@caelo-cms/provisioning 0.10.44 → 0.10.47

package/dist/upgrade/release-images.js

@@ -0,0 +1,315 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Caelo release images — where they live, how a tag becomes a digest, and
+ * which signer identity cosign must see. The ONE module for this, shared by
+ * every install path that runs the prebuilt images (CLAUDE.md §11.C):
+ *   - the GCP `upgrade` (Artifact Registry mirror, {@link RELEASE_REGISTRY});
+ *   - the self-hosted Compose install + upgrade (GHCR, the canonical
+ *     registry, {@link ghcrRepository}).
+ * Both registries carry the SAME digests: release-images.yml pushes to GHCR,
+ * signs, then `oras copy -r`s image + signature to the mirror. So one
+ * resolver and one cosign identity serve both. The in-cloud upgrader job
+ * (epic #696) takes the digests from the signed release manifest instead.
+ */
+import { confirm, isCancel, log, spinner } from "@clack/prompts";
+import { green, red } from "kleur/colors";
+/** The services every install runs, in roll order (admin first, then gateway). */
+export const RELEASE_SERVICES = ["admin", "gateway"];
+/** GHCR — the canonical registry (release-images.yml), used by self-hosted Compose. */
+export const GHCR_REGISTRY = "ghcr.io";
+export const GHCR_NAMESPACE = "caelo-cms";
+/** `ghcr.io/caelo-cms/<service>` — the repository of a service's release image. */
+export function ghcrRepository(service) {
+    return `${GHCR_REGISTRY}/${GHCR_NAMESPACE}/${service}`;
+}
+/** Where Caelo's release workflows live; every signer identity starts here. */
+export const RELEASE_WORKFLOWS_URL = "https://github.com/caelo-cms/caelo-cms/.github/workflows";
+/**
+ * The keyless signer cosign must see on every release image: one of the two
+ * release workflows of the caelo-cms repo, via GitHub's OIDC issuer. A
+ * different identity means a registry compromise, a typosquat, or a fork's
+ * image — every caller refuses to run it.
+ */
+export const RELEASE_SIGNER_IDENTITY_REGEXP = `${RELEASE_WORKFLOWS_URL}/(release-images|release).yml@.*`;
+/** OIDC issuer of every Caelo release signature — images and release manifest (GitHub Actions). */
+export const RELEASE_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
+/**
+ * The `cosign verify` argv for one image reference pinned by digest.
+ *
+ * @example cosignVerifyArgv("ghcr.io/caelo-cms/admin@sha256:…")
+ */
+export function cosignVerifyArgv(imageRef) {
+    return [
+        "cosign",
+        "verify",
+        imageRef,
+        "--certificate-identity-regexp",
+        RELEASE_SIGNER_IDENTITY_REGEXP,
+        "--certificate-oidc-issuer",
+        RELEASE_OIDC_ISSUER,
+    ];
+}
+/** A `sha256:<64 hex>` image / blob digest. */
+export const IMAGE_DIGEST = /^sha256:[0-9a-f]{64}$/;
+/** Whether `s` is a well-formed `sha256:<64 hex>` digest. */
+export function isImageDigest(s) {
+    return IMAGE_DIGEST.test(s);
+}
+const HEX_DIGITS = "0123456789abcdef";
+/**
+ * `s` rebuilt character by character from a constant alphabet when it is a
+ * well-formed digest, else null. The digest comes from a registry's HTTP
+ * header and ends up in files (release.json, the Compose file); rebuilding
+ * it — rather than passing the checked string on — guarantees that nothing
+ * but `sha256:` and 64 hex digits from our own constants is ever written.
+ */
+export function canonicalDigest(s) {
+    if (!isImageDigest(s))
+        return null;
+    const hex = [...s.slice("sha256:".length)].map((c) => HEX_DIGITS[HEX_DIGITS.indexOf(c)]);
+    return `sha256:${hex.join("")}`;
+}
+const TAG_CHARS = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-v";
+const RELEASE_TAG = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+/**
+ * A semver release tag (`v0.10.43`, `0.11.0-rc.1`) rebuilt from a constant
+ * alphabet, else null. The tag comes from the GitHub API and is recorded in
+ * release.json, so — like {@link canonicalDigest} — only our own characters
+ * reach the file.
