@caelo-cms/provisioning 0.10.50 → 0.10.51

package/dist/adapter.d.ts

@@ -49,14 +49,12 @@ export interface DnsRecord {
 export interface CloudAdapterOutputs {
     /** DSN for cms_admin role (encrypted in Pulumi state). */
     readonly adminDatabaseUrl: string;
-    /** DSN for public_role on cms_public (encrypted in Pulumi state). */
-    readonly publicDatabaseUrl: string;
     /**
-     * DSN for gateway_role on cms_admin — the API gateway's own narrow login
-     * (#613). The gateway gets this and `publicDatabaseUrl`, never
-     * `adminDatabaseUrl` (CLAUDE.md §2).
+     * DSN for public_role on cms_public (encrypted in Pulumi state) — the API
+     * gateway's only database login. It never gets a cms_admin DSN of any
+     * role (CLAUDE.md §2, #635).
      */
-    readonly gatewayDatabaseUrl: string;
+    readonly publicDatabaseUrl: string;
     /** Provider-native blob URL (s3://, gs://, https://<account>.blob.core.windows.net/<container>). */
     readonly mediaStorageUrl: string;
     /** Public-facing URL the admin reaches for media reads. */

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}

package/dist/admin-internal.d.ts

@@ -0,0 +1,41 @@
+import { type GcloudResult } from "./gcloud.js";
+type Run = (args: string[]) => Promise<GcloudResult>;
+export interface AdminInternalTarget {
+    readonly projectId: string;
+    readonly region: string;
+}
+export interface AdminInternalDeps {
+    readonly run?: Run;
+    readonly fetch?: typeof fetch;
+    /** Seconds since epoch (IAP JWT); tests pin it. */
+    readonly now?: () => number;
+}
+/** One endpoint call: where, under which token scope, with what body. */
+export interface AdminInternalCall {
+    /** Path under the admin origin, e.g. `/api/internal/owner-reset`. */
+    readonly endpoint: string;
+    /** Scope the endpoint's `requireInternalAuth` checks. */
+    readonly scope: string;
+    readonly body: Record<string, unknown>;
+    /** The issue that added the endpoint, named when an older admin answers 404. */
+    readonly introducedBy: string;
+}
+export type AdminInternalResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * POST `call.body` to the endpoint and return the admin's JSON answer and
+ * the admin URL it was reached at (to build links the operator opens).
+ * Every failure names the fix: an IAP refusal or a pre-endpoint admin points
+ * at `cms-provision upgrade`, a refusal carries the admin's own message.
+ */
+export declare function callAdminInternal<T>(target: AdminInternalTarget, call: AdminInternalCall, deps?: AdminInternalDeps): Promise<AdminInternalResult<{
+    answer: T;
+    adminUrl: string;
+}>>;
+export {};
+//# sourceMappingURL=admin-internal.d.ts.map

package/dist/admin-internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal.d.ts","sourceRoot":"","sources":["../src/admin-internal.ts"],"names":[],"mappings":"AAuBA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAIzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAKrD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,iBAAiB,EACvB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAkG/D"}

