@caelo-cms/provisioning 0.10.47 → 0.10.48

package/src/self-command.test.ts

@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { CAELO_VERSION } from "@caelo-cms/shared";
+import { selfCommand } from "./self-command.js";
+
+describe("selfCommand", () => {
+  it("pins every printed command to the running CLI's release (#696)", () => {
+    expect(selfCommand()).toBe(`bunx @caelo-cms/provisioning@${CAELO_VERSION}`);
+    expect(selfCommand("rotate-secret", "internal-secret", "--install", "example.com")).toBe(
+      `bunx @caelo-cms/provisioning@${CAELO_VERSION} rotate-secret internal-secret --install example.com`,
+    );
+  });
+});

package/src/self-command.ts

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { CAELO_VERSION, provisioningCommand } from "@caelo-cms/shared";
+
+/**
+ * A command line for this CLI, pinned to the version that is running
+ * (#696): `bunx @caelo-cms/provisioning@<this version> <args>`. Hints the
+ * CLI prints — resume the wizard, rotate a secret, check status — then
+ * run the same release the operator is using now, instead of whatever
+ * copy `bunx` cached for the bare package name.
+ *
+ * Not for upgrades: an upgrade must run as the *target* release, so
+ * `status` and the admin's Settings → Updates page build that command
+ * with the target version (`provisioningUpgradeCommand` in @caelo-cms/shared).
+ *
+ * @example selfCommand("rotate-secret", "internal-secret")
+ *   // → "bunx @caelo-cms/provisioning@0.10.43 rotate-secret internal-secret"
+ */
+export function selfCommand(...args: string[]): string {
+  return provisioningCommand(CAELO_VERSION, args);
+}

package/src/self-hosted-compose.test.ts

@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import {
+  type ComposeSpec,
+  generateDockerCompose,
+  ghcrImageDigest,
+  ghcrImageRef,
+} from "./compose.js";
+
+const ADMIN = `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`;
+const GATEWAY = `ghcr.io/caelo-cms/gateway@sha256:${"b".repeat(64)}`;
+
+const base: Omit<ComposeSpec, "images"> = {
+  domain: "example.com",
+  postgresPassword: "pgpw",
+  rolePasswords: { admin: "adminpw", public: "publicpw", gateway: "gatewaypw" },
+  minioRootUser: "caelo",
+  minioRootPassword: "miniopw",
+  caeloSecretKek: "0".repeat(64),
+  anthropicApiKey: "sk-ant-x",
+  diskSize: "20Gi",
+};
+
+/** The block of one Compose service, up to the next blank line. */
+function service(yaml: string, name: string): string {
+  const start = yaml.indexOf(`  ${name}:\n`);
+  const end = yaml.indexOf("\n\n", start);
+  return yaml.slice(start, end === -1 ? undefined : end);
+}
+
+describe("self-hosted Compose — release images (#696)", () => {
+  const yaml = generateDockerCompose({
+    ...base,
+    images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+  });
+
+  it("runs the admin + gateway from the digest-pinned GHCR release images", () => {
+    expect(service(yaml, "caelo-admin")).toContain(`image: ${ADMIN}`);
+    expect(service(yaml, "caelo-gateway")).toContain(`image: ${GATEWAY}`);
+  });
+
+  it("mounts no source checkout and runs no build tooling", () => {
+    expect(yaml).not.toContain("../..");
+    expect(yaml).not.toContain("oven/bun");
+    expect(yaml).not.toContain("working_dir");
+    expect(yaml).not.toMatch(/^\s+command: bun/m);
+    expect(yaml).not.toContain("DEV MODE");
+  });
+
+  it("mounts the bootstrap-token, site output + media dirs, never .caelo/ with its secrets", () => {
+    const admin = service(yaml, "caelo-admin");
+    expect(admin).toContain(
+      "    volumes:\n      - ./bootstrap:/app/.caelo\n      - ./output:/srv/caelo\n      - ./media:/data/media",
+    );
+    expect(yaml).not.toMatch(/- \.\/?:/);
+    expect(service(yaml, "caelo-gateway")).not.toContain("volumes:");
+    expect(admin).toContain('CAELO_OUTPUT_ROOT: "/srv/caelo"');
+    expect(admin).toContain('MEDIA_ROOT_DIR: "/data/media"');
+    expect(service(yaml, "caddy")).toContain("- ./output:/srv/caelo:ro");
+  });
+
+  it("keeps the env + secret wiring of each service", () => {
