@caelo-cms/provisioning 0.10.49 → 0.10.51

package/stacks/gcp/index.ts

@@ -30,6 +30,7 @@ import {
   runServiceAccountId,
   staticPublisherServiceAccountId,
 } from "../../dist/gcp-names.js";
+import { createSiteUrlMap } from "../../dist/gcp-url-map.js";
 import {
   ADMIN_MEMORY_DEFAULT,
   adminEnvContract,
@@ -323,6 +324,13 @@ const pgAdminUser = new gcp.sql.User(
   opts,
 );
 
+// #633 — the Admin API makes this user a member of cloudsqlsuperuser, and
+// the stack cannot declare "no roles" (an empty `databaseRoles` reads as
+// unset, and the field is write-only, so drift would never show).
+// `cms-provision` revokes the membership on every install pass and every
+// `upgrade` (public-role-isolation.ts); the migration job's role audit
+// fails the install or upgrade while it remains
+// (packages/migrations/src/role-audit.ts).
 const pgPublicUser = new gcp.sql.User(
   `${namePrefix}-pg-public`,
   { instance: sqlInstance.name, name: "public_role", password: publicRolePassword },
@@ -654,7 +662,6 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
-    gateway: dbUrls.gateway,
   },
 } as const;
 
@@ -745,8 +752,8 @@ const gatewaySvc = cloudRunService({
   minInstances: gatewayMinInstances,
   maxInstances: 100,
   memory: "512Mi",
-  // public_role on cms_public + gateway_role on cms_admin, each with its
-  // own password; never admin_role (#613, CLAUDE.md §2).
+  // public_role on cms_public only: no cms_admin login of any role
+  // (#613, #635, CLAUDE.md §2).
   contractEnv: gatewayEnvContract(envContractInputs),
 });
 
@@ -997,29 +1004,28 @@ new gcp.iap.WebBackendServiceIamMember(
 // URL map: routes by host header.
 //   admin.<domain>  → admin backend (IAP-gated)
 //   <domain>        → default static bucket; /api/* → gateway
-const urlMap = new gcp.compute.URLMap(
+// #587 — the public path matcher also carries the redirects table as
+// `urlRedirect` rules, written by the admin on every Confirm-publish; the
+// stack ignores that field after creation (src/gcp-url-map.ts).
+const urlMap = createSiteUrlMap(
   `${namePrefix}-url-map`,
   {
-    defaultService: staticBackendBucket.id,
-    hostRules: [
-      { hosts: [domain], pathMatcher: "public" },
-      { hosts: [adminDomain], pathMatcher: "admin" },
-    ],
-    pathMatchers: [
-      {
-        name: "public",
-        defaultService: staticBackendBucket.id,
-        pathRules: [{ paths: ["/api/*"], service: gatewayBackendService.id }],
-      },
-      {
-        name: "admin",
-        defaultService: adminBackendService.id,
-      },
-    ],
+    domain,
+    adminDomain,
+    staticBackend: staticBackendBucket.id,
+    gatewayBackend: gatewayBackendService.id,
+    adminBackend: adminBackendService.id,
   },
   opts,
 );
 
+// #587 — the admin's run SA may rewrite the URL map's redirect rules through
+// a project custom role. The CLI owns that role, not this stack: the
+// installer and `cms-provision upgrade` both run ensureUrlMapRedirectsAccess
+// (url-map-redirects-access.ts). A role declared here would collide with the
+// one upgrade creates on installs older than it (a role id exists once per
+// project, and a create of an existing one fails).
+
 // Managed TLS cert covering both hostnames.
 const managedCert = new gcp.compute.ManagedSslCertificate(
   `${namePrefix}-cert`,
@@ -1151,7 +1157,6 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
-  gatewayDatabaseUrl: dbUrls.gateway as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
   bootstrapUrl:
@@ -1165,7 +1170,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp-firebase/index.ts

