@caelo-cms/provisioning 0.10.44 → 0.10.47

package/dist/adc-impersonation.d.ts

@@ -0,0 +1,28 @@
+import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
+export type AdcCheck = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    /** `no-adc`: no Application Default Credentials; `denied`: they can't impersonate. */
+    readonly reason: "no-adc" | "denied" | "error";
+    readonly error: string;
+};
+/**
+ * Verify the credential chain Pulumi will use: the operator's Application
+ * Default Credentials exist and may mint a token for the provisioner. Run
+ * before `pulumi up` so a missing login or grant fails here with the fix,
+ * not halfway through the stack. `freshGrant` waits out IAM propagation
+ * (a new binding can take minutes to apply). Both tokens stay in this
+ * function: neither is printed nor kept.
+ */
+export declare function checkAdcImpersonation(target: {
+    readonly projectId: string;
+    readonly operatorAccount: string;
+    freshGrant: boolean;
+}, deps?: {
+    run?: GcloudRunner;
+    sleep?: Sleep;
+    fetch?: typeof fetch;
+    env?: NodeJS.ProcessEnv;
+}): Promise<AdcCheck>;
+//# sourceMappingURL=adc-impersonation.d.ts.map

package/dist/adc-impersonation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adc-impersonation.d.ts","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,YAAY,EAAa,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAa7E,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,EAC7F,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAO,GAC9F,OAAO,CAAC,QAAQ,CAAC,CAqGnB"}

package/dist/adc-impersonation.js

@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Pre-flight for the keyless provisioner's credential chain (#696): before
+ * `pulumi up`, verify that the operator's Application Default Credentials
+ * exist and may mint a token for `caelo-provisioner` — the exact chain
+ * Pulumi's GCP provider uses (wizards/gcp-pulumi.ts `pulumiGcpEnv`). A
+ * missing login or grant then fails here with the fix, not halfway through
+ * the stack. See provisioner-identity.ts for the design.
+ *
+ * Both access tokens involved (the ADC source token and the minted one)
+ * stay in local variables: never printed, logged, returned or written.
+ */
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep } from "./gcloud-retry.js";
+import { operatorMember, PROPAGATION_DELAYS_MS, provisionerServiceAccountEmail, TOKEN_CREATOR_ROLE, withoutAmbientGoogleCredentials, } from "./provisioner-identity.js";
+/** A user-managed service account's email, as IAM reports it. */
+const SERVICE_ACCOUNT_EMAIL = /^[a-z][a-z0-9-]{4,28}[a-z0-9]@[a-z][a-z0-9.:-]*[a-z0-9]\.iam\.gserviceaccount\.com$/;
+/**
+ * Verify the credential chain Pulumi will use: the operator's Application
+ * Default Credentials exist and may mint a token for the provisioner. Run
+ * before `pulumi up` so a missing login or grant fails here with the fix,
+ * not halfway through the stack. `freshGrant` waits out IAM propagation
+ * (a new binding can take minutes to apply). Both tokens stay in this
+ * function: neither is printed nor kept.
+ */
+export async function checkAdcImpersonation(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const doFetch = deps.fetch ?? fetch;
+    const sa = provisionerServiceAccountEmail(target.projectId);
+    const env = withoutAmbientGoogleCredentials(deps.env ?? process.env);
+    const adc = await run(["auth", "application-default", "print-access-token"], { env });
+    const sourceToken = adc.ok ? adc.stdout.trim() : "";
+    if (!sourceToken) {
+        return {
+            ok: false,
+            reason: "no-adc",
+            error: [
+                "No Application Default Credentials on this machine.",
+                `Infrastructure runs authenticate with your own Google login and impersonate ${sa}; no key file is used.`,
+                `Run \`gcloud auth application-default login\` (sign in as ${target.operatorAccount}), then re-run.`,
+            ].join("\n"),
+        };
+    }
+    // The account to impersonate is the one IAM reports, not a string
+    // assembled from install.json: what goes into the request is an email
+    // Google confirmed exists in the project (CodeQL js/file-access-to-http:
+    // local file data never reaches the network unchecked).
