@caelo-cms/provisioning 0.10.44 → 0.10.47

package/dist/wizards/gcp.js

@@ -8,9 +8,14 @@
  *   5. Links billing
  *   6. Enables 13 APIs in one call
  *   7. Creates the provisioner SA + grants 15 IAM roles
- *   8. Mints a JSON SA key into `~/.caelo-<install-id>/secrets/sa-key.json`
- *   9. Generates Pulumi passphrase if absent → secrets/pulumi-passphrase
- *  10. Pre-flight cost-estimate table; single y/N confirm
+ *   8. Lets the operator's gcloud account impersonate that SA (#696): no
+ *      key is ever minted; an older install's `sa-key.json` is deleted,
+ *      locally and in IAM (provisioner-identity.ts)
+ *   9. Pre-flight cost-estimate table; single y/N confirm
+ *  10. Ensures the install's ops bucket + KMS key in its own project and
+ *      keeps Pulumi's state + install.json there (#696, ops-backend.ts).
+ *      An older install whose state is on this machine keeps it there
+ *      and its passphrase in secrets/pulumi-passphrase
  *  11. Pulumi up via the Automation SDK; streams progress, then deletes
  *      the firewall rules GCP pre-populates on the default network
  *  12. Prints DNS records + bootstrap URL + a note pointing the
@@ -25,6 +30,7 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { cancel, confirm, isCancel, log, note, select, spinner, text } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
+import { checkAdcImpersonation } from "../adc-impersonation.js";
 import { CERT_WAIT_TIMEOUT_MS, lbCertProbe, waitForCert } from "../cert-wait.js";
 import { redactCredentials } from "../checkpoint-secrets.js";
 import { removeDefaultFirewallRules } from "../default-firewall.js";
@@ -32,15 +38,19 @@ import { checkDeployedRuntimeEnv, chooseImageDigests, readDeployedImageDigests,
 import { formatDnsRecordGroups, groupDnsRecords } from "../dns/groups.js";
 import { pickDnsAdapter } from "../dns/index.js";
 import { ensureGatewayRolePassword, findSqlInstance } from "../gateway-credentials.js";
-import { activeAccount, createProject, createServiceAccount, createServiceAccountKey, enableApis, gcloud, gcloudEnv, grantProvisionerRoles, linkBilling, listBillingAccounts, PROVISIONER_ROLE_LIST, projectExists, REQUIRED_API_LIST, serviceAccountExists, } from "../gcloud.js";
+import { activeAccount, createProject, createServiceAccount, enableApis, gcloud, gcloudEnv, grantProvisionerRoles, linkBilling, listBillingAccounts, PROVISIONER_ROLE_LIST, projectExists, REQUIRED_API_LIST, serviceAccountExists, } from "../gcloud.js";
 import { GCP_STACK_ENV } from "../gcp-names.js";
-import { ensureInstallDir, installRoot, installStagingHost, isStepDone, markStepDone, readMetadata, readSecret, recordedImageDigests, recordImageDigests, writeMetadata, writeSecret, } from "../install-state.js";
+import { adoptStateBackend, ensureInstallDir, installRoot, installStagingHost, isStepDone, markStepDone, readLocalMetadata, readMetadata, readSecret, recordedImageDigests, recordImageDigests, writeMetadata, writeSecret, } from "../install-state.js";
 import { ensureOperatorAccessSync, installIapAllowlist, resolveOperatorAccessTarget, } from "../operator-access.js";
+import { ensureOpsBackend } from "../ops-backend.js";
+import { convergeKeylessProvisioner, PROVISIONER_ACCOUNT_ID, provisionerServiceAccountEmail, } from "../provisioner-identity.js";
 import { decideRegion, detectCliRegion, installableRegions, suggestRegion } from "../regions.js";
-import { ABSENT_DEFAULT_FIREWALL_RULES, ADMIN_MEMORY_DEFAULT } from "../stack-contract.js";
+import { selfCommand } from "../self-command.js";
+import { ABSENT_DEFAULT_FIREWALL_RULES } from "../stack-contract.js";
+import { chooseInstallBackend, describeBackend, gcsBackendRecord, hasLocalPulumiState, installBackend, parseStateBackend, resolveBackend, } from "../state-backend.js";
+import { acquireStateLock, GcsStateStore } from "../state-store.js";
 import { estimateGcpCost } from "./gcp-cost.js";
-import { pulumiUpGcp, readStackOutput } from "./gcp-pulumi.js";
-const SA_ACCOUNT_ID = "caelo-provisioner";
+import { GCP_STACK_KNOB_DEFAULTS, pulumiUpGcp, readStackOutput } from "./gcp-pulumi.js";
 export async function runGcpWizard(opts) {
     const { installId, domain, ownerEmail } = opts;
     const { secretsDir } = ensureInstallDir(installId);
@@ -66,7 +76,7 @@ export async function runGcpWizard(opts) {
     await stepBillingLink(installId, projectId, opts.nonInteractive);
     // === 5. Enable APIs ===
     await stepEnableApis(installId, projectId, opts.provider ?? "gcp");
-    // === 6. Service account + roles + key ===
+    // === 6. Service account + roles + impersonation (no key, #696) ===
     // v0.3.12 — dropped the firebase-hosting-identity step. The
     // Service Usage GenerateServiceIdentity API doesn't support
     // `firebasehosting.googleapis.com` (returns
@@ -77,30 +87,17 @@ export async function runGcpWizard(opts) {
     // PROJECT level (vs the Cloud Run service level) — project IAM
     // accepts deferred google-managed principals; v1 Cloud Run IAM
     // didn't.
