@caelo-cms/provisioning 0.10.50 → 0.10.52

package/caddy/Caddyfile.production

@@ -22,7 +22,7 @@
 	# `file` gates the header on the file existing: a 404 for a hashed
 	# URL (old page after a deploy switch) must not be cached for a year.
 	@content_hashed {
-		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\.woff2|_assets/fonts/pinned/[0-9a-f]{64}\.[a-z]+(?:-[a-z]+)?\.[0-9a-f]{12}\.woff2|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\.[0-9a-f]{16}\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
+		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\.woff2|_assets/fonts/pinned/[0-9a-f]{64}\.[0-9a-f]{12}\.[a-z]+(?:-[a-z]+)?\.[0-9a-f]{12}\.woff2|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\.[0-9a-f]{16}\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
 		file
 	}
 	header @content_hashed Cache-Control "public, max-age=31536000, immutable"

package/caddy/Caddyfile.staging

@@ -26,7 +26,7 @@
 	# `file` gates the header on the file existing: a 404 for a hashed
 	# URL (old page after a deploy switch) must not be cached for a year.
 	@content_hashed {
-		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\.woff2|_assets/fonts/pinned/[0-9a-f]{64}\.[a-z]+(?:-[a-z]+)?\.[0-9a-f]{12}\.woff2|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\.[0-9a-f]{16}\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
+		path_regexp content_hashed ^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\.woff2|_assets/fonts/pinned/[0-9a-f]{64}\.[0-9a-f]{12}\.[a-z]+(?:-[a-z]+)?\.[0-9a-f]{12}\.woff2|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\.[0-9a-f]{16}\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\.[0-9a-f]{12}\.(?:js|css))$
 		file
 	}
 	header @content_hashed Cache-Control "public, max-age=31536000, immutable"

package/dist/adapter.d.ts

@@ -49,14 +49,12 @@ export interface DnsRecord {
 export interface CloudAdapterOutputs {
     /** DSN for cms_admin role (encrypted in Pulumi state). */
     readonly adminDatabaseUrl: string;
-    /** DSN for public_role on cms_public (encrypted in Pulumi state). */
-    readonly publicDatabaseUrl: string;
     /**
-     * DSN for gateway_role on cms_admin — the API gateway's own narrow login
-     * (#613). The gateway gets this and `publicDatabaseUrl`, never
-     * `adminDatabaseUrl` (CLAUDE.md §2).
+     * DSN for public_role on cms_public (encrypted in Pulumi state) — the API
+     * gateway's only database login. It never gets a cms_admin DSN of any
+     * role (CLAUDE.md §2, #635).
      */
-    readonly gatewayDatabaseUrl: string;
+    readonly publicDatabaseUrl: string;
     /** Provider-native blob URL (s3://, gs://, https://<account>.blob.core.windows.net/<container>). */
     readonly mediaStorageUrl: string;
     /** Public-facing URL the admin reaches for media reads. */

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAClD,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,CAAC,EAAE;QAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,oGAAoG;IACpG,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,QAAQ,CAAC,kBAAkB,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACtD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,KAAK,GAAG,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B"}

package/dist/admin-internal.d.ts

@@ -0,0 +1,41 @@
+import { type GcloudResult } from "./gcloud.js";
+type Run = (args: string[]) => Promise<GcloudResult>;
+export interface AdminInternalTarget {
+    readonly projectId: string;
+    readonly region: string;
+}
+export interface AdminInternalDeps {
+    readonly run?: Run;
+    readonly fetch?: typeof fetch;
+    /** Seconds since epoch (IAP JWT); tests pin it. */
+    readonly now?: () => number;
+}
+/** One endpoint call: where, under which token scope, with what body. */
+export interface AdminInternalCall {
+    /** Path under the admin origin, e.g. `/api/internal/owner-reset`. */
+    readonly endpoint: string;
+    /** Scope the endpoint's `requireInternalAuth` checks. */
+    readonly scope: string;
+    readonly body: Record<string, unknown>;
+    /** The issue that added the endpoint, named when an older admin answers 404. */
+    readonly introducedBy: string;
+}
+export type AdminInternalResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * POST `call.body` to the endpoint and return the admin's JSON answer and
+ * the admin URL it was reached at (to build links the operator opens).
+ * Every failure names the fix: an IAP refusal or a pre-endpoint admin points
+ * at `cms-provision upgrade`, a refusal carries the admin's own message.
+ */
+export declare function callAdminInternal<T>(target: AdminInternalTarget, call: AdminInternalCall, deps?: AdminInternalDeps): Promise<AdminInternalResult<{
+    answer: T;
+    adminUrl: string;
+}>>;
+export {};
+//# sourceMappingURL=admin-internal.d.ts.map