@@ -295,6 +295,13 @@ const pgAdminUser = new gcp.sql.User(
   { instance: sqlInstance.name, name: "admin_role", password: postgresPassword },
   opts,
 );
+// #633 — the Admin API makes this user a member of cloudsqlsuperuser, and
+// the stack cannot declare "no roles" (an empty `databaseRoles` reads as
+// unset, and the field is write-only, so drift would never show).
+// `cms-provision` revokes the membership on every install pass and every
+// `upgrade` (public-role-isolation.ts); the migration job's role audit
+// fails the install or upgrade while it remains
+// (packages/migrations/src/role-audit.ts).
 new gcp.sql.User(
   `${namePrefix}-public-user`,
   { instance: sqlInstance.name, name: "public_role", password: publicRolePassword },
@@ -599,7 +606,6 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
-    gateway: dbUrls.gateway,
   },
 } as const;
 
@@ -981,7 +987,6 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
-  gatewayDatabaseUrl: dbUrls.gateway as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   // Firebase Hosting serves media via its own CDN; we proxy through
   // the Firebase site's apex domain for canonical URLs.
@@ -998,7 +1003,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/self-hosted/Pulumi.yaml

@@ -13,11 +13,11 @@ runtime:
   options:
     typescript: true
     packagemanager: bun
-description: Caelo self-hosted Docker Compose stack (Postgres + Caddy + MinIO + admin/gateway).
+description: Caelo self-hosted Docker Compose stack (Postgres + Caddy + admin/gateway).
 config:
   caelo-self-hosted:domain:
     type: string
-    description: Primary domain (e.g. example.com). Admin + production public both bind here; staging gets staging.<domain>.
+    description: Primary domain (e.g. example.com). The live site binds here, the admin to admin.<domain>, staging to staging.<domain>.
   caelo-self-hosted:ownerEmail:
     type: string
     description: Operator email used for ACME registration with Let's Encrypt.

package/stacks/self-hosted/README.md

@@ -23,11 +23,11 @@ pulumi config set caelo-self-hosted:gatewayImage ghcr.io/caelo-cms/gateway@sha25
 pulumi up
 ```
 
-Pulumi mints postgres + minio passwords, generates `docker-compose.yml` + `Caddyfile` + `pending-token.json` under `.caelo/`, and runs `docker compose up -d`. After the run:
+Pulumi mints the postgres and role passwords and the KEK, generates `docker-compose.yml` + `Caddyfile` + `bootstrap.sh` + `pending-token.json` under `.caelo/`, starts Postgres, runs the migrations and runs `docker compose up -d`. Point DNS for `<domain>`, `admin.<domain>` and `staging.<domain>` at the host. After the run:
 
 ```bash
 pulumi stack output bootstrapUrl
-# → https://example.com/setup?token=<64-hex>
+# → https://admin.example.com/setup?token=<64-hex>
 ```
 
 Open that URL once Caddy has issued the cert (~30 s).
@@ -38,7 +38,7 @@ Open that URL once Caddy has issued the cert (~30 s).
 pulumi destroy
 ```
 
-Tears down the compose stack with `-v`, deleting all volumes (Postgres + MinIO + Caddy data). The generated files are removed too.
+Tears down the compose stack with `-v`, deleting all volumes (Postgres + Caddy data). The generated files are removed too.
 