+ */
+export function canonicalReleaseTag(s) {
+    if (s.length > 64 || !RELEASE_TAG.test(s))
+        return null;
+    return [...s].map((c) => TAG_CHARS[TAG_CHARS.indexOf(c)]).join("");
+}
+/**
+ * The registry tag for an upgrade request: an explicit version (a leading
+ * `v` dropped, as release tags are `vX.Y.Z` but image tags `X.Y.Z`), else
+ * the channel's moving tag, else `latest`.
+ */
+export function releaseTag(opts) {
+    if (opts.version)
+        return opts.version.startsWith("v") ? opts.version.slice(1) : opts.version;
+    if (opts.channel === "rc")
+        return "rc";
+    if (opts.channel === "beta")
+        return "beta";
+    return "latest";
+}
+/** Manifest media types: single-arch manifests and multi-arch indexes, Docker + OCI. */
+const MANIFEST_ACCEPT = [
+    "application/vnd.docker.distribution.manifest.v2+json",
+    "application/vnd.oci.image.manifest.v1+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+    "application/vnd.oci.image.index.v1+json",
+].join(",");
+/**
+ * Resolve `<registryHost>/<repository>:<tag>` to the digest a `docker pull`
+ * of that tag would fetch, through the Docker Registry V2 API anonymously.
+ *
+ * The images are public, but registries differ in how they say so: Artifact
+ * Registry answers the manifest HEAD directly, GHCR answers 401 with a
+ * `WWW-Authenticate: Bearer realm=…,service=…,scope=…` challenge whose realm
+ * hands out an anonymous pull token. Both paths are handled here, so callers
+ * never need registry credentials (end users have none for Caelo's).
+ *
+ * @param repository - path below the host, e.g. `caelo-cms/admin`.
+ */
+export async function resolveRegistryDigest(registryHost, repository, tag, fetchImpl = fetch) {
+    const url = `https://${registryHost}/v2/${repository}/manifests/${tag}`;
+    try {
+        let res = await fetchImpl(url, { method: "HEAD", headers: { Accept: MANIFEST_ACCEPT } });
+        if (res.status === 401) {
+            const token = await anonymousPullToken(res.headers.get("www-authenticate"), fetchImpl);
+            if (!token.ok)
+                return token;
+            res = await fetchImpl(url, {
+                method: "HEAD",
+                headers: { Accept: MANIFEST_ACCEPT, Authorization: `Bearer ${token.token}` },
+            });
+        }
+        if (!res.ok)
+            return { ok: false, reason: `HTTP ${res.status} ${res.statusText}` };
+        const header = res.headers.get("docker-content-digest");
+        const digest = header ? canonicalDigest(header) : null;
+        if (!digest) {
+            return { ok: false, reason: `unexpected digest header: ${header ?? "(missing)"}` };
+        }
+        return { ok: true, digest };
+    }
+    catch (e) {
+        return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+    }
+}
+/** Follow a registry's Bearer challenge to an anonymous pull token. */
+async function anonymousPullToken(challenge, fetchImpl) {
+    const params = parseBearerChallenge(challenge);
+    if (!params?.realm) {
+        return {
+            ok: false,
+            reason: `registry demanded auth without a Bearer challenge (${challenge})`,
+        };
+    }
+    const tokenUrl = new URL(params.realm);
+    if (params.service)
+        tokenUrl.searchParams.set("service", params.service);
+    if (params.scope)
+        tokenUrl.searchParams.set("scope", params.scope);
+    const res = await fetchImpl(tokenUrl.toString());
+    if (!res.ok)
+        return { ok: false, reason: `token endpoint HTTP ${res.status} ${res.statusText}` };
+    const body = (await res.json());
+    const token = body.token ?? body.access_token;
+    return token ? { ok: true, token } : { ok: false, reason: "token endpoint returned no token" };
+}
+/**
+ * The key/value pairs of a `Bearer k="v",k2="v2"` challenge, or null when
+ * it is not a Bearer challenge.