package/dist/admin-internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal.d.ts","sourceRoot":"","sources":["../src/admin-internal.ts"],"names":[],"mappings":"AAuBA,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAIzE,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAKrD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,MAAM,EAAE,mBAAmB,EAC3B,IAAI,EAAE,iBAAiB,EACvB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC;IAAE,MAAM,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAkG/D"}

package/dist/admin-internal.js

@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The CLI's channel to the admin's `/api/internal/*` endpoints on a
+ * gcp-firebase install, for commands that need an answer BACK from the admin
+ * (a generated password, a reset link). A one-shot Cloud Run job could only
+ * report through Cloud Logging, which would put that secret into the
+ * project's logs; this call answers over TLS straight to the CLI process, and
+ * nothing is written anywhere (CLAUDE.md §7, #659).
+ *
+ * Getting there, as the operator's own gcloud identity — the same path the
+ * Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
+ *
+ *   1. the admin Cloud Run service and its URL;
+ *   2. the install's internal secret from Secret Manager (in memory only),
+ *      which signs a 5-minute token for the endpoint's scope;
+ *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
+ *      API — the admin's IAP lets that service account in, and every
+ *      IAP-allowlisted operator may sign as it (`cms-provision upgrade`
+ *      grants it) — so the request passes IAP first, then Caelo's token.
+ */
+import { findService } from "./admin-domain.js";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
+import { mintInternalToken } from "./internal-token.js";
+/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
+const IAP_JWT_LIFETIME_S = 600;
+/**
+ * POST `call.body` to the endpoint and return the admin's JSON answer and
+ * the admin URL it was reached at (to build links the operator opens).
+ * Every failure names the fix: an IAP refusal or a pre-endpoint admin points
+ * at `cms-provision upgrade`, a refusal carries the admin's own message.
+ */
+export async function callAdminInternal(target, call, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const doFetch = deps.fetch ?? fetch;
+    const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
+    const found = await findService(run, scope, "admin");
+    if (!found.ok)
+        return { ok: false, error: found.error };
+    const url = await run([
+        "run",
+        "services",
+        "describe",
+        found.service,
+        ...scope,
+        "--format=value(status.url)",
+    ]);
+    const adminUrl = url.stdout.trim();
+    if (!url.ok || !adminUrl) {
+        return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
+    }
+    const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
+    const secret = await run([
+        "secrets",
+        "versions",
+        "access",
+        "latest",
+        `--secret=${secretId}`,
+        `--project=${target.projectId}`,
+    ]);
+    const internalSecret = secret.stdout.trim();
+    if (!secret.ok || internalSecret.length < 32) {
+        return {
+            ok: false,
+            error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
+        };
+    }
+    // Installs from before #678 may not have the IAM Credentials API on;
+    // enabling an enabled API is a no-op (codex review on #681).
+    const api = await run([
+        "services",
+        "enable",
+        "iamcredentials.googleapis.com",
+        `--project=${target.projectId}`,
+    ]);
+    if (!api.ok) {
+        return {
+            ok: false,
+            error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
+        };
+    }
+    const iap = await signIapJwt(run, doFetch, target.projectId, adminUrl, deps.now);
+    if (!iap.ok)
+        return iap;
+    const token = await mintInternalToken(internalSecret, call.scope);
+    let res;
+    try {
+        res = await doFetch(`${adminUrl}${call.endpoint}`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${iap.value}`,
+                "x-caelo-internal-token": token,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify(call.body),
+        });
+    }
+    catch (e) {
+        return { ok: false, error: `reach the admin at ${adminUrl}: ${String(e)}` };
+    }
+    const text = await res.text();
+    if (res.headers.get("x-goog-iap-generated-response") === "true") {
+        return {
+            ok: false,
+            error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
+        };
+    }
+    if (res.status === 404) {
+        return {
+            ok: false,
+            error: `the admin has no ${call.endpoint} yet (it runs a release from before ${call.introducedBy}). Run \`cms-provision upgrade\`, then run this command again.`,
+        };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return {
+            ok: false,
+            error: `the admin answered HTTP ${res.status} with a non-JSON body: ${text.slice(0, 200)}`,
+        };
+    }
+    if (!res.ok || parsed.ok !== true) {
+        return {
+            ok: false,
+            error: `the admin refused (HTTP ${res.status}): ${parsed.error ?? text.slice(0, 300)}`,
+        };
+    }
+    return { ok: true, value: { answer: parsed, adminUrl } };
+}
+/** A JWT signed as the install's MCP service account, for the admin's IAP. */
+async function signIapJwt(run, doFetch, projectId, adminUrl, now) {
+    const access = await run(["auth", "print-access-token"]);
+    const accessToken = access.stdout.trim();
+    if (!access.ok || !accessToken) {
+        return {
+            ok: false,
+            error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
+        };
+    }
+    const serviceAccount = mcpIapServiceAccountEmail(projectId);
+    const iat = now ? now() : Math.floor(Date.now() / 1000);
+    const res = await doFetch(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
+        body: JSON.stringify({
+            payload: JSON.stringify({
+                iss: serviceAccount,
+                sub: serviceAccount,
+                aud: `${new URL(adminUrl).origin}/*`,
+                iat,
+                exp: iat + IAP_JWT_LIFETIME_S,
+            }),
+        }),
+    });
+    if (!res.ok) {
+        const detail = (await res.text().catch(() => "")).slice(0, 300);
+        return {
+            ok: false,
+            error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
+        };
+    }
+    const { signedJwt } = (await res.json());
+    if (!signedJwt)
+        return { ok: false, error: "IAM signJwt answered without a signedJwt" };
+    return { ok: true, value: signedJwt };
+}
+//# sourceMappingURL=admin-internal.js.map