+    const admin = service(yaml, "caelo-admin");
+    expect(admin).toContain(
+      'ADMIN_DATABASE_URL: "postgres://admin_role:adminpw@postgres:5432/cms_admin"',
+    );
+    expect(admin).toContain(
+      'PUBLIC_ADMIN_DATABASE_URL: "postgres://admin_role:adminpw@postgres:5432/cms_public"',
+    );
+    expect(admin).toContain(`CAELO_SECRET_KEK: "${"0".repeat(64)}"`);
+    expect(admin).toContain('CAELO_SITE_URL: "https://example.com"');
+    expect(admin).toContain('PORT: "5173"');
+    expect(admin).toContain('ANTHROPIC_API_KEY: "sk-ant-x"');
+    const gateway = service(yaml, "caelo-gateway");
+    expect(gateway).toContain('GATEWAY_PORT: "8090"');
+    expect(gateway).not.toMatch(/ADMIN_DATABASE|adminpw|CAELO_SECRET_KEK/);
+  });
+
+  it("keeps Caddy and Postgres as they were", () => {
+    expect(service(yaml, "caddy")).toContain("image: caddy:2-alpine");
+    expect(service(yaml, "postgres")).toContain("image: postgres:16-alpine");
+  });
+
+  it("refuses a tag, a foreign repository or a malformed digest", () => {
+    for (const admin of [
+      "ghcr.io/caelo-cms/admin:latest",
+      `ghcr.io/evil/admin@sha256:${"a".repeat(64)}`,
+      "ghcr.io/caelo-cms/admin@sha256:abc",
+      GATEWAY,
+    ]) {
+      expect(() =>
+        generateDockerCompose({ ...base, images: { mode: "release", admin, gateway: GATEWAY } }),
+      ).toThrow(/is not ghcr\.io\/caelo-cms\/admin@sha256/);
+    }
+  });
+});
+
+describe("self-hosted Compose — dev mode", () => {
+  const yaml = generateDockerCompose({ ...base, images: { mode: "dev" } });
+
+  it("bind-mounts the checkout, clearly labelled as contributor-only", () => {
+    for (const name of ["caelo-admin", "caelo-gateway"]) {
+      const block = service(yaml, name);
+      expect(block).toContain("DEV MODE");
+      expect(block).toContain("- ../..:/app");
+      expect(block).not.toMatch(/command:.*\n\s+- /);
+      expect(block).not.toContain("ghcr.io");
+    }
+  });
+
+  it("also mounts the bootstrap-token dir into the admin", () => {
+    expect(service(yaml, "caelo-admin")).toContain(
+      "    volumes:\n      - ../..:/app\n      - ./bootstrap:/app/.caelo",
+    );
+  });
+
+  it("keeps the same env wiring as release mode", () => {
+    const release = generateDockerCompose({
+      ...base,
+      images: { mode: "release", admin: ADMIN, gateway: GATEWAY },
+    });
+    const envOf = (y: string, name: string) =>
+      service(y, name).slice(service(y, name).indexOf("environment:"));
+    for (const name of ["caelo-admin", "caelo-gateway"]) {
+      expect(envOf(yaml, name)).toBe(envOf(release, name));
+    }
+  });
+});
+
+describe("release image references", () => {
+  it("round-trips a digest", () => {
+    const digest = `sha256:${"c".repeat(64)}`;
+    expect(ghcrImageDigest("gateway", ghcrImageRef("gateway", digest))).toBe(digest);
+  });
+
+  it("refuses to build a reference from a non-digest", () => {
+    expect(() => ghcrImageRef("admin", "latest")).toThrow(/not an image digest/);
+  });
+});
+
+describe("self-hosted Compose — the host update agent (#696 Phase 4c)", () => {
+  const images = { mode: "release", admin: ADMIN, gateway: GATEWAY } as const;
+
+  it("publishes no database port without the agent, and tells the admin its provider", () => {
+    const yaml = generateDockerCompose({ ...base, images });
+    expect(service(yaml, "postgres")).not.toContain("ports:");
+    expect(yaml).not.toContain("AGENT_ROLE_PASSWORD");
+    expect(service(yaml, "caelo-admin")).toContain('CAELO_PROVIDER: "self-hosted"');
+  });
+
+  it("publishes Postgres for the agent on the loopback interface only", () => {
+    const yaml = generateDockerCompose({
+      ...base,
+      images,
+      agent: { dbPort: 15432, dbPassword: 'ag"pw' },
+    });
+    const pg = service(yaml, "postgres");
+    expect(pg).toContain('    ports: ["127.0.0.1:15432:5432"]');
+    expect(pg).toContain('AGENT_ROLE_PASSWORD: "ag\\"pw"');
+    // The only published ports: Caddy's, and the agent's loopback one.
