@caelo-cms/provisioning 0.10.49 → 0.10.50

package/caddy/Caddyfile.production

@@ -10,6 +10,10 @@
 
 :80 {
 	root * /srv/current
+	# #587 — the redirects table of the build served here (the generator
+	# writes it; `*` so a fresh checkout without a build still starts).
+	# docker-compose.yml reloads Caddy when it changes (caddy-redirects.ts).
+	import /srv/current/_redirects.caddy*
 	# Content-hashed build outputs (fonts, plugin bundles, media) never
 	# change under the same URL — cache them for a year. Keep this pattern in
 	# sync with CONTENT_HASHED_PATH_PATTERN in @caelo-cms/shared

package/caddy/Caddyfile.staging

@@ -14,6 +14,10 @@
 
 :80 {
 	root * /srv/current
+	# #587 — the redirects table of the build served here (the generator
+	# writes it; `*` so a fresh checkout without a build still starts).
+	# docker-compose.yml reloads Caddy when it changes (caddy-redirects.ts).
+	import /srv/current/_redirects.caddy*
 	# Content-hashed build outputs (fonts, plugin bundles, media) never
 	# change under the same URL — cache them for a year. Keep this pattern in
 	# sync with CONTENT_HASHED_PATH_PATTERN in @caelo-cms/shared

package/dist/agent-db.js

@@ -8083,6 +8083,10 @@ var pageLogEntrySchema = object({
 // ../shared/src/proposal-status.ts
 var PROPOSAL_STATUSES = ["pending", "applied", "rejected", "superseded"];
 var proposalStatus = _enum(PROPOSAL_STATUSES);
+// ../shared/src/redirect-emit-cloudfront.ts
+var CLOUDFRONT_KVS_MAX_TOTAL_BYTES = 5 * 1024 * 1024;
+// ../shared/src/redirect-plan.ts
+var REDIRECT_STATUSES = new Set([301, 302, 307, 308]);
 // ../shared/src/release-manifest.ts
 var RELEASE_CHANNELS = ["stable", "rc", "beta", "alpha"];
 var IMAGE_DIGEST = /^sha256:[0-9a-f]{64}$/;

package/dist/caddy-redirects.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The container's shell script: Caddy in the foreground of the container's
+ * lifetime, reloaded when any file matching `snippetGlob` changes.
+ *
+ * @param snippetGlob Shell glob of the imported snippets, e.g.
+ *   `/srv/caelo/output/*\/current/_redirects.caddy`.
+ */
+export declare function caddyRedirectReloadScript(snippetGlob: string): string;
+/**
+ * A Compose `command:` line running {@link caddyRedirectReloadScript}. `$` is
+ * doubled because Compose interpolates `$VAR` in the file; the JSON string is
+ * a valid YAML double-quoted scalar.
+ */
+export declare function caddyRedirectReloadCommand(snippetGlob: string): string;
+//# sourceMappingURL=caddy-redirects.d.ts.map

package/dist/caddy-redirects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy-redirects.d.ts","sourceRoot":"","sources":["../src/caddy-redirects.ts"],"names":[],"mappings":"AA2BA;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAuBrE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGtE"}