package/dist/admin-internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-internal.js","sourceRoot":"","sources":["../src/admin-internal.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAIxD,qEAAqE;AACrE,MAAM,kBAAkB,GAAG,GAAG,CAAC;AA2B/B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B,EAC3B,IAAuB,EACvB,OAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,YAAY,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAE7E,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,KAAK;QACL,UAAU;QACV,UAAU;QACV,KAAK,CAAC,OAAO;QACb,GAAG,KAAK;QACR,4BAA4B;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,SAAS;QACT,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,YAAY,QAAQ,EAAE;QACtB,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uCAAuC,QAAQ,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,sBAAsB,2EAA2E;SAC1M,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,6DAA6D;IAC7D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QACpB,UAAU;QACV,QAAQ;QACR,+BAA+B;QAC/B,aAAa,MAAM,CAAC,SAAS,EAAE;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mGAAmG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE;gBACpC,wBAAwB,EAAE,KAAK;gBAC/B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,KAAK,MAAM,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wCAAwC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,0IAA0I;SACpR,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,uCAAuC,IAAI,CAAC,YAAY,gEAAgE;SACjK,CAAC;IACJ,CAAC;IACD,IAAI,MAAkE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,GAAG,CAAC,MAAM,0BAA0B,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,2BAA2B,GAAG,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAsB,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,UAAU,CACvB,GAAQ,EACR,OAAqB,EACrB,SAAiB,EACjB,QAAgB,EAChB,GAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oCAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,OAAO,oEAAoE;SAC/I,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,uEAAuE,kBAAkB,CAAC,cAAc,CAAC,UAAU,EACnH;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,cAAc;gBACnB,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,IAAI;gBACpC,GAAG;gBACH,GAAG,EAAE,GAAG,GAAG,kBAAkB;aAC9B,CAAC;SACH,CAAC;KACH,CACF,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wBAAwB,cAAc,UAAU,GAAG,CAAC,MAAM,MAAM,MAAM,4IAA4I;SAC1N,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;IACnE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IACxF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC"}

package/dist/agent/units.js

@@ -77,7 +77,7 @@ export function agentServiceUnit(spec) {
         "# Generated by cms-provision (agent install) — do not edit; re-run it instead.",
         "[Unit]",
         `Description=Caelo update agent for ${spec.domain}`,
-        "Documentation=https://caelo-cms.com/install-self-hosted",
+        "Documentation=https://caelo-cms.com/docs/install/maintenance/",
         "After=network-online.target",
         "",
         "[Service]",