-    const saEmail = `${SA_ACCOUNT_ID}@${projectId}.iam.gserviceaccount.com`;
+    const saEmail = provisionerServiceAccountEmail(projectId);
     await stepServiceAccount(installId, projectId, saEmail);
     await stepGrantRoles(installId, projectId, saEmail);
-    const keyPath = await stepMintKey(installId, projectId, saEmail, secretsDir);
-    // === 7. Pulumi passphrase ===
-    // v0.3.2 — removed the legacy `stepAnthropicKey` prompt. The
-    // runtime AI provider configuration lives at /settings/ai (the
-    // key is encrypted under the project KEK and stored in
-    // ai_providers). Pre-v0.3.2 the wizard captured a key + stored
-    // it in Secret Manager but the Cloud Run service never read it,
-    // so the prompt was dead UX cost.
-    const pulumiPassphrase = stepPulumiPassphrase(installId);
+    await stepKeylessProvisioner(projectId, secretsDir, opts.nonInteractive);
     // === 8. Cost-estimate pre-flight ===
     // v0.3.3 — provider variant threads through so gcp-firebase
     // drops the LB / Cloud CDN / Cloud Armor lines (saves ~$19/mo
     // vs gcp). Default 'gcp' for backwards compatibility with
     // installs that don't set the field.
     const costInputs = {
-        cloudSqlTier: "db-f1-micro",
-        cloudSqlHa: false,
-        adminMinInstances: 0,
-        adminMemory: ADMIN_MEMORY_DEFAULT,
-        gatewayMinInstances: 0,
-        wafAdaptiveProtection: false,
+        ...GCP_STACK_KNOB_DEFAULTS,
         provider: opts.provider ?? "gcp",
         region,
     };
@@ -125,6 +122,11 @@ export async function runGcpWizard(opts) {
             process.exit(0);
         }
     }
+    // === 8.5. Where Pulumi's state lives (#696) ===
+    // A new install: the ops bucket + KMS key in its own project — after the
+    // cost confirmation, which lists them (CLAUDE.md §11.C: nothing billable
+    // before the y/N). An older install keeps its local state + passphrase.