+ *
+ * @example parseBearerChallenge('Bearer realm="https://ghcr.io/token",service="ghcr.io"')
+ * // → { realm: "https://ghcr.io/token", service: "ghcr.io" }
+ */
+export function parseBearerChallenge(header) {
+    if (!header || !/^Bearer\s/i.test(header))
+        return null;
+    const out = {};
+    for (const m of header.slice(header.indexOf(" ") + 1).matchAll(/(\w+)="([^"]*)"/g)) {
+        const [, key, value] = m;
+        if (key && value !== undefined)
+            out[key] = value;
+    }
+    return out;
+}
+/**
+ * The tag of the newest stable Caelo release on GitHub (e.g. `v0.10.43`),
+ * or an error reason. Used to turn "upgrade to latest" into an exact
+ * version before anything is resolved, so the version an install records is
+ * a real release, never the moving `latest` tag.
+ */
+export async function fetchLatestReleaseTag(fetchImpl = fetch) {
+    try {
+        const res = await fetchImpl("https://api.github.com/repos/caelo-cms/caelo-cms/releases/latest", { headers: { Accept: "application/vnd.github+json" } });
+        if (!res.ok)
+            return { ok: false, reason: `GitHub API HTTP ${res.status} ${res.statusText}` };
+        const json = (await res.json());
+        const tag = json.tag_name ? canonicalReleaseTag(json.tag_name) : null;
+        return tag
+            ? { ok: true, tag }
+            : { ok: false, reason: `GitHub returned no usable release tag (${json.tag_name})` };
+    }
+    catch (e) {
+        return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+    }
+}
+/** Where Caelo's release images live (public Artifact Registry repo). */
+export const RELEASE_REGISTRY = {
+    region: "europe-west1",
+    project: "caelo-website",
+    repo: "caelo-cms-images",
+};
+/** The digest-pinned reference of release image `slug@digest` in the Artifact Registry mirror. */
+export function releaseImageRef(slug, digest) {
+    const r = RELEASE_REGISTRY;
+    return `${r.region}-docker.pkg.dev/${r.project}/${r.repo}/${slug}@${digest}`;
+}
+/**
+ * Resolve a tag (e.g. `0.2.6` or `latest`) to its digest in the public
+ * Artifact Registry mirror, anonymously through the Registry V2 API
+ * ({@link resolveRegistryDigest}) — the caller's gcloud session needs no IAM
+ * access to the registry's project.
+ */
+export function resolveTagDigest(image, tag) {
+    const { region, project, repo } = RELEASE_REGISTRY;
+    return resolveRegistryDigest(`${region}-docker.pkg.dev`, `${project}/${repo}/${image}`, tag);
+}
+function probeBinary(argv) {
+    try {
+        const r = Bun.spawnSync(argv, { stdout: "pipe", stderr: "pipe" });
+        return r.exitCode === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ensure cosign is on PATH. If not — and the operator is on macOS with
+ * brew available — offer to `brew install cosign` interactively. Falls
+ * back to printing the platform install URL + the --skip-verify
+ * escape hatch when auto-install isn't possible.
+ *
+ * Returns true if cosign is callable after this function returns.
+ */
+async function ensureCosignAvailable() {
+    if (probeBinary(["cosign", "version"]))
+        return true;
+    log.error(red("cosign not found on PATH — required for image-signature verification."));
+    // macOS auto-install offer. Only when `brew` is itself on PATH —
+    // otherwise the operator is on a stripped-down install where
+    // homebrew was never set up, and the manual instructions are more
+    // useful than a failing brew shell-out.
+    if (process.platform === "darwin" && probeBinary(["brew", "--version"])) {
+        const proceed = await confirm({
+            message: "Install cosign via brew now? (one-shot: brew install cosign)",
+            initialValue: true,
+        });
+        if (!isCancel(proceed) && proceed === true) {
+            const s = spinner();
+            s.start("brew install cosign");
+            const installResult = Bun.spawnSync(["brew", "install", "cosign"], {
+                stdout: "pipe",
+                stderr: "pipe",
+            });
+            if (installResult.exitCode === 0 && probeBinary(["cosign", "version"])) {
+                s.stop(green("cosign installed ✓"));
+                return true;
+            }
+            const stderr = new TextDecoder().decode(installResult.stderr);
+            s.stop(red("brew install cosign failed"));
+            log.error(stderr.trim().slice(0, 500));
+        }
+    }
+    log.warn("Install cosign:\n" +
+        "  • brew install cosign           (macOS)\n" +
+        "  • https://docs.sigstore.dev/cosign/installation/  (other)\n" +
+        "Or pass --skip-verify to roll without signature checks (NOT recommended for production).");
+    return false;
+}
+/**
+ * P21 ship 4 — verify cosign keyless signatures on every planned
+ * image digest. Sigstore Fulcio + Rekor; the certificate identity
+ * must match the Caelo release-images workflow. A mismatch means
+ * either a registry compromise, a typosquat, or the operator pointed
+ * at a fork's image. Either way: refuse to roll.