+    const described = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        `--project=${target.projectId}`,
+        "--format=value(email)",
+    ], { env });
+    const confirmed = described.ok ? described.stdout.trim().toLowerCase() : "";
+    if (!SERVICE_ACCOUNT_EMAIL.test(confirmed) || confirmed !== sa.toLowerCase()) {
+        return {
+            ok: false,
+            reason: "error",
+            error: `Could not find ${sa} in project ${target.projectId}${described.ok ? "" : `: ${described.stderr.trim().split("\n").slice(-1)[0] ?? ""}`}. Re-run the installer so it creates the provisioner service account.`,
+        };
+    }
+    const delays = target.freshGrant ? PROPAGATION_DELAYS_MS : [];
+    let status = 0;
+    let detail = "";
+    for (let attempt = 0;; attempt++) {
+        try {
+            const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(confirmed)}:generateAccessToken`, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${sourceToken}`,
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    scope: ["https://www.googleapis.com/auth/cloud-platform"],
+                    lifetime: "300s",
+                }),
+            });
+            status = res.status;
+            // Drain the body without keeping the minted token; only the error text matters.
+            const text = await res.text();
+            if (res.ok)
+                return { ok: true };
+            detail = errorMessage(text);
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: "error",
+                error: `Could not reach the IAM Credentials API: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+        const delay = delays[attempt];
+        if (status !== 403 || delay === undefined)
+            break;
+        await sleep(delay);
+    }
+    if (status !== 403) {
+        return {
+            ok: false,
+            reason: "error",
+            error: `Impersonating ${sa} failed (HTTP ${status}): ${detail}`,
+        };
+    }
+    const adcAccount = await tokenAccount(doFetch, sourceToken);
+    const mismatch = adcAccount && adcAccount.toLowerCase() !== target.operatorAccount.trim().toLowerCase();
+    return {
+        ok: false,
+        reason: "denied",
+        error: [
+            `Your Application Default Credentials${adcAccount ? ` (${adcAccount})` : ""} may not impersonate ${sa}: ${detail}`,
+            mismatch
+                ? `They belong to another account than gcloud (${target.operatorAccount}), which holds ${TOKEN_CREATOR_ROLE} on it. Run \`gcloud auth application-default login\` as ${target.operatorAccount}, then re-run.`
+                : `The account needs ${TOKEN_CREATOR_ROLE} on ${sa}. A grant made moments ago can take a few minutes to apply: wait, then re-run. Otherwise ask a project Owner to run:\n  gcloud iam service-accounts add-iam-policy-binding ${sa} --project=${target.projectId} --member=${operatorMember(adcAccount || target.operatorAccount)} --role=${TOKEN_CREATOR_ROLE} --condition=None`,
+        ].join("\n"),
+    };
+}
+function errorMessage(body) {
+    try {
+        const parsed = JSON.parse(body);
+        if (parsed.error?.message)
+            return parsed.error.message;
+    }
+    catch {
+        // not JSON — fall through to the raw text
+    }
+    return body.trim().slice(0, 300) || "(no body)";
+}
+/** The email an access token belongs to (Google's tokeninfo), or "" when unknown. */
+async function tokenAccount(doFetch, accessToken) {
+    try {
+        const res = await doFetch("https://oauth2.googleapis.com/tokeninfo", {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({ access_token: accessToken }).toString(),
+        });
+        if (!res.ok)
+            return "";
+        const info = (await res.json());
+        return typeof info.email === "string" ? info.email : "";
+    }
+    catch {
+        return "";
+    }
+}
+//# sourceMappingURL=adc-impersonation.js.map

package/dist/adc-impersonation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adc-impersonation.js","sourceRoot":"","sources":["../src/adc-impersonation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,8BAA8B,EAC9B,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AAEnC,iEAAiE;AACjE,MAAM,qBAAqB,GACzB,qFAAqF,CAAC;AAWxF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA6F,EAC7F,OAA6F,EAAE;IAE/F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,EAAE,GAAG,8BAA8B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,+BAA+B,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE;gBACL,qDAAqD;gBACrD,+EAA+E,EAAE,wBAAwB;gBACzG,6DAA6D,MAAM,CAAC,eAAe,iBAAiB;aACrG,CAAC,IAAI,CAAC,IAAI,CAAC;SACb,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,SAAS,GAAG,MAAM,GAAG,CACzB;QACE,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,uBAAuB;KACxB,EACD,EAAE,GAAG,EAAE,CACR,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,kBAAkB,EAAE,eAAe,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,uEAAuE;SACtN,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,SAAS,CAAC,sBAAsB,EAC1H;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,WAAW,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,CAAC,gDAAgD,CAAC;oBACzD,QAAQ,EAAE,MAAM;iBACjB,CAAC;aACH,CACF,CAAC;YACF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACpB,gFAAgF;YAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAChC,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,4CAA4C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aAChG,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM;QACjD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,MAAM,MAAM,MAAM,EAAE;SAChE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,QAAQ,GACZ,UAAU,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzF,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE;YACL,uCAAuC,UAAU,CAAC,CAAC,CAAC,KAAK,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,KAAK,MAAM,EAAE;YAClH,QAAQ;gBACN,CAAC,CAAC,+CAA+C,MAAM,CAAC,eAAe,kBAAkB,kBAAkB,4DAA4D,MAAM,CAAC,eAAe,gBAAgB;gBAC7M,CAAC,CAAC,qBAAqB,kBAAkB,OAAO,EAAE,8KAA8K,EAAE,cAAc,MAAM,CAAC,SAAS,aAAa,cAAc,CAAC,UAAU,IAAI,MAAM,CAAC,eAAe,CAAC,WAAW,kBAAkB,mBAAmB;SACpX,CAAC,IAAI,CAAC,IAAI,CAAC;KACb,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;QACpE,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC;AAClD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,YAAY,CAAC,OAAqB,EAAE,WAAmB;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,yCAAyC,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;SACpE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;QACvD,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/checkpoint-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkpoint-secrets.d.ts","sourceRoot":"","sources":["../src/checkpoint-secrets.ts"],"names":[],"mappings":"AA4BA,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,YAAY,CAAC;IAC7D,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AA2CD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,aAAa,EAAE,CAetE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAElE;AAED,0FAA0F;AAC1F,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEjF;AAcD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,OAAO,GAAG,aAAa,EAAE,CAO1E;AAcD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAgBtD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,GACtE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAO3D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CASlE;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAuB5F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD"}
+{"version":3,"file":"checkpoint-secrets.d.ts","sourceRoot":"","sources":["../src/checkpoint-secrets.ts"],"names":[],"mappings":"AA6BA,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,YAAY,CAAC;IAC7D,gEAAgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AA2CD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,aAAa,EAAE,CAetE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAElE;AAED,0FAA0F;AAC1F,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAEjF;AAcD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,OAAO,GAAG,aAAa,EAAE,CAO1E;AAcD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAgBtD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,GACtE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAO3D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CASlE;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB5F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD"}

package/dist/checkpoint-secrets.js

@@ -22,6 +22,7 @@
  * future secret output is caught without being listed here.
  */
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { selfCommand } from "./self-command.js";
 import { DATABASE_ROLE_SECRET } from "./stack-contract.js";
 /** `scheme://user:password@` — the user-info of a URL that carries a password. */
 const CREDENTIAL_URL = /[a-z][a-z0-9+.-]{0,31}:\/\/([^\s:@/]*):([^\s@/]+)@/gi;
@@ -216,7 +217,7 @@ const ROLE_BY_USER = DATABASE_ROLE_SECRET;
  * @param installId the install, named in each command so it acts on the right one
  */
 export function rotationHints(removed, installId) {
-    const rotate = (secret) => `bunx @caelo-cms/provisioning rotate-secret ${secret} --install ${installId}`;
+    const rotate = (secret) => selfCommand("rotate-secret", secret, "--install", installId);
     const hints = new Set();
     for (const f of removed) {
         if (f.kind === "credential-url") {

package/dist/checkpoint-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"checkpoint-secrets.js","sourceRoot":"","sources":["../src/checkpoint-secrets.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAqB,MAAM,qBAAqB,CAAC;AAgB9E,kFAAkF;AAClF,MAAM,cAAc,GAAG,sDAAsD,CAAC;AAE9E,0FAA0F;AAC1F,MAAM,WAAW,GACf,6FAA6F,CAAC;AAEhG;;;;GAIG;AACH,MAAM,UAAU,GAAG,4EAA4E,CAAC;AAEhG,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,GAAG;SACV,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY;IACjD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,IAAI,GAAG,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,kEAAkE;YAClE,kDAAkD;YAClD,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1F,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,IAAY;IAC1D,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,yBAAyB,CAAC,UAAmB,EAAE,IAAY;IACzE,cAAc,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B,EAAE,IAAY;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACvG,sHAAsH,CACzH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAmB;IACvD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,wFAAwF;AACxF,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACtC,OAAO;QACL,GAAI,cAAc,CAAC,IAAI,CAA6B;QACpD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;aACnE,GAAG,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAAE,SAAS;YAC9F,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAuE;IAEvE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS;QACvB,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7C,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,oBAAoE,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAiC,EAAE,SAAiB;IAChF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,8CAA8C,MAAM,cAAc,SAAS,EAAE,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,KAAK,CAAC,GAAG,CACP,MAAM;gBACJ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,uDAAuD,MAAM,CAAC,MAAM,CAAC,EAAE;gBAClF,CAAC,CAAC,iCAAiC,CAAC,CAAC,IAAI,IAAI,GAAG,kCAAkC,CAAC,CAAC,IAAI,eAAe,CAC1G,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CACP,yLAAyL,CAC1L,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CACP,+CAA+C,CAAC,CAAC,IAAI,mCAAmC,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,oDAAoD,EAAE,SAAS,CAAC,CAAC;AACvF,CAAC"}