+    const backend = await stepStateBackend(installId, projectId, region, saEmail);
     // === 9. Image digests to deploy ===
     // An install that already runs a recorded release (from an earlier
     // wizard run or from `upgrade`) keeps it: re-running the wizard converges
@@ -182,8 +184,8 @@ export async function runGcpWizard(opts) {
         }),
         ownerEmail,
         region,
-        saKeyPath: keyPath,
-        pulumiPassphrase,
+        impersonateServiceAccount: saEmail,
+        backend,
         cloudSqlTier: costInputs.cloudSqlTier,
         cloudSqlHa: costInputs.cloudSqlHa,
         adminMinInstances: costInputs.adminMinInstances,
@@ -328,7 +330,7 @@ async function stepActiveGcloud() {
     const account = await activeAccount();
     if (!account) {
         log.error(red("No active gcloud account."));
-        log.warn(`Run ${bold("gcloud auth login")} in another terminal, then re-run ${bold("bunx @caelo-cms/provisioning")}.`);
+        log.warn(`Run ${bold("gcloud auth login")} in another terminal, then re-run ${bold(selfCommand())}.`);
         cancel("Aborted — no gcloud auth.");
         process.exit(2);
     }
@@ -473,7 +475,7 @@ async function stepBillingLink(installId, projectId, nonInteractive) {
     const open = accounts.filter((a) => a.open);
     if (open.length === 0) {
         log.error(red("No open billing accounts found."));
-        log.warn(`Open one at https://console.cloud.google.com/billing then re-run ${bold("bunx @caelo-cms/provisioning")}.`);
+        log.warn(`Open one at https://console.cloud.google.com/billing then re-run ${bold(selfCommand())}.`);
         cancel("Aborted.");
         process.exit(1);
     }
@@ -543,7 +545,7 @@ async function stepEnableApis(installId, projectId, provider = "gcp") {
     markStepDone(installId, stepName, { count: apiCount });
 }
 async function stepServiceAccount(installId, projectId, saEmail) {
-    const stepName = `service-account-${SA_ACCOUNT_ID}`;
+    const stepName = `service-account-${PROVISIONER_ACCOUNT_ID}`;
     if (isStepDone(installId, stepName)) {
         log.success(`Provisioner SA ${dim("(already created)")}`);
         return;
@@ -555,7 +557,7 @@ async function stepServiceAccount(installId, projectId, saEmail) {
     }
     const s = spinner();
     s.start(`Creating provisioner service account...`);
-    const r = await createServiceAccount(projectId, SA_ACCOUNT_ID, "Caelo provisioner");
+    const r = await createServiceAccount(projectId, PROVISIONER_ACCOUNT_ID, "Caelo provisioner");
     if (!r.ok) {
         s.stop(red(`Failed: ${r.stderr.trim()}`));
         cancel("Aborted.");
@@ -658,24 +660,147 @@ async function stepRemoveDefaultFirewallRules(projectId) {
     for (const o of failed)
         log.warn(yellow(`  not removed: ${o.id} — ${o.why}\n    ${o.error ?? ""}`));
 }
-async function stepMintKey(installId, projectId, saEmail, secretsDir) {
-    const stepName = `mint-key-${projectId}`;
-    const keyPath = join(secretsDir, "sa-key.json");
-    if (isStepDone(installId, stepName) && existsSync(keyPath)) {
-        log.success(`SA key ${dim("(already minted, kept)")}`);
-        return keyPath;
+/**
+ * #696 — make the provisioner SA usable without a key: the operator's gcloud
+ * account gets TokenCreator on it, an older install's `sa-key.json` is
+ * deleted (locally and in IAM), and the credential chain Pulumi will use —
+ * Application Default Credentials impersonating the SA — is verified before
+ * anything billable runs. Idempotent; runs on every wizard pass.
+ */
+async function stepKeylessProvisioner(projectId, secretsDir, nonInteractive) {
+    const sa = provisionerServiceAccountEmail(projectId);
+    const account = await activeAccount();
+    if (!account) {
+        cancel("No active gcloud account. Run `gcloud auth login`, then re-run.");
+        process.exit(2);
     }
     const s = spinner();
-    s.start(`Minting SA key → ${dim(keyPath)}`);
-    const r = await createServiceAccountKey(saEmail, keyPath);
-    if (!r.ok) {
-        s.stop(red(`Failed: ${r.stderr.trim()}`));
+    s.start(`Letting ${account} impersonate ${sa} (no key file)...`);
+    const converged = await convergeKeylessProvisioner({
+        projectId,
+        secretsDir,
+        operatorAccount: account,
+        justCreated: true,
+    });
+    if (!converged.ok) {
+        s.stop(red("Could not set up impersonation of the provisioner"));
+        log.error(converged.error);
+        cancel("Aborted.");
+        process.exit(1);
+    }
+    if (converged.grant === "no-provisioner") {
+        // stepServiceAccount ensured it and the lookup waited out propagation.