package/dist/admin-internal.js

@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The CLI's channel to the admin's `/api/internal/*` endpoints on a
+ * gcp-firebase install, for commands that need an answer BACK from the admin
+ * (a generated password, a reset link). A one-shot Cloud Run job could only
+ * report through Cloud Logging, which would put that secret into the
+ * project's logs; this call answers over TLS straight to the CLI process, and
+ * nothing is written anywhere (CLAUDE.md §7, #659).
+ *
+ * Getting there, as the operator's own gcloud identity — the same path the
+ * Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
+ *
+ *   1. the admin Cloud Run service and its URL;
+ *   2. the install's internal secret from Secret Manager (in memory only),
+ *      which signs a 5-minute token for the endpoint's scope;
+ *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
+ *      API — the admin's IAP lets that service account in, and every
+ *      IAP-allowlisted operator may sign as it (`cms-provision upgrade`
+ *      grants it) — so the request passes IAP first, then Caelo's token.
+ */
+import { findService } from "./admin-domain.js";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
+import { mintInternalToken } from "./internal-token.js";
+/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
+const IAP_JWT_LIFETIME_S = 600;
+/**
+ * POST `call.body` to the endpoint and return the admin's JSON answer and
+ * the admin URL it was reached at (to build links the operator opens).
+ * Every failure names the fix: an IAP refusal or a pre-endpoint admin points
+ * at `cms-provision upgrade`, a refusal carries the admin's own message.
+ */
+export async function callAdminInternal(target, call, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const doFetch = deps.fetch ?? fetch;
+    const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
+    const found = await findService(run, scope, "admin");
+    if (!found.ok)
+        return { ok: false, error: found.error };
+    const url = await run([
+        "run",
+        "services",
+        "describe",
+        found.service,
+        ...scope,
+        "--format=value(status.url)",
+    ]);
+    const adminUrl = url.stdout.trim();
+    if (!url.ok || !adminUrl) {
+        return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
+    }
+    const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
+    const secret = await run([
+        "secrets",
+        "versions",
+        "access",
+        "latest",
+        `--secret=${secretId}`,
+        `--project=${target.projectId}`,
+    ]);
+    const internalSecret = secret.stdout.trim();
+    if (!secret.ok || internalSecret.length < 32) {
+        return {
+            ok: false,
+            error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
+        };
+    }
+    // Installs from before #678 may not have the IAM Credentials API on;
+    // enabling an enabled API is a no-op (codex review on #681).
+    const api = await run([
+        "services",
+        "enable",
+        "iamcredentials.googleapis.com",
+        `--project=${target.projectId}`,
+    ]);
+    if (!api.ok) {
+        return {
+            ok: false,
+            error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
+        };
+    }
+    const iap = await signIapJwt(run, doFetch, target.projectId, adminUrl, deps.now);
+    if (!iap.ok)
+        return iap;
+    const token = await mintInternalToken(internalSecret, call.scope);
+    let res;
+    try {
+        res = await doFetch(`${adminUrl}${call.endpoint}`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${iap.value}`,
+                "x-caelo-internal-token": token,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(call.body),
+        });
+    }
+    catch (e) {
+        return { ok: false, error: `reach the admin at ${adminUrl}: ${String(e)}` };
+    }
+    const text = await res.text();
+    if (res.headers.get("x-goog-iap-generated-response") === "true") {
+        return {
+            ok: false,
+            error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
+        };
+    }
+    if (res.status === 404) {
+        return {
+            ok: false,
+            error: `the admin has no ${call.endpoint} yet (it runs a release from before ${call.introducedBy}). Run \`cms-provision upgrade\`, then run this command again.`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return {
+            ok: false,
+            error: `the admin answered HTTP ${res.status} with a non-JSON body: ${text.slice(0, 200)}`,
+        };
+    }
+    if (!res.ok || parsed.ok !== true) {
+        return {
+            ok: false,
+            error: `the admin refused (HTTP ${res.status}): ${parsed.error ?? text.slice(0, 300)}`,
+        };
+    }
+    return { ok: true, value: { answer: parsed, adminUrl } };
+}
+/** A JWT signed as the install's MCP service account, for the admin's IAP. */
+async function signIapJwt(run, doFetch, projectId, adminUrl, now) {
+    const access = await run(["auth", "print-access-token"]);
+    const accessToken = access.stdout.trim();
+    if (!access.ok || !accessToken) {
+        return {
+            ok: false,
+            error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
+        };
+    }
+    const serviceAccount = mcpIapServiceAccountEmail(projectId);
+    const iat = now ? now() : Math.floor(Date.now() / 1000);
+    const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
+        body: JSON.stringify({
+            payload: JSON.stringify({
+                iss: serviceAccount,
+                sub: serviceAccount,
+                aud: `${new URL(adminUrl).origin}/*`,
+                iat,
+                exp: iat + IAP_JWT_LIFETIME_S,
+            }),
+        }),
+    });
+    if (!res.ok) {
+        const detail = (await res.text().catch(() => "")).slice(0, 300);
+        return {
+            ok: false,
+            error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
+        };
+    }
+    const { signedJwt } = (await res.json());
+    if (!signedJwt)
+        return { ok: false, error: "IAM signJwt answered without a signedJwt" };
+    return { ok: true, value: signedJwt };
+}
+//# sourceMappingURL=admin-internal.js.map

