@caelo-cms/provisioning 0.10.38 → 0.10.40

package/dist/checkpoint-secrets.js

@@ -0,0 +1,245 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Keeps secret material out of the files the CLI writes under
+ * `~/.caelo-<install-id>/` (#656).
+ *
+ * Only `secrets/` may hold secrets (CLAUDE.md §7, §11.C); `progress.json`
+ * and `install.json` are plain bookkeeping that tooling, backups, sync
+ * clients and agents read. Installs from before #576 checkpointed the full
+ * Pulumi outputs, whose database URLs carried admin_role's and
+ * public_role's passwords, and every install so far checkpointed the Owner
+ * setup link with its token. This module
+ *
+ *   - finds secret material in a JSON value ({@link findSecrets}), which
+ *     `markStepDone` / `writeMetadata` use to refuse writing it;
+ *   - removes it from an existing checkpoint ({@link scrubProgressFile}),
+ *     which `upgrade` and wizard re-runs call, and names the secrets to
+ *     rotate ({@link rotationHints});
+ *   - masks credentials in text the CLI prints ({@link redactCredentials}).
+ *
+ * Detection is by shape (a URL with a password, a URL with a token-like
+ * query parameter) and by key name (password, secret, token, ...), so a
+ * future secret output is caught without being listed here.
+ */
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { DATABASE_ROLE_SECRET } from "./stack-contract.js";
+/** `scheme://user:password@` — the user-info of a URL that carries a password. */
+const CREDENTIAL_URL = /[a-z][a-z0-9+.-]{0,31}:\/\/([^\s:@/]*):([^\s@/]+)@/gi;
+/** A URL query parameter that carries a credential (the Owner setup link's `?token=`). */
+const TOKEN_PARAM = /[?&](?:token|secret|password|passwd|pwd|api[_-]?key|access[_-]?key|sig|signature)=[^&\s#]+/i;
+/**
+ * Key names whose value is a secret, after lower-casing, dropping non
+ * alphanumerics and a Pulumi `Out` suffix: `postgresPassword`,
+ * `caeloSecretKek`, `bootstrap_token`, `anthropicApiKey`.
+ */
+const SECRET_KEY = /(password|passwd|passphrase|secret|secretkek|kek|token|apikey|privatekey)$/;
+function isSecretKey(key) {
+    const k = key
+        .toLowerCase()
+        .replace(/[^a-z0-9]/g, "")
+        .replace(/out$/, "");
+    return SECRET_KEY.test(k);
+}
+function urlUser(raw) {
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+function stringFindings(value, path) {
+    const found = [];
+    for (const m of value.matchAll(CREDENTIAL_URL)) {
+        found.push({ path, kind: "credential-url", user: urlUser(m[1] ?? "") });
+    }
+    if (found.length === 0 && /:\/\//.test(value) && TOKEN_PARAM.test(value)) {
+        found.push({ path, kind: "token-url" });
+    }
+    return found;
+}
+/**
+ * Every place `value` holds secret material.
+ *
+ * @param value any JSON-shaped value (a checkpoint payload, install.json)
+ * @param path the path prefix to report findings under
+ */
+export function findSecrets(value, path = "") {
+    if (typeof value === "string")
+        return stringFindings(value, path || "(value)");
+    const join = (k) => (path ? `${path}.${k}` : String(k));
+    if (Array.isArray(value))
+        return value.flatMap((v, i) => findSecrets(v, join(i)));
+    if (value !== null && typeof value === "object") {
+        return Object.entries(value).flatMap(([k, v]) => {
+            // A secret-named key is only a finding when it holds something; a
+            // null / false / 0 marker is not secret material.
+            if (isSecretKey(k) && v !== null && v !== undefined && v !== "" && typeof v !== "boolean") {
+                return [{ path: join(k), kind: "secret-key" }];
+            }
+            return findSecrets(v, join(k));
+        });
+    }
+    return [];
+}
+/**
+ * Throw when `value` holds secret material. The message names the paths,
+ * never the values, so the error itself cannot leak them.