 ## Why this exists alongside `cms-provision`
 

package/stacks/self-hosted/index.ts

@@ -9,7 +9,8 @@
  *      written to `<caeloDir>/pending-token.json`. Captured as a Pulumi
  *      output so operators can read `pulumi stack output bootstrapUrl`
  *      after `pulumi up`.
- *   3. `caeloDockerCompose` — runs `docker compose up -d` and tears down
+ *   3. `caeloDockerCompose` — starts Postgres, runs the migrations, runs
+ *      `docker compose up -d` and tears down
  *      with `docker compose down -v` on destroy.
  *
  * Why thin: Caelo's self-hosted stack is fundamentally a single Compose
@@ -24,8 +25,15 @@ import { resolve } from "node:path";
 import { local } from "@pulumi/command";
 import * as pulumi from "@pulumi/pulumi";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
-import { generateCaddyfile } from "../../dist/caddy.js";
-import { generateDockerCompose } from "../../dist/compose.js";
+import { generateCaddyfile, selfHostedAdminHost, selfHostedSeedDomains } from "../../dist/caddy.js";
+import {
+  COMPOSE_ADMIN_UPSTREAM,
+  COMPOSE_GATEWAY_UPSTREAM,
+  composeProjectName,
+  generateDockerCompose,
+  SITE_OUTPUT_ROOT,
+} from "../../dist/compose.js";
+import { selfHostedBootstrapScript } from "../../dist/self-hosted-roles.js";
 
 const cfg = new pulumi.Config();
 const domain = cfg.require("domain");
@@ -44,6 +52,8 @@ const gatewayImage = cfg.require("gatewayImage");
 
 const composePath = resolve(caeloDir, "docker-compose.yml");
 const caddyPath = resolve(caeloDir, "Caddyfile");
+// What Postgres runs on its first start: the roles + databases (compose.ts mounts it).
+const bootstrapPath = resolve(caeloDir, "bootstrap.sh");
 // The admin container mounts only `<caeloDir>/bootstrap/` (compose.ts).
 const tokenPath = resolve(caeloDir, "bootstrap", "pending-token.json");
 
@@ -56,44 +66,45 @@ const postgresPassword = pulumi.secret(randomHex(32));
 const adminRolePassword = pulumi.secret(randomHex(32));
 const publicRolePassword = pulumi.secret(randomHex(32));
 const gatewayRolePassword = pulumi.secret(randomHex(32));
-const minioRootUser = "caelo";
-const minioRootPassword = pulumi.secret(randomHex(32));
+// P18 — the KEK that encrypts stored provider keys.
+const caeloSecretKek = pulumi.secret(randomHex(32));
 
 const composeYaml = pulumi
   .all([
     postgresPassword,
-    minioRootPassword,
     adminRolePassword,
     publicRolePassword,
     gatewayRolePassword,
+    caeloSecretKek,
   ])
-  .apply(([pgPw, minioPw, adminPw, publicPw, gatewayPw]) =>
+  .apply(([pgPw, adminPw, publicPw, gatewayPw, kek]) =>
     generateDockerCompose({
       domain,
       postgresPassword: pgPw,
       rolePasswords: { admin: adminPw, public: publicPw, gateway: gatewayPw },
-      minioRootUser,
-      minioRootPassword: minioPw,
+      caeloSecretKek: kek,
       anthropicApiKey: process.env.ANTHROPIC_API_KEY,
       resendApiKey: process.env.RESEND_API_KEY,
       diskSize: "20Gi",
       ...(adminMemory ? { adminMemory } : {}),
       images: { mode: "release", admin: adminImage, gateway: gatewayImage },
+      ports: { http: 80, https: 443 },
+      project: composeProjectName(domain),
     }),
   );
 
+// Same generator inputs as `cms-provision init` (#707): the admin on
+// admin.<domain>, Caddy reaching the services by their Compose names.
 const caddyConf = generateCaddyfile({
   ownerEmail,
-  publicSiteRoot: "/srv/caelo/output/production/current",
-  stagingSiteRoot: "/srv/caelo/output/staging/current",
-  adminPort: 5173,
-  gatewayPort: 8090,
-  domains: [
-    { hostname: domain, kind: "admin", env: "production" as const },
-    { hostname: domain, kind: "public", env: "production" as const },
-    { hostname: stagingHost, kind: "public", env: "staging" as const },
-  ],
+  tls: "acme",
+  publicSiteRoot: `${SITE_OUTPUT_ROOT}/output/production/current`,
+  stagingSiteRoot: `${SITE_OUTPUT_ROOT}/output/staging/current`,
+  adminUpstream: COMPOSE_ADMIN_UPSTREAM,
+  gatewayUpstream: COMPOSE_GATEWAY_UPSTREAM,
+  domains: selfHostedSeedDomains(domain, stagingHost),
 });
+const bootstrapScript = selfHostedBootstrapScript({ agent: false });
 