+{"version":3,"file":"checkpoint-secrets.js","sourceRoot":"","sources":["../src/checkpoint-secrets.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAqB,MAAM,qBAAqB,CAAC;AAgB9E,kFAAkF;AAClF,MAAM,cAAc,GAAG,sDAAsD,CAAC;AAE9E,0FAA0F;AAC1F,MAAM,WAAW,GACf,6FAA6F,CAAC;AAEhG;;;;GAIG;AACH,MAAM,UAAU,GAAG,4EAA4E,CAAC;AAEhG,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,GAAG;SACV,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,IAAY;IACjD,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,IAAI,GAAG,EAAE;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,kEAAkE;YAClE,kDAAkD;YAClD,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1F,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,IAAY;IAC1D,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,yBAAyB,CAAC,UAAmB,EAAE,IAAY;IACzE,cAAc,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,KAA+B,EAAE,IAAY;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACvG,sHAAsH,CACzH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAmB;IACvD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,wFAAwF;AACxF,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC;IACtC,OAAO;QACL,GAAI,cAAc,CAAC,IAAI,CAA6B;QACpD,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;aACnE,GAAG,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;gBAAE,SAAS;YAC9F,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAuE;IAEvE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS;QACvB,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QACvD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC7C,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc;IAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,oBAAoE,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAiC,EAAE,SAAiB;IAChF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,KAAK,CAAC,GAAG,CACP,MAAM;gBACJ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,uDAAuD,MAAM,CAAC,MAAM,CAAC,EAAE;gBAClF,CAAC,CAAC,iCAAiC,CAAC,CAAC,IAAI,IAAI,GAAG,kCAAkC,CAAC,CAAC,IAAI,eAAe,CAC1G,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,KAAK,CAAC,GAAG,CACP,yLAAyL,CAC1L,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CACP,+CAA+C,CAAC,CAAC,IAAI,mCAAmC,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,oDAAoD,EAAE,SAAS,CAAC,CAAC;AACvF,CAAC"}

package/dist/cli.js

@@ -5,10 +5,16 @@
  *
  * Sub-commands:
  *   init [--domain D --owner-email E]  — first-time setup; generates
- *                                         secrets, writes .caelo/, runs
- *                                         `docker compose up -d`, prints
- *                                         the bootstrap token URL.
+ *                                         secrets, resolves + cosign-verifies
+ *                                         the release images, writes .caelo/,
+ *                                         prints the start steps + the
+ *                                         bootstrap token URL. `--dev` runs a
+ *                                         Caelo checkout instead (contributors).
  *   up                                  — re-runs against existing config.
+ *   migrate                             — applies DB migrations with the
+ *                                         admin image the install runs.
+ *   upgrade [--version X]               — verified, backed-up, health-checked
+ *                                         image roll with rollback.
  *   regenerate-caddy                    — re-emits Caddyfile from the
  *                                         domains table; runs `caddy reload`.
  *   backup --to <path>                  — pgBackRest full + MinIO mirror →
@@ -22,19 +28,38 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { defaultStagingHost, normalizeStagingHost, stagingHostProblem } from "@caelo-cms/shared";
+import { CAELO_VERSION, defaultStagingHost, normalizeStagingHost, stagingHostProblem, } from "@caelo-cms/shared";
 import { generateBootstrapToken } from "./bootstrap-token.js";
 import { generateCaddyfile } from "./caddy.js";
 import { redactCredentials } from "./checkpoint-secrets.js";
 import { initDelegatesToWizard, resolveCliRoute } from "./cli-routing.js";
-import { generateDockerCompose } from "./compose.js";
+import { BOOTSTRAP_DIR, generateDockerCompose, } from "./compose.js";
+import { selfCommand } from "./self-command.js";
+import { bunHostRunner, readRelease, recordRelease, releaseImages, resolveVerifiedRelease, } from "./self-hosted-release.js";
 import { convergeSelfHostedRoles, decideUp } from "./self-hosted-roles.js";
 const REPO_ROOT = resolve(import.meta.dir, "../../..");
-const CAELO_DIR = resolve(REPO_ROOT, ".caelo");
+/**
+ * Whether this CLI runs from a Caelo source checkout (contributor) rather
+ * than from an installed package (`bunx @caelo-cms/provisioning` puts it in
+ * a package cache, where `../../..` is a `node_modules` dir).