+        s.stop(red(`${sa} does not exist`));
+        cancel("Aborted — re-run the installer.");
+        process.exit(1);
+    }
+    s.stop(green(converged.grant === "granted"
+        ? `${account} may now impersonate ${sa}`
+        : `${account} may impersonate ${sa} ${dim("(already)")}`));
+    if (converged.legacyKey === "removed") {
+        log.warn(yellow("Removed the provisioner's long-lived key; this install now uses impersonation."));
+        for (const line of converged.lines)
+            log.info(`  ${line}`);
+    }
+    const check = async () => checkAdcImpersonation({
+        projectId,
+        operatorAccount: account,
+        freshGrant: converged.grant === "granted",
+    });
+    const sAdc = spinner();
+    sAdc.start("Checking that your Application Default Credentials can impersonate it...");
+    let adc = await check();
+    if (!adc.ok && adc.reason === "no-adc" && !nonInteractive) {
+        sAdc.stop(yellow("No Application Default Credentials yet"));
+        const login = await confirm({
+            message: `Run ${bold("gcloud auth application-default login")} now (opens your browser; sign in as ${account})?`,
+            initialValue: true,
+        });
+        if (isCancel(login) || !login) {
+            log.error(adc.error);
+            cancel("Aborted.");
+            process.exit(1);
+        }
+        const { spawnSync } = await import("node:child_process");
+        spawnSync("gcloud", ["auth", "application-default", "login"], { stdio: "inherit" });
+        sAdc.start("Checking again...");
+        adc = await check();
+    }
+    if (!adc.ok) {
+        sAdc.stop(red("Infrastructure credentials not ready"));
+        log.error(adc.error);
         cancel("Aborted.");
         process.exit(1);
     }
-    s.stop(green(`SA key minted (mode 600)`));
-    markStepDone(installId, stepName, { path: keyPath });
-    return keyPath;
+    sAdc.stop(green(`Pulumi will run as ${sa} via impersonation`));
+}
+/**
+ * Decide and prepare where the install's Pulumi state lives (#696,
+ * state-backend.ts chooseInstallBackend) and resolve it for Pulumi.
+ *
+ * For the ops bucket: ensures bucket + KMS key + IAM (idempotent, every
+ * run), then records the backend in install.json and moves install.json +
+ * progress.json into the bucket. A project whose bucket already holds
+ * another install's install.json is refused — this machine would overwrite
+ * that install's record; this install's own copy from an interrupted run is
+ * taken over.
+ */
+async function stepStateBackend(installId, projectId, region, provisionerEmail) {
+    const root = installRoot(installId);
+    const meta = readMetadata(installId);
+    if (!meta)
+        throw new Error(`No install.json for install '${installId}'.`);
+    const kind = chooseInstallBackend(meta, hasLocalPulumiState(root), isStepDone(installId, `pulumi-up-${projectId}`));
+    if (kind === "local") {
+        stepPulumiPassphrase(installId);
+        log.info(`Pulumi state: ${dim(describeBackend(meta, root))} (this install predates state in project ${projectId}). Move it there, so any machine you sign in on can manage the install: ${bold(selfCommand("state", "migrate", "--install", installId))}`);
+        return resolveBackend(meta, {
+            installRoot: root,
+            readPassphrase: () => readSecret(installId, "pulumi-passphrase"),
+        });
+    }
+    const account = await activeAccount();
+    if (!account) {
+        cancel("No active gcloud account. Run `gcloud auth login`, then re-run.");
+        process.exit(1);
+    }
+    const s = spinner();
+    s.start(`Ensuring the install's state bucket + KMS key in ${projectId}...`);
+    const r = await ensureOpsBackend({
+        projectId,
+        region,
+        operatorAccount: account,
+        provisionerEmail,
+    });
+    if (!r.ok) {
+        s.stop(red("Could not set up where the install's state lives"));
+        log.error(r.error);
+        cancel("Aborted before anything else was provisioned; fix the above and re-run.");
+        process.exit(1);
+    }
+    s.stop(green(r.actions.length > 0
+        ? `State bucket + KMS key ready ${dim(`(${r.actions.length} change(s))`)}`
+        : `State bucket + KMS key ok ${dim("(already in place)")}`));
+    for (const a of r.actions)
+        log.info(dim(`  ${a}`));
+    if (meta.stateBackend?.kind !== "gcs") {
+        const record = gcsBackendRecord(projectId, region);
+        const existing = new GcsStateStore(record.bucket, root).peek("install.json");
+        const other = existing === null ? null : JSON.parse(existing);
+        // The same install (id + creation time) is this machine's own earlier
+        // run, interrupted between writing the bucket and the local copy:
+        // finishing the move is safe. Anything else is another install.