 // Mint the owner bootstrap token at preview time. Captured below as a
 // Pulumi output so the URL surfaces on `pulumi up`.
@@ -111,8 +122,12 @@ EOF
 cat > ${tokenPath} <<'EOF'
 ${JSON.stringify(tokenInfo, null, 2)}
 EOF
+cat > ${bootstrapPath} <<'EOF'
+${bootstrapScript}
+EOF
+chmod 755 ${bootstrapPath}
 `,
-  delete: pulumi.interpolate`rm -f ${composePath} ${caddyPath} ${tokenPath}`,
+  delete: pulumi.interpolate`rm -f ${composePath} ${caddyPath} ${tokenPath} ${bootstrapPath}`,
   triggers: [composeYaml, caddyConf],
 });
 
@@ -121,7 +136,15 @@ EOF
 const composeUp = new local.Command(
   "caeloDockerCompose",
   {
-    create: pulumi.interpolate`docker compose -f ${composePath} up -d`,
+    // Same order as `cms-provision init` (self-hosted-start.ts): Postgres
+    // (its first start runs bootstrap.sh), the migrations with the
+    // install's admin image, then everything else.
+    create: pulumi.interpolate`set -e
+docker compose -f ${composePath} up -d --wait postgres
+for target in admin public; do
+  docker compose -f ${composePath} run --rm --no-deps -T caelo-admin bun --bun /app/packages/migrations/src/migrate.ts "$target"
+done
+docker compose -f ${composePath} up -d --remove-orphans`,
     delete: pulumi.interpolate`docker compose -f ${composePath} down -v`,
     triggers: [composeYaml],
   },
@@ -130,9 +153,9 @@ const composeUp = new local.Command(
 
 export const composeFilePath = composePath;
 export const caddyFilePath = caddyPath;
-export const bootstrapUrl = pulumi.interpolate`https://${domain}/setup?token=${tokenInfo.token}`;
+export const bootstrapUrl = pulumi.interpolate`https://${selfHostedAdminHost(domain)}/setup?token=${tokenInfo.token}`;
 export const bootstrapTokenExpiresAt = tokenInfo.expiresAt;
-export { minioRootPassword, postgresPassword };
+export { postgresPassword };
 
 // Re-export so the destroy summary shows operators what they'll lose.
 export const composeRunOutput = composeUp.stdout;

