@caelo-cms/provisioning 0.10.48 → 0.10.50

package/src/self-hosted-start.test.ts

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import type { CommandResult, HostRunner } from "./self-hosted-release.js";
+import { startSelfHosted } from "./self-hosted-start.js";
+
+const DIR = "/srv/install/.caelo";
+
+/** A runner that records every command (minus the `docker compose -f <file>` prefix). */
+function fakeRunner(fail?: (cmd: string) => boolean): HostRunner & { calls: string[] } {
+  const calls: string[] = [];
+  return {
+    calls,
+    async run(argv): Promise<CommandResult> {
+      const cmd = argv.join(" ").replace(`docker compose -f ${DIR}/docker-compose.yml `, "");
+      calls.push(cmd);
+      return { exitCode: fail?.(cmd) ? 1 : 0, stdout: "", stderr: fail?.(cmd) ? "boom" : "" };
+    },
+  };
+}
+
+const MIGRATE =
+  "run --rm --no-deps -T caelo-admin bun --bun /app/packages/migrations/src/migrate.ts";
+
+describe("startSelfHosted (#707 — one command ends with a serving install)", () => {
+  it("pulls, starts Postgres, migrates, starts everything, then health-checks both services", async () => {
+    const runner = fakeRunner();
+    const r = await startSelfHosted({ caeloDir: DIR, runner, log: () => {} });
+    expect(r).toEqual({ ok: true });
+    expect(runner.calls.map((c) => c.replace(/ -e .*/, " -e <probe>"))).toEqual([
+      "pull",
+      "up -d --wait postgres",
+      `${MIGRATE} admin`,
+      `${MIGRATE} public`,
+      "up -d --remove-orphans",
+      "exec -T caelo-admin bun -e <probe>",
+      "exec -T caelo-gateway bun -e <probe>",
+      "exec -T caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile",
+    ]);
+  });
+
+  it("stops at a failed migration — nothing else is started", async () => {
+    const runner = fakeRunner((c) => c.endsWith("migrate.ts admin"));
+    const r = await startSelfHosted({ caeloDir: DIR, runner, log: () => {} });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.stage).toBe("migrate");
+      expect(r.error).toContain("admin migrations failed");
+    }
+    expect(runner.calls).not.toContain("up -d --remove-orphans");
+  });
+
+  it("reports an unhealthy admin with where to look", async () => {
+    const runner = fakeRunner((c) => c.startsWith("exec -T caelo-admin"));
+    const r = await startSelfHosted({
+      caeloDir: DIR,
+      runner,
+      log: () => {},
+      healthAttempts: 2,
+      sleep: async () => {},
+    });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.stage).toBe("health");
+      expect(r.error).toContain("logs caelo-admin");
+    }
+  });
+});