package/dist/agent/units.js.map

@@ -1 +1 @@
-{"version":3,"file":"units.js","sourceRoot":"","sources":["../../src/agent/units.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AA2BvE,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,MAAM;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,eAAe,IAAI,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,2BAA2B,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAS,IAAI,CAAC,KAAa;IACzB,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,iCAAiC;AACjC,SAAS,WAAW,CAAC,GAAW,EAAE,KAAa;IAC7C,OAAO,eAAe,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAC1B,IAA4D;IAE5D,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,wBAAwB;AACxB,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,OAAO;QACL,oCAAoC;QACpC,gFAAgF;QAChF,QAAQ;QACR,sCAAsC,IAAI,CAAC,MAAM,EAAE;QACnD,yDAAyD;QACzD,6BAA6B;QAC7B,EAAE;QACF,WAAW;QACX,cAAc;QACd,oBAAoB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACxC,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,QAAQ,CAAC;QACnD,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,aAAa,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrD,mBAAmB,yBAAyB,KAAK;QACjD,+DAA+D;QAC/D,YAAY;QACZ,qBAAqB;QACrB,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,sBAAsB;AACtB,MAAM,UAAU,cAAc,CAAC,IAA4C;IACzE,OAAO;QACL,oCAAoC;QACpC,gFAAgF;QAChF,QAAQ;QACR,0CAA0C,IAAI,CAAC,MAAM,EAAE;QACvD,EAAE;QACF,SAAS;QACT,kEAAkE;QAClE,qCAAqC;QACrC,kBAAkB;QAClB,gBAAgB;QAChB,qBAAqB,kCAAkC,GAAG;QAC1D,gBAAgB;QAChB,QAAQ,IAAI,CAAC,IAAI,UAAU;QAC3B,EAAE;QACF,WAAW;QACX,wBAAwB;QACxB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,CAAC,GACL,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC;QACnF,sEAAsE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC"}
+{"version":3,"file":"units.js","sourceRoot":"","sources":["../../src/agent/units.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AA2BvE,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,QAAgB;IAC5D,MAAM,IAAI,GAAG,MAAM;SAChB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,eAAe,IAAI,IAAI,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,2BAA2B,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,SAAS,IAAI,CAAC,KAAa;IACzB,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AAC1C,CAAC;AAED,iCAAiC;AACjC,SAAS,WAAW,CAAC,GAAW,EAAE,KAAa;IAC7C,OAAO,eAAe,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAC1B,IAA4D;IAE5D,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACrF,CAAC;AAED,wBAAwB;AACxB,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,OAAO;QACL,oCAAoC;QACpC,gFAAgF;QAChF,QAAQ;QACR,sCAAsC,IAAI,CAAC,MAAM,EAAE;QACnD,+DAA+D;QAC/D,6BAA6B;QAC7B,EAAE;QACF,WAAW;QACX,cAAc;QACd,oBAAoB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QACxC,WAAW,CAAC,uBAAuB,EAAE,IAAI,CAAC,QAAQ,CAAC;QACnD,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,aAAa,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrD,mBAAmB,yBAAyB,KAAK;QACjD,+DAA+D;QAC/D,YAAY;QACZ,qBAAqB;QACrB,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,sBAAsB;AACtB,MAAM,UAAU,cAAc,CAAC,IAA4C;IACzE,OAAO;QACL,oCAAoC;QACpC,gFAAgF;QAChF,QAAQ;QACR,0CAA0C,IAAI,CAAC,MAAM,EAAE;QACvD,EAAE;QACF,SAAS;QACT,kEAAkE;QAClE,qCAAqC;QACrC,kBAAkB;QAClB,gBAAgB;QAChB,qBAAqB,kCAAkC,GAAG;QAC1D,gBAAgB;QAChB,QAAQ,IAAI,CAAC,IAAI,UAAU;QAC3B,EAAE;QACF,WAAW;QACX,wBAAwB;QACxB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,CAAC,GACL,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC;QACnF,sEAAsE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC"}