package/dist/redirects-emit.d.ts

@@ -1,52 +0,0 @@
-export type RedirectStatusCode = 301 | 302 | 307 | 308;
-export interface RedirectRow {
-    readonly fromPath: string;
-    readonly toPath: string;
-    readonly statusCode: RedirectStatusCode;
-}
-/**
- * Cloudflare Pages `_redirects` format (also consumed by Netlify, Vercel,
- * Render, etc.). One redirect per line: `<from> <to> <status>`. Wildcards
- * use `:splat`; we only support exact-path redirects in v1 (matches what
- * Caelo's redirects table allows).
- */
-export declare function emitRedirectsCloudflare(rows: ReadonlyArray<RedirectRow>): string;
-/**
- * CloudFront via Lambda@Edge. Returns a JSON config the L@E function
- * reads at startup + a tiny Lambda source that consumes it. The L@E
- * function is deployed to `us-east-1` (CloudFront constraint); the
- * config blob is bundled into the Lambda deployment artifact.
- *
- * Returning both halves lets the AWS stack ship a single asset.
- */
-export interface CloudFrontRedirectArtifact {
-    readonly jsonConfig: string;
-    readonly lambdaSource: string;
-}
-export declare function emitRedirectsCloudFront(rows: ReadonlyArray<RedirectRow>): CloudFrontRedirectArtifact;
-/**
- * Azure Front Door rules engine. Returns a Pulumi-compatible
- * RuleEngineRule[]-shaped array (untyped here so callers don't need to
- * import @pulumi/azure-native). Each rule fires on a path-equals match
- * + executes a 301/302/etc. response.
- */
-export interface FrontDoorRule {
-    readonly name: string;
-    readonly order: number;
-    readonly conditions: ReadonlyArray<{
-        readonly name: "RequestUri";
-        readonly parameters: {
-            readonly operator: "Equal";
-            readonly matchValues: ReadonlyArray<string>;
-        };
-    }>;
-    readonly actions: ReadonlyArray<{
-        readonly name: "UrlRedirect";
-        readonly parameters: {
-            readonly redirectType: "Moved" | "Found" | "TemporaryRedirect" | "PermanentRedirect";
-            readonly destinationPath: string;
-        };
-    }>;
-}
-export declare function emitRedirectsAzureFrontDoor(rows: ReadonlyArray<RedirectRow>): ReadonlyArray<FrontDoorRule>;
-//# sourceMappingURL=redirects-emit.d.ts.map

package/dist/redirects-emit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirects-emit.d.ts","sourceRoot":"","sources":["../src/redirects-emit.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,kBAAkB,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAiCD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,MAAM,CAKhF;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,GAC/B,0BAA0B,CAwB5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;QACjC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;QAC5B,QAAQ,CAAC,UAAU,EAAE;YACnB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;YAC3B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SAC7C,CAAC;KACH,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE;YACnB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,OAAO,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;YACrF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;SAClC,CAAC;KACH,CAAC,CAAC;CACJ;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,GAC/B,aAAa,CAAC,aAAa,CAAC,CAqB9B"}