package/dist/admin-internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal.js","sourceRoot":"","sources":["../src/admin-internal.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIxD,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AA2B/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,IAAuB,EACvB,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uCAAuC,QAAQ,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,sBAAsB,2EAA2E;SAC1M,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mGAAmG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE;gBACpC,wBAAwB,EAAE,KAAK;gBAC/B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,MAAM,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wCAAwC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,0IAA0I;SACpR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,uCAAuC,IAAI,CAAC,YAAY,gEAAgE;SACjK,CAAC;IACJ,CAAC;IACD,IAAI,MAAkE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,GAAG,CAAC,MAAM,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,GAAG,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAsB,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,UAAU,CACvB,GAAQ,EACR,OAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,GAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oCAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,oEAAoE;SAC/I,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,cAAc,CAAC,UAAU,EACnH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAI;gBACpC,GAAG;gBACH,GAAG,EAAE,GAAG,GAAG,kBAAkB;aAC9B,CAAC;SACH,CAAC;KACH,CACF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,cAAc,UAAU,GAAG,CAAC,MAAM,MAAM,MAAM,4IAA4I;SAC1N,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IACxF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC"}

package/dist/agent-db.js

@@ -17777,6 +17777,13 @@ function isRlsDenial(error) {
 // ../query-api/src/adapter.ts
 var SQL3 = globalThis.Bun?.SQL;
 var DEFAULT_ROLES = { admin: "admin_role", public: ["admin_role", "public_role"] };
+
+class AdminDatabaseUnavailableError extends Error {
+  name = "AdminDatabaseUnavailableError";
+  constructor(what) {
+    super(`${what}: this process has no cms_admin connection by design (public side, CLAUDE.md \xA72). Read what the admin published into cms_public instead.`);
+  }
+}
 function resolvePoolMax(explicit) {
   if (explicit !== undefined)
     return validatePoolMax(explicit, "poolMax option");
@@ -17800,19 +17807,41 @@ class DatabaseAdapter {
   #skipVerify;
   #roles;
   #verifyPromise = null;
+  #projectionPublisher = null;
   constructor(config) {
-    const poolMax = resolvePoolMax(config.poolMax);
-    if (poolMax === undefined) {
-      this.#adminRaw = new SQL3(config.adminDatabaseUrl);
-      this.#publicRaw = new SQL3(config.publicDatabaseUrl);
-    } else {
-      this.#adminRaw = new SQL3(config.adminDatabaseUrl, { max: poolMax });
-      this.#publicRaw = new SQL3(config.publicDatabaseUrl, { max: poolMax });
+    this.#roles = config.expectedRoles ?? DEFAULT_ROLES;
+    if (config.adminDatabaseUrl === null !== (this.#roles.admin === null)) {
+      throw new Error("DatabaseAdapter: a public-only adapter (adminDatabaseUrl: null) must expect no admin role, and an adapter with an admin URL must expect one");
     }
-    this.#admin = drizzle(this.#adminRaw);
+    const poolMax = resolvePoolMax(config.poolMax);
+    const open = (url) => poolMax === undefined ? new SQL3(url) : new SQL3(url, { max: poolMax });
+    this.#adminRaw = config.adminDatabaseUrl === null ? null : open(config.adminDatabaseUrl);
+    this.#publicRaw = open(config.publicDatabaseUrl);
+    this.#admin = this.#adminRaw === null ? null : drizzle(this.#adminRaw);
     this.#public = drizzle(this.#publicRaw);
     this.#skipVerify = config.skipRoleVerification === true;
-    this.#roles = config.expectedRoles ?? DEFAULT_ROLES;
+  }
+  get hasAdminDatabase() {
+    return this.#admin !== null;
+  }
+  setProjectionPublisher(publish) {
+    this.#projectionPublisher = publish;
+  }
+  async#projectionDirty(tx) {
+    if (this.#projectionPublisher === null)
+      return false;
+    const found = await tx.execute(sql`SELECT current_setting('caelo.projection_dirty', true) AS v`);
+    return found[0]?.v === "on";
+  }
+  async#publishAfterCommit() {
+    const publish = this.#projectionPublisher;
+    if (publish !== null)
+      await publish();
+  }
+  #adminDb(what) {
+    if (this.#admin === null)
+      throw new AdminDatabaseUnavailableError(what);
+    return this.#admin;
   }
   verifyRoles() {
     if (this.#verifyPromise !== null)
@@ -17824,9 +17853,11 @@ class DatabaseAdapter {
     return this.#verifyPromise;
   }
   async#verifyRolesOnce() {
-    const admin = await this.#identity(this.#adminRaw);
-    if (admin.user !== this.#roles.admin || admin.database !== "cms_admin") {
-      throw new Error(`DatabaseAdapter admin pool expected (${this.#roles.admin}, cms_admin) but connected as (${admin.user}, ${admin.database}). Check ADMIN_DATABASE_URL.`);
+    if (this.#adminRaw !== null) {
+      const admin = await this.#identity(this.#adminRaw);
+      if (admin.user !== this.#roles.admin || admin.database !== "cms_admin") {
