@caelo-cms/provisioning 0.10.50 → 0.10.52

package/src/stack-converge.test.ts

@@ -268,12 +268,7 @@ const CONVERGED_GATEWAY_DB = [
     name: "PUBLIC_DATABASE_URL",
     value: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
   },
-  {
-    name: "GATEWAY_DATABASE_URL",
-    value: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
-  },
   secretRef("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-  secretRef("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
 ];
 
 describe("planContractEnv", () => {
@@ -776,10 +771,10 @@ describe("ensureStackInvariants", () => {
       const gatewayGrants = calls.filter(
         (c) => c.startsWith("secrets add-iam-policy-binding") && c.includes(GW_SA),
       );
-      // #613 — never admin_role's postgres-password. #650 — the staging
-      // gate key is the one secret the gateway shares with the admin.
+      // #613 — never admin_role's postgres-password; #635 — nor
+      // gateway_role's. #650 — the staging gate key is the one secret the
+      // gateway shares with the admin.
       expect(gatewayGrants).toEqual([
-        `secrets add-iam-policy-binding caelo-production-gateway-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
         `secrets add-iam-policy-binding caelo-production-public-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
         `secrets add-iam-policy-binding caelo-production-staging-gate-secret --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
       ]);
@@ -802,7 +797,8 @@ describe("removeRetiredIamBindings (#613)", () => {
       ],
     });
     const outcomes = await removeRetiredIamBindings(gcp, { run, sleep: async () => {} });
-    expect(outcomes.map((o) => o.status)).toEqual(["removed"]);
+    // postgres-password removed; gateway-role-password (#635) already clean.
+    expect(outcomes.map((o) => o.status)).toEqual(["removed", "absent"]);
     expect(calls).toContain(REMOVE);
     // The admin's own binding on the same secret is never touched.
     expect(calls.some((c) => c.includes("remove") && c.includes(RUN_SA))).toBe(false);
@@ -815,10 +811,23 @@ describe("removeRetiredIamBindings (#613)", () => {
       ],
     });
     const outcomes = await removeRetiredIamBindings(firebase, { run, sleep: async () => {} });
-    expect(outcomes.map((o) => o.status)).toEqual(["absent"]);
+    expect(outcomes.map((o) => o.status)).toEqual(["absent", "absent"]);
     expect(calls.filter((c) => c.includes("remove-iam-policy-binding"))).toEqual([]);
   });
 
+  it("takes the gateway SA off gateway_role's password (#635)", async () => {
+    const { run, calls } = fakeGcloud({
+      "secrets get-iam-policy caelo-production-gateway-role-password": [
+        policy([{ role: "roles/secretmanager.secretAccessor", members: [GW_SA] }]),
+      ],
+    });
+    const outcomes = await removeRetiredIamBindings(gcp, { run, sleep: async () => {} });
+    expect(outcomes.map((o) => o.status)).toEqual(["absent", "removed"]);
+    expect(calls).toContain(
+      `secrets remove-iam-policy-binding caelo-production-gateway-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
+    );
+  });
+
   it("reports a failed removal instead of throwing", async () => {
     const { run } = fakeGcloud({
       "secrets get-iam-policy caelo-production-postgres-password": [

package/src/staging-admin.ts

@@ -3,51 +3,25 @@
 /**
  * #678 — `staging-domain enable` tells the admin itself what the operator
  * decided, instead of printing "now set the same host in the admin".
- *
- * Why an HTTP call to the admin (and not a one-shot Cloud Run job like the
- * migrations): the call must hand a result BACK — above all the generated
- * basic-auth password, which the CLI prints once. A job can only report
- * through Cloud Logging, which would put the password into the project's
- * logs. The admin endpoint (`POST /api/internal/staging/provision`) answers
- * over TLS straight to this process, and the password is never written
- * anywhere (CLAUDE.md §7, #659).
- *
- * Getting there, as the operator's own gcloud identity — the same path the
- * Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
- *
- *   1. the admin Cloud Run service and its URL;
- *   2. the install's internal secret from Secret Manager (in memory only),
- *      which signs a 5-minute token for scope `staging.provision`;
- *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
- *      API — the admin's IAP lets that service account in, and every
- *      IAP-allowlisted operator may sign as it (`cms-provision upgrade`
- *      grants it) — so the request passes IAP first, then Caelo's token.
+ * It calls `POST /api/internal/staging/provision` through admin-internal.ts
+ * (IAP as caelo-mcp + the internal token, scope `staging.provision`), because
+ * the answer carries the generated basic-auth password back to the CLI, which
+ * prints it once and never stores it.
  */
 