+ *
+ * @param what what was about to be written, for the message
+ */
+export function assertNoSecrets(value, what) {
+    refuseFindings(findSecrets(value), what);
+}
+/** {@link assertNoSecrets} for a whole checkpoint (see {@link findCheckpointSecrets}). */
+export function assertNoCheckpointSecrets(checkpoint, what) {
+    refuseFindings(findCheckpointSecrets(checkpoint), what);
+}
+function refuseFindings(found, what) {
+    if (found.length === 0)
+        return;
+    throw new Error(`Refusing to write secret material to ${what} (${found.map((f) => `${f.path}: ${f.kind}`).join(", ")}). ` +
+        "Secrets belong in Secret Manager or the install's secrets/ directory; read them at the moment of use instead (#656).");
+}
+function isRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/**
+ * {@link findSecrets} for a progress.json checkpoint. Its step names are
+ * derived from operator input (`project-<project id>`), so they are
+ * identifiers, not field names: a project called `acme-token` must not read
+ * as a secret. Only the step payloads (and the other top-level fields) are
+ * inspected.
+ */
+export function findCheckpointSecrets(checkpoint) {
+    if (!isRecord(checkpoint))
+        return findSecrets(checkpoint);
+    const { steps, ...rest } = checkpoint;
+    const inSteps = isRecord(steps)
+        ? Object.entries(steps).flatMap(([name, payload]) => findSecrets(payload, `steps.${name}`))
+        : findSecrets(steps, "steps");
+    return [...findSecrets(rest), ...inSteps];
+}
+/** {@link withoutSecrets} for a checkpoint: every step is kept, its payload cleaned. */
+function checkpointWithoutSecrets(checkpoint) {
+    if (!isRecord(checkpoint))
+        return withoutSecrets(checkpoint);
+    const { steps, ...rest } = checkpoint;
+    return {
+        ...withoutSecrets(rest),
+        steps: isRecord(steps)
+            ? Object.fromEntries(Object.entries(steps).map(([n, p]) => [n, withoutSecrets(p)]))
+            : withoutSecrets(steps),
+    };
+}
+/**
+ * `value` without its secret material: secret-named keys and strings that
+ * hold a credential or token URL are dropped. Everything else is kept.
+ */
+export function withoutSecrets(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value)) {
+        return value
+            .filter((v) => typeof v !== "string" || findSecrets(v).length === 0)
+            .map(withoutSecrets);
+    }
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (findSecrets({ [k]: v }).length > 0 && (isSecretKey(k) || typeof v === "string"))
+                continue;
+            out[k] = withoutSecrets(v);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * The Pulumi outputs worth checkpointing: everything except outputs Pulumi
+ * marks secret and anything else that holds secret material (the Owner
+ * setup link). Nothing reads secrets back from the checkpoint; code that
+ * needs one reads the stack (`readStackOutput`) when it needs it.
+ *
+ * @param outputs the stack outputs as the Automation API returns them
+ */
+export function checkpointableOutputs(outputs) {
+    const kept = {};
+    for (const [k, o] of Object.entries(outputs)) {
+        if (o.secret)
+            continue;
+        if (findSecrets({ [k]: o.value }).length > 0)
+            continue;
+        kept[k] = o.value;
+    }
+    return kept;
+}
+/**
+ * Remove secret material from a `progress.json` in place. The rewrite is
+ * atomic (temp file in the same directory, then rename) and the result is
+ * mode 0600, so an interrupted scrub never leaves a truncated checkpoint
+ * and wizard re-runs still find every completed step.
+ *
+ * @param path the checkpoint file; a missing file is a no-op
+ */
+export function scrubProgressFile(path) {
+    if (!existsSync(path))
+        return { removed: [] };
+    const checkpoint = JSON.parse(readFileSync(path, "utf8"));
+    const removed = findCheckpointSecrets(checkpoint);
+    if (removed.length === 0)
+        return { removed };
+    writeJsonAtomic(path, checkpointWithoutSecrets(checkpoint));
+    return { removed };
+}
+/**
+ * Write `value` as JSON to `path` atomically with mode 0600: a temp file in
+ * the same directory (so the rename stays on one filesystem), then rename.
+ */
+export function writeJsonAtomic(path, value) {
+    const tmp = `${path}.tmp-${process.pid}`;
+    try {
+        writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch (e) {
+        rmSync(tmp, { force: true });
+        throw e;
+    }
+}
+const ROLE_BY_USER = DATABASE_ROLE_SECRET;
+/**
+ * What the operator should do about secrets a scrub removed: one line per
+ * affected secret, with the exact command where one exists.