+ *
+ * Returns true on success (or skips with a clear error and returns
+ * false if cosign isn't installed / verification fails).
+ */
+export async function verifyCosignAll(plans) {
+    // Probe cosign. Bun.spawnSync THROWS ENOENT when the binary is
+    // missing (instead of returning a non-zero exit), so the probe
+    // needs try/catch — relying on `exitCode !== 0` would surface a
+    // confusing stack trace to the operator instead of the actionable
+    // "install cosign" hint.
+    if (!(await ensureCosignAvailable()))
+        return false;
+    for (const plan of plans) {
+        const s = spinner();
+        s.start(`Verifying cosign signature for ${plan.slug}@${plan.digest.slice(0, 19)}...`);
+        const fullRef = releaseImageRef(plan.slug, plan.digest);
+        const verify = Bun.spawnSync(cosignVerifyArgv(fullRef), { stdout: "pipe", stderr: "pipe" });
+        if (verify.exitCode !== 0) {
+            const stderr = new TextDecoder().decode(verify.stderr);
+            s.stop(red(`cosign verify FAILED for ${plan.slug}`));
+            log.error(red(`${plan.slug}@${plan.digest.slice(0, 19)} signature does NOT match the Caelo release workflow identity.\n` +
+                "Either:\n" +
+                "  • the registry was compromised, OR\n" +
+                "  • you're targeting a fork's image (verify your install's registry path), OR\n" +
+                "  • cosign / sigstore had a transient outage (retry).\n" +
+                `cosign stderr: ${stderr.trim().slice(0, 500)}`));
+            return false;
+        }
+        s.stop(green(`${plan.slug} signature verified ✓`));
+    }
+    return true;
+}
+//# sourceMappingURL=release-images.js.map

package/dist/upgrade/release-images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-images.js","sourceRoot":"","sources":["../../src/upgrade/release-images.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAK1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAA8B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAEhF,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,OAAuB;IACpD,OAAO,GAAG,aAAa,IAAI,cAAc,IAAI,OAAO,EAAE,CAAC;AACzD,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,0DAA0D,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,qBAAqB,kCAAkC,CAAC;AAEzG,mGAAmG;AACnG,MAAM,CAAC,MAAM,mBAAmB,GAAG,6CAA6C,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,+BAA+B;QAC/B,8BAA8B;QAC9B,2BAA2B;QAC3B,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAEpD,6DAA6D;AAC7D,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,UAAU,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,SAAS,GAAG,mEAAmE,CAAC;AACtF,MAAM,WAAW,GAAG,uCAAuC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC3C,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAG1B;IACC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAC7F,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAID,wFAAwF;AACxF,MAAM,eAAe,GAAG;IACtB,sDAAsD;IACtD,4CAA4C;IAC5C,2DAA2D;IAC3D,yCAAyC;CAC1C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,UAAkB,EAClB,GAAW,EACX,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,WAAW,YAAY,OAAO,UAAU,cAAc,GAAG,EAAE,CAAC;IACxE,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,SAAS,CAAC,CAAC;YACvF,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC5B,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QAClF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,MAAM,IAAI,WAAW,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,kBAAkB,CAC/B,SAAwB,EACxB,SAAuB;IAEvB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,sDAAsD,SAAS,GAAG;SAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO;QAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,KAAK;QAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;IACjG,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8C,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC;IAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;AACjG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnF,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAA0B,KAAK;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,kEAAkE,EAClE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,EAAE,CACvD,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;QAC7F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,OAAO,GAAG;YACR,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE;YACnB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,cAAc;IACtB,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,kBAAkB;CAChB,CAAC;AAEX,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IAC1D,MAAM,CAAC,GAAG,gBAAgB,CAAC;IAC3B,OAAO,GAAG,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