-import { findService } from "./admin-domain.js";
-import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
-import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
-import { mintInternalToken } from "./internal-token.js";
-
-type Run = (args: string[]) => Promise<GcloudResult>;
+import {
+  type AdminInternalDeps,
+  type AdminInternalResult,
+  type AdminInternalTarget,
+  callAdminInternal,
+} from "./admin-internal.js";
 
 /** Token scope the admin endpoint checks (apps/admin …/api/internal/staging/provision). */
 export const STAGING_PROVISION_SCOPE = "staging.provision";
 const ENDPOINT = "/api/internal/staging/provision";
-/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
-const IAP_JWT_LIFETIME_S = 600;
 
-export interface StagingAdminTarget {
-  readonly projectId: string;
-  readonly region: string;
-}
-
-export interface StagingAdminDeps {
-  readonly run?: Run;
-  readonly fetch?: typeof fetch;
-  /** Seconds since epoch (IAP JWT); tests pin it. */
-  readonly now?: () => number;
-}
+export type StagingAdminTarget = AdminInternalTarget;
+export type StagingAdminDeps = AdminInternalDeps;
 
 /** Main's draft pages, as the admin reports them. */
 export interface DraftPages {
@@ -80,7 +54,7 @@ export interface StagingApply {
   readonly draftPages: DraftPages;
 }
 
-export type StagingAdminResult<T> = { ok: true; value: T } | { ok: false; error: string };
+export type StagingAdminResult<T> = AdminInternalResult<T>;
 
 export interface ApplyRequest {
   readonly host?: string;
@@ -110,149 +84,12 @@ async function callStagingAdmin<T>(
   body: Record<string, unknown>,
   deps: StagingAdminDeps,
 ): Promise<StagingAdminResult<T>> {
-  const run = deps.run ?? defaultGcloud;
-  const doFetch = deps.fetch ?? fetch;
-  const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
-
-  const found = await findService(run, scope, "admin");
-  if (!found.ok) return { ok: false, error: found.error };
-  const url = await run([
-    "run",
-    "services",
-    "describe",
-    found.service,
-    ...scope,
-    "--format=value(status.url)",
-  ]);
-  const adminUrl = url.stdout.trim();
-  if (!url.ok || !adminUrl) {
-    return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
-  }
-
-  const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
-  const secret = await run([
-    "secrets",
-    "versions",
-    "access",
-    "latest",
-    `--secret=${secretId}`,
-    `--project=${target.projectId}`,
-  ]);
-  const internalSecret = secret.stdout.trim();
-  if (!secret.ok || internalSecret.length < 32) {
-    return {
-      ok: false,
-      error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
-    };
-  }
-
-  // Installs from before #678 may not have the IAM Credentials API on;
-  // enabling an enabled API is a no-op (codex review on #681).
-  const api = await run([
-    "services",
-    "enable",
-    "iamcredentials.googleapis.com",
-    `--project=${target.projectId}`,
-  ]);
-  if (!api.ok) {
-    return {
-      ok: false,
-      error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
-    };
-  }
-  const iap = await signIapJwt(run, doFetch, target.projectId, adminUrl, deps.now);
-  if (!iap.ok) return iap;
-
-  const token = await mintInternalToken(internalSecret, STAGING_PROVISION_SCOPE);
-  let res: Response;
-  try {
-    res = await doFetch(`${adminUrl}${ENDPOINT}`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${iap.value}`,
-        "x-caelo-internal-token": token,
-        "content-type": "application/json",
-      },
-      body: JSON.stringify(body),
-    });
-  } catch (e) {
-    return { ok: false, error: `reach the admin at ${adminUrl}: ${String(e)}` };
-  }
-  const text = await res.text();
-  if (res.headers.get("x-goog-iap-generated-response") === "true") {
-    return {
-      ok: false,
-      error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
-    };
-  }
-  if (res.status === 404) {
-    return {
-      ok: false,
-      error: `the admin has no ${ENDPOINT} yet (it runs a release from before #678). Run \`cms-provision upgrade\`, then run this command again.`,
-    };
-  }
-  let parsed: { ok?: boolean; error?: string } & Record<string, unknown>;
-  try {
-    parsed = JSON.parse(text) as typeof parsed;
-  } catch {
-    return {
-      ok: false,
-      error: `the admin answered HTTP ${res.status} with a non-JSON body: ${text.slice(0, 200)}`,
-    };
-  }
-  if (!res.ok || parsed.ok !== true) {
-    return {
-      ok: false,
-      error: `the admin refused (HTTP ${res.status}): ${parsed.error ?? text.slice(0, 300)}`,
-    };
-  }
-  return { ok: true, value: parsed as unknown as T };
-}
-
-/** A JWT signed as the install's MCP service account, for the admin's IAP. */
-async function signIapJwt(
-  run: Run,
-  doFetch: typeof fetch,
-  projectId: string,
-  adminUrl: string,
-  now: (() => number) | undefined,
-): Promise<StagingAdminResult<string>> {
-  const access = await run(["auth", "print-access-token"]);
-  const accessToken = access.stdout.trim();
-  if (!access.ok || !accessToken) {
-    return {
-      ok: false,
-      error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
-    };
-  }
-  const serviceAccount = mcpIapServiceAccountEmail(projectId);
-  const iat = now ? now() : Math.floor(Date.now() / 1000);
-  const res = await doFetch(
-    `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`,
-    {
-      method: "POST",
-      headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
-      body: JSON.stringify({
-        payload: JSON.stringify({
-          iss: serviceAccount,
-          sub: serviceAccount,
-          aud: `${new URL(adminUrl).origin}/*`,
-          iat,
-          exp: iat + IAP_JWT_LIFETIME_S,
-        }),
-      }),
-    },
+  const r = await callAdminInternal<T>(
+    target,
+    { endpoint: ENDPOINT, scope: STAGING_PROVISION_SCOPE, body, introducedBy: "#678" },
+    deps,
   );
-  if (!res.ok) {
-    const detail = (await res.text().catch(() => "")).slice(0, 300);
-    return {
-      ok: false,
-      error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
-    };
-  }
-  const { signedJwt } = (await res.json()) as { signedJwt?: string };
-  if (!signedJwt) return { ok: false, error: "IAM signJwt answered without a signedJwt" };
-  return { ok: true, value: signedJwt };
+  return r.ok ? { ok: true, value: r.value.answer } : r;
 }
 