package/src/self-hosted-start.ts

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Start (or converge) a self-hosted Compose install — what `init` and `up`
+ * run after writing `.caelo/`, so one command ends with a serving install
+ * (CLAUDE.md §11.C, issue #707) instead of printing steps to copy.
+ *
+ * Order, and why:
+ *   1. pull every image, with the progress on the terminal (the admin image
+ *      is large; a silent multi-minute step reads as a hang);
+ *   2. start Postgres and wait for its health check — on a fresh volume its
+ *      first start runs bootstrap.sh (roles + databases);
+ *   3. apply the migrations with the install's admin image;
+ *   4. start everything (`--remove-orphans` drops services an older Compose
+ *      file had, e.g. the pgBackRest sidecar);
+ *   5. health-check the admin (`/_caelo/health` proves the DB pool and its
+ *      role) and the gateway;
+ *   6. reload Caddy — Compose does not restart a running Caddy when only
+ *      its bind-mounted Caddyfile changed, so a re-run `up` would otherwise
+ *      keep serving the old vhosts.
+ * Every step converges, so a re-run after a failure picks up where it
+ * stopped.
+ */
+
+import type { HostRunner } from "./self-hosted-release.js";
+import { compose, runMigrations, waitHealthy } from "./self-hosted-upgrade.js";
+
+export interface StartDeps {
+  readonly caeloDir: string;
+  readonly runner: HostRunner;
+  readonly log: (message: string) => void;
+  /** Health probe attempts per service and the pause between them. */
+  readonly healthAttempts?: number;
+  readonly healthIntervalMs?: number;
+  readonly sleep?: (ms: number) => Promise<void>;
+}
+
+export type StartResult =
+  | { readonly ok: true }
+  | { readonly ok: false; readonly stage: StartStage; readonly error: string };
+
+type StartStage = "pull" | "postgres" | "migrate" | "start" | "health" | "caddy";
+
+/** Bring the install's Compose stack up and prove it serves. Never throws for an expected failure. */
+export async function startSelfHosted(deps: StartDeps): Promise<StartResult> {
+  const { caeloDir, runner, log } = deps;
+  log("Pulling the images …");
+  const pull = await runner.run(compose(caeloDir, "pull"), { inherit: true });
+  if (pull.exitCode !== 0) {
+    return fail("pull", "docker compose pull failed (see above). Check the network and re-run.");
+  }
+
+  log("Starting Postgres …");
+  const pg = await runner.run(compose(caeloDir, "up", "-d", "--wait", "postgres"), {
+    inherit: true,
+  });
+  if (pg.exitCode !== 0) {
+    return fail(
+      "postgres",
+      `Postgres did not become healthy (see above; \`docker compose -f ${caeloDir}/docker-compose.yml logs postgres\`).`,
+    );
+  }
+
+  log("Applying the database migrations …");
+  const migrated = await runMigrations(caeloDir, runner);
+  if (!migrated.ok) return fail("migrate", migrated.error);
+
+  log("Starting Caddy, the admin and the gateway …");
+  const up = await runner.run(compose(caeloDir, "up", "-d", "--remove-orphans"), {
+    inherit: true,
+  });
+  if (up.exitCode !== 0) return fail("start", "docker compose up failed (see above).");
+
+  for (const service of ["admin", "gateway"] as const) {
+    log(`Waiting for the ${service} to answer its health check …`);
+    const healthy = await waitHealthy(service, caeloDir, {
+      runner,
+      ...(deps.sleep ? { sleep: deps.sleep } : {}),
+      ...(deps.healthAttempts !== undefined ? { healthAttempts: deps.healthAttempts } : {}),
+      ...(deps.healthIntervalMs !== undefined ? { healthIntervalMs: deps.healthIntervalMs } : {}),
+    });
+    if (!healthy.ok) {
+      return fail(
+        "health",
+        `The ${service} is not healthy: ${healthy.error}. See \`docker compose -f ${caeloDir}/docker-compose.yml logs caelo-${service}\`.`,
+      );
+    }
+  }
+  log("Reloading Caddy …");
+  const reloaded = await reloadCaddy(caeloDir, runner);
+  if (!reloaded.ok) return fail("caddy", reloaded.error);
+  return { ok: true };
+}
+
+/** `caddy reload` in the running Caddy container with the current Caddyfile. */
+export async function reloadCaddy(
+  caeloDir: string,
+  runner: HostRunner,
+): Promise<{ ok: true } | { ok: false; error: string }> {
+  const r = await runner.run(
+    compose(
+      caeloDir,
+      "exec",
+      "-T",
+      "caddy",
+      "caddy",
+      "reload",
+      "--config",
+      "/etc/caddy/Caddyfile",
+      "--adapter",
+      "caddyfile",
+    ),
+  );
+  if (r.exitCode === 0) return { ok: true };
+  return {
+    ok: false,
+    error: `caddy reload failed: ${r.stderr.trim().split("\n").slice(-3).join("\n")}`,
+  };
+}
+
+function fail(stage: StartStage, error: string): StartResult {
+  return { ok: false, stage, error };
+}

package/src/self-hosted-upgrade.ts

@@ -196,7 +196,7 @@ export function composePath(caeloDir: string): string {
 }
 
 /** `docker compose -f <file>` — every Compose call targets the install's file explicitly. */
-function compose(caeloDir: string, ...args: string[]): string[] {
+export function compose(caeloDir: string, ...args: string[]): string[] {
   return ["docker", "compose", "-f", composePath(caeloDir), ...args];
 }
 