+        if (other && !(other.installId === meta.installId && other.createdAt === meta.createdAt)) {
+            cancel(`Project ${projectId} already has a Caelo install (${other.domain ?? "unknown domain"}) whose state lives in gs://${record.bucket}. This run would overwrite that install's record. To manage it from this machine run: ${selfCommand("attach", "--project", projectId)}`);
+            process.exit(1);
+        }
+        adoptStateBackend(installId, record);
+        log.success(`Pulumi state + install metadata live in ${bold(describeBackend({ stateBackend: record }, root))}`);
+    }
+    const current = readMetadata(installId);
+    if (!current)
+        throw new Error(`install.json for '${installId}' vanished from its store.`);
+    return resolveBackend(current, { installRoot: root, readPassphrase: () => null });
 }
 function stepPulumiPassphrase(installId) {
     const existing = readSecret(installId, "pulumi-passphrase");
@@ -690,33 +815,77 @@ function stepPulumiPassphrase(installId) {
 }
 async function stepPulumiUp(installId, opts) {
     const stepName = `pulumi-up-${opts.projectId}`;
-    if (isStepDone(installId, stepName)) {
+    const deployed = isStepDone(installId, stepName);
+    if (deployed) {
         log.success(`Pulumi up ${dim("(checkpointed — re-running for drift refresh)")}`);
     }
     const { secretsDir } = ensureInstallDir(installId);
     const root = installRoot(installId);
+    // #696 — hold the install's state lock through `pulumi up` (`state
+    // migrate` takes the same one), then re-check, uncached, that the state
+    // still lives where this run resolved it: the bucket's install.json for a
+    // bucket-backed install (another machine may have moved it back), the
+    // file on disk for a local one.
+    const opsBucket = gcsBackendRecord(opts.projectId, opts.region).bucket;
+    let releaseLock;
+    try {
+        releaseLock = acquireStateLock(opts.backend.kind === "gcs" ? { kind: "gcs", bucket: opsBucket } : { kind: "local" }, root, "installer pulumi up");
+    }
+    catch (e) {
+        cancel(e instanceof Error ? e.message : String(e));
+        process.exit(1);
+    }
+    let moved;
+    try {
+        const nowText = opts.backend.kind === "gcs"
+            ? new GcsStateStore(opsBucket, root).peek("install.json")
+            : JSON.stringify(readLocalMetadata(installId));
+        const now = nowText ? JSON.parse(nowText) : null;
+        moved =
+            !now ||
+                installBackend({ stateBackend: parseStateBackend(now.stateBackend) }).kind !==
+                    opts.backend.kind;
+    }
+    catch (e) {
+        releaseLock();
+        throw e;
+    }
+    if (moved) {
+        releaseLock();
+        cancel("The install's Pulumi state has moved (state migrate) since this run started. Re-run the installer.");
+        process.exit(1);
+    }
     log.info(`Pulumi up — wall-clock 8–15 min (Cloud SQL is the long pole). Streaming progress...`);
     let resourceCount = 0;
-    const result = await pulumiUpGcp({
-        installId,
-        installRoot: root,
-        secretsDir,
-        ...opts,
-        provider: opts.provider ?? "gcp",
-    }, (kind, message) => {
-        if (kind === "resource") {
-            resourceCount++;
-            if (resourceCount % 5 === 0) {
-                process.stdout.write(`\r${dim(`  ${resourceCount} resources updated`)}`);
+    let result;
+    try {
+        result = await pulumiUpGcp({
+            installId,
+            installRoot: root,
+            secretsDir,
+            ...opts,
+            // A deployed install's stack must exist: a missing one means the
+            // state is elsewhere, and a fresh stack would try to recreate it all.
+            stackMustExist: deployed,
+            provider: opts.provider ?? "gcp",
+        }, (kind, message) => {
+            if (kind === "resource") {
+                resourceCount++;
+                if (resourceCount % 5 === 0) {
+                    process.stdout.write(`\r${dim(`  ${resourceCount} resources updated`)}`);
+                }
             }
-        }
-        else if (kind === "error") {
-            process.stdout.write("\n");
-            log.error(red(redactCredentials(message)));
-        }
-        // logs: silent — too noisy for a live progress UI; pulumi
-        // diagnostics will print on failure via the SDK's onOutput.