package/dist/agent-db.js

@@ -6791,6 +6791,7 @@ var setMediaAltToolInput = object({
   alt: string2().max(2048)
 }).strict();
 var setHomePageToolInput = object({ pageId: string2().uuid() }).strict();
+var setNotFoundPageToolInput = object({ pageId: string2().uuid().nullable() }).strict();
 var setMediaSourceToolInput = object({
   assetId: string2().uuid(),
   sourceKind: _enum(["upload", "ai_generated", "imported", "external"]).optional(),
@@ -7550,6 +7551,60 @@ var THEME_ASSET_KEY_TO_SLOT = {
 };
 var THEME_ASSET_KEYS = Object.keys(THEME_ASSET_KEY_TO_SLOT);
 
+// ../shared/src/font-assets.ts
+var fontRef = object({ id: string2().uuid(), sha256: string2().regex(/^[a-f0-9]{64}$/) }).strict();
+var fontLicense = object({
+  name: string2().min(1).max(200),
+  text: string2().min(1).max(1e5),
+  webEmbedding: boolean2(),
+  documentEmbedding: boolean2()
+}).strict();
+var fontMetadata = fontRef.extend({
+  family: string2(),
+  subfamily: string2(),
+  postscriptName: string2(),
+  cssFamily: string2(),
+  format: _enum(["ttf", "otf", "woff", "woff2"]),
+  weight: number2(),
+  style: _enum(["normal", "italic"]),
+  axes: record(string2(), object({ min: number2(), max: number2(), default: number2() })),
+  sizeBytes: number2(),
+  glyphCount: number2(),
+  embedding: object({
+    web: boolean2(),
+    document: boolean2(),
+    subset: boolean2(),
+    restriction: string2().nullable()
+  }),
+  license: fontLicense,
+  source: string2(),
+  createdAt: string2()
+});
+var fontImportInput = object({
+  dataBase64: string2().min(1).max(11184812),
+  license: fontLicense,
+  source: string2().min(1).max(1000)
+}).strict();
+var fontResolveInput = fontRef.extend({
+  use: _enum(["web", "document"]),
+  text: string2().max(200000).default(""),
+  formats: array(_enum(["ttf", "otf", "woff", "woff2"])).min(1).max(4)
+}).strict();
+var fontReadInput = fontRef.extend({ offset: number2().int().min(0), length: number2().int().min(1).max(262144) }).strict();
+var fontFindInput = object({
+  query: string2().max(200).default(""),
+  limit: number2().int().min(1).max(100).default(50)
+}).strict();
+
+// ../shared/src/font-axis-policy.ts
+var fontAxisTag = string2().regex(/^[A-Za-z0-9]{4}$/, "axis tag must be 4 characters");
+var fontAxisSetting = union([
+  literal("full"),
+  object({ min: number2().finite(), max: number2().finite() }).strict(),
+  number2().finite()
+]);
+var fontAxisPolicy = record(fontAxisTag, fontAxisSetting).refine((p) => Object.keys(p).length > 0 && Object.keys(p).length <= 16, "name between 1 and 16 axes; pass null to reset the face to the default policy");
+
 // ../shared/src/safe-keys.ts
 var UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
@@ -7790,50 +7845,28 @@ var createThemeOverridesSchema = record(string2(), unknown());
 var languageTagSchema = string2().max(35).regex(/^[A-Za-z]{2,8}(-[A-Za-z0-9]{1,8})*$/, "must be a BCP 47 language tag such as `en`, `de` or `pt-BR`");
 var HTML_WS = new Set(["\t", `
 `, "\f", "\r", " "]);
-// ../shared/src/font-assets.ts
-var fontRef = object({ id: string2().uuid(), sha256: string2().regex(/^[a-f0-9]{64}$/) }).strict();
-var fontLicense = object({
-  name: string2().min(1).max(200),
-  text: string2().min(1).max(1e5),
-  webEmbedding: boolean2(),
-  documentEmbedding: boolean2()
-}).strict();
-var fontMetadata = fontRef.extend({
-  family: string2(),
-  subfamily: string2(),
-  postscriptName: string2(),
-  cssFamily: string2(),
-  format: _enum(["ttf", "otf", "woff", "woff2"]),
-  weight: number2(),
-  style: _enum(["normal", "italic"]),
-  axes: record(string2(), object({ min: number2(), max: number2(), default: number2() })),
-  sizeBytes: number2(),
-  glyphCount: number2(),