+    expect(yaml.match(/ports:/g)?.length).toBe(2);
+    expect(yaml).not.toMatch(/"(0\.0\.0\.0:)?15432:5432"/);
+    // Only Postgres sees the agent's password.
+    expect(service(yaml, "caelo-admin")).not.toContain('ag\\"pw');
+    expect(service(yaml, "caelo-gateway")).not.toContain("AGENT");
+  });
+
+  it("refuses a privileged or invalid port", () => {
+    expect(() =>
+      generateDockerCompose({ ...base, images, agent: { dbPort: 5432.5, dbPassword: "x" } }),
+    ).toThrow();
+    expect(() =>
+      generateDockerCompose({ ...base, images, agent: { dbPort: 443, dbPassword: "x" } }),
+    ).toThrow(/between 1024 and 65535/);
+  });
+});

package/src/self-hosted-release.ts

@@ -0,0 +1,240 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #696 Phase 4 — which Caelo release a self-hosted install runs, and how a
+ * release becomes a pair of verified image digests.
+ *
+ * `.caelo/release.json` is the install metadata for self-hosted (the cloud
+ * providers keep theirs in `~/.caelo-<id>/install.json`): the release
+ * version, the digest-pinned admin + gateway image references the Compose
+ * file runs, and a short history of installs/upgrades/rollbacks. It holds no
+ * secrets (config.json does), so it is safe to read from tooling and
+ * backups; writes refuse secret material like install.json's do.
+ *
+ * Every image reference that reaches the Compose file comes through
+ * {@link resolveVerifiedRelease}: the tag is resolved to a digest in GHCR
+ * (anonymously) and that digest — not the tag — is cosign-verified against
+ * the Caelo release workflow identity. `init` and `upgrade` share it.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { assertNoSecrets, writeJsonAtomic } from "./checkpoint-secrets.js";
+import { ghcrImageDigest, ghcrImageRef, type ReleaseImages } from "./compose.js";
+import { selfCommand } from "./self-command.js";
+import {
+  cosignVerifyArgv,
+  GHCR_NAMESPACE,
+  GHCR_REGISTRY,
+  RELEASE_SERVICES,
+  resolveRegistryDigest,
+} from "./upgrade/release-images.js";
+
+/** What a host command returned. */
+export interface CommandResult {
+  readonly exitCode: number;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/**
+ * Runs `docker` / `cosign` on the install's host. A seam so the install and
+ * upgrade orchestration is unit-testable with a fake (no real containers).
+ */
+export interface HostRunner {
+  /**
+   * Run `argv` to completion. With `stdoutPath`, stdout streams into that
+   * file (mode 600) instead of being captured — used for database dumps.
+   */
+  run(argv: readonly string[], opts?: { readonly stdoutPath?: string }): Promise<CommandResult>;
+}
+
+/** The real runner: Bun.spawn; a missing binary is exit code 127, not a throw. */
+export const bunHostRunner: HostRunner = {
+  async run(argv, opts) {
+    try {
+      const proc = Bun.spawn([...argv], {
+        stdout: opts?.stdoutPath ? Bun.file(opts.stdoutPath) : "pipe",
+        stderr: "pipe",
+      });
+      const stdout = opts?.stdoutPath
+        ? ""
+        : await new Response(proc.stdout as ReadableStream).text();
+      const stderr = await new Response(proc.stderr).text();
+      return { exitCode: await proc.exited, stdout, stderr };
+    } catch (e) {
+      return { exitCode: 127, stdout: "", stderr: e instanceof Error ? e.message : String(e) };
+    }
+  },
+};
+
+/** One install / upgrade / rollback of a self-hosted install. */
+export interface ReleaseHistoryEntry {
+  readonly at: string;
+  readonly from: string | null;
+  readonly to: string;
+  readonly outcome: "installed" | "upgraded" | "rolled-back";
+  readonly detail?: string;
+}
+
+/** `.caelo/release.json`. */
+export interface SelfHostedRelease {
+  /** The release tag the images were resolved from (e.g. `0.10.43`). */
+  readonly version: string;
+  readonly images: { readonly admin: string; readonly gateway: string };
+  readonly installedAt: string;
+  /** Newest last; capped at {@link HISTORY_LIMIT}. */
+  readonly history: readonly ReleaseHistoryEntry[];
+}
+
+const HISTORY_LIMIT = 20;
+
+export function releasePath(caeloDir: string): string {
+  return join(caeloDir, "release.json");
+}
+
+/** The images of a recorded release, as the Compose generator takes them. */
+export function releaseImages(release: SelfHostedRelease): ReleaseImages {
+  return { mode: "release", admin: release.images.admin, gateway: release.images.gateway };
+}
+
+/**
+ * The install's recorded release, or null when none is recorded (a dev-mode
+ * install, or one created before #696 that still runs the repo bind mount).