 /**

package/src/state-store.ts

@@ -162,6 +162,15 @@ export class GcsStateStore implements StateStore {
   }
 }
 
+/**
+ * Another run holds the install's state lock. Distinct from every other
+ * lock failure (no access, gcloud missing), which callers must not report
+ * as "busy" — retrying later will not fix those.
+ */
+export class StateLockHeldError extends Error {
+  override readonly name = "StateLockHeldError";
+}
+
 /** `gs://<bucket>/install/state.lock` — see {@link acquireBucketStateLock}. */
 export function bucketStateLockUrl(bucket: string): string {
   return `gs://${bucket}/${OPS_INSTALL_PREFIX}/state.lock`;
@@ -197,7 +206,7 @@ export function acquireBucketStateLock(
   if (!r.ok) {
     if (/PreconditionFailed|412|At least one of the pre-conditions/i.test(r.stderr)) {
       const held = run(["storage", "cat", url]);
-      throw new Error(
+      throw new StateLockHeldError(
         `Another run is changing this install's state (${held.ok ? held.stdout.trim() : url}). Re-run once it has finished; if none is running, remove the stale lock: gcloud storage rm ${url}`,
       );
     }
@@ -221,7 +230,7 @@ export function acquireLocalStateLock(root: string, purpose: string): () => void
     writeFileSync(path, lockBody(purpose), { flag: "wx", mode: 0o600 });
   } catch (e) {
     if ((e as NodeJS.ErrnoException).code === "EEXIST") {
-      throw new Error(
+      throw new StateLockHeldError(
         `Another run is changing this install's state (${readFileSync(path, "utf8").trim()}). Re-run once it has finished; if none is running, remove the stale lock: rm ${path}`,
       );
     }

package/src/upgrader-job.test.ts

@@ -14,6 +14,7 @@ import type { GcloudResult } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import type { InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
+import { StateLockHeldError } from "./state-store.js";
 import type { HealthOutcome, HealthProbe } from "./upgrade/health.js";
 import {
   type ClaimedUpdate,
@@ -162,6 +163,7 @@ function setup(
     deep?: HealthOutcome;
     migrate?: { ok: boolean; error?: string };
     locked?: boolean;
+    lockDenied?: boolean;
   } = {},
 ) {
   const order: string[] = [];
@@ -188,7 +190,8 @@ function setup(
     },
     lockState: () => {
       order.push("lock");
-      if (opts.locked) throw new Error("held by caelo installer");
+      if (opts.locked) throw new StateLockHeldError("held by caelo installer");
+      if (opts.lockDenied) throw new Error("storage.objects.list denied");
       return () => order.push("unlock");
     },
     readInstall: () => (opts.meta === undefined ? META : opts.meta),
@@ -286,6 +289,19 @@ describe("runUpgraderJob", () => {
     expect(busy.order.some((l) => l.startsWith("manifest") || l.startsWith("gcloud"))).toBe(false);
   });
 