@@ -415,12 +415,35 @@ export async function backupDatabases(
     };
   }
   const dir = join(caeloDir, "backups", `pre-upgrade-${at.toISOString().replace(/[:.]/g, "-")}`);
+  const dumped = await dumpDatabases(caeloDir, runner, dir);
+  if (!dumped.ok) return { ok: false, error: `${dumped.error} The upgrade did not start.` };
+  return { ok: true, dir };
+}
+
+/** The files {@link dumpDatabases} writes, and what each holds. */
+export const DATABASE_DUMPS = {
+  /** The cluster's roles (reference only — restores re-create them from config.json). */
+  globals: "globals.sql",
+  cms_admin: "cms_admin.dump",
+  cms_public: "cms_public.dump",
+} as const;
+
+/**
+ * pg_dump both databases (custom format) plus the cluster's roles into
+ * `dir` (created mode 700) from the running Postgres container. Every dump
+ * must exit 0 and be non-empty.
+ */
+export async function dumpDatabases(
+  caeloDir: string,
+  runner: HostRunner,
+  dir: string,
+): Promise<{ ok: true } | { ok: false; error: string }> {
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   chmodSync(dir, 0o700);
   const dumps: [string, string[]][] = [
-    ["globals.sql", ["pg_dumpall", "-U", "caelo", "--globals-only"]],
-    ["cms_admin.dump", ["pg_dump", "-U", "caelo", "-Fc", "cms_admin"]],
-    ["cms_public.dump", ["pg_dump", "-U", "caelo", "-Fc", "cms_public"]],
+    [DATABASE_DUMPS.globals, ["pg_dumpall", "-U", "caelo", "--globals-only"]],
+    [DATABASE_DUMPS.cms_admin, ["pg_dump", "-U", "caelo", "-Fc", "cms_admin"]],
+    [DATABASE_DUMPS.cms_public, ["pg_dump", "-U", "caelo", "-Fc", "cms_public"]],
   ];
   for (const [name, cmd] of dumps) {
     const out = join(dir, name);
@@ -430,12 +453,12 @@ export async function backupDatabases(
     if (r.exitCode !== 0 || fileSize(out) === 0) {
       return {
         ok: false,
-        error: `Backup failed (${cmd.join(" ")} → ${out}): ${tail(r.stderr) || "empty dump"}. The upgrade did not start.`,
+        error: `Backup failed (${cmd.join(" ")} → ${out}): ${tail(r.stderr) || "empty dump"}.`,
       };
     }
     chmodSync(out, 0o600);
   }
-  return { ok: true, dir };
+  return { ok: true };
 }
 
 /**
@@ -483,10 +506,14 @@ const HEALTH_PROBE: Record<"admin" | "gateway", string> = {
     'const r=await fetch("http://127.0.0.1:"+(process.env.PORT||process.env.GATEWAY_PORT||"8090")+"/healthz").catch(()=>null);process.exit(r&&r.ok?0:1)',
 };
 
-async function waitHealthy(
+/**
+ * Probe `service` inside its container until it answers healthy, or give up
+ * after `healthAttempts` tries (default 45, 2 s apart).
+ */
+export async function waitHealthy(
   service: "admin" | "gateway",
   caeloDir: string,
-  deps: SelfHostedUpgradeDeps,
+  deps: Pick<SelfHostedUpgradeDeps, "runner" | "sleep" | "healthAttempts" | "healthIntervalMs">,
 ): Promise<{ ok: true } | { ok: false; error: string }> {
   const attempts = deps.healthAttempts ?? 45;
   const interval = deps.healthIntervalMs ?? 2000;

package/src/stack-contract.test.ts

@@ -311,10 +311,10 @@ describe("self-hosted compose", () => {
       domain: "acme.com",
       postgresPassword: "p",
       rolePasswords: { admin: "a", public: "b", gateway: "g" },
-      minioRootUser: "u",
-      minioRootPassword: "m",
       caeloSecretKek: "k",
       diskSize: "10G",
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
       images: {
         mode: "release" as const,
         admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,