+ *
+ * @param removed the scrub's findings
+ * @param installId the install, named in each command so it acts on the right one
+ */
+export function rotationHints(removed, installId) {
+    const rotate = (secret) => `bunx @caelo-cms/provisioning rotate-secret ${secret} --install ${installId}`;
+    const hints = new Set();
+    for (const f of removed) {
+        if (f.kind === "credential-url") {
+            const secret = f.user ? ROLE_BY_USER[f.user] : undefined;
+            hints.add(secret
+                ? `${f.user}'s password was stored in progress.json. Rotate it: ${rotate(secret)}`
+                : `A password for database user "${f.user ?? "?"}" was stored in progress.json (${f.path}); change it.`);
+        }
+        else if (f.kind === "token-url") {
+            hints.add("The Owner setup link (with its one-time token) was stored in progress.json. It expires 24 hours after it was issued and stops working once the Owner account exists; nothing to rotate.");
+        }
+        else {
+            hints.add(`A secret value was stored in progress.json (${f.path}). Rotate whatever it belongs to.`);
+        }
+    }
+    return [...hints];
+}
+/**
+ * `text` with every URL password masked (`postgresql://admin_role:***@`),
+ * for anything the CLI prints that could carry one (errors from Pulumi or
+ * gcloud, for instance). Same masking as the API gateway's error log.
+ */
+export function redactCredentials(text) {
+    return text.replace(/([a-z][a-z0-9+.-]{0,31}:\/\/[^\s:@/]*):[^\s@/]+@/gi, "$1:***@");
+}
+//# sourceMappingURL=checkpoint-secrets.js.map

package/dist/checkpoint-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-secrets.js","sourceRoot":"","sources":["../src/checkpoint-secrets.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAqB,MAAM,qBAAqB,CAAC;AAgB9E,kFAAkF;AAClF,MAAM,cAAc,GAAG,sDAAsD,CAAC;AAE9E,0FAA0F;AAC1F,MAAM,WAAW,GACf,6FAA6F,CAAC;AAEhG;;;;GAIG;AACH,MAAM,UAAU,GAAG,4EAA4E,CAAC;AAEhG,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,GAAG;SACV,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY;IACjD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,IAAI,GAAG,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,kEAAkE;YAClE,kDAAkD;YAClD,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1F,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,IAAY;IAC1D,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,yBAAyB,CAAC,UAAmB,EAAE,IAAY;IACzE,cAAc,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B,EAAE,IAAY;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACvG,sHAAsH,CACzH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAmB;IACvD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,wFAAwF;AACxF,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACtC,OAAO;QACL,GAAI,cAAc,CAAC,IAAI,CAA6B;QACpD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;aACnE,GAAG,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAAE,SAAS;YAC9F,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAuE;IAEvE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS;QACvB,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7C,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,oBAAoE,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAiC,EAAE,SAAiB;IAChF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,8CAA8C,MAAM,cAAc,SAAS,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,KAAK,CAAC,GAAG,CACP,MAAM;gBACJ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,uDAAuD,MAAM,CAAC,MAAM,CAAC,EAAE;gBAClF,CAAC,CAAC,iCAAiC,CAAC,CAAC,IAAI,IAAI,GAAG,kCAAkC,CAAC,CAAC,IAAI,eAAe,CAC1G,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CACP,yLAAyL,CAC1L,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CACP,+CAA+C,CAAC,CAAC,IAAI,mCAAmC,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,oDAAoD,EAAE,SAAS,CAAC,CAAC;AACvF,CAAC"}

package/dist/cli.js

@@ -22,8 +22,10 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { defaultStagingHost, normalizeStagingHost, stagingHostProblem } from "@caelo-cms/shared";
 import { generateBootstrapToken } from "./bootstrap-token.js";
 import { generateCaddyfile } from "./caddy.js";
+import { redactCredentials } from "./checkpoint-secrets.js";
 import { initDelegatesToWizard, resolveCliRoute } from "./cli-routing.js";
 import { generateDockerCompose } from "./compose.js";
 import { convergeSelfHostedRoles, decideUp } from "./self-hosted-roles.js";
@@ -104,6 +106,10 @@ function emitConfig(cfg, extraDomains = []) {
         cfg.caeloSecretKek = randomSecret(32);
         saveConfig(cfg);
     }
+    if (!cfg.stagingDomain) {
+        cfg.stagingDomain = defaultStagingHost(cfg.domain);
+        saveConfig(cfg);
+    }
     if (!cfg.rolePasswords) {
         // `init` sets them and `up` back-fills + applies them before calling here.