+ * Throws on a malformed record rather than running a guessed image.
+ */
+export function readRelease(caeloDir: string): SelfHostedRelease | null {
+  const path = releasePath(caeloDir);
+  if (!existsSync(path)) return null;
+  const raw = JSON.parse(readFileSync(path, "utf8")) as Partial<SelfHostedRelease>;
+  const admin = raw.images?.admin ?? "";
+  const gateway = raw.images?.gateway ?? "";
+  if (
+    typeof raw.version !== "string" ||
+    !ghcrImageDigest("admin", admin) ||
+    !ghcrImageDigest("gateway", gateway)
+  ) {
+    throw new Error(
+      `${path} is malformed (needs version + digest-pinned ghcr.io/caelo-cms images); fix it or re-run \`${selfCommand("upgrade", "--version", "<x.y.z>")}\`.`,
+    );
+  }
+  return {
+    version: raw.version,
+    images: { admin, gateway },
+    installedAt: raw.installedAt ?? "",
+    history: Array.isArray(raw.history) ? raw.history : [],
+  };
+}
+
+/**
+ * Record that the install now runs `images` of `version` (or, for a
+ * rollback, keeps running the previous ones), appending to the history.
+ */
+export function recordRelease(
+  caeloDir: string,
+  next: { version: string; images: ReleaseImages },
+  entry: Omit<ReleaseHistoryEntry, "at">,
+  now: Date = new Date(),
+): SelfHostedRelease {
+  const prior = readRelease(caeloDir);
+  const at = now.toISOString();
+  const record: SelfHostedRelease = {
+    version: next.version,
+    images: { admin: next.images.admin, gateway: next.images.gateway },
+    installedAt:
+      prior && prior.version === next.version && entry.outcome === "rolled-back"
+        ? prior.installedAt
+        : at,
+    history: [...(prior?.history ?? []), { at, ...entry }].slice(-HISTORY_LIMIT),
+  };
+  assertNoSecrets(record, "release.json");
+  writeJsonAtomic(releasePath(caeloDir), record);
+  return record;
+}
+
+/** Record a failed-and-rolled-back upgrade without changing the running release. */
+export function recordRollback(
+  caeloDir: string,
+  current: SelfHostedRelease,
+  attempted: string,
+  detail: string,
+  now: Date = new Date(),
+): void {
+  recordRelease(
+    caeloDir,
+    { version: current.version, images: releaseImages(current) },
+    { from: current.version, to: attempted, outcome: "rolled-back", detail },
+    now,
+  );
+}
+
+export type VerifiedRelease =
+  | { readonly ok: true; readonly images: ReleaseImages }
+  | { readonly ok: false; readonly error: string };
+
+/**
+ * Resolve the admin + gateway images of release `tag` in GHCR to digests,
+ * then cosign-verify each digest against the Caelo release workflow
+ * identity (unless `skipVerify`, the escape hatch for forks). The returned
+ * references are digest-pinned, so what was verified is exactly what runs.