+ */
+const IN_REPO_CHECKOUT = existsSync(resolve(REPO_ROOT, "packages/provisioning/package.json")) &&
+    existsSync(resolve(REPO_ROOT, "bun.lock"));
+/**
+ * The install's `.caelo/` dir: `$CAELO_SELF_HOSTED_DIR` when set; in a
+ * checkout the repo's own `.caelo/` (dev mode bind-mounts `../..` from it);
+ * otherwise `./.caelo` in the working directory — never inside a package
+ * cache, which `bunx` may wipe.
+ */
+const CAELO_DIR = process.env.CAELO_SELF_HOSTED_DIR
+    ? resolve(process.env.CAELO_SELF_HOSTED_DIR)
+    : resolve(IN_REPO_CHECKOUT ? REPO_ROOT : process.cwd(), ".caelo");
 const CONFIG_PATH = resolve(CAELO_DIR, "config.json");
 const COMPOSE_PATH = resolve(CAELO_DIR, "docker-compose.yml");
 const CADDYFILE_PATH = resolve(CAELO_DIR, "Caddyfile");
-const PENDING_TOKEN_PATH = resolve(CAELO_DIR, "pending-token.json");
+// The admin container mounts only `.caelo/bootstrap/` (compose.ts), never the
+// secrets next to it, and consumes the token from there on first boot.
+const PENDING_TOKEN_PATH = resolve(CAELO_DIR, BOOTSTRAP_DIR, "pending-token.json");
 // P15 — `cms-provision init --provider <name>` writes here so subsequent
 // commands route to the right Pulumi stack. Defaults to "self-hosted"
 // when missing (preserves the P14 path).
@@ -110,23 +135,7 @@ function emitConfig(cfg, extraDomains = []) {
         cfg.stagingDomain = defaultStagingHost(cfg.domain);
         saveConfig(cfg);
     }
-    if (!cfg.rolePasswords) {
-        // `init` sets them and `up` back-fills + applies them before calling here.
-        throw new Error("config has no rolePasswords — run `cms-provision up`");
-    }
-    // Generate compose + Caddyfile from the canonical config.
-    const compose = generateDockerCompose({
-        domain: cfg.domain,
-        postgresPassword: cfg.postgresPassword,
-        rolePasswords: cfg.rolePasswords,
-        minioRootUser: cfg.minioRootUser,
-        minioRootPassword: cfg.minioRootPassword,
-        caeloSecretKek: cfg.caeloSecretKek,
-        anthropicApiKey: cfg.anthropicApiKey,
-        resendApiKey: cfg.resendApiKey,
-        diskSize: "20Gi",
-    });
-    writeFileSync(COMPOSE_PATH, compose);
+    writeFileSync(COMPOSE_PATH, renderCompose(cfg, installImages(cfg)), { mode: 0o600 });
     // Seed the install with the operator's primary domain plus a staging
     // sibling. Extra domains added via /settings/domains are appended by
     // regenerate-caddy when it queries the live domains table.
@@ -145,6 +154,44 @@ function emitConfig(cfg, extraDomains = []) {
     });
     writeFileSync(CADDYFILE_PATH, caddy);
 }
+/** The Compose file for `cfg` running `images` (secrets come from config.json). */
+function renderCompose(cfg, images) {
+    if (!cfg.rolePasswords) {
+        // `init` sets them and `up` back-fills + applies them before calling here.