,GAAW;IACzD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;IACnD,OAAO,qBAAqB,CAAC,GAAG,MAAM,iBAAiB,EAAE,GAAG,OAAO,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,WAAW,CAAC,IAAc;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,qBAAqB;IAClC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;IAExF,iEAAiE;IACjE,6DAA6D;IAC7D,kEAAkE;IAClE,wCAAwC;IACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC;YAC5B,OAAO,EAAE,8DAA8D;YACvE,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAC/B,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YACH,IAAI,aAAa,CAAC,QAAQ,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,mBAAmB;QACjB,6CAA6C;QAC7C,+DAA+D;QAC/D,0FAA0F,CAC7F,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAoE;IAEpE,+DAA+D;IAC/D,+DAA+D;IAC/D,gEAAgE;IAChE,kEAAkE;IAClE,yBAAyB;IACzB,IAAI,CAAC,CAAC,MAAM,qBAAqB,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,GAAG,CAAC,KAAK,CACP,GAAG,CACD,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kEAAkE;gBACxG,WAAW;gBACX,wCAAwC;gBACxC,iFAAiF;gBACjF,yDAAyD;gBACzD,kBAAkB,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAClD,CACF,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/upgrade/reporter.d.ts

@@ -0,0 +1,17 @@
+/** One long-running step: started once, ended exactly once. */
+export interface ReportStep {
+    done(message: string): void;
+    failed(message: string): void;
+    /** Ended without success, but the upgrade continues. */
+    warned(message: string): void;
+}
+export interface UpgradeReporter {
+    step(label: string): ReportStep;
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+    success(message: string): void;
+}
+/** The CLI's reporter: a clack spinner per step, colored log lines. */
+export declare function clackReporter(): UpgradeReporter;
+//# sourceMappingURL=reporter.d.ts.map

package/dist/upgrade/reporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../src/upgrade/reporter.ts"],"names":[],"mappings":"AAYA,+DAA+D;AAC/D,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wDAAwD;IACxD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,uEAAuE;AACvE,wBAAgB,aAAa,IAAI,eAAe,CAgB/C"}

package/dist/upgrade/reporter.js

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * How the upgrade phases (converge.ts, app-roll.ts) tell the operator what
+ * they do. The CLI renders it with clack spinners; the in-cloud upgrader job
+ * (epic #696) will write the same lines to its run log, and the tests record
+ * them. The phases never import a terminal UI themselves.
+ */
+import { log, spinner } from "@clack/prompts";
+import { green, red, yellow } from "kleur/colors";
+/** The CLI's reporter: a clack spinner per step, colored log lines. */
+export function clackReporter() {
+    return {
+        step(label) {
+            const s = spinner();
+            s.start(label);
+            return {
+                done: (m) => s.stop(green(m)),
+                failed: (m) => s.stop(red(m)),
+                warned: (m) => s.stop(yellow(m)),
+            };
+        },
+        info: (m) => log.info(m),
+        warn: (m) => log.warn(yellow(m)),
+        error: (m) => log.error(red(m)),
+        success: (m) => log.success(m),
+    };
+}
+//# sourceMappingURL=reporter.js.map

package/dist/upgrade/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../src/upgrade/reporter.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAkBlD,uEAAuE;AACvE,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,IAAI,CAAC,KAAK;YACR,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aACjC,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;KAC/B,CAAC;AACJ,CAAC"}

package/dist/upgrade/upgrade.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `cms-provision upgrade` for one gcp / gcp-firebase install: converge, then
+ * app-roll (epic #696). The order, and why:
+ *
+ *   1. plan (read-only): release digests, both services, the env contract
+ *   2. verify the images' signatures
+ *   3. pre-upgrade Cloud SQL backup — the first change; if it fails, the
+ *      install is exactly as it was
+ *   4. converge, the part before the roll (keyless provisioner, IAM, secrets,
+ *      MCP access)
+ *   5. app-roll: health baseline, migrations, the converge steps that must
+ *      follow migrations, admin + gateway rolls, deep health check, rollback
+ *      on failure, recorded digests
+ *   6. converge, the part after the roll; a complete converge records the
+ *      install's infrastructure contract version
+ *
+ * Every side effect goes through {@link GcpUpgradeDeps}, so the sequence runs
+ * against a fake gcloud in tests. lifecycle.ts wires the real ones.