package/src/tar-entries.test.ts

@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { bunHostRunner } from "./self-hosted-release.js";
+import { escapesRoot, listTarEntries, normalizeMemberName } from "./tar-entries.js";
+
+let dir: string;
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "caelo-tar-test-"));
+});
+afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+describe("listTarEntries", () => {
+  it("reads files, directories, symlinks and long (>100 byte) names from the host's tar", async () => {
+    const root = join(dir, "src");
+    const long = `${"d".repeat(60)}/${"e".repeat(60)}/${"f".repeat(30)}.txt`;
+    mkdirSync(join(root, long, ".."), { recursive: true });
+    writeFileSync(join(root, long), "x");
+    writeFileSync(join(root, "ä-ü.txt"), "umlaut");
+    symlinkSync("target", join(root, "link"));
+    const out = join(dir, "a.tar");
+    const r = await bunHostRunner.run(["tar", "-cf", out, "-C", root, "."], {
+      env: { COPYFILE_DISABLE: "1" },
+    });
+    expect(r.exitCode).toBe(0);
+    const entries = listTarEntries(readFileSync(out));
+    const byName = new Map(entries.map((e) => [normalizeMemberName(e.name), e]));
+    expect(byName.get(long)?.type).toBe("file");
+    expect(byName.get("ä-ü.txt")?.type).toBe("file");
+    expect(byName.get("d".repeat(60))?.type).toBe("directory");
+    expect(byName.get("link")).toMatchObject({ type: "symlink", linkTarget: "target" });
+  });
+
+  it("refuses a truncated archive instead of skipping members", () => {
+    const header = new Uint8Array(512);
+    header.set(new TextEncoder().encode("a.txt"), 0);
+    header.set(new TextEncoder().encode("00000001000\0"), 124); // 512 bytes of data, none present
+    header[156] = "0".charCodeAt(0);
+    expect(() => listTarEntries(header)).toThrow(/truncated/);
+  });
+});
+
+describe("escapesRoot", () => {
+  it("flags absolute and parent-relative member names", () => {
+    expect(escapesRoot("/etc/passwd")).toBe(true);
+    expect(escapesRoot("srv/caelo/../../app")).toBe(true);
+    expect(escapesRoot("./srv/caelo/a..b")).toBe(false);
+  });
+});