+  it("does not call a lock it cannot take 'busy': an access failure asks for Cloud Shell", async () => {
+    const denied = setup({ lockDenied: true });
+    const r = await runUpgraderJob(denied.deps);
+    expect(r.status).toBe("needs_cloud_shell");
+    const end = denied.q.end();
+    expect(end?.codes).toEqual(["state-access"]);
+    expect(end?.reason).not.toContain("another install operation");
+    expect(end?.reason).toContain("storage.objects.list denied");
+    expect(denied.order.some((l) => l.startsWith("manifest") || l.startsWith("gcloud"))).toBe(
+      false,
+    );
+  });
+
   it("retries recording the end, and fails the run when it cannot", async () => {
     const { deps, q } = setup();
     let calls = 0;

package/src/upgrader-job.ts

@@ -43,6 +43,7 @@ import type { GcloudRunner, Sleep } from "./gcloud-retry.js";
 import { gcpNamePrefix, upgraderJobName } from "./gcp-names.js";
 import type { InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
+import { StateLockHeldError } from "./state-store.js";
 import {
   type AppRollPlan,
   executeAppRoll,
@@ -224,10 +225,19 @@ export async function runUpgraderJob(deps: UpgraderJobDeps): Promise<UpgraderRun
     try {
       releaseLock = deps.lockState();
     } catch (e) {
+      if (e instanceof StateLockHeldError) {
+        return stopWith(
+          "failed",
+          ["state-locked"],
+          `Nothing was changed: another install operation is running on this site (${errorText(e)}). Try again when it has finished.`,
+        );
+      }
+      // Not contention: the job cannot reach its own ops bucket. Retrying
+      // will not help; a Cloud Shell upgrade re-converges the job's grants.
       return stopWith(
-        "failed",
-        ["state-locked"],
-        `Nothing was changed: another install operation is running on this site (${errorText(e)}). Try again when it has finished.`,
+        "needs_cloud_shell",
+        ["state-access"],
+        `Nothing was changed: the upgrader could not take the install's state lock (${errorText(e)}). Run the upgrade once with Cloud Shell; it repairs the upgrader's access.`,
       );
     }
 

package/src/upgrader-setup.test.ts

@@ -13,6 +13,7 @@ import type { GcloudResult } from "./gcloud.js";
 import {
   ensureUpgraderJob,
   UPGRADER_FORBIDDEN_ROLES,
+  UPGRADER_OPS_LIST_ROLE,
   UPGRADER_SQL_BACKUP_ROLE,
   type UpgraderSetupTarget,
 } from "./upgrader-setup.js";
@@ -83,6 +84,7 @@ describe("ensureUpgraderJob", () => {
         "iam service-accounts add-iam-policy-binding caelo-production-upgrader@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-mcp@acme.iam.gserviceaccount.com → roles/iam.serviceAccountTokenCreator",
         "storage buckets add-iam-policy-binding gs://acme-caelo-ops → roles/storage.objectUser",
+        "storage buckets add-iam-policy-binding gs://acme-caelo-ops → projects/acme/roles/caeloUpgraderOpsList",
       ].sort(),
     );
     // The bucket grant only reaches install.json, not the Pulumi state.
@@ -90,6 +92,12 @@ describe("ensureUpgraderJob", () => {
     expect(bucket?.condition).toContain(
       'resource.name.startsWith("projects/_/buckets/acme-caelo-ops/objects/install/")',
     );
+    // gcloud storage cp lists the bucket before every upload; GCS checks the
+    // list against the bucket itself, so this grant cannot carry the
+    // install/ condition — and so it carries nothing but the list.
+    const list = mine.find((g) => g.role.endsWith("/caeloUpgraderOpsList"));
+    expect(list?.condition).toBe("None");
+    expect(UPGRADER_OPS_LIST_ROLE.permissions).toEqual(["storage.objects.list"]);
   });
 