+        throw new Error("config has no rolePasswords — run `cms-provision up`");
+    }
+    if (!cfg.caeloSecretKek)
+        throw new Error("config has no caeloSecretKek — run `cms-provision up`");
+    return generateDockerCompose({
+        domain: cfg.domain,
+        postgresPassword: cfg.postgresPassword,
+        rolePasswords: cfg.rolePasswords,
+        minioRootUser: cfg.minioRootUser,
+        minioRootPassword: cfg.minioRootPassword,
+        caeloSecretKek: cfg.caeloSecretKek,
+        anthropicApiKey: cfg.anthropicApiKey,
+        resendApiKey: cfg.resendApiKey,
+        diskSize: "20Gi",
+        images,
+    });
+}
+/**
+ * The admin + gateway images the install runs: the checkout in dev mode,
+ * else the digests recorded in release.json. An install with neither (made
+ * before #696, still running the repo bind mount) is moved to the prebuilt
+ * images by `upgrade` — no silent fallback to the bind mount.
+ */
+function installImages(cfg) {
+    if (cfg.imageMode === "dev")
+        return { mode: "dev" };
+    const release = readRelease(CAELO_DIR);
+    if (!release) {
+        throw new Error(`${CAELO_DIR}/release.json records no release images. This install predates the prebuilt\n` +
+            `images (it ran the repo bind mount): run \`${selfCommand("upgrade")}\` to move it to the signed\n` +
+            'release images. (A contributor checkout that wants the bind mount sets "imageMode": "dev" in config.json.)');
+    }
+    return releaseImages(release);
+}
 function dedupeDomains(list) {
     // Two domain entries with the same (hostname, kind) collapse to the
     // first occurrence — the seed wins over operator additions on a
@@ -178,7 +225,7 @@ async function init() {
         return;
     }
     if (!domain || !ownerEmail) {
-        console.error("Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com\n" +
+        console.error("Usage: cms-provision init [--provider self-hosted] --domain example.com [--staging-domain staging.example.com] --owner-email me@example.com [--version x.y.z] [--skip-verify] [--dev]\n" +
             "Cloud providers (gcp | gcp-firebase | aws | azure) run the wizard: cms-provision --provider <name>");
         process.exit(2);
     }
@@ -197,6 +244,33 @@ async function init() {
         console.error(`--staging-domain: ${stagingProblem}`);
         process.exit(2);
     }
+    // #696 — the prebuilt release images, resolved to digests and
+    // cosign-verified BEFORE anything is written, so a failed check leaves no
+    // half-made install. `--dev` (contributors only) runs this checkout instead.
+    const dev = process.argv.includes("--dev");
+    if (dev && !IN_REPO_CHECKOUT) {
+        console.error("--dev runs the admin + gateway from a Caelo source checkout and only works from one\n" +
+            "(bun packages/provisioning/src/cli.ts init --dev …). End-user installs omit it.");
+        process.exit(2);
+    }
+    const version = (arg("version") ?? CAELO_VERSION).replace(/^v/, "");
+    const skipVerify = process.argv.includes("--skip-verify");
+    let images = { mode: "dev" };
+    if (!dev) {
+        console.log(`Resolving + verifying the Caelo ${version} release images …`);
+        const resolved = await resolveVerifiedRelease(version, {
+            runner: bunHostRunner,
+            skipVerify,
+            onProgress: (m) => console.log(`  ${m}`),
+        });
+        if (!resolved.ok) {
+            console.error(resolved.error);
+            process.exit(1);
+        }
+        if (skipVerify)
+            console.warn("--skip-verify set — image signatures NOT verified.");
+        images = resolved.images;
+    }
     saveProvider(providerArg);
     const cfg = {
         domain,
@@ -211,8 +285,12 @@ async function init() {
         caeloSecretKek: randomSecret(32),
         anthropicApiKey: process.env.ANTHROPIC_API_KEY,
         resendApiKey: process.env.RESEND_API_KEY,
+        imageMode: dev ? "dev" : "release",
     };
     saveConfig(cfg);
+    if (images.mode === "release") {
+        recordRelease(CAELO_DIR, { version, images }, { from: null, to: version, outcome: "installed" });
+    }
     emitConfig(cfg);
     // Mint the bootstrap token and stage it for hooks.server.ts to insert
     // on first request. The CLI doesn't talk to Postgres directly because
@@ -220,7 +298,8 @@ async function init() {
     // first boot, calls owner_bootstrap_tokens.insert, then deletes the
     // staging file.
     const tok = generateBootstrapToken();
-    writeFileSync(PENDING_TOKEN_PATH, JSON.stringify(tok, null, 2));
+    mkdirSync(resolve(CAELO_DIR, BOOTSTRAP_DIR), { recursive: true, mode: 0o700 });
+    writeFileSync(PENDING_TOKEN_PATH, JSON.stringify(tok, null, 2), { mode: 0o600 });
     // P15.1 — mint the shared HMAC secret for /api/internal/* endpoints.