+ */
+import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
+import type { ImageDigests } from "../install-state.js";
+import type { HttpFetch } from "../runtime-secrets.js";
+import { type AppRollPlan, type ReleaseImage, type RollSlug } from "./app-roll.js";
+import type { HealthProbe } from "./health.js";
+import type { UpgradeReporter } from "./reporter.js";
+export interface GcpUpgradeTarget {
+    readonly provider: "gcp" | "gcp-firebase";
+    readonly projectId: string;
+    readonly region: string;
+    /** Pulumi stack name (`production`). */
+    readonly env: string;
+    readonly domain: string;
+    readonly stagingHost: string;
+    readonly ownerEmail: string;
+    /** The tag rolled to: a version (`0.11.0`) or a channel tag (`latest`, `rc`). */
+    readonly targetTag: string;
+    /** The infrastructure contract version this CLI converges to (infra-contract.ts). */
+    readonly infraContractVersion: number;
+    readonly skipVerify: boolean;
+    readonly skipHealthCheck: boolean;
+}
+export interface GcpUpgradeDeps {
+    readonly run: GcloudRunner;
+    readonly reporter: UpgradeReporter;
+    readonly sleep?: Sleep;
+    /** Cloud SQL Admin API calls (database role passwords). */
+    readonly http?: HttpFetch;
+    readonly resolveImages: (tag: string) => Promise<{
+        readonly ok: true;
+        readonly images: Record<RollSlug, ReleaseImage>;
+    } | {
+        readonly ok: false;
+        readonly error: string;
+    }>;
+    readonly verifyImages: (images: readonly {
+        slug: string;
+        digest: string;
+    }[]) => Promise<boolean>;
+    readonly migrate: (imageRef: string) => Promise<{
+        readonly ok: boolean;
+        readonly error?: string;
+    }>;
+    readonly healthProbe: (plan: AppRollPlan) => Promise<{
+        readonly ok: true;
+        readonly probe: HealthProbe;
+    } | {
+        readonly ok: false;
+        readonly error: string;
+    }>;
+    readonly recordDigests: (digests: ImageDigests) => Promise<void>;
+    readonly recordInfraContractVersion: (version: number) => void;
+    /** The operator-identity converge step (keyless provisioner); see ConvergeDeps. */
+    readonly provisionerIdentity?: () => Promise<boolean>;
+    /** Today, for the backup's description. */
+    readonly now?: () => Date;
+}
+/** Upgrade one install; true on success. See the file comment for the order. */
+export declare function upgradeGcpInstall(target: GcpUpgradeTarget, deps: GcpUpgradeDeps): Promise<boolean>;
+//# sourceMappingURL=upgrade.d.ts.map

package/dist/upgrade/upgrade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.d.ts","sourceRoot":"","sources":["../../src/upgrade/upgrade.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,KAAK,WAAW,EAGhB,KAAK,YAAY,EACjB,KAAK,QAAQ,EAEd,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,CACtB,GAAG,EAAE,MAAM,KACR,OAAO,CACR;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;KAAE,GACtE;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CACjD,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjG,QAAQ,CAAC,OAAO,EAAE,CAChB,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,WAAW,EAAE,CACpB,IAAI,EAAE,WAAW,KACd,OAAO,CACR;QAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;KAAE,GAClD;QAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CACjD,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,QAAQ,CAAC,0BAA0B,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/D,mFAAmF;IACnF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,2CAA2C;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED,gFAAgF;AAChF,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,OAAO,CAAC,CAqHlB"}

package/dist/upgrade/upgrade.js

@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: MPL-2.0
+import { executeAppRoll, planAppRoll, reportPlan, } from "./app-roll.js";
+import { backupFailureHelp, restoreCommand, takeSqlBackup } from "./backup.js";
+import { startConverge } from "./converge.js";
+/** Upgrade one install; true on success. See the file comment for the order. */
+export async function upgradeGcpInstall(target, deps) {
+    const { reporter: r, run } = deps;
+    const { projectId } = target;
+    // 1. Plan. Nothing changes until every lookup succeeded.