         throw new Error("config has no rolePasswords — run `cms-provision up`");
@@ -127,7 +133,7 @@ function emitConfig(cfg, extraDomains = []) {
     const baseDomains = [
         { hostname: cfg.domain, kind: "admin", env: "production" },
         { hostname: cfg.domain, kind: "public", env: "production" },
-        { hostname: `staging.${cfg.domain}`, kind: "public", env: "staging" },
+        { hostname: cfg.stagingDomain, kind: "public", env: "staging" },
     ];
     const caddy = generateCaddyfile({
         ownerEmail: cfg.ownerEmail,
@@ -172,7 +178,7 @@ async function init() {
         return;
     }
     if (!domain || !ownerEmail) {
-        console.error("Usage: cms-provision init [--provider self-hosted] --domain example.com --owner-email me@example.com\n" +
+        console.error("Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com\n" +
             "Cloud providers (gcp | gcp-firebase | aws | azure) run the wizard: cms-provision --provider <name>");
         process.exit(2);
     }
@@ -180,9 +186,21 @@ async function init() {
         console.error(`config already exists at ${CONFIG_PATH}; run \`cms-provision up\` to re-deploy`);
         process.exit(2);
     }
+    const stagingArg = arg("staging-domain");
+    const stagingProblem = stagingArg
+        ? stagingHostProblem(stagingArg, {
+            liveHosts: [domain, `www.${domain}`],
+            adminHosts: [`admin.${domain}`],
+        })
+        : null;
+    if (stagingProblem) {
+        console.error(`--staging-domain: ${stagingProblem}`);
+        process.exit(2);
+    }
     saveProvider(providerArg);
     const cfg = {
         domain,
+        stagingDomain: stagingArg ? normalizeStagingHost(stagingArg) : defaultStagingHost(domain),
         ownerEmail,
         postgresPassword: randomSecret(32),
         rolePasswords: newRolePasswords(),
@@ -667,6 +685,7 @@ const handlers = {
     destroy: lifecycleDestroy,
     truncate: lifecycleTruncate,
     "admin-domain": adminDomain,
+    "staging-domain": stagingDomain,
     // Misc
     "pulumi-output-sync": pulumiOutputSync,
     version,
@@ -725,20 +744,51 @@ async function lifecycleTruncate() {
  * (see admin-domain.ts for why this runs as the operator, not Pulumi).
  */
 async function adminDomain() {
+    await domainMappingCommand("admin");
+}
+/**
+ * #650 `staging-domain enable [--staging-domain <host>]` — bind the install's
+ * staging host (its setting, default staging.<domain>) to the gcp-firebase
+ * gateway, which serves the protected staging site. `--staging-domain`
+ * records a new host for the install first (after it was changed in the
+ * admin under Security → Domains, or to choose one).
+ */
+async function stagingDomain() {
+    await domainMappingCommand("staging");
+}
+async function domainMappingCommand(kind) {
+    const command = `${kind}-domain`;
     const sub = process.argv[3];
     if (sub !== "enable") {
-        console.log("Usage: cms-provision admin-domain enable [--install <install-id>]");
+        console.log(`Usage: cms-provision ${command} enable [--install <install-id>]${kind === "staging" ? " [--staging-domain <host>]" : ""}`);
         process.exit(2);
     }
-    const { installFlag, listInstalls, selectInstall } = await import("./install-state.js");
-    const { enableAdminDomain } = await import("./admin-domain.js");
+    const { installFlag, installStagingHost, listInstalls, selectInstall, writeMetadata } = await import("./install-state.js");
+    const { enableAdminDomain, enableStagingDomain } = await import("./admin-domain.js");
     // Guessing among several installs could map the domain in the wrong project.
     const selected = selectInstall(listInstalls().filter((m) => m.projectId), installFlag(process.argv));
     if (!selected.ok) {
         console.error(selected.message);
         process.exit(1);
     }
-    const meta = selected.meta;
+    let meta = selected.meta;
+    if (kind === "staging") {
+        // The install's staging host setting; `--staging-domain` changes it.
+        // Validated either way: the recorded/default host may predate a check
+        // (e.g. a long default staging.<domain> a Cloud Run mapping refuses).