+        throw new Error(`DatabaseAdapter admin pool expected (${this.#roles.admin}, cms_admin) but connected as (${admin.user}, ${admin.database}). Check ADMIN_DATABASE_URL.`);
+      }
     }
     const pub = await this.#identity(this.#publicRaw);
     if (pub.database !== "cms_public") {
@@ -17846,9 +17877,11 @@ class DatabaseAdapter {
   async runOperation(op, ctx, validatedInput) {
     if (!this.#skipVerify)
       await this.verifyRoles();
-    const db = op.database === "cms_admin" ? this.#admin : this.#public;
+    const db = op.database === "cms_admin" ? this.#adminDb(`operation ${op.name}`) : this.#public;
+    let publishAfterCommit = false;
+    let result;
     try {
-      return await db.transaction(async (tx) => {
+      result = await db.transaction(async (tx) => {
         await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
         await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
         await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
@@ -17859,7 +17892,10 @@ class DatabaseAdapter {
           if (denied !== null)
             return err(branchNotFound(op.name, denied));
         }
-        return await op.handler(ctx, validatedInput, tx);
+        const out = await op.handler(ctx, validatedInput, tx);
+        if (op.database === "cms_admin")
+          publishAfterCommit = await this.#projectionDirty(tx);
+        return out;
       });
     } catch (thrown) {
       if (thrown instanceof OperationAbortError) {
@@ -17880,14 +17916,28 @@ class DatabaseAdapter {
         ...pgDetail ? { pgDetail } : {}
       });
     }
+    if (publishAfterCommit) {
+      try {
+        await this.#publishAfterCommit();
+      } catch (thrown) {
+        return err({
+          kind: "HandlerError",
+          operation: op.name,
+          message: `The change is saved, but the public site does not serve it yet: publishing it failed (${thrown instanceof Error ? thrown.message : String(thrown)}). Do not repeat the change; it is published automatically within seconds once the public database answers.`
+        });
+      }
+    }
+    return result;
   }
   async close() {
-    await Promise.all([this.#adminRaw.end(), this.#publicRaw.end()]);
+    await Promise.all([this.#adminRaw?.end(), this.#publicRaw.end()]);
   }
   async withAdminTransaction(ctx, fn) {
+    const admin = this.#adminDb("withAdminTransaction");
     if (!this.#skipVerify)
       await this.verifyRoles();
-    return await this.#admin.transaction(async (tx) => {
+    let publishAfterCommit = false;
+    const out = await admin.transaction(async (tx) => {
       await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
       await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
       await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
@@ -17897,10 +17947,27 @@ class DatabaseAdapter {
       if (denied !== null) {
         throw new OperationAbortError(branchNotFound("withAdminTransaction", denied));
       }
+      const result = await fn(tx);
+      publishAfterCommit = await this.#projectionDirty(tx);
+      return result;
+    });
+    if (publishAfterCommit)
+      await this.#publishAfterCommit();
+    return out;
+  }
+  async withPublicTransaction(ctx, fn) {
+    if (!this.#skipVerify)
+      await this.verifyRoles();
+    return await this.#public.transaction(async (tx) => {
+      await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
+      await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
+      await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
       return await fn(tx);
     });
   }
   rawAdmin() {
+    if (this.#adminRaw === null)
+      throw new AdminDatabaseUnavailableError("rawAdmin");
     return this.#adminRaw;
   }
   rawPublic() {
@@ -17916,21 +17983,23 @@ class DatabaseAdapter {
     });
   }
   async provisionPluginAdminSchema(opts) {
+    const admin = this.#adminDb("provisionPluginAdminSchema");
     if (!this.#skipVerify)
       await this.verifyRoles();
-    await this.#admin.transaction(async (tx) => {
+    await admin.transaction(async (tx) => {
       await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
       await tx.execute(sql.raw(`SELECT set_config('caelo.plugin_id', '${opts.pluginId}', true)`));
       await tx.execute(sql.raw(opts.sql));
     });
   }
   async dropPluginAdminSchema(opts) {
+    const admin = this.#adminDb("dropPluginAdminSchema");
     if (!this.#skipVerify)
       await this.verifyRoles();
     if (!/^plugin_[a-z][a-z0-9_]*$/.test(opts.schemaName)) {
       throw new Error(`dropPluginAdminSchema: refusing to drop schema "${opts.schemaName}" \u2014 name doesn't match plugin_<slug> pattern`);
     }
-    await this.#admin.transaction(async (tx) => {
+    await admin.transaction(async (tx) => {
       await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
       await tx.execute(sql.raw(`DROP SCHEMA IF EXISTS "${opts.schemaName}" CASCADE`));
     });
@@ -17947,7 +18016,7 @@ class DatabaseAdapter {
     });
   }
   get admin() {
-    return this.#admin;
+    return this.#adminDb("admin pool");
   }
   get public() {
     return this.#public;

