once its tables
+ * exist) and before operator access. Not fatal: the site works without it,
+ * but plugin workers, update checks and clean-up do not run, so a failure
+ * warns loudly and the install is not recorded at this contract — the next
+ * wizard pass or `upgrade` retries. Idempotent.
+ *
+ * @returns whether the tick is in place
+ */
+async function stepSchedulerTick(
+  projectId: string,
+  region: string,
+  provider: "gcp" | "gcp-firebase",
+  ownerEmail: string,
+  adminUrl: string | null,
+  recordedInterval: number | undefined,
+): Promise<boolean> {
+  const s = spinner();
+  s.start("Setting up the scheduler tick (periodic work and plugin workers)...");
+  const failed = (error: string) => {
+    s.stop(yellow(`Scheduler tick not set up: ${error}`));
+    log.warn(
+      `The install works, but plugin workers (newsletter sends, rating aggregates), update checks and clean-up do not run until this succeeds. Re-run the installer or ${bold(selfCommand("upgrade"))} once the cause is fixed.`,
+    );
+    return false;
+  };
+  let intervalMinutes: number;
+  try {
+    intervalMinutes = parseSchedulerIntervalMinutes(
+      recordedInterval,
+      "install.json schedulerIntervalMinutes",
+    );
+  } catch (e) {
+    return failed((e as Error).message);
+  }
+  if (!adminUrl) return failed("the admin's URL could not be read (see the remote-MCP step above)");
+  const resolved = await resolveOperatorAccessTarget({
+    provider,
+    projectId,
+    region,
+    env: GCP_STACK_ENV,
+    ownerEmail,
+  });
+  if (!resolved.ok) return failed(resolved.error);
+  const r = await ensureSchedulerTick({
+    projectId,
+    region,
+    env: GCP_STACK_ENV,
+    adminUrl,
+    resource: resolved.target.resource,
+    intervalMinutes,
+  });
+  if (!r.ok) return failed(r.error);
+  s.stop(green(`Scheduler tick ready (every ${intervalMinutes} min, ${r.done.length} steps)`));
+  return true;
+}
+
 /**
  * Set up the operator-access sync job (operator-access.ts): the only
  * principal that may change who passes IAP, run as the operator's gcloud
@@ -1214,6 +1328,7 @@ async function stepOperatorAccessSync(
   provider: "gcp" | "gcp-firebase",
   ownerEmail: string,
   mcpSigners: readonly string[],
+  iapServiceAccounts: readonly string[],
 ): Promise<void> {
   const s = spinner();
   s.start("Setting up the operator-access sync job (Google IAP follows the user list)...");
@@ -1225,7 +1340,7 @@ async function stepOperatorAccessSync(
     ownerEmail,
   });
   const r = resolved.ok
-    ? await ensureOperatorAccessSync({ ...resolved.target, mcpSigners })
+    ? await ensureOperatorAccessSync({ ...resolved.target, mcpSigners, iapServiceAccounts })
     : { ok: false as const, done: [], error: resolved.error };
   if (!r.ok) {
     s.stop(red(`Failed: ${r.error}`));
@@ -1309,9 +1424,11 @@ async function stepResolveRemoteMcpIdentity(
  */
 async function stepRemoteMcp(
   projectId: string,
+  region: string,
   provider: "gcp" | "gcp-firebase",
   domain: string,
   identity: ResolvedRemoteMcpIdentity | null,
+  imageDigests: ImageDigests,
 ): Promise<boolean> {
   const s = spinner();
   s.start(
@@ -1325,11 +1442,22 @@ async function stepRemoteMcp(
     return false;
   };
   if (!identity) return failed("its URLs and IAP audience could not be read (see above)");
-  const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
+  const proxyDigest = imageDigests["mcp-auth-proxy"];
+  if (!proxyDigest) return failed("the release records no MCP-Auth-Proxy image");
+  const edge = await ensureRemoteMcpEdge({
+    provider,
+    projectId,
+    region,
+    env: GCP_STACK_ENV,
+    domain,
+    mcpAuthProxyImageRef: releaseImageRef("mcp-auth-proxy", proxyDigest),
+  });
   if (!edge.ok) return failed(edge.error);
   const check = await checkRemoteMcpIdentityEnv(identity.target, identity.identity);
   if (!check.ok) return failed(check.error);
-  const missing = [...check.drift.admin, ...check.drift.gateway].map((c) => c.name);
+  const missing = Object.values(check.drift)
+    .flat()
+    .map((c) => c.name);
   if (missing.length > 0) {
     return failed(`pulumi up left ${[...new Set(missing)].join(", ")} out of the services' env`);
   }
@@ -1905,8 +2033,10 @@ async function stepDrainLegacyCaeloAdminUser(projectId: string, region: string):
     pgPass,
   ]);
 
-  // Resolve the SQL instance's private IP from gcloud (avoids reading
-  // Pulumi outputs from inside the wizard).
+  // Resolve the SQL instance's DNS name from gcloud (avoids reading
+  // Pulumi outputs from inside the wizard). #1338: the job connects with
+  // verify-full, and the shared-CA certificate names the DNS name, not the
+  // private IP.
   const sqlDescr = await gcloud([
     "sql",
     "instances",
@@ -1914,16 +2044,28 @@ async function stepDrainLegacyCaeloAdminUser(projectId: string, region: string):
     "caelo-production-pg-1d65811",
     "--project",
     projectId,
-    "--format=value(ipAddresses[0].ipAddress)",
+    "--format=json(dnsNames)",
   ]);
-  const pgHost = (sqlDescr.stdout || "").trim();
+  let pgHost: string | null = null;
+  try {
+    pgHost = cloudSqlPrivateDnsName(
+      (
+        JSON.parse(sqlDescr.stdout || "{}") as {
+          dnsNames?: { name?: string; connectionType?: string }[];
+        }
+      ).dnsNames,
+    );
+  } catch {
+    pgHost = null;
+  }
   if (!pgHost) {
-    s.stop(yellow("Could not resolve Cloud SQL private IP — skipping drain"));
+    s.stop(yellow("Could not resolve the Cloud SQL instance's DNS name — skipping drain"));
     return;
   }
 
-  const adminPg = `postgres://postgres:${pgPass}@${pgHost}:5432/cms_admin`;
-  const publicPg = `postgres://postgres:${pgPass}@${pgHost}:5432/cms_public`;
+  const tls = verifyFullQuery(CLOUD_SQL_CA_BUNDLE);
+  const adminPg = `postgres://postgres:${pgPass}@${pgHost}:5432/cms_admin?${tls}`;
+  const publicPg = `postgres://postgres:${pgPass}@${pgHost}:5432/cms_public?${tls}`;
 
   // The cleanup script — uses bun's globalThis.Bun.SQL (already proven
   // pattern in hooks.server.ts + the migration runner). DO block makes

package/stacks/aws/Pulumi.yaml

@@ -34,7 +34,7 @@ config:
     description: RDS max_connections (parameter group); every service's pool size is computed from it (docs/dev/connection-budget.md).
   caelo-aws:adminMaxInstances:
     type: string
-    default: "5"
+    default: "4"
     description: Most admin tasks at once; part of the connection budget.
   caelo-aws:gatewayMaxInstances:
     type: string