-  embedding: object({
-    web: boolean2(),
-    document: boolean2(),
-    subset: boolean2(),
-    restriction: string2().nullable()
-  }),
-  license: fontLicense,
-  source: string2(),
-  createdAt: string2()
-});
-var fontImportInput = object({
-  dataBase64: string2().min(1).max(11184812),
-  license: fontLicense,
-  source: string2().min(1).max(1000)
-}).strict();
-var fontResolveInput = fontRef.extend({
-  use: _enum(["web", "document"]),
-  text: string2().max(200000).default(""),
-  formats: array(_enum(["ttf", "otf", "woff", "woff2"])).min(1).max(4)
-}).strict();
-var fontReadInput = fontRef.extend({ offset: number2().int().min(0), length: number2().int().min(1).max(262144) }).strict();
-var fontFindInput = object({
-  query: string2().max(200).default(""),
-  limit: number2().int().min(1).max(100).default(50)
-}).strict();
+// ../shared/src/font-usage.ts
+var GLOBAL_KEYWORDS = new Set(["inherit", "initial", "unset", "revert", "revert-layer"]);
+var SYSTEM_FONTS = new Set([
+  "caption",
+  "icon",
+  "menu",
+  "message-box",
+  "small-caption",
+  "status-bar"
+]);
+var SIZE_KEYWORDS = new Set([
+  "xx-small",
+  "x-small",
+  "small",
+  "medium",
+  "large",
+  "x-large",
+  "xx-large",
+  "xxx-large",
+  "larger",
+  "smaller"
+]);
 // ../shared/src/fonts.ts
 var SYSTEM_FONT_FAMILIES = new Set([
   "serif",
@@ -8219,7 +8252,9 @@ var revertPageInput = object({
 var STAGING_SESSION_TTL_SECONDS = 12 * 60 * 60;
 var ENCODER = new TextEncoder;
 // ../shared/src/static-cache-policy.ts
-var CONTENT_HASHED_PATH_PATTERN = "^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\\.woff2|_assets/fonts/pinned/[0-9a-f]{64}\\.[a-z]+(?:-[a-z]+)?\\.[0-9a-f]{12}\\.woff2|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\\.[0-9a-f]{16}\\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\\.[0-9a-f]{12}\\.(?:js|css))$";
+var PINNED_FONT_SLICE_FILE_PATTERN = "[0-9a-f]{64}\\.[0-9a-f]{12}\\.[a-z]+(?:-[a-z]+)?\\.[0-9a-f]{12}\\.woff2";
+var PINNED_FONT_SLICE_FILE_RE = new RegExp(`^${PINNED_FONT_SLICE_FILE_PATTERN}$`);
+var CONTENT_HASHED_PATH_PATTERN = `^/(?:_app/immutable/.+|_assets/fonts/[^/]+/[0-9a-f]{16}\\.woff2|_assets/fonts/pinned/${PINNED_FONT_SLICE_FILE_PATTERN}|_assets/[a-z0-9][a-z0-9-]*(?:/[a-z][a-z0-9-]*)?\\.[0-9a-f]{16}\\.[a-z0-9]{2,5}|_caelo/plugin/[^/]+/[^/]+\\.[0-9a-f]{12}\\.(?:js|css))$`;
 var CONTENT_HASHED_PATH_RE = new RegExp(CONTENT_HASHED_PATH_PATTERN);
 // ../shared/src/structured-sets.ts
 var navMenuItem = lazy(() => object({
@@ -17777,6 +17812,13 @@ function isRlsDenial(error) {
 // ../query-api/src/adapter.ts
 var SQL3 = globalThis.Bun?.SQL;
 var DEFAULT_ROLES = { admin: "admin_role", public: ["admin_role", "public_role"] };
+
+class AdminDatabaseUnavailableError extends Error {
+  name = "AdminDatabaseUnavailableError";
+  constructor(what) {
+    super(`${what}: this process has no cms_admin connection by design (public side, CLAUDE.md \xA72). Read what the admin published into cms_public instead.`);
+  }
+}
 function resolvePoolMax(explicit) {
   if (explicit !== undefined)
     return validatePoolMax(explicit, "poolMax option");
@@ -17800,19 +17842,41 @@ class DatabaseAdapter {
   #skipVerify;
   #roles;
   #verifyPromise = null;
+  #projectionPublisher = null;
   constructor(config) {
-    const poolMax = resolvePoolMax(config.poolMax);
-    if (poolMax === undefined) {
-      this.#adminRaw = new SQL3(config.adminDatabaseUrl);
-      this.#publicRaw = new SQL3(config.publicDatabaseUrl);
-    } else {
-      this.#adminRaw = new SQL3(config.adminDatabaseUrl, { max: poolMax });
-      this.#publicRaw = new SQL3(config.publicDatabaseUrl, { max: poolMax });
+    this.#roles = config.expectedRoles ?? DEFAULT_ROLES;