+        const requested = arg("staging-domain");
+        const { normalizeStagingHost, stagingHostProblem } = await import("@caelo-cms/shared");
+        const host = requested ?? installStagingHost(meta);
+        const problem = stagingHostProblem(host, { liveHosts: [meta.domain, `www.${meta.domain}`], adminHosts: [`admin.${meta.domain}`] }, { provider: meta.provider });
+        if (problem) {
+            console.error(requested
+                ? `--staging-domain: ${problem}`
+                : `the install's staging host: ${problem}. Pass --staging-domain <host>.`);
+            process.exit(1);
+        }
+        meta = { ...meta, stagingDomain: normalizeStagingHost(host) };
+        writeMetadata(meta.installId, meta);
+    }
     if (!meta.projectId)
         process.exit(1);
     if (!meta.region) {
@@ -746,32 +796,105 @@ async function adminDomain() {
         process.exit(1);
     }
     if (meta.provider !== "gcp-firebase") {
-        console.log(meta.provider === "gcp"
-            ? `Nothing to do: on gcp the load balancer already serves admin.${meta.domain}.`
-            : `admin-domain is for gcp-firebase installs; this one is ${meta.provider}.`);
+        console.log(kind === "admin"
+            ? meta.provider === "gcp"
+                ? `Nothing to do: on gcp the load balancer already serves admin.${meta.domain}.`
+                : `admin-domain is for gcp-firebase installs; this one is ${meta.provider}.`
+            : meta.provider === "self-hosted"
+                ? `Recorded staging host ${installStagingHost(meta)}; Caddy serves it after \`cms-provision regenerate-caddy\`.`
+                : `staging-domain is for gcp-firebase installs; on ${meta.provider} the protected staging domain is not available yet (issue #650 follow-up).`);
         return;
     }
-    const r = await enableAdminDomain({
-        projectId: meta.projectId,
-        region: meta.region,
-        domain: meta.domain,
-    });
+    const target = { projectId: meta.projectId, region: meta.region, domain: meta.domain };
+    const r = kind === "admin"
+        ? await enableAdminDomain(target)
+        : await enableStagingDomain({ ...target, stagingHost: installStagingHost(meta) });
     if (r.status === "failed") {
-        console.error(`admin-domain: ${r.error}`);
+        console.error(`${command}: ${r.error}`);
         process.exit(1);
     }
     if (r.status === "needs-verification") {
         console.log(`Google only maps ${r.hostname} for a verified owner of ${r.verifyDomain}.\n` +
             "Search Console was opened for you: add the TXT record it shows at your registrar,\n" +
-            "click Verify, then run `cms-provision admin-domain enable` again.");
+            `click Verify, then run \`cms-provision ${command} enable\` again.`);
         process.exit(3);
     }
-    console.log(`${r.hostname} ${r.created ? "is now mapped" : "was already mapped"} to the admin.` +
-        (r.records.length > 0
-            ? `\nAdd at your registrar (TLS is issued once DNS resolves, typically 15-60 min):\n${r.records
-                .map((d) => `  ${d.type.padEnd(6)} ${d.name} -> ${d.value}`)
-                .join("\n")}`
-            : "\nGoogle has not published the DNS records yet; run the command again in a minute."));
+    const mappedTo = kind === "admin" ? "the admin" : "the gateway (protected staging site)";
+    console.log(`${r.hostname} ${r.created ? "is now mapped" : "was already mapped"} to ${mappedTo}.`);
+    if (kind === "staging") {
+        console.log("Staging access (who may open it, crawler credentials): admin → Security → Staging access.\n" +
+            "If you changed the host here, set the same host in the admin (Security → Domains) so Stage renders it.");
+    }
+    if (r.records.length === 0) {
+        console.log(`Google has not published the DNS records yet; run \`cms-provision ${command} enable\` again in a minute.`);
+        return;
+    }
+    const waited = await waitForDomainMappingCert({
+        command,
+        hostname: r.hostname,
+        records: r.records,
+        projectId: meta.projectId,
+        region: meta.region,
+    });
+    if (!waited)
+        process.exit(4);
+    console.log(kind === "admin"
+        ? `Admin login: https://${r.hostname}/login`
+        : `Protected staging site: https://${r.hostname}/`);
+}
+/**
+ * After `<kind>-domain enable` mapped the host: print the DNS records, then
+ * poll the mapping until Google has issued its certificate (cert-wait.ts),
+ * with a spinner. Returns false on timeout or a gcloud failure, after saying
+ * how to check the status. Ctrl-C is safe: the command is idempotent, and
+ * re-running it finds the mapping and resumes the wait.