     // Same secret is read by:
     //   - admin app (process.env.CAELO_INTERNAL_SECRET),
@@ -236,10 +315,15 @@ async function init() {
     console.log(`Wrote ${CADDYFILE_PATH}`);
     console.log(`Wrote ${PENDING_TOKEN_PATH} (admin will insert on first boot)`);
     console.log("");
+    console.log(images.mode === "release"
+        ? `Images: Caelo ${version}, pinned by digest (${images.admin.split("@")[1]?.slice(0, 19)}…)`
+        : "Images: DEV MODE — admin + gateway run this checkout (contributors only).");
+    console.log("");
     console.log("Next steps:");
-    console.log(`  cd ${CAELO_DIR}`);
-    console.log("  docker compose up -d");
-    console.log("  # Wait ~30s for Postgres + Caddy + ACME");
+    console.log(`  docker compose -f ${COMPOSE_PATH} up -d postgres`);
+    console.log(`  ${selfCommand("migrate")}     # applies the database migrations`);
+    console.log(`  docker compose -f ${COMPOSE_PATH} up -d`);
+    console.log("  # Wait ~30s for Caddy + ACME");
     console.log("");
     console.log("Then visit:");
     console.log(`  https://${domain}/setup?token=${tok.token}`);
@@ -579,6 +663,75 @@ async function restore() {
     }).exited;
     console.log("Restore complete.");
 }
+/**
+ * #696 — `migrate`: apply the database migrations with the admin image the
+ * install runs (a one-off `docker compose run` of its migration entrypoint,
+ * as the GCP migrate job does). Postgres must be up; idempotent.
+ */
+async function migrate() {
+    requireSelfHosted("migrate");
+    if (!existsSync(COMPOSE_PATH)) {
+        console.error(`no Compose file — run \`${selfCommand("init")}\` first`);
+        process.exit(2);
+    }
+    const { runMigrations } = await import("./self-hosted-upgrade.js");
+    const r = await runMigrations(CAELO_DIR, bunHostRunner);
+    if (!r.ok) {
+        console.error(r.error);
+        process.exit(1);
+    }
+    console.log("Migrations applied (cms_admin + cms_public).");
+}
+/**
+ * Whether `upgrade` targets this directory's self-hosted Compose install.
+ * `--install <id|domain|all>` always names cloud installs (install.json),
+ * so it goes to the lifecycle selector even where a `.caelo/` exists.
+ */
+function selfHostedInstallPresent() {
+    return (arg("install") === undefined && existsSync(CONFIG_PATH) && loadProvider() === "self-hosted");
+}
+/**
+ * #696 — `upgrade` for a self-hosted install: verified digests, pg_dump
+ * backup, pull, migrations, admin-then-gateway roll with health checks and
+ * rollback (self-hosted-upgrade.ts).
+ */
+async function upgradeSelfHostedCommand(opts) {
+    const cfg = loadConfig();
+    if (!cfg) {
+        console.error("no config — run `cms-provision init` first");
+        process.exit(2);
+    }
+    if (cfg.imageMode === "dev") {
+        console.error("This is a DEV MODE install: the admin + gateway run your Caelo checkout, so there are\n" +
+            "no images to upgrade. Update the checkout (git pull), then `bun packages/provisioning/src/cli.ts migrate` and\n" +
+            `\`docker compose -f ${COMPOSE_PATH} restart caelo-admin caelo-gateway\`.`);
+        process.exit(2);
+    }
+    const { upgradeSelfHosted } = await import("./self-hosted-upgrade.js");
+    const result = await upgradeSelfHosted(opts, {
+        caeloDir: CAELO_DIR,
+        runner: bunHostRunner,
+        renderCompose: (images) => renderCompose(cfg, images),
+        log: {
+            step: (m) => console.log(`\n==> ${m}`),
+            info: (m) => console.log(`    ${m}`),
+            warn: (m) => console.warn(`    ! ${m}`),
+            error: (m) => console.error(`    x ${m}`),
+        },
+    });
+    if (result.ok) {
+        if (result.status === "upgraded" && cfg.imageMode !== "release") {
+            cfg.imageMode = "release";
+            saveConfig(cfg);
+        }
+        return;
+    }
+    console.error(`\nUpgrade failed at "${result.stage}":\n${result.error}`);
+    console.error(result.previousRunning
+        ? "The previous release is still the one running."
