@caelo-cms/provisioning 0.3.3 → 0.3.5

package/dist/adapter.d.ts

@@ -81,7 +81,7 @@ export interface CloudAdapterOutputs {
     /** Which environment this output snapshot represents. */
     readonly environment: Environment;
 }
-export type SupportedProvider = "self-hosted" | "gcp" | "aws" | "azure";
+export type SupportedProvider = "self-hosted" | "gcp" | "gcp-firebase" | "aws" | "azure";
 /**
  * Convenience: the shape persisted in `cms_admin.provisioning_outputs.outputs_json`.
  * Pulumi runs the adapter, the CLI's `pulumi-output-sync` subcommand reads

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAC3D,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,WAAW,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,qFAAqF;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAC3D,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,WAAW,GAAG,QAAQ,CAAC;AAErE,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,qFAAqF;IACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caelo-cms/provisioning",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "private": false,
   "license": "MPL-2.0",
   "description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
@@ -33,12 +33,12 @@
     "package.json"
   ],
   "scripts": {
-    "typecheck": "tsc -b",
+    "typecheck": "tsc -b && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json",
     "build": "tsc -b --force",
-    "prepublishOnly": "tsc -b --force"
+    "prepublishOnly": "tsc -b --force && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
   },
   "dependencies": {
-    "@caelo-cms/shared": "^0.3.3",
+    "@caelo-cms/shared": "^0.3.5",
     "@clack/prompts": "1.3.0",
     "@pulumi/aws": "^7",
     "@pulumi/awsx": "^3",
@@ -47,7 +47,9 @@
     "@pulumi/gcp": "^9",
     "@pulumi/pulumi": "^3",
     "@pulumi/random": "^4.19.2",
-    "kleur": "4.1.5"
+    "kleur": "4.1.5",
+    "ts-node": "^10",
+    "typescript": "^5"
   },
   "publishConfig": {
     "access": "public"

package/stacks/gcp/index.ts

@@ -935,7 +935,7 @@ new gcp.bigquery.DatasetIamMember(
 
 const tokenInfo = generateBootstrapToken();
 
-const dnsRecordsRequired: pulumi.Output<DnsRecord[]> = lbIp.address.apply((ip) => [
+const dnsRecordsRequired: pulumi.Output<DnsRecord[]> = lbIp.address.apply((ip): DnsRecord[] => [
   {
     hostname: domain,
     type: "A",

package/stacks/gcp/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "target": "es2022",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "noEmit": true
+  },
+  "include": ["index.ts"],
+  "ts-node": {
+    "transpileOnly": true,
+    "compilerOptions": {
+      "module": "nodenext",
+      "moduleResolution": "nodenext"
+    }
+  }
+}

package/stacks/gcp-firebase/index.ts

@@ -309,7 +309,11 @@ const firebaseCustomDomain = new gcp.firebase.HostingCustomDomain(
   `${namePrefix}-firebase-apex`,
   {
     project,
-    siteId: firebaseSite.siteId,
+    // Use the input string (known at config time) instead of the
+    // resource's siteId output — the typed output is
+    // `Output<string | undefined>` but Input<string> doesn't accept
+    // undefined.
+    siteId: firebaseSiteId,
     customDomain: domain,
     waitDnsVerification: false,
   },
@@ -419,7 +423,9 @@ const adminSvc = cloudRunService({
   iapEnabled: true,
   extraEnv: [
     { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
-    { name: "CAELO_FIREBASE_SITE", value: firebaseSite.siteId },
+    // Use the input string (known at config time) — resource output
+    // is Output<string | undefined> which Input<string> rejects.
+    { name: "CAELO_FIREBASE_SITE", value: firebaseSiteId },
     { name: "CAELO_GENERATOR_CLI", value: "/app/apps/static-generator/src/cli.ts" },
     // v0.3.1 — Firebase publisher needs the gateway service name +
     // region to declare the /api/** rewrite when creating each
@@ -516,7 +522,12 @@ const dnsRecords: pulumi.Output<DnsRecord[]> = pulumi
         ?.flatMap((s) => s.resourceRecords ?? [])
         .map((r) => ({ type: r.type ?? "CNAME", value: r.rrdata ?? "" })) ?? [];
     for (const t of adminTargets) {
-      out.push({ host: adminDomain, type: t.type as DnsRecord["type"], value: t.value });
+      out.push({
+        hostname: adminDomain,
+        type: t.type as DnsRecord["type"],
+        value: t.value,
+        purpose: "Admin app → Cloud Run direct (gen2 IAP-gated)",
+      });
     }
 