package/src/tar-entries.ts

@@ -0,0 +1,116 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Read the member list of a tar archive WITHOUT extracting it, so a restore
+ * can refuse an archive before `tar -x` writes anything (PR #755 review: an
+ * absolute or `../` member, or a member written through a symlink, would
+ * otherwise land outside the target directory).
+ *
+ * Parses ustar headers plus the two extensions GNU tar and bsdtar emit for
+ * long names: GNU `L`/`K` records and pax `x`/`g` records (`path=`,
+ * `linkpath=`). Anything it cannot read is an error, never a skipped member.
+ */
+
+const BLOCK = 512;
+
+export type TarEntryType = "file" | "directory" | "symlink" | "other";
+
+export interface TarEntry {
+  readonly name: string;
+  readonly type: TarEntryType;
+  /** The link target, for symlinks. */
+  readonly linkTarget?: string;
+}
+
+/** Every member of an (uncompressed) tar archive, in archive order. */
+export function listTarEntries(tar: Uint8Array): TarEntry[] {
+  const entries: TarEntry[] = [];
+  let offset = 0;
+  let longName: string | null = null;
+  let longLink: string | null = null;
+  let paxPath: string | null = null;
+  let paxLink: string | null = null;
+  while (offset + BLOCK <= tar.length) {
+    const header = tar.subarray(offset, offset + BLOCK);
+    if (header.every((b) => b === 0)) break; // end-of-archive marker
+    const size = octal(header.subarray(124, 136));
+    const typeflag = String.fromCharCode(header[156] ?? 0);
+    const body = tar.subarray(offset + BLOCK, offset + BLOCK + size);
+    if (body.length < size) throw new Error("truncated tar archive");
+    offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
+
+    if (typeflag === "L") {
+      longName = cString(body);
+      continue;
+    }
+    if (typeflag === "K") {
+      longLink = cString(body);
+      continue;
+    }
+    if (typeflag === "x" || typeflag === "g") {
+      const pax = paxRecords(body);
+      if (typeflag === "x") {
+        paxPath = pax.path ?? null;
+        paxLink = pax.linkpath ?? null;
+      }
+      continue;
+    }
+    const prefix = cString(header.subarray(345, 500));
+    const shortName = cString(header.subarray(0, 100));
+    const name = paxPath ?? longName ?? (prefix ? `${prefix}/${shortName}` : shortName);
+    const link = paxLink ?? longLink ?? cString(header.subarray(157, 257));
+    longName = longLink = paxPath = paxLink = null;
+    const type: TarEntryType =
+      typeflag === "0" || typeflag === "\0" || typeflag === "7"
+        ? "file"
+        : typeflag === "5"
+          ? "directory"
+          : typeflag === "2"
+            ? "symlink"
+            : "other";
+    entries.push(type === "symlink" ? { name, type, linkTarget: link } : { name, type });
+  }
+  return entries;
+}
+
+/** `./a/b/` → `a/b`; the archive root (`./`) → "". */
+export function normalizeMemberName(name: string): string {
+  return name.replace(/^(\.\/)+/, "").replace(/\/+$/, "");
+}
+
+/** Whether a member name could write outside the extraction directory. */
+export function escapesRoot(name: string): boolean {
+  return name.startsWith("/") || name.split("/").some((part) => part === "..");
+}
+
+function octal(field: Uint8Array): number {
+  const text = cString(field).trim();
+  if (text === "") return 0;
+  if (!/^[0-7]+$/.test(text)) throw new Error(`unreadable tar header size ${JSON.stringify(text)}`);
+  return Number.parseInt(text, 8);
+}
+
+function cString(bytes: Uint8Array): string {
+  const end = bytes.indexOf(0);
+  return new TextDecoder().decode(end === -1 ? bytes : bytes.subarray(0, end));
+}
+
+/** pax records: `<len> <key>=<value>\n`, repeated; `<len>` counts bytes. */
+function paxRecords(body: Uint8Array): Record<string, string> {
+  const out: Record<string, string> = {};
+  const decode = (b: Uint8Array) => new TextDecoder().decode(b);
+  let i = 0;
+  while (i < body.length && body[i] !== 0) {
+    const space = body.indexOf(0x20, i);
+    if (space === -1) throw new Error("unreadable pax header");
+    const len = Number.parseInt(decode(body.subarray(i, space)), 10);
+    if (!Number.isFinite(len) || len <= 0 || i + len > body.length) {
+      throw new Error("unreadable pax header");
+    }
+    const record = decode(body.subarray(space + 1, i + len - 1));
+    const eq = record.indexOf("=");
+    if (eq !== -1) out[record.slice(0, eq)] = record.slice(eq + 1);
+    i += len;
+  }
+  return out;
+}

package/src/upgrade/converge.ts

@@ -5,8 +5,9 @@
  * service accounts, secrets or other cloud resources so the install matches
  * what the release's stacks declare — the gateway's run SA and the
  * CLI-generated runtime secrets, the stack's IAM/CDN/firewall invariants,
- * MCP access through IAP, the gateway's and public_role's database logins,
- * the operator-access sync job, and dropping bindings nothing reads any more.
+ * MCP access through IAP, public_role's Cloud SQL role memberships (#633),
+ * the gateway's and public_role's database logins, the operator-access sync
+ * job, and dropping bindings nothing reads any more.
  *
  * It needs the rights of whoever provisioned the install, so only
  * `cms-provision upgrade` (the operator's own identity) runs it — never the
@@ -33,6 +34,7 @@ import { upgraderServiceAccountEmail } from "../gcp-names.js";
 import type { InstallMetadata } from "../install-state.js";
 import { ensureMcpIapAccess, type IapResource } from "../mcp-iap.js";
 import { ensureOperatorAccessSync, resolveOperatorAccessTarget } from "../operator-access.js";
+import { revokePublicRoleMemberships } from "../public-role-isolation.js";
 import {
   ensureGatewayServiceAccount,
   ensureGeneratedSecrets,
@@ -52,6 +54,7 @@ import {
   removeRetiredIamBindings,
 } from "../stack-converge.js";
 import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
+import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
 import type { AppRollHooks, AppRollPlan, RollPlan, RollSlug } from "./app-roll.js";
 import type { UpgradeReporter } from "./reporter.js";
 