package/dist/aws-task-roles.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The AWS stack's per-service ECS task roles (#635 review): which Secrets
+ * Manager entries each service's task role may read. One role per service,
+ * so the API gateway's identity cannot read a secret that unlocks a
+ * cms_admin login (CLAUDE.md §2: the public side has no path to cms_admin),
+ * mirroring the GCP gateway SA's bindings (stack-contract.ts
+ * `SERVICE_SECRET_ENV`). Kept apart from the Pulumi program so the
+ * provisioning tests can assert it.
+ */
+/** The Secrets Manager entries the AWS stack creates (`caelo-<env>-<name>`). */
+export type AwsSecret = "postgres-password" | "public-role-password" | "gateway-role-password" | "csrf-secret" | "cookie-secret" | "anthropic-api-key" | "resend-api-key";
+/** A service with its own ECS task role. */
+export type AwsTaskService = "admin" | "gateway";
+/**
+ * The secrets each service's task role may read. The admin side (admin and
+ * its in-process workers) reads all of them; the gateway reads only
+ * public_role's password — its one database login.
+ */
+export declare const AWS_SERVICE_SECRETS: Readonly<Record<AwsTaskService, readonly AwsSecret[]>>;
+/**
+ * The IAM policy document letting a task role read exactly `secretArns`.
+ *
+ * @throws on an empty list: a policy with no resource is malformed, and a
+ *   service that needs no secret should get no secrets policy at all.
+ */
+export declare function secretsReadPolicy(secretArns: readonly string[]): string;
+//# sourceMappingURL=aws-task-roles.d.ts.map

package/dist/aws-task-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-task-roles.d.ts","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,gFAAgF;AAChF,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,uBAAuB,GACvB,aAAa,GACb,eAAe,GACf,mBAAmB,GACnB,gBAAgB,CAAC;AAErB,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,SAAS,EAAE,CAAC,CAWtF,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQvE"}

package/dist/aws-task-roles.js

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The secrets each service's task role may read. The admin side (admin and
+ * its in-process workers) reads all of them; the gateway reads only
+ * public_role's password — its one database login.
+ */
+export const AWS_SERVICE_SECRETS = {
+    admin: [
+        "postgres-password",
+        "public-role-password",
+        "gateway-role-password",
+        "csrf-secret",
+        "cookie-secret",
+        "anthropic-api-key",
+        "resend-api-key",
+    ],
+    gateway: ["public-role-password"],
+};
+/**
+ * The IAM policy document letting a task role read exactly `secretArns`.
+ *
+ * @throws on an empty list: a policy with no resource is malformed, and a
+ *   service that needs no secret should get no secrets policy at all.
+ */
+export function secretsReadPolicy(secretArns) {
+    if (secretArns.length === 0)
+        throw new Error("secretsReadPolicy: no secret ARNs");
+    return JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [
+            { Effect: "Allow", Action: "secretsmanager:GetSecretValue", Resource: [...secretArns] },
+        ],
+    });
+}
+//# sourceMappingURL=aws-task-roles.js.map