     // Apex — Firebase Hosting custom-domain DNS instructions.
@@ -529,9 +540,10 @@ const dnsRecords: pulumi.Output<DnsRecord[]> = pulumi
       for (const desired of apex.desireds ?? []) {
         for (const v of desired.records ?? []) {
           out.push({
-            host: domain,
+            hostname: domain,
             type: (v.type ?? "A") as DnsRecord["type"],
             value: v.rdata ?? "",
+            purpose: "Public site → Firebase Hosting CDN",
           });
         }
       }
@@ -539,24 +551,40 @@ const dnsRecords: pulumi.Output<DnsRecord[]> = pulumi
     return out;
   });
 
-const bootstrapToken = generateBootstrapToken();
-
-const outputs: CloudAdapterOutputs = {
-  adminUrl: pulumi.interpolate`https://${adminDomain}`,
-  gatewayUrl: gatewaySvc.uri,
-  staticUrl: `https://${domain}`,
-  adminDatabaseUrl,
-  publicDatabaseUrl,
-  bootstrapToken,
-  dnsRecords,
+const tokenInfo = generateBootstrapToken();
+
+// Cast pulumi.Output<string> values to plain `string` to satisfy the
+// shared CloudAdapterOutputs shape. Pulumi serialises Outputs to
+// plain strings in stack outputs at runtime; the cast bridges the
+// build-time type. Same pattern as packages/provisioning/stacks/gcp/index.ts.
+const out: CloudAdapterOutputs = {
+  adminDatabaseUrl: adminDatabaseUrl as unknown as string,
+  publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
+  // Firebase Hosting serves media via its own CDN; we proxy through
+  // the Firebase site's apex domain for canonical URLs.
+  mediaCdnBaseUrl: `https://${domain}/media` as unknown as string,
+  bootstrapUrl:
+    pulumi.interpolate`https://${adminDomain}/setup?token=${tokenInfo.token}` as unknown as string,
+  dnsRecordsRequired: dnsRecords as unknown as DnsRecord[],
+  // gcp-firebase doesn't provision BigQuery sinks today (no LB → no
+  // edge log stream). v0.3.x+ adds a Firebase Hosting log export.
+  edgeLogSinkUrl: `bigquery://${project}/firebase_logs` as unknown as string,
+  provider: "gcp-firebase",
+  environment: env,
 };
 
-export const adminUrl = outputs.adminUrl;
-export const gatewayUrl = outputs.gatewayUrl;
-export const staticUrl = outputs.staticUrl;
-export const adminDatabaseUrlOut = outputs.adminDatabaseUrl;
-export const publicDatabaseUrlOut = outputs.publicDatabaseUrl;
-export const bootstrapTokenOut = outputs.bootstrapToken;
-export const dnsRecordsOut = outputs.dnsRecords;
-export const firebaseSiteIdOut = firebaseSite.siteId;
-export const firebaseSiteName = firebaseSite.name;
+export const adminDatabaseUrlOut = out.adminDatabaseUrl;
+export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const mediaStorageUrlOut = out.mediaStorageUrl;
+export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
+export const bootstrapUrlOut = out.bootstrapUrl;
+export const dnsRecordsRequiredOut = out.dnsRecordsRequired;
+export const edgeLogSinkUrlOut = out.edgeLogSinkUrl;
+export const providerOut = out.provider;
+export const environmentOut = out.environment;
+export const adminCloudRunUrlOut = adminSvc.uri;
+export const gatewayCloudRunUrlOut = gatewaySvc.uri;
+export const adminDomainOut = adminDomain;
+export const firebaseSiteIdOut = firebaseSiteId;
+export const bootstrapTokenExpiresAtOut = tokenInfo.expiresAt;

package/stacks/gcp-firebase/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "target": "es2022",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "noEmit": true
+  },
+  "include": ["index.ts"],
+  "ts-node": {
+    "transpileOnly": true,
+    "compilerOptions": {
+      "module": "nodenext",
+      "moduleResolution": "nodenext"
+    }
+  }
+}