+    if (config.adminDatabaseUrl === null !== (this.#roles.admin === null)) {
+      throw new Error("DatabaseAdapter: a public-only adapter (adminDatabaseUrl: null) must expect no admin role, and an adapter with an admin URL must expect one");
     }
-    this.#admin = drizzle(this.#adminRaw);
+    const poolMax = resolvePoolMax(config.poolMax);
+    const open = (url) => poolMax === undefined ? new SQL3(url) : new SQL3(url, { max: poolMax });
+    this.#adminRaw = config.adminDatabaseUrl === null ? null : open(config.adminDatabaseUrl);
+    this.#publicRaw = open(config.publicDatabaseUrl);
+    this.#admin = this.#adminRaw === null ? null : drizzle(this.#adminRaw);
     this.#public = drizzle(this.#publicRaw);
     this.#skipVerify = config.skipRoleVerification === true;
-    this.#roles = config.expectedRoles ?? DEFAULT_ROLES;
+  }
+  get hasAdminDatabase() {
+    return this.#admin !== null;
+  }
+  setProjectionPublisher(publish) {
+    this.#projectionPublisher = publish;
+  }
+  async#projectionDirty(tx) {
+    if (this.#projectionPublisher === null)
+      return false;
+    const found = await tx.execute(sql`SELECT current_setting('caelo.projection_dirty', true) AS v`);
+    return found[0]?.v === "on";
+  }
+  async#publishAfterCommit() {
+    const publish = this.#projectionPublisher;
+    if (publish !== null)
+      await publish();
+  }
+  #adminDb(what) {
+    if (this.#admin === null)
+      throw new AdminDatabaseUnavailableError(what);
+    return this.#admin;
   }
   verifyRoles() {
     if (this.#verifyPromise !== null)
@@ -17824,9 +17888,11 @@ class DatabaseAdapter {
     return this.#verifyPromise;
   }
   async#verifyRolesOnce() {
-    const admin = await this.#identity(this.#adminRaw);
-    if (admin.user !== this.#roles.admin || admin.database !== "cms_admin") {
-      throw new Error(`DatabaseAdapter admin pool expected (${this.#roles.admin}, cms_admin) but connected as (${admin.user}, ${admin.database}). Check ADMIN_DATABASE_URL.`);
+    if (this.#adminRaw !== null) {
+      const admin = await this.#identity(this.#adminRaw);
+      if (admin.user !== this.#roles.admin || admin.database !== "cms_admin") {
+        throw new Error(`DatabaseAdapter admin pool expected (${this.#roles.admin}, cms_admin) but connected as (${admin.user}, ${admin.database}). Check ADMIN_DATABASE_URL.`);
+      }
     }
     const pub = await this.#identity(this.#publicRaw);
     if (pub.database !== "cms_public") {
@@ -17846,9 +17912,11 @@ class DatabaseAdapter {
   async runOperation(op, ctx, validatedInput) {
     if (!this.#skipVerify)
       await this.verifyRoles();
-    const db = op.database === "cms_admin" ? this.#admin : this.#public;
+    const db = op.database === "cms_admin" ? this.#adminDb(`operation ${op.name}`) : this.#public;
+    let publishAfterCommit = false;
+    let result;
     try {
-      return await db.transaction(async (tx) => {
+      result = await db.transaction(async (tx) => {
         await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
         await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
         await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
@@ -17859,7 +17927,10 @@ class DatabaseAdapter {
           if (denied !== null)
             return err(branchNotFound(op.name, denied));
         }
-        return await op.handler(ctx, validatedInput, tx);
+        const out = await op.handler(ctx, validatedInput, tx);
+        if (op.database === "cms_admin")
+          publishAfterCommit = await this.#projectionDirty(tx);
+        return out;
       });
     } catch (thrown) {
       if (thrown instanceof OperationAbortError) {
@@ -17880,14 +17951,28 @@ class DatabaseAdapter {