+        : "The install may be degraded — see above.");
+    process.exit(1);
+}
 const cmd = process.argv[2];
 /**
  * P15 — `pulumi-output-sync`. Reads `pulumi stack output --json` from
@@ -667,6 +820,7 @@ const handlers = {
     init,
     up,
     "regenerate-caddy": regenerateCaddy,
+    migrate,
     // §11.C lifecycle dispatchers route by provider via install metadata.
     // Self-hosted bodies remain reachable as `<command>-self-hosted` for
     // back-compat scripts that bypassed the dispatcher.
@@ -681,6 +835,9 @@ const handlers = {
     truncate: lifecycleTruncate,
     "admin-domain": adminDomain,
     "staging-domain": stagingDomain,
+    // #696 — Pulumi state in the install's own project.
+    state: async () => (await import("./state-command.js")).stateCommand(process.argv),
+    attach: async () => (await import("./state-command.js")).attachCommand(process.argv),
     // Misc
     "pulumi-output-sync": pulumiOutputSync,
     version,
@@ -695,7 +852,6 @@ async function lifecycleStatus() {
     await statusCommand();
 }
 async function lifecycleUpgrade() {
-    const { upgradeCommand } = await import("./lifecycle.js");
     // P20 — version + channel flags. Default = latest stable.
     //   bunx @caelo-cms/provisioning upgrade
     //   bunx @caelo-cms/provisioning upgrade --version 0.5.3
@@ -708,14 +864,27 @@ async function lifecycleUpgrade() {
         ? channelArg
         : undefined;
     const skipVerify = process.argv.includes("--skip-verify");
+    if (selfHostedInstallPresent()) {
+        await upgradeSelfHostedCommand({
+            ...(version ? { version } : {}),
+            ...(channel ? { channel } : {}),
+            ...(skipVerify ? { skipVerify: true } : {}),
+        });
+        return;
+    }
+    // #696 — `--skip-health-check` rolls without the post-roll deep health
+    //   check (Cloud Run readiness only), e.g. for a release that predates it.
+    const skipHealthCheck = process.argv.includes("--skip-health-check");
     // #607 — optional; must match the install's recorded region (upgrade
     // never moves an install between regions).
     const region = arg("region");
+    const { upgradeCommand } = await import("./lifecycle.js");
     await upgradeCommand({
         ...(region ? { region } : {}),
         ...(version ? { version } : {}),
         ...(channel ? { channel } : {}),
         ...(skipVerify ? { skipVerify: true } : {}),
+        ...(skipHealthCheck ? { skipHealthCheck: true } : {}),
     });
 }
 async function lifecycleBackup() {
@@ -761,7 +930,7 @@ async function domainMappingCommand(kind) {
         console.log(`Usage: cms-provision ${command} enable [--install <install-id>]${kind === "staging" ? " [--staging-domain <host>] [--rotate-staging-password] [--show-staging-password]" : ""}`);
         process.exit(2);
     }
-    const { installFlag, installStagingHost, listInstalls, recordableStagingHost, selectInstall, writeMetadata, } = await import("./install-state.js");
+    const { installFlag, installStagingHost, currentMetadata, listInstalls, recordableStagingHost, selectInstall, writeMetadata, } = await import("./install-state.js");
     const { enableAdminDomain, enableStagingDomain } = await import("./admin-domain.js");
     // Guessing among several installs could map the domain in the wrong project.
     const selected = selectInstall(listInstalls().filter((m) => m.projectId), installFlag(process.argv));
@@ -769,7 +938,7 @@ async function domainMappingCommand(kind) {
         console.error(selected.message);
         process.exit(1);
     }
-    let meta = selected.meta;
+    let meta = currentMetadata(selected.meta);
     // The command to re-run after a stop before the admin was updated: an
     // explicitly requested host must survive it, or the retry would map the
     // admin's old host (codex review on #681).
@@ -981,7 +1150,7 @@ if (route.kind === "handler" || route.kind === "wizard") {
     }
 }
 else {
-    console.log("Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] | <init|up|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|pulumi-output-sync|version> [options]\n" +
+    console.log("Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] | <init|up|migrate|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|state migrate|attach|pulumi-output-sync|version> [options]\n" +
         "With several installs on this machine, pick one with --install <install-id or domain> (status, upgrade and backup also take --install all); in a terminal you are asked otherwise.\n" +
         "Pass --no-wizard with no sub-command to print this usage instead of the wizard.");
     process.exit(cmd && !cmd.startsWith("-") ? 2 : 0);