package/dist/redirects-emit.js

@@ -1,111 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-/**
- * P15 — per-provider redirect file generators.
- *
- * P14's self-hosted Caddy consumes a `_redirects.caddy` file. Cloud
- * providers want different formats: Cloudflare Pages reads `_redirects`
- * (also a fine fit for any platform that consumes that format),
- * CloudFront wants a JSON config a Lambda@Edge function reads at
- * startup, and Azure Front Door wants a rules-engine RuleEngineRule[].
- *
- * The deploy step calls the right emitter based on `process.env.CAELO_PROVIDER`
- * and uploads the result to the right place. Each emitter is pure +
- * idempotent — same input → same byte output.
- */
-import { redirectTargetIssue } from "@caelo-cms/shared";
-/**
- * Reject whitespace + control chars in either path before any emitter
- * touches them. The Cloudflare `_redirects` format is space-delimited;
- * a `fromPath` containing a space ambiguates the line (CF parses
- * `/old foo /new 301` as from=`/old`, to=`foo`, status=`/new`, then
- * fails on `301`). Caelo's redirects table normally rejects these
- * upstream but the emitter shouldn't trust that — pure functions
- * defend their own contract.
- */
-function assertPathClean(label, path) {
-    // \p{Cc} matches the Unicode control category (U+0000–U+001F + U+007F–U+009F);
-    // the linter rejects literal \x00-\x1f ranges in regex, but the intent — defending
-    // emitter contracts against control chars — is the explicit reason for this check.
-    if (/[\s\p{Cc}]/u.test(path)) {
-        throw new Error(`redirects-emit: ${label}=${JSON.stringify(path)} contains whitespace or control chars; reject upstream`);
-    }
-}
-function assertRowsClean(rows) {
-    for (const r of rows) {
-        assertPathClean("fromPath", r.fromPath);
-        assertPathClean("toPath", r.toPath);
-        // #657 — a `//host` or `/https://…` target would ship as an open
-        // redirect or a broken 301 in every CDN format below.
-        const targetIssue = redirectTargetIssue(r.toPath);
-        if (targetIssue)
-            throw new Error(`redirects-emit: ${targetIssue}`);
-    }
-}
-/**
- * Cloudflare Pages `_redirects` format (also consumed by Netlify, Vercel,
- * Render, etc.). One redirect per line: `<from> <to> <status>`. Wildcards
- * use `:splat`; we only support exact-path redirects in v1 (matches what
- * Caelo's redirects table allows).
- */
-export function emitRedirectsCloudflare(rows) {
-    assertRowsClean(rows);
-    const header = "# Generated by @caelo-cms/provisioning — do not edit by hand.\n";
-    const lines = rows.map((r) => `${r.fromPath} ${r.toPath} ${r.statusCode}`);
-    return header + lines.join("\n") + (rows.length > 0 ? "\n" : "");
-}
-export function emitRedirectsCloudFront(rows) {
-    assertRowsClean(rows);
-    const jsonConfig = JSON.stringify({ redirects: rows.map((r) => ({ from: r.fromPath, to: r.toPath, status: r.statusCode })) }, null, 2);
-    // Tiny Lambda@Edge handler. v1 is exact-path match (matches Caelo's
-    // redirects table). Wildcard support lands when the table grows it.
-    const lambdaSource = `// SPDX-License-Identifier: MPL-2.0
-// Generated by @caelo-cms/provisioning. Bundled with redirects.json.
-const REDIRECTS = require("./redirects.json").redirects;
-const TABLE = new Map(REDIRECTS.map((r) => [r.from, r]));
-exports.handler = (event, _ctx, callback) => {
-  const req = event.Records[0].cf.request;
-  const m = TABLE.get(req.uri);
-  if (!m) return callback(null, req);
-  callback(null, {
-    status: String(m.status),
-    statusDescription: "Redirect",
-    headers: { location: [{ key: "Location", value: m.to }] },
-  });
-};`;
-    return { jsonConfig, lambdaSource };
-}
-export function emitRedirectsAzureFrontDoor(rows) {
-    assertRowsClean(rows);
-    return rows.map((r, i) => ({
-        name: `redirect-${i + 1}`,
-        order: i + 1,
-        conditions: [
-            {
-                name: "RequestUri",
-                parameters: { operator: "Equal", matchValues: [r.fromPath] },
-            },
-        ],
-        actions: [
-            {
-                name: "UrlRedirect",
-                parameters: {
-                    redirectType: statusToFrontDoor(r.statusCode),
-                    destinationPath: r.toPath,
-                },
-            },
-        ],
-    }));
-}
-function statusToFrontDoor(status) {
-    switch (status) {
-        case 301:
-            return "Moved";
-        case 302:
-            return "Found";
-        case 307:
-            return "TemporaryRedirect";
-        case 308:
-            return "PermanentRedirect";
-    }
-}
-//# sourceMappingURL=redirects-emit.js.map

package/dist/redirects-emit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redirects-emit.js","sourceRoot":"","sources":["../src/redirects-emit.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAUxD;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,KAA4B,EAAE,IAAY;IACjE,+EAA+E;IAC/E,mFAAmF;IACnF,mFAAmF;IACnF,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,wDAAwD,CACzG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAgC;IACvD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACxC,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACpC,iEAAiE;QACjE,sDAAsD;QACtD,MAAM,WAAW,GAAG,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAgC;IACtE,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,iEAAiE,CAAC;IACjF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E,OAAO,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAeD,MAAM,UAAU,uBAAuB,CACrC,IAAgC;IAEhC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAC/B,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAC1F,IAAI,EACJ,CAAC,CACF,CAAC;IACF,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,YAAY,GAAG;;;;;;;;;;;;;GAapB,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC;AA2BD,MAAM,UAAU,2BAA2B,CACzC,IAAgC;IAEhC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;QACzB,KAAK,EAAE,CAAC,GAAG,CAAC;QACZ,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,YAAqB;gBAC3B,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAgB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;aACtE;SACF;QACD,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,aAAsB;gBAC5B,UAAU,EAAE;oBACV,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;oBAC7C,eAAe,EAAE,CAAC,CAAC,MAAM;iBAC1B;aACF;SACF;KACF,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,iBAAiB,CACxB,MAA0B;IAE1B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG;YACN,OAAO,OAAO,CAAC;QACjB,KAAK,GAAG;YACN,OAAO,OAAO,CAAC;QACjB,KAAK,GAAG;YACN,OAAO,mBAAmB,CAAC;QAC7B,KAAK,GAAG;YACN,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/src/redirects-emit.ts