         ...pgDetail ? { pgDetail } : {}
       });
     }
+    if (publishAfterCommit) {
+      try {
+        await this.#publishAfterCommit();
+      } catch (thrown) {
+        return err({
+          kind: "HandlerError",
+          operation: op.name,
+          message: `The change is saved, but the public site does not serve it yet: publishing it failed (${thrown instanceof Error ? thrown.message : String(thrown)}). Do not repeat the change; it is published automatically within seconds once the public database answers.`
+        });
+      }
+    }
+    return result;
   }
   async close() {
-    await Promise.all([this.#adminRaw.end(), this.#publicRaw.end()]);
+    await Promise.all([this.#adminRaw?.end(), this.#publicRaw.end()]);
   }
   async withAdminTransaction(ctx, fn) {
+    const admin = this.#adminDb("withAdminTransaction");
     if (!this.#skipVerify)
       await this.verifyRoles();
-    return await this.#admin.transaction(async (tx) => {
+    let publishAfterCommit = false;
+    const out = await admin.transaction(async (tx) => {
       await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
       await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
       await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
@@ -17897,10 +17982,27 @@ class DatabaseAdapter {
       if (denied !== null) {
         throw new OperationAbortError(branchNotFound("withAdminTransaction", denied));
       }
+      const result = await fn(tx);
+      publishAfterCommit = await this.#projectionDirty(tx);
+      return result;
+    });
+    if (publishAfterCommit)
+      await this.#publishAfterCommit();
+    return out;
+  }
+  async withPublicTransaction(ctx, fn) {
+    if (!this.#skipVerify)
+      await this.verifyRoles();
+    return await this.#public.transaction(async (tx) => {
+      await tx.execute(sql`SELECT set_config('caelo.actor_id', ${ctx.actorId}, true)`);
+      await tx.execute(sql`SELECT set_config('caelo.actor_kind', ${ctx.actorKind}, true)`);
+      await tx.execute(sql`SELECT set_config('caelo.plugin_id', ${ctx.pluginId ?? ""}, true)`);
       return await fn(tx);
     });
   }
   rawAdmin() {
+    if (this.#adminRaw === null)
+      throw new AdminDatabaseUnavailableError("rawAdmin");
     return this.#adminRaw;
   }
   rawPublic() {
@@ -17916,21 +18018,23 @@ class DatabaseAdapter {
     });
   }
   async provisionPluginAdminSchema(opts) {
+    const admin = this.#adminDb("provisionPluginAdminSchema");
     if (!this.#skipVerify)
       await this.verifyRoles();
-    await this.#admin.transaction(async (tx) => {
+    await admin.transaction(async (tx) => {
       await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
       await tx.execute(sql.raw(`SELECT set_config('caelo.plugin_id', '${opts.pluginId}', true)`));
       await tx.execute(sql.raw(opts.sql));
     });
   }
   async dropPluginAdminSchema(opts) {
+    const admin = this.#adminDb("dropPluginAdminSchema");
     if (!this.#skipVerify)
       await this.verifyRoles();
     if (!/^plugin_[a-z][a-z0-9_]*$/.test(opts.schemaName)) {
       throw new Error(`dropPluginAdminSchema: refusing to drop schema "${opts.schemaName}" \u2014 name doesn't match plugin_<slug> pattern`);
     }
-    await this.#admin.transaction(async (tx) => {
+    await admin.transaction(async (tx) => {
       await tx.execute(sql.raw("SELECT set_config('caelo.actor_kind', 'system', true)"));
       await tx.execute(sql.raw(`DROP SCHEMA IF EXISTS "${opts.schemaName}" CASCADE`));
     });
@@ -17947,7 +18051,7 @@ class DatabaseAdapter {
     });
   }
   get admin() {
-    return this.#admin;
+    return this.#adminDb("admin pool");
   }
   get public() {
     return this.#public;