+ */
+export async function resolveVerifiedRelease(
+  tag: string,
+  deps: {
+    readonly runner: HostRunner;
+    readonly skipVerify?: boolean;
+    readonly fetchImpl?: typeof fetch;
+    readonly onProgress?: (message: string) => void;
+  },
+): Promise<VerifiedRelease> {
+  const refs: Partial<Record<"admin" | "gateway", string>> = {};
+  for (const service of RELEASE_SERVICES) {
+    deps.onProgress?.(`Resolving ${GHCR_REGISTRY}/${GHCR_NAMESPACE}/${service}:${tag}`);
+    const r = await resolveRegistryDigest(
+      GHCR_REGISTRY,
+      `${GHCR_NAMESPACE}/${service}`,
+      tag,
+      deps.fetchImpl,
+    );
+    if (!r.ok) {
+      return {
+        ok: false,
+        error:
+          `Could not resolve ${GHCR_REGISTRY}/${GHCR_NAMESPACE}/${service}:${tag} (${r.reason}).\n` +
+          "Check the version exists at https://github.com/caelo-cms/caelo-cms/releases and pass it as --version x.y.z.",
+      };
+    }
+    refs[service] = ghcrImageRef(service, r.digest);
+  }
+  const images: ReleaseImages = {
+    mode: "release",
+    admin: refs.admin ?? "",
+    gateway: refs.gateway ?? "",
+  };
+  if (deps.skipVerify) return { ok: true, images };
+
+  const probe = await deps.runner.run(["cosign", "version"]);
+  if (probe.exitCode !== 0) {
+    return {
+      ok: false,
+      error:
+        "cosign is required to verify the Caelo release image signatures and was not found on PATH.\n" +
+        "Install it (https://docs.sigstore.dev/cosign/system_config/installation/ — e.g. `brew install cosign`,\n" +
+        "or the release binary for Linux), then re-run. --skip-verify skips the check (NOT for production).",
+    };
+  }
+  for (const service of RELEASE_SERVICES) {
+    deps.onProgress?.(`Verifying the signature of ${service}`);
+    const v = await deps.runner.run(cosignVerifyArgv(images[service]));
+    if (v.exitCode !== 0) {
+      return {
+        ok: false,
+        error:
+          `cosign verify FAILED for ${images[service]}: its signature does not match the Caelo release workflow.\n` +
+          "Either the registry was compromised, the image is a fork's, or sigstore had an outage (retry).\n" +
+          `cosign: ${v.stderr.trim().slice(0, 500)}`,
+      };
+    }
+  }
+  return { ok: true, images };
+}

package/src/self-hosted-roles.integration.test.ts

@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #613 review — `cms-provision up` on a self-hosted volume created before
+ * the per-role passwords: no `gateway_role`, `public_role` on another
+ * password. The convergence script, run as the superuser exactly as `up`
+ * runs it (psql, script on stdin), must leave the roles on the configured
+ * passwords with the gateway's grants in place — and be safe to re-run.
+ *
+ * Runs against the test database with the passwords the environment already
+ * uses, so the other suites' connection URLs keep working afterwards.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { SQL } from "bun";
+import {
+  convergeSelfHostedRoles,
+  type SuperuserPsql,
+  selfHostedBootstrapScript,
+} from "./self-hosted-roles.js";
+
+const env = process.env;
+const required = [
+  "POSTGRES_USER",
+  "POSTGRES_PORT",
+  "ADMIN_ROLE_PASSWORD",
+  "PUBLIC_ROLE_PASSWORD",
+  "GATEWAY_ROLE_PASSWORD",
+  "ADMIN_DATABASE_URL",
+  "GATEWAY_DATABASE_URL",
+] as const;
+const missing = required.filter((name) => !env[name]);
+if (missing.length > 0) throw new Error(`${missing.join(", ")} required (see .env.example)`);
+
+/** psql as the superuser — the local equivalent of `docker compose exec postgres psql`. */
+const psql: SuperuserPsql = async (script) => {
+  const proc = Bun.spawn(
+    [
+      "psql",
+      "-h",
+      env.PGHOST ?? "localhost",
+      "-p",
+      env.POSTGRES_PORT as string,
+      "-U",
+      env.POSTGRES_USER as string,
+      "-d",
+      "postgres",
+      "-q",
+      "-f",
+      "-",
+    ],
+    {
+      stdin: new TextEncoder().encode(script),
+      stdout: "ignore",
+      stderr: "pipe",
+      env: { ...env, ...(env.POSTGRES_PASSWORD ? { PGPASSWORD: env.POSTGRES_PASSWORD } : {}) },
+    },
+  );
+  const stderr = await new Response(proc.stderr).text();
+  return { exitCode: await proc.exited, stderr };
+};
+
+const passwords = {
+  admin: env.ADMIN_ROLE_PASSWORD as string,
+  public: env.PUBLIC_ROLE_PASSWORD as string,
+  gateway: env.GATEWAY_ROLE_PASSWORD as string,
+};
+
+describe("self-hosted role convergence against Postgres (#613 review)", () => {
+  it("brings a pre-#613 volume to the configured roles, grants and passwords — twice", async () => {
+    // The pre-#613 volume: no gateway_role, public_role on another password.