@@ -1,175 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-/**
- * P15 — per-provider redirect file generators.
- *
- * P14's self-hosted Caddy consumes a `_redirects.caddy` file. Cloud
- * providers want different formats: Cloudflare Pages reads `_redirects`
- * (also a fine fit for any platform that consumes that format),
- * CloudFront wants a JSON config a Lambda@Edge function reads at
- * startup, and Azure Front Door wants a rules-engine RuleEngineRule[].
- *
- * The deploy step calls the right emitter based on `process.env.CAELO_PROVIDER`
- * and uploads the result to the right place. Each emitter is pure +
- * idempotent — same input → same byte output.
- */
-
-import { redirectTargetIssue } from "@caelo-cms/shared";
-
-export type RedirectStatusCode = 301 | 302 | 307 | 308;
-
-export interface RedirectRow {
-  readonly fromPath: string;
-  readonly toPath: string;
-  readonly statusCode: RedirectStatusCode;
-}
-
-/**
- * Reject whitespace + control chars in either path before any emitter
- * touches them. The Cloudflare `_redirects` format is space-delimited;
- * a `fromPath` containing a space ambiguates the line (CF parses
- * `/old foo /new 301` as from=`/old`, to=`foo`, status=`/new`, then
- * fails on `301`). Caelo's redirects table normally rejects these
- * upstream but the emitter shouldn't trust that — pure functions
- * defend their own contract.
- */
-function assertPathClean(label: "fromPath" | "toPath", path: string): void {
-  // \p{Cc} matches the Unicode control category (U+0000–U+001F + U+007F–U+009F);
-  // the linter rejects literal \x00-\x1f ranges in regex, but the intent — defending
-  // emitter contracts against control chars — is the explicit reason for this check.
-  if (/[\s\p{Cc}]/u.test(path)) {
-    throw new Error(
-      `redirects-emit: ${label}=${JSON.stringify(path)} contains whitespace or control chars; reject upstream`,
-    );
-  }
-}
-
-function assertRowsClean(rows: ReadonlyArray<RedirectRow>): void {
-  for (const r of rows) {
-    assertPathClean("fromPath", r.fromPath);
-    assertPathClean("toPath", r.toPath);
-    // #657 — a `//host` or `/https://…` target would ship as an open
-    // redirect or a broken 301 in every CDN format below.
-    const targetIssue = redirectTargetIssue(r.toPath);
-    if (targetIssue) throw new Error(`redirects-emit: ${targetIssue}`);
-  }
-}
-
-/**
- * Cloudflare Pages `_redirects` format (also consumed by Netlify, Vercel,
- * Render, etc.). One redirect per line: `<from> <to> <status>`. Wildcards
- * use `:splat`; we only support exact-path redirects in v1 (matches what
- * Caelo's redirects table allows).
- */
-export function emitRedirectsCloudflare(rows: ReadonlyArray<RedirectRow>): string {
-  assertRowsClean(rows);
-  const header = "# Generated by @caelo-cms/provisioning — do not edit by hand.\n";
-  const lines = rows.map((r) => `${r.fromPath} ${r.toPath} ${r.statusCode}`);
-  return header + lines.join("\n") + (rows.length > 0 ? "\n" : "");
-}
-
-/**
- * CloudFront via Lambda@Edge. Returns a JSON config the L@E function
- * reads at startup + a tiny Lambda source that consumes it. The L@E