package/dist/aws-task-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-task-roles.js","sourceRoot":"","sources":["../src/aws-task-roles.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAyBnC;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA2D;IACzF,KAAK,EAAE;QACL,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,aAAa;QACb,eAAe;QACf,mBAAmB;QACnB,gBAAgB;KACjB;IACD,OAAO,EAAE,CAAC,sBAAsB,CAAC;CAClC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA6B;IAC7D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,EAAE,QAAQ,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE;SACxF;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.js

@@ -925,6 +925,7 @@ const handlers = {
     truncate: lifecycleTruncate,
     "admin-domain": adminDomain,
     "staging-domain": stagingDomain,
+    "owner-reset": ownerReset,
     // #696 — Pulumi state in the install's own project.
     state: async () => (await import("./state-command.js")).stateCommand(process.argv),
     attach: async () => (await import("./state-command.js")).attachCommand(process.argv),
@@ -997,6 +998,38 @@ async function lifecycleTruncate() {
     const { truncateCommand } = await import("./lifecycle.js");
     await truncateCommand();
 }
+/**
+ * #769 `owner-reset [--install <id>] [--email <addr>]` — print a one-time
+ * reset link for a locked-out Owner, for installs whose admin cannot email
+ * one (see owner-reset.ts for why the operator's cloud identity may).
+ */
+async function ownerReset() {
+    const { installFlag, listInstalls, selectInstall } = await import("./install-state.js");
+    const selected = selectInstall(listInstalls(), installFlag(process.argv));
+    if (!selected.ok) {
+        console.error(selected.message);
+        process.exit(1);
+    }
+    const meta = selected.meta;
+    if (meta.provider !== "gcp-firebase") {
+        console.error(`owner-reset works on gcp-firebase installs so far; this one is ${meta.provider} (issue #770). ` +
+            "Until then, another Owner can set a new password under Settings -> Users, or set up email under Settings -> Email so /forgot can send the link.");
+        process.exit(1);
+    }
+    if (!meta.projectId || !meta.region) {
+        console.error(`install ${meta.installId} has no project or region recorded in install.json; re-run the wizard to record it.`);
+        process.exit(1);
+    }
+    const email = arg("email");
+    const { describeOwnerReset, requestOwnerReset } = await import("./owner-reset.js");
+    const r = await requestOwnerReset({ projectId: meta.projectId, region: meta.region }, email ? { email } : {});
+    if (!r.ok) {
+        console.error(`owner-reset: ${r.error}`);
+        process.exit(1);
+    }
+    for (const line of describeOwnerReset(r.value))
+        console.log(line);
+}
 /**
  * `admin-domain enable` — bind admin.<domain> to a gcp-firebase admin
  * (see admin-domain.ts for why this runs as the operator, not Pulumi).
@@ -1247,7 +1280,7 @@ if (route.kind === "handler" || route.kind === "wizard") {
     }
 }
 else {
-    console.log("Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <init|up|migrate|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|state migrate|attach|pulumi-output-sync|version> [options]\n" +
+    console.log("Usage: cms-provision [wizard] [--provider <name> --domain <d> [--staging-domain <host>] --owner-email <e> --region <r>] [--local|--install-job] | <init|up|migrate|status|upgrade|backup|restore|rotate-secret|truncate|destroy|regenerate-caddy|admin-domain|staging-domain|owner-reset|state migrate|attach|pulumi-output-sync|version> [options]\n" +
         "With several installs on this machine, pick one with --install <install-id or domain> (status, upgrade and backup also take --install all); in a terminal you are asked otherwise.\n" +
         "Pass --no-wizard with no sub-command to print this usage instead of the wizard.");
     process.exit(cmd && !cmd.startsWith("-") ? 2 : 0);