package/dist/caddy-redirects.js

@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * How the self-hosted Caddy picks up a deploy's redirect snippet (#587).
+ *
+ * Each public site block imports `<site root>/_redirects.caddy`, which the
+ * static generator rewrites on every build. Caddy reads imports only when it
+ * loads a config, so something must reload it after a deploy. The container
+ * does that itself: its command runs Caddy plus a small loop that watches a
+ * checksum of the snippets and runs `caddy reload` (against Caddy's own
+ * localhost admin endpoint, inside the container) when they change.
+ *
+ * Why not the alternatives:
+ * - `caddy run --watch` stops watching for good after the first config that
+ *   fails to load — a snippet read while a deploy is still copying it would
+ *   freeze the redirects until Caddy restarts.
+ * - The admin reloading Caddy through the admin API would need a channel
+ *   from the admin into Caddy and would post a file's content over HTTP.
+ *
+ * The loop waits until the checksum is stable across two reads before
+ * reloading (a deploy may be mid-copy), and a reload Caddy rejects only
+ * logs: Caddy keeps the previous config, and the next change retries.
+ */
+/** Seconds between checksum polls. */
+const POLL_SECONDS = 2;
+/**
+ * The container's shell script: Caddy in the foreground of the container's
+ * lifetime, reloaded when any file matching `snippetGlob` changes.
+ *
+ * @param snippetGlob Shell glob of the imported snippets, e.g.
+ *   `/srv/caelo/output/*\/current/_redirects.caddy`.
+ */
+export function caddyRedirectReloadScript(snippetGlob) {
+    if (/[\s'"`$\\;&|<>]/.test(snippetGlob)) {
+        throw new Error(`caddy-redirects: unsafe snippet glob ${JSON.stringify(snippetGlob)}`);
+    }
+    const config = "--config /etc/caddy/Caddyfile --adapter caddyfile";
+    return [
+        `sum() { cat ${snippetGlob} 2>/dev/null | md5sum; }`,
+        "last=$(sum)",
+        `caddy run ${config} &`,
+        "pid=$!",
+        `trap 'kill -TERM "$pid" 2>/dev/null; wait "$pid"; exit $?' TERM INT`,
+        `while kill -0 "$pid" 2>/dev/null; do`,
+        `  sleep ${POLL_SECONDS}`,
+        "  now=$(sum)",
+        `  [ "$now" = "$last" ] && continue`,
+        // A deploy may still be copying the file: reload only a stable one.
+        "  sleep 1",
+        `  [ "$(sum)" = "$now" ] || continue`,
+        "  last=$now",
+        `  caddy reload ${config} || echo "caelo: redirects changed but Caddy rejected the reload; still serving the previous redirects" >&2`,
+        "done",
+        `wait "$pid"`,
+    ].join("\n");
+}
+/**
+ * A Compose `command:` line running {@link caddyRedirectReloadScript}. `$` is
+ * doubled because Compose interpolates `$VAR` in the file; the JSON string is
+ * a valid YAML double-quoted scalar.
+ */
+export function caddyRedirectReloadCommand(snippetGlob) {
+    const script = caddyRedirectReloadScript(snippetGlob).replaceAll("$", () => "$$");
+    return `command: ["/bin/sh", "-c", ${JSON.stringify(script)}]`;
+}
+//# sourceMappingURL=caddy-redirects.js.map

package/dist/caddy-redirects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caddy-redirects.js","sourceRoot":"","sources":["../src/caddy-redirects.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,sCAAsC;AACtC,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,mDAAmD,CAAC;IACnE,OAAO;QACL,eAAe,WAAW,0BAA0B;QACpD,aAAa;QACb,aAAa,MAAM,IAAI;QACvB,QAAQ;QACR,qEAAqE;QACrE,sCAAsC;QACtC,WAAW,YAAY,EAAE;QACzB,cAAc;QACd,oCAAoC;QACpC,oEAAoE;QACpE,WAAW;QACX,qCAAqC;QACrC,aAAa;QACb,kBAAkB,MAAM,6GAA6G;QACrI,MAAM;QACN,aAAa;KACd,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,MAAM,MAAM,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO,8BAA8B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AACjE,CAAC"}

package/dist/caddy.d.ts

@@ -3,13 +3,33 @@ export interface CaddyDomainSpec {
     readonly kind: "admin" | "public";
     readonly env: "production" | "staging";
 }
+/**
+ * How Caddy gets certificates: `acme` — publicly trusted ones from Let's
+ * Encrypt / ZeroSSL (needs public DNS + ports 80/443 reachable); `internal`
+ * — Caddy's own local CA, for a LAN or evaluation install without public
+ * DNS (browsers warn until the CA root is trusted).
+ */
+export type CaddyTlsMode = "acme" | "internal";
 export interface CaddyfileSpec {
     readonly ownerEmail: string;
+    readonly tls: CaddyTlsMode;
     readonly publicSiteRoot: string;
     readonly stagingSiteRoot: string;
-    readonly adminPort: number;
-    readonly gatewayPort: number;
+    /** `host:port` of the admin as Caddy reaches it (Compose: `caelo-admin:5173`). */
+    readonly adminUpstream: string;
+    /** `host:port` of the API gateway as Caddy reaches it (Compose: `caelo-gateway:8090`). */
+    readonly gatewayUpstream: string;
     readonly domains: ReadonlyArray<CaddyDomainSpec>;
 }
+/** The host the admin of a self-hosted install answers on (same convention as GCP). */
+export declare function selfHostedAdminHost(domain: string): string;
+/**
+ * The vhosts every self-hosted install serves before an Owner adds domains
+ * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
+ * the staging site on its own host. The admin needs its own host — it
+ * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
+ * public site, and Caddy refuses two site blocks for the same address.
+ */
+export declare function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[];
 export declare function generateCaddyfile(spec: CaddyfileSpec): string;
 //# sourceMappingURL=caddy.d.ts.map