+    const sPre = r.step("Pre-flight: resolving services + image digests + current revisions...");
+    const images = await deps.resolveImages(target.targetTag);
+    if (!images.ok) {
+        sPre.failed("Couldn't resolve the release images");
+        r.error(images.error);
+        return false;
+    }
+    const planned = await planAppRoll({
+        provider: target.provider,
+        projectId,
+        region: target.region,
+        env: target.env,
+        domain: target.domain,
+        stagingHost: target.stagingHost,
+    }, images.images, run);
+    if (!planned.ok) {
+        sPre.failed("Pre-flight failed");
+        r.error(planned.error);
+        return false;
+    }
+    const plan = planned.plan;
+    sPre.done(`Pre-flight ok — ${plan.services.length} services planned`);
+    reportPlan(plan, r);
+    // 2. P21 ship 4 — signatures against the Caelo release workflow's
+    // identity: refuses a compromised registry, a typosquat or a fork's image.
+    if (!target.skipVerify) {
+        if (!(await deps.verifyImages(plan.services)))
+            return false;
+    }
+    else {
+        r.warn("--skip-verify set — image signatures NOT verified.");
+    }
+    // 3. The first change: a failure leaves the install exactly as it was.
+    const sBak = r.step("Taking a pre-upgrade Cloud SQL backup...");
+    const backup = await takeSqlBackup(run, { projectId, env: target.env }, `pre-upgrade to ${target.targetTag}`, deps.now);
+    if (!backup.ok) {
+        sBak.failed(`Pre-upgrade backup failed: ${backup.error}`);
+        r.warn(backupFailureHelp({ projectId }));
+        return false;
+    }
+    sBak.done(`Pre-upgrade backup ${backup.backup.backupId} of ${backup.backup.instance} taken`);
+    // 4. Converge, the part before the roll.
+    const converge = startConverge(plan, target.ownerEmail, {
+        run,
+        reporter: r,
+        ...(deps.sleep ? { sleep: deps.sleep } : {}),
+        ...(deps.http ? { http: deps.http } : {}),
+        ...(deps.provisionerIdentity ? { provisionerIdentity: deps.provisionerIdentity } : {}),
+    });
+    if (!(await converge.beforeAppRoll()))
+        return false;
+    // 5. App-roll, with the converge steps that sit between its own.
+    let health = null;
+    if (!target.skipHealthCheck) {
+        const probe = await deps.healthProbe(plan);
+        if (!probe.ok) {
+            r.error(probe.error);
+            r.warn("No migrations ran and no traffic moved.");
+            return false;
+        }
+        health = probe.probe;
+    }
+    const rolled = await executeAppRoll({
+        plan,
+        backup: backup.backup,
+        targetVersion: /^\d+\.\d+\.\d+/.test(target.targetTag) ? target.targetTag : null,
+        // Unknown until the signed release manifest names it (epic #696).
+        migrationsContract: null,
+    }, converge.hooks, {
+        run,
+        reporter: r,
+        ...(deps.sleep ? { sleep: deps.sleep } : {}),
+        migrate: deps.migrate,
+        health,
+        recordDigests: deps.recordDigests,
+    });
+    if (!rolled.ok)
+        return false;
+    r.success(`Upgrade to ${target.targetTag} complete (admin + gateway revisions serving).`);
+    r.info(`Pre-upgrade backup: ${backup.backup.backupId} (restore: ${restoreCommand(backup.backup)})`);
+    // 6. Converge, the part after the roll.