@@ -90,8 +93,8 @@ export interface ConvergeDeps {
 
 export interface ConvergeSession {
   /**
-   * Before the app-roll: runtime identities + secrets, stack invariants, MCP
-   * access. False when a step the install cannot work without failed —
+   * Before the app-roll: runtime identities + secrets, stack invariants,
+   * public_role's Cloud SQL role memberships (#633), MCP access. False when a step the install cannot work without failed —
    * nothing app-side changed then.
    */
   beforeAppRoll(): Promise<boolean>;
@@ -195,6 +198,25 @@ export function startConverge(
     return true;
   }
 
+  async function publicRoleIsolation(): Promise<boolean> {
+    // #633 — the Admin API made public_role a member of cloudsqlsuperuser.
+    // Revoked here, before migrations, because the migration job's role
+    // audit is what verifies it and fails the upgrade while it remains.
+    const s = r.step("Removing public_role from the Cloud SQL superuser group...");
+    const outcome = await revokePublicRoleMemberships(
+      { projectId: install.projectId, env: install.env },
+      runDeps,
+    );
+    if (outcome.status === "failed") {
+      s.failed("public_role's role memberships could not be revoked. Aborting upgrade.");
+      r.error(`  ${outcome.error ?? ""}`);
+      r.warn("No traffic was shifted and no migrations ran. Fix the above and re-run.");
+      return false;
+    }
+    s.done(`public_role holds no database roles (${outcome.detail ?? "revoked"})`);
+    return true;
+  }
+
   async function mcpAccess(): Promise<void> {
     // Issue #37 — the MCP service account + its IAP/token-creator bindings.
     // Also what the deep health check signs its IAP credential as. A failure
@@ -227,6 +249,29 @@ export function startConverge(
     leaveUntouched.push(MCP_ENV_VAR);
   }
 
+  async function urlMapRedirectsAccess(): Promise<void> {
+    // #587 — on `gcp` the admin writes the redirects table into the URL map
+    // on Confirm-publish, through a custom role the stack declares. Without
+    // it Confirm-publish fails loudly (403); the rest of the install works,
+    // so a failure here warns.
+    if (install.provider !== "gcp") return;
+    const s = r.step("Ensuring the admin may write redirects into the URL map...");
+    const access = await ensureUrlMapRedirectsAccess({
+      projectId: install.projectId,
+      env: install.env,
+      ...runDeps,
+    });
+    if (access.ok) {
+      s.done(`URL-map redirects role ready (${access.role})`);
+      return;
+    }
+    s.warned(`URL-map redirects role not set up: ${access.error}`);
+    r.warn(
+      "The upgrade continues; Confirm-publish fails with a permission error until this succeeds. Re-run upgrade with an account that may manage IAM roles.",
+    );
+    incomplete = true;
+  }
+
   /** The admin's IAP resource: the service on gcp-firebase, the LB backend on gcp. */
   async function adminIapResource(): Promise<IapResource | null> {
     if (install.provider === "gcp-firebase") {
@@ -372,7 +417,9 @@ export function startConverge(
       if (deps.provisionerIdentity && !(await deps.provisionerIdentity())) return false;
       if (!(await runtimeIdentities())) return false;
       if (!(await stackInvariants())) return false;
+      if (!(await publicRoleIsolation())) return false;
       await mcpAccess();
+      await urlMapRedirectsAccess();
       return true;
     },
 

package/src/upgrade/release-images.ts

@@ -13,6 +13,7 @@
  * (epic #696) takes the digests from the signed release manifest instead.
  */
 
+import { IMAGE_DIGEST } from "@caelo-cms/shared";
 import { confirm, isCancel, log, spinner } from "@clack/prompts";
 import { green, red } from "kleur/colors";
 
@@ -62,8 +63,9 @@ export function cosignVerifyArgv(imageRef: string): string[] {
   ];
 }
 
-/** A `sha256:<64 hex>` image / blob digest. */
-export const IMAGE_DIGEST = /^sha256:[0-9a-f]{64}$/;
+// A `sha256:<64 hex>` image / blob digest — one definition, shared with
+// the release manifest schema.
+export { IMAGE_DIGEST };
 
 /** Whether `s` is a well-formed `sha256:<64 hex>` digest. */
 export function isImageDigest(s: string): boolean {