- * function is deployed to `us-east-1` (CloudFront constraint); the
- * config blob is bundled into the Lambda deployment artifact.
- *
- * Returning both halves lets the AWS stack ship a single asset.
- */
-export interface CloudFrontRedirectArtifact {
-  readonly jsonConfig: string;
-  readonly lambdaSource: string;
-}
-
-export function emitRedirectsCloudFront(
-  rows: ReadonlyArray<RedirectRow>,
-): CloudFrontRedirectArtifact {
-  assertRowsClean(rows);
-  const jsonConfig = JSON.stringify(
-    { redirects: rows.map((r) => ({ from: r.fromPath, to: r.toPath, status: r.statusCode })) },
-    null,
-    2,
-  );
-  // Tiny Lambda@Edge handler. v1 is exact-path match (matches Caelo's
-  // redirects table). Wildcard support lands when the table grows it.
-  const lambdaSource = `// SPDX-License-Identifier: MPL-2.0
-// Generated by @caelo-cms/provisioning. Bundled with redirects.json.
-const REDIRECTS = require("./redirects.json").redirects;
-const TABLE = new Map(REDIRECTS.map((r) => [r.from, r]));
-exports.handler = (event, _ctx, callback) => {
-  const req = event.Records[0].cf.request;
-  const m = TABLE.get(req.uri);
-  if (!m) return callback(null, req);
-  callback(null, {
-    status: String(m.status),
-    statusDescription: "Redirect",
-    headers: { location: [{ key: "Location", value: m.to }] },
-  });
-};`;
-  return { jsonConfig, lambdaSource };
-}
-
-/**
- * Azure Front Door rules engine. Returns a Pulumi-compatible
- * RuleEngineRule[]-shaped array (untyped here so callers don't need to
- * import @pulumi/azure-native). Each rule fires on a path-equals match
- * + executes a 301/302/etc. response.
- */
-export interface FrontDoorRule {
-  readonly name: string;
-  readonly order: number;
-  readonly conditions: ReadonlyArray<{
-    readonly name: "RequestUri";
-    readonly parameters: {
-      readonly operator: "Equal";
-      readonly matchValues: ReadonlyArray<string>;
-    };
-  }>;
-  readonly actions: ReadonlyArray<{
-    readonly name: "UrlRedirect";
-    readonly parameters: {
-      readonly redirectType: "Moved" | "Found" | "TemporaryRedirect" | "PermanentRedirect";
-      readonly destinationPath: string;
-    };
-  }>;
-}
-
-export function emitRedirectsAzureFrontDoor(
-  rows: ReadonlyArray<RedirectRow>,
-): ReadonlyArray<FrontDoorRule> {
-  assertRowsClean(rows);
-  return rows.map((r, i) => ({
-    name: `redirect-${i + 1}`,
-    order: i + 1,
-    conditions: [
-      {
-        name: "RequestUri" as const,
-        parameters: { operator: "Equal" as const, matchValues: [r.fromPath] },
-      },
-    ],
-    actions: [
-      {
-        name: "UrlRedirect" as const,
-        parameters: {
-          redirectType: statusToFrontDoor(r.statusCode),
-          destinationPath: r.toPath,
-        },
-      },
-    ],
-  }));
-}
-
-function statusToFrontDoor(
-  status: RedirectStatusCode,
-): FrontDoorRule["actions"][0]["parameters"]["redirectType"] {
-  switch (status) {
-    case 301:
-      return "Moved";
-    case 302:
-      return "Found";
-    case 307:
-      return "TemporaryRedirect";
-    case 308:
-      return "PermanentRedirect";
-  }
-}