+ */
+async function waitForDomainMappingCert(target) {
+    const { spinner } = await import("@clack/prompts");
+    const { CERT_WAIT_TIMEOUT_MS, domainMappingProbe, waitForCert } = await import("./cert-wait.js");
+    const { gcloud } = await import("./gcloud.js");
+    const width = Math.max(...target.records.map((d) => d.name.length));
+    console.log(`\nSet this DNS record at your registrar (if you have not already):\n${target.records
+        .map((d) => `  ${d.type.padEnd(6)} ${d.name.padEnd(width)} → ${d.value}`)
+        .join("\n")}\n` +
+        "Google issues the TLS certificate once the record resolves — usually 15-60 minutes.\n" +
+        `Safe to stop with Ctrl-C: \`cms-provision ${target.command} enable\` again resumes waiting.\n`);
+    // clack's spinner swallows SIGINT; exit explicitly so Ctrl-C stops the wait.
+    const s = spinner({
+        cancelMessage: `Stopped. Run \`cms-provision ${target.command} enable\` again to resume waiting.`,
+        onCancel: () => process.exit(130),
+    });
+    s.start(`Waiting for the certificate of ${target.hostname} (DNS set? this takes 15-60 min)`);
+    const r = await waitForCert({
+        probe: () => domainMappingProbe(gcloud, {
+            hostname: target.hostname,
+            region: target.region,
+            projectId: target.projectId,
+        }),
+        timeoutMs: CERT_WAIT_TIMEOUT_MS,
+        intervalMs: 30 * 1000,
+        onUpdate: (detail) => s.message(`${target.hostname}: ${detail}`),
+    });
+    if (r.ok) {
+        s.stop(`Certificate for ${target.hostname} is ready.`);
+        return true;
+    }
+    const check = `gcloud beta run domain-mappings describe --domain=${target.hostname} --region=${target.region} --project=${target.projectId}`;
+    if (r.reason === "error") {
+        s.error(`Could not read the domain mapping: ${r.error}`);
+        console.error(`Check it by hand with:\n  ${check}`);
+        return false;
+    }
+    s.error(`No certificate for ${target.hostname} after 60 minutes.`);
+    console.error([
+        r.lastDetail ? `Google reports: ${r.lastDetail}` : "",
+        `Check that the record resolves: dig +short ${target.hostname} ${target.records[0]?.type ?? "CNAME"}`,
+        `Check the mapping's status:    ${check}`,
+        `Once DNS resolves, run \`cms-provision ${target.command} enable\` again to resume waiting.`,
+    ]
+        .filter(Boolean)
+        .join("\n"));
+    return false;
 }
 /**
  * §11.C — interactive wizard. Loaded lazily so the bare-CLI startup
@@ -785,6 +908,7 @@ async function wizardCommand() {
         nonInteractive: process.argv.includes("--non-interactive"),
         provider: arg("provider"),
         domain: arg("domain"),
+        stagingDomain: arg("staging-domain"),
         ownerEmail: arg("owner-email"),
         projectId: arg("project-id"),
         region: arg("region"),
@@ -794,14 +918,22 @@ async function wizardCommand() {
 // documented one-command form) and a bare `cms-provision` drop into the
 // wizard. `--no-wizard` / `--help` keep the legacy "print usage" shape.
 const route = resolveCliRoute(process.argv, Object.keys(handlers));
-if (route.kind === "handler") {
-    await handlers[route.name]?.();
-}
-else if (route.kind === "wizard") {
-    await wizardCommand();
+if (route.kind === "handler" || route.kind === "wizard") {
+    try {
+        if (route.kind === "handler")
+            await handlers[route.name]?.();
+        else
+            await wizardCommand();
+    }
+    catch (e) {
+        // #656 — an error from Pulumi, gcloud or a database client can quote a
+        // connection URL; print it with any password masked.
+        console.error(redactCredentials(e instanceof Error ? (e.stack ?? e.message) : String(e)));
+        process.exit(1);
+    }
 }
 else {
-    console.log("Usage: cms-provision [wizard] [--provider <name> --domain <d> --owner-email <e> --region <r>] | <init|up|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|pulumi-output-sync|version> [options]\n" +
+    console.log("Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] | <init|up|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|pulumi-output-sync|version> [options]\n" +
         "With several installs on this machine, pick one with --install <install-id or domain> (status, upgrade and backup also take --install all); in a terminal you are asked otherwise.\n" +
         "Pass --no-wizard with no sub-command to print this usage instead of the wizard.");
     process.exit(cmd && !cmd.startsWith("-") ? 2 : 0);