package/dist/caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAyB7D"}
+{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqC7D"}

package/dist/caddy.js

@@ -4,18 +4,32 @@
  *
  * Reads the `domains` table + the deploy targets and emits a
  * deterministic Caddyfile string. The CLI's `regenerate-caddy`
- * sub-command writes this to `/etc/caddy/Caddyfile` and runs
+ * sub-command writes this to `.caelo/Caddyfile` and runs
  * `caddy reload`.
  *
  * Per-vhost shape:
  *   <hostname> {
- *     # admin   → reverse_proxy localhost:5173
- *     # public  → root + try_files (static), with /api/* → gateway
- *     tls <ownerEmail>
+ *     # admin   → reverse_proxy <adminUpstream>
+ *     # public  → /api/* → <gatewayUpstream>; everything else is the
+ *     #           static site (try_files + file_server, 404 → /404.html)
  *   }
  *
+ * Upstreams are `host:port` as seen FROM CADDY. In the Compose install
+ * Caddy runs in its own container, where `localhost` is Caddy itself, so
+ * the CLI passes the Compose service names (`caelo-admin:5173`,
+ * `caelo-gateway:8090`) — issue #707.
+ *
+ * Every directive here must be one Caddy accepts: the output is checked
+ * with `caddy validate` on the pinned Caddy image (caddy-validate.test.ts,
+ * run in CI) — issue #566 shipped a `try_files` nested inside
+ * `file_server { }`, which Caddy 2.11 refuses, so no vhost came up.
+ *
  * Staging vhosts force `X-Robots-Tag: noindex`.
  *
+ * Public vhosts import the redirect snippet of the build they serve
+ * (`_redirects.caddy`, #587); the Caddy container reloads itself when a
+ * deploy changes it (caddy-redirects.ts).
+ *
  * Public vhosts mark content-hashed build outputs (fonts, plugin
  * bundles — `CONTENT_HASHED_PATH_PATTERN` in @caelo-cms/shared)
  * `immutable` for a year. Everything else keeps Caddy's file_server
@@ -25,17 +39,49 @@
  * hashed URL (an old page requesting an asset the new build dropped)
  * is never cached for a year.
  *
+ * A path that matches no file is a real 404 serving the generator's
+ * `/404.html` — never the home page with a 200 (an SPA-style
+ * `/index.html` fallback would turn every dead URL into a soft 404).
+ * Same behaviour as the GCS / S3 / Blob adapters (CLAUDE.md §11.B).
+ *
  * `.ico` files (theme favicons) are served as `image/x-icon`, the one
  * icon MIME the media library stores and `<link rel="icon" type>`
  * declares. file_server only fills Content-Type when no earlier handler
  * set it, so the `header` line wins over the host's mime.types name.
  */
-import { CONTENT_HASHED_PATH_PATTERN, IMMUTABLE_CACHE_CONTROL } from "@caelo-cms/shared";
+import { CONTENT_HASHED_PATH_PATTERN, caddyRedirectsImport, IMMUTABLE_CACHE_CONTROL, } from "@caelo-cms/shared";
+/** The host the admin of a self-hosted install answers on (same convention as GCP). */
+export function selfHostedAdminHost(domain) {
+    return `admin.${domain}`;
+}
+/**
+ * The vhosts every self-hosted install serves before an Owner adds domains
+ * in the admin: the admin on `admin.<domain>`, the live site on `<domain>`,
+ * the staging site on its own host. The admin needs its own host — it
+ * routes from `/` (`/setup`, `/login`, …), so it cannot share one with the
+ * public site, and Caddy refuses two site blocks for the same address.
+ */
+export function selfHostedSeedDomains(domain, stagingDomain) {
+    return [
+        { hostname: selfHostedAdminHost(domain), kind: "admin", env: "production" },
+        { hostname: domain, kind: "public", env: "production" },
+        { hostname: stagingDomain, kind: "public", env: "staging" },
+    ];
+}
 export function generateCaddyfile(spec) {
+    const hostnames = new Set();
+    for (const d of spec.domains) {
+        if (hostnames.has(d.hostname)) {
+            // Caddy refuses a config with two site blocks for one address, so a
+            // duplicate would take every vhost down, not just this one.
+            throw new Error(`Caddyfile: ${d.hostname} is listed twice — one host serves either the admin or a public site, not both.`);
+        }
+        hostnames.add(d.hostname);
+    }
     const blocks = [];
     // Global options.
     blocks.push(`{
-  email ${spec.ownerEmail}
+  email ${spec.ownerEmail}${spec.tls === "internal" ? "\n  local_certs" : ""}
 }
 `);
     for (const d of spec.domains) {
@@ -47,7 +93,7 @@ export function generateCaddyfile(spec) {
         blocks.push(`# No domains configured yet — cms-provision regenerate-caddy
 # will overwrite this file when you add one at /settings/domains.
 :8081 {
-  reverse_proxy localhost:${spec.adminPort}
+  reverse_proxy ${spec.adminUpstream}
 }
 `);
     }
@@ -57,15 +103,18 @@ function vhost(d, spec) {
     const noindex = d.env === "staging" ? `\n  header X-Robots-Tag "noindex"` : "";
     if (d.kind === "admin") {
         return `${d.hostname} {${noindex}
-  reverse_proxy localhost:${spec.adminPort}
+  reverse_proxy ${spec.adminUpstream}
 }
 `;
     }
-    // public — API routes go to the gateway,
-    // the rest serves static files. Locale variants serve from a
+    // public — API routes go to the gateway, the rest is the static site.
+    // `try_files` is its own directive (a rewrite), never a file_server
+    // subdirective (#566).
     const root = d.env === "staging" ? spec.stagingSiteRoot : spec.publicSiteRoot;
+    // #587 — the redirects table of the build this vhost serves.
     return `${d.hostname} {${noindex}
   root * ${root}
+  ${caddyRedirectsImport(root)}
   @content_hashed {
     path_regexp content_hashed ${CONTENT_HASHED_PATH_PATTERN}
     file
@@ -74,15 +123,15 @@ function vhost(d, spec) {
   @ico path *.ico
   header @ico Content-Type "image/x-icon"
   handle /api/* {
-    reverse_proxy localhost:${spec.gatewayPort}
-  }
-  handle /admin/* {
-    reverse_proxy localhost:${spec.adminPort}
+    reverse_proxy ${spec.gatewayUpstream}
   }
   handle {
-    file_server {
-      try_files {path} {path}/index.html /index.html
-    }
+    try_files {path} {path}/index.html
+    file_server
+  }
+  handle_errors 404 {
+    rewrite * /404.html
+    file_server
   }
 }
 `;