+    const reset = await psql(
+      [
+        "\\set ON_ERROR_STOP on",
+        "\\connect cms_admin",
+        "DROP OWNED BY gateway_role;",
+        "\\connect postgres",
+        "DROP ROLE gateway_role;",
+        "ALTER ROLE public_role WITH PASSWORD 'the-old-shared-password';",
+        "",
+      ].join("\n"),
+    );
+    expect(reset).toEqual({ exitCode: 0, stderr: "" });
+
+    for (let run = 0; run < 2; run++) {
+      const r = await convergeSelfHostedRoles(passwords, { probe: async () => true, psql });
+      expect(r).toEqual({ ok: true });
+    }
+
+    // The gateway logs in with its configured password and reads what 0248 grants.
+    const gateway = new SQL(env.GATEWAY_DATABASE_URL as string);
+    try {
+      const rows = (await gateway.begin(async (tx) => {
+        await tx.unsafe("SET LOCAL caelo.actor_kind = 'system'");
+        return tx`SELECT current_user::text AS u, length(gateway_cookie_secret) > 0 AS s FROM site_settings`;
+      })) as { u: string; s: boolean }[];
+      expect(rows[0]).toEqual({ u: "gateway_role", s: true });
+    } finally {
+      await gateway.end();
+    }
+    const admin = new SQL(env.ADMIN_DATABASE_URL as string);
+    try {
+      const [attrs] = (await admin`
+        SELECT rolcanlogin, rolinherit FROM pg_roles WHERE rolname = 'gateway_role'`) as {
+        rolcanlogin: boolean;
+        rolinherit: boolean;
+      }[];
+      expect(attrs).toEqual({ rolcanlogin: true, rolinherit: false });
+      const policies = (await admin`
+        SELECT policyname::text AS p FROM pg_policies WHERE 'gateway_role' = ANY (roles) ORDER BY 1`) as {
+        p: string;
+      }[];
+      expect(policies.map((p) => p.p)).toEqual([
+        "audit_events_gateway_plugin_only",
+        // #634 (migration 0252): the visitor paths' row limits. The A/B
+        // ones went with the experiment tables (#676, migration 0259).
+        "comment_archive_gateway_approved_only",
+        "rate_limit_buckets_gateway_keys",
+      ]);
+    } finally {
+      await admin.end();
+    }
+  });
+});
+
+describe("the install's bootstrap.sh (#696 Phase 4c)", () => {
+  it("runs as the Postgres entrypoint would and creates the agent's login, idempotently", async () => {
+    const script = selfHostedBootstrapScript({ agent: true });
+    for (let run = 0; run < 2; run++) {
+      const proc = Bun.spawn(["sh", "-c", script], {
+        stdout: "ignore",
+        stderr: "pipe",
+        env: {
+          ...env,
+          PGHOST: env.PGHOST ?? "localhost",
+          PGPORT: env.POSTGRES_PORT,
+          ...(env.POSTGRES_PASSWORD ? { PGPASSWORD: env.POSTGRES_PASSWORD } : {}),
+          AGENT_ROLE_PASSWORD: "bootstrap-agent-pw",
+        },
+      });
+      const stderr = await new Response(proc.stderr).text();
+      expect({ exitCode: await proc.exited, stderr }).toEqual({ exitCode: 0, stderr: "" });
+    }
+    const agent = new SQL(
+      `postgres://caelo_agent:bootstrap-agent-pw@${env.PGHOST ?? "localhost"}:${env.POSTGRES_PORT}/cms_admin`,
+    );
+    try {
+      const rows = (await agent.begin(async (tx) => {
+        await tx.unsafe("SET LOCAL caelo.actor_kind = 'system'");
+        return tx`SELECT current_user::text AS u, count(*)::int AS n FROM platform_update_policy`;
+      })) as { u: string; n: number }[];
+      expect(rows[0]).toEqual({ u: "caelo_agent", n: 1 });
+    } finally {
+      await agent.end();
+    }
+    const dropped = await psql(
+      "\\set ON_ERROR_STOP on\n\\connect cms_admin\nDROP OWNED BY caelo_agent;\n\\connect cms_public\nDROP OWNED BY caelo_agent;\n\\connect postgres\nDROP ROLE caelo_agent;\n",
+    );
+    expect(dropped).toEqual({ exitCode: 0, stderr: "" });
+  });
+});