+    await converge.afterAppRoll();
+    if (converge.complete()) {
+        try {
+            deps.recordInfraContractVersion(target.infraContractVersion);
+        }
+        catch (e) {
+            r.warn(`Could not record the infrastructure contract version (${e instanceof Error ? e.message : String(e)}); the next upgrade converges again.`);
+        }
+    }
+    else {
+        r.warn("Some converge steps did not succeed (see above); the install is not marked as converged, so in-product updates stay unavailable until a re-run of upgrade completes them.");
+    }
+    return true;
+}
+//# sourceMappingURL=upgrade.js.map

package/dist/upgrade/upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upgrade.js","sourceRoot":"","sources":["../../src/upgrade/upgrade.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAyBnC,OAAO,EAEL,cAAc,EACd,WAAW,EAGX,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAmD9C,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAwB,EACxB,IAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE7B,yDAAyD;IACzD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACnD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B;QACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,EACD,MAAM,CAAC,MAAM,EACb,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACjC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;IACtE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpB,kEAAkE;IAClE,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC/D,CAAC;IAED,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,GAAG,EACH,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAC9B,kBAAkB,MAAM,CAAC,SAAS,EAAE,EACpC,IAAI,CAAC,GAAG,CACT,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,8BAA8B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,QAAQ,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,QAAQ,CAAC,CAAC;IAE7F,yCAAyC;IACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE;QACtD,GAAG;QACH,QAAQ,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpD,iEAAiE;IACjE,IAAI,MAAM,GAAuB,IAAI,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC;QACE,IAAI;QACJ,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,aAAa,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QAChF,kEAAkE;QAClE,kBAAkB,EAAE,IAAI;KACzB,EACD,QAAQ,CAAC,KAAK,EACd;QACE,GAAG;QACH,QAAQ,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;KAClC,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,CAAC,CAAC,OAAO,CAAC,cAAc,MAAM,CAAC,SAAS,gDAAgD,CAAC,CAAC;IAC1F,CAAC,CAAC,IAAI,CACJ,uBAAuB,MAAM,CAAC,MAAM,CAAC,QAAQ,cAAc,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAC5F,CAAC;IAEF,wCAAwC;IACxC,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;IAC9B,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CACJ,yDAAyD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAC1I,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,IAAI,CACJ,2KAA2K,CAC5K,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/wizard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../src/wizard.ts"],"names":[],"mappings":"AAuBA,OAAO,EAQL,OAAO,EAER,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAKL,KAAK,QAAQ,EAKd,MAAM,oBAAoB,CAAC;AAI5B,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0HvE;AAyLD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../src/wizard.ts"],"names":[],"mappings":"AAuBA,OAAO,EAQL,OAAO,EAER,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAML,KAAK,QAAQ,EAKd,MAAM,oBAAoB,CAAC;AAK5B,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6HvE;AAyLD,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/wizard.js

@@ -21,7 +21,8 @@
 import { defaultStagingHost, normalizeStagingHost, stagingHostProblem } from "@caelo-cms/shared";
 import { cancel, confirm, intro, isCancel, log, outro, select, spinner, text, } from "@clack/prompts";
 import { bold, cyan, dim, yellow } from "kleur/colors";
-import { deriveInstallId, ensureInstallDir, listInstalls, readMetadata, resumedMetadata, scrubInstallProgress, writeMetadata, } from "./install-state.js";
+import { currentMetadata, deriveInstallId, ensureInstallDir, listInstalls, readMetadata, resumedMetadata, scrubInstallProgress, writeMetadata, } from "./install-state.js";
+import { selfCommand } from "./self-command.js";
 import { runGcpWizard } from "./wizards/gcp.js";
 import { runGcpFirebaseWizard } from "./wizards/gcp-firebase.js";
 export async function runWizard(opts = {}) {
@@ -41,9 +42,12 @@ export async function runWizard(opts = {}) {
     let projectIdHint;
     let installId;
     const existing = opts.nonInteractive ? [] : listInstalls();
-    const resumeChoice = existing.length > 0 && !opts.provider && !opts.domain && !opts.ownerEmail
+    const picked = existing.length > 0 && !opts.provider && !opts.domain && !opts.ownerEmail
         ? await pickInstallToResume(existing)
         : null;
+    // #696 — the bucket's copy for an install whose state lives there: another
+    // machine may have changed its domain or owner since this mirror was written.
+    const resumeChoice = picked ? currentMetadata(picked) : null;
     if (resumeChoice) {
         provider = resumeChoice.provider;
         domain = resumeChoice.domain;
@@ -128,7 +132,7 @@ export async function runWizard(opts = {}) {
             });
             break;
         case "self-hosted":
-            cancel("Self-hosted wizard is the existing `cms-provision init` flow. Run `bunx @caelo-cms/provisioning init --domain ... --owner-email ...` for now; wizard polish lands in a follow-up commit.");
+            cancel(`Self-hosted wizard is the existing \`cms-provision init\` flow. Run \`${selfCommand("init", "--domain", "...", "--owner-email", "...")}\` for now; wizard polish lands in a follow-up commit.`);
             process.exit(0);
             break;
         case "aws":