   it("never grants a forbidden role, a setIamPolicy permission, or a project-wide iam role", async () => {
@@ -101,7 +109,10 @@ describe("ensureUpgraderJob", () => {
       }
       if (g.role.startsWith("roles/iam.")) expect(g.where).toStartWith("iam service-accounts");
     }
-    const role = calls.find((c) => c.slice(0, 3).join(" ") === "iam roles create");
+    const role = calls.find(
+      (c) =>
+        c.slice(0, 3).join(" ") === "iam roles create" && c[3] === UPGRADER_SQL_BACKUP_ROLE.roleId,
+    );
     const perms = (flag(role ?? [], "permissions") ?? "").split(",");
     expect(perms.sort()).toEqual([...UPGRADER_SQL_BACKUP_ROLE.permissions].sort());
     // Nothing but the one write it needs: create a backup.

package/src/upgrader-setup.ts

@@ -31,7 +31,13 @@
  *     health check signs its IAP credential as that account
  *     (upgrade/health.ts). The operator-access sync job keeps it there.
  *   - `roles/storage.objectUser` on the ops bucket, conditioned to the
- *     `install/` prefix (install.json) — not the Pulumi state.
+ *     `install/` prefix (install.json, the state lock) — not the Pulumi state.
+ *   - the custom role `caeloUpgraderOpsList` (`storage.objects.list` only)
+ *     on the ops bucket, unconditioned: `gcloud storage cp` lists the
+ *     destination prefix and reads the bucket's storage layout before every
+ *     upload, and GCS checks both against the bucket, never an object path,
+ *     so no `install/` condition can admit them. It reveals object names,
+ *     not contents.
  *   - `roles/logging.logWriter`.
  *
  * It gets no `*.setIamPolicy`, no service-account admin, no secret
@@ -71,6 +77,18 @@ export const UPGRADER_SQL_BACKUP_ROLE: CustomRoleSpec = {
   ],
 };
 
+/**
+ * Listing the ops bucket, which every `gcloud storage cp` into it needs (see
+ * the file header). Names only — reads and writes stay on `install/`.
+ */
+export const UPGRADER_OPS_LIST_ROLE: CustomRoleSpec = {
+  roleId: "caeloUpgraderOpsList",
+  title: "Caelo upgrader: list the ops bucket",
+  description:
+    "Lets the Caelo upgrader job list object names in the install's ops bucket (gcloud storage cp needs it). Names only; object reads/writes stay limited to install/.",
+  permissions: ["storage.objects.list"],
+};
+
 /** Project-level roles of the upgrader's service account. */
 export const UPGRADER_PROJECT_ROLES = [
   "roles/run.developer",
@@ -176,10 +194,12 @@ export async function ensureUpgraderJob(
     };
   }
 
-  // 1. The backup role.
-  const roleError = await ensureCustomRole(run, projectId, UPGRADER_SQL_BACKUP_ROLE);
-  if (roleError) return { ok: false, done, error: roleError };
-  done.push(`custom role ${UPGRADER_SQL_BACKUP_ROLE.roleId}`);
+  // 1. The backup and ops-bucket-list roles.
+  for (const role of [UPGRADER_SQL_BACKUP_ROLE, UPGRADER_OPS_LIST_ROLE]) {
+    const roleError = await ensureCustomRole(run, projectId, role);
+    if (roleError) return { ok: false, done, error: roleError };
+    done.push(`custom role ${role.roleId}`);
+  }
 
   // 2. The job's own service account.
   const describe = await run([
@@ -276,6 +296,22 @@ export async function ensureUpgraderJob(
     return fail(`grant the upgrader install.json in gs://${bucket}`, bucketGrant);
   done.push(`upgrader: roles/storage.objectUser on gs://${bucket}/${OPS_INSTALL_PREFIX}/`);
 
+  const listRole = customRoleName(projectId, UPGRADER_OPS_LIST_ROLE.roleId);
+  const listGrant = await retry([
+    "storage",
+    "buckets",
+    "add-iam-policy-binding",
+    `gs://${bucket}`,
+    `--member=${member}`,
+    `--role=${listRole}`,
+    "--condition=None",
+    project,
+    "--quiet",
+    "--format=none",
+  ]);
+  if (!listGrant.ok) return fail(`grant the upgrader object listing on gs://${bucket}`, listGrant);
+  done.push(`upgrader: ${listRole} on gs://${bucket}`);
+
   // 6. Its database login (migration 0267's platform_updater role).
   const sqlUser = await ensureCloudSqlIamUser(run, {
     projectId,