package/dist/caddy.js.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAiBzF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU;;CAExB,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;4BAGY,IAAI,CAAC,SAAS;;CAEzC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;4BACR,IAAI,CAAC,SAAS;;CAEzC,CAAC;IACA,CAAC;IACD,yCAAyC;IACzC,6DAA6D;IAC7D,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;;iCAEkB,2BAA2B;;;0CAGlB,uBAAuB;;;;8BAInC,IAAI,CAAC,WAAW;;;8BAGhB,IAAI,CAAC,SAAS;;;;;;;;CAQ3C,CAAC;AACF,CAAC"}
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;;oBAI7C,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}

package/dist/cli-routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.d.ts","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,+CAA+C;AAC/C,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAElG;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAWjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D"}
+{"version":3,"file":"cli-routing.d.ts","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,+CAA+C;AAC/C,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAElG;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,QAAQ,CAkBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D"}

package/dist/cli-routing.js

@@ -17,6 +17,13 @@ export function resolveCliRoute(argv, handlerNames) {
     if (argv.includes("--no-wizard") || argv.includes("--help") || argv.includes("-h")) {
         return { kind: "usage" };
     }
+    // #707 — `--provider self-hosted --domain … --owner-email …` is the
+    // self-hosted one-command install: `init` writes `.caelo/` and starts the
+    // stack. (The cloud wizard has nothing to provision for it.)
+    const provider = argv.indexOf("--provider");
+    if (provider !== -1 && argv[provider + 1] === "self-hosted") {
+        return { kind: "handler", name: "init" };
+    }
     return { kind: "wizard" };
 }
 /**

package/dist/cli-routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC"}
+{"version":3,"file":"cli-routing.js","sourceRoot":"","sources":["../src/cli-routing.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAenC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB,EAAE,YAA8B;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,QAAQ,KAAK,aAAa,CAAC;AACpC,CAAC"}