-    });
+            else if (kind === "error") {
+                process.stdout.write("\n");
+                log.error(red(redactCredentials(message)));
+            }
+            // logs: silent — too noisy for a live progress UI; pulumi
+            // diagnostics will print on failure via the SDK's onOutput.
+        });
+    }
+    finally {
+        releaseLock();
+    }
     process.stdout.write("\n");
     log.success(green(`Pulumi up complete — ${result.resourceCount.created} created, ${result.resourceCount.updated} updated, ${result.resourceCount.deleted} deleted`));
     markStepDone(installId, stepName, { outputs: result.outputs });
@@ -1068,13 +1237,14 @@ async function stepUploadStaticPlaceholder(installId, projectId, domain) {
  * re-run picks it up.
  */
 async function readBootstrapUrl(installId, provider) {
-    const passphrase = readSecret(installId, "pulumi-passphrase");
-    if (!passphrase) {
-        throw new Error(`~/.caelo-${installId}/secrets/pulumi-passphrase is missing; the Owner setup link can't be read from the stack.`);
-    }
+    const meta = readMetadata(installId);
+    if (!meta)
+        throw new Error(`No install.json for install '${installId}'.`);
     const value = await readStackOutput({
-        installRoot: installRoot(installId),
-        pulumiPassphrase: passphrase,
+        backend: resolveBackend(meta, {
+            installRoot: installRoot(installId),
+            readPassphrase: () => readSecret(installId, "pulumi-passphrase"),
+        }),
         provider: provider === "gcp-firebase" ? "gcp-firebase" : "gcp",
         name: "bootstrapUrlOut",
     });
@@ -1127,15 +1297,13 @@ async function stepGcpDnsRecords(installId) {
     }
     catch (e) {
         log.warn(yellow(`DNS records not confirmed yet: ${e instanceof Error ? e.message : String(e)}`));
-        log.warn(`Set them at your registrar, then re-run ${bold("bunx @caelo-cms/provisioning")} to resume.`);
+        log.warn(`Set them at your registrar, then re-run ${bold(selfCommand())} to resume.`);
         cancel("Stopped at the DNS step.");
         process.exit(1);
     }
 }
 async function stepFinalize(installId) {
     const meta = readMetadata(installId);
-    const progress = readSecret(installId, "pulumi-passphrase"); // touch to verify state still present
-    void progress;
     if (!meta?.projectId)
         return;
     const outputs = await recordedStackOutputs(installId, meta.projectId);
@@ -1179,12 +1347,12 @@ async function stepFinalize(installId) {
             bold("Admin custom domain (admin.<domain>):"),
             `  Not configured — using the Cloud Run URL above.`,
             `  To bind ${cyan(`admin.${meta.domain}`)}, run`,
-            `  ${dim("bunx @caelo-cms/provisioning admin-domain enable")}`,
+            `  ${dim(selfCommand("admin-domain", "enable"))}`,
             `  (it walks you through the one-time Search Console verification, prints the DNS record and waits for the certificate).`,
             "",
             bold("Protected staging site:"),
             `  Stage builds render ${cyan(installStagingHost(meta))}; to serve it, run`,
-            `  ${dim("bunx @caelo-cms/provisioning staging-domain enable")}`,
+            `  ${dim(selfCommand("staging-domain", "enable"))}`,
             `  It maps the host, turns on password protection and prints the staging login once;`,
             `  add the DNS record it prints. The host serves pages after the first Stage.`,
         ]
@@ -1206,9 +1374,9 @@ async function stepFinalize(installId) {
         ...adminNote,
         "",
         bold("Lifecycle commands:"),
-        `  ${dim("bunx @caelo-cms/provisioning status")}     — health check + monthly cost`,
-        `  ${dim("bunx @caelo-cms/provisioning upgrade")}    — pull latest images + roll Cloud Run`,
-        `  ${dim("bunx @caelo-cms/provisioning destroy")}    — tear everything down (irreversible)`,
+        `  ${dim(selfCommand("status"))}   — health check, and the exact upgrade command once a new release is out`,
+        `  ${dim(selfCommand("destroy"))}  — tear everything down (irreversible)`,
+        `  New releases: ${cyan(`${adminBase}/settings/updates`)} shows the exact upgrade command for this install.`,
     ].join("\n"), "Done");
     void homedir; // unused-import guard
     void readFileSync;