package/src/welcome-page.test.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #781 — contracts of `static/welcome.html`, the placeholder the GCP
+ * wizard uploads to a fresh static bucket. It must stay fully
+ * self-contained (the bucket holds nothing else, and a first impression
+ * that fetches from third parties leaks the visitor), keep the
+ * `{{ADMIN_URL}}` placeholder the wizard substitutes, and carry the
+ * Caelatum sky instead of the old animated mesh.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+
+const html = readFileSync(new URL("../static/welcome.html", import.meta.url), "utf8");
+
+describe("welcome.html", () => {
+  it("makes no external requests", () => {
+    // Any absolute or protocol-relative URL, stylesheet/script/image
+    // reference or CSS import/url() would be a network fetch.
+    expect(html).not.toMatch(/https?:\/\//i);
+    expect(html).not.toMatch(/["'(]\s*\/\//);
+    expect(html).not.toMatch(/<link\b/i);
+    expect(html).not.toMatch(/<script\b/i);
+    expect(html).not.toMatch(/<img\b/i);
+    expect(html).not.toMatch(/@import|url\(|@font-face/i);
+    expect(html).not.toMatch(/\b(src|href)\s*=/i);
+  });
+
+  it("keeps the admin URL placeholder the wizard substitutes", () => {
+    expect(html).toContain("{{ADMIN_URL}}");
+  });
+
+  it("uses the sky + relief plate with the inline mark, not the mesh", () => {
+    expect(html).toContain("#c3dbf2 0%, #dce9f6 40%, #efe7ef 72%, #f8e6d8 100%");
+    expect(html).toContain("0 0 0 5px var(--plate-ring)");
+    expect(html).toMatch(/<svg viewBox="0 0 32 32" aria-hidden="true"/);
+    expect(html).not.toMatch(/class="blob|@keyframes (drift|pulse)/);
+  });
+});

package/src/wizards/gcp-cost.ts

@@ -104,7 +104,7 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       name: "Quality checks (Lighthouse on the admin)",
       monthlyUsd: 1,
       notes:
-        "~1-2 min of admin CPU per audited Stage (up to 5 pages x 3 runs); ~$1/mo at a few Stages a day",
+        "~2-4 min of admin CPU per audited Stage (up to 5 pages x 5 runs); ~$1/mo at a few Stages a day",
     },
     {
       name: "Cloud Run gateway",

package/src/wizards/gcp.ts

@@ -1965,7 +1965,7 @@ async function stepFinalize(installId: string, setupLink: "print" | "secret"): P
       `     click ${bold("New token")} (scope ${bold("chat")}: Caelo's AI does the work; ${bold("admin")}: your agent drives Caelo's tools),`,
       "     copy the bearer (shown once) and run the `claude mcp add` command the page shows.",
       "     The admin is behind Google IAP, so run `gcloud auth application-default login` once on that machine.",
-      `     Details: ${cyan("https://caelo-cms.com/mcp")}`,
+      `     Details: ${cyan("https://caelo-cms.com/docs/mcp/")}`,
       ...adminNote,
       "",
       bold("Lifecycle commands:"),

package/stacks/aws/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on AWS managed services. Implements the shared `
 | Blob storage | Two S3 buckets (`caelo-<env>-media` + `caelo-<env>-static`) |
 | CDN | CloudFront distribution with two origins (S3 static + S3 media); static files are served as files, no edge compute on the request path |
 | Container runtime | ECS Fargate cluster + four services (admin / gateway / orchestrator / runner) |
-| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `gatewayDatabaseUrlOut` + `publicDatabaseUrlOut`, never the admin URL (#613). |
+| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
 | DNS + cert | ACM cert (us-east-1, DNS-validated, supports `*.<domain>`) |
 | Edge-log sink | CloudFront access logs delivered to the CloudWatch log group `/caelo/<env>/cloudfront` in us-east-1 (queryable by P12A analytics plugin) |
 
@@ -18,6 +18,8 @@ The Caelo runtime never knows it's on AWS — it just consumes `DATABASE_URL` /
 
 ## First-time install
 
+Run this stack from a checkout of the Caelo repository after `bun install` at its root. `@pulumi/aws` + `@pulumi/awsx` are devDependencies of `@caelo-cms/provisioning`: the CLI wizard does not provision AWS yet, so the published package does not make every GCP and self-hosted install download them (the one-click install from Cloud Shell runs in a 5 GB home directory). They move back to `dependencies` when the AWS wizard ships.
+
 ```bash
 cd packages/provisioning/stacks/aws
 pulumi stack init prod