@caelo-cms/provisioning 0.10.51 → 0.10.52

package/src/upgrader-setup.ts

@@ -31,7 +31,13 @@
  *     health check signs its IAP credential as that account
  *     (upgrade/health.ts). The operator-access sync job keeps it there.
  *   - `roles/storage.objectUser` on the ops bucket, conditioned to the
- *     `install/` prefix (install.json) — not the Pulumi state.
+ *     `install/` prefix (install.json, the state lock) — not the Pulumi state.
+ *   - the custom role `caeloUpgraderOpsList` (`storage.objects.list` only)
+ *     on the ops bucket, unconditioned: `gcloud storage cp` lists the
+ *     destination prefix and reads the bucket's storage layout before every
+ *     upload, and GCS checks both against the bucket, never an object path,
+ *     so no `install/` condition can admit them. It reveals object names,
+ *     not contents.
  *   - `roles/logging.logWriter`.
  *
  * It gets no `*.setIamPolicy`, no service-account admin, no secret
@@ -71,6 +77,18 @@ export const UPGRADER_SQL_BACKUP_ROLE: CustomRoleSpec = {
   ],
 };
 
+/**
+ * Listing the ops bucket, which every `gcloud storage cp` into it needs (see
+ * the file header). Names only — reads and writes stay on `install/`.
+ */
+export const UPGRADER_OPS_LIST_ROLE: CustomRoleSpec = {
+  roleId: "caeloUpgraderOpsList",
+  title: "Caelo upgrader: list the ops bucket",
+  description:
+    "Lets the Caelo upgrader job list object names in the install's ops bucket (gcloud storage cp needs it). Names only; object reads/writes stay limited to install/.",
+  permissions: ["storage.objects.list"],
+};
+
 /** Project-level roles of the upgrader's service account. */
 export const UPGRADER_PROJECT_ROLES = [
   "roles/run.developer",
@@ -176,10 +194,12 @@ export async function ensureUpgraderJob(
     };
   }
 
-  // 1. The backup role.
-  const roleError = await ensureCustomRole(run, projectId, UPGRADER_SQL_BACKUP_ROLE);
-  if (roleError) return { ok: false, done, error: roleError };
-  done.push(`custom role ${UPGRADER_SQL_BACKUP_ROLE.roleId}`);
+  // 1. The backup and ops-bucket-list roles.
+  for (const role of [UPGRADER_SQL_BACKUP_ROLE, UPGRADER_OPS_LIST_ROLE]) {
+    const roleError = await ensureCustomRole(run, projectId, role);
+    if (roleError) return { ok: false, done, error: roleError };
+    done.push(`custom role ${role.roleId}`);
+  }
 
   // 2. The job's own service account.
   const describe = await run([
@@ -276,6 +296,22 @@ export async function ensureUpgraderJob(
     return fail(`grant the upgrader install.json in gs://${bucket}`, bucketGrant);
   done.push(`upgrader: roles/storage.objectUser on gs://${bucket}/${OPS_INSTALL_PREFIX}/`);
 
+  const listRole = customRoleName(projectId, UPGRADER_OPS_LIST_ROLE.roleId);
+  const listGrant = await retry([
+    "storage",
+    "buckets",
+    "add-iam-policy-binding",
+    `gs://${bucket}`,
+    `--member=${member}`,
+    `--role=${listRole}`,
+    "--condition=None",
+    project,
+    "--quiet",
+    "--format=none",
+  ]);
+  if (!listGrant.ok) return fail(`grant the upgrader object listing on gs://${bucket}`, listGrant);
+  done.push(`upgrader: ${listRole} on gs://${bucket}`);
+
   // 6. Its database login (migration 0267's platform_updater role).
   const sqlUser = await ensureCloudSqlIamUser(run, {
     projectId,

package/src/welcome-page.test.ts

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #781 — contracts of `static/welcome.html`, the placeholder the GCP
+ * wizard uploads to a fresh static bucket. It must stay fully
+ * self-contained (the bucket holds nothing else, and a first impression
+ * that fetches from third parties leaks the visitor), keep the
+ * `{{ADMIN_URL}}` placeholder the wizard substitutes, and carry the
+ * Caelatum sky instead of the old animated mesh.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+
+const html = readFileSync(new URL("../static/welcome.html", import.meta.url), "utf8");
+
+describe("welcome.html", () => {
+  it("makes no external requests", () => {
+    // Any absolute or protocol-relative URL, stylesheet/script/image
+    // reference or CSS import/url() would be a network fetch.
+    expect(html).not.toMatch(/https?:\/\//i);
+    expect(html).not.toMatch(/["'(]\s*\/\//);
+    expect(html).not.toMatch(/<link\b/i);
+    expect(html).not.toMatch(/<script\b/i);
+    expect(html).not.toMatch(/<img\b/i);
+    expect(html).not.toMatch(/@import|url\(|@font-face/i);
+    expect(html).not.toMatch(/\b(src|href)\s*=/i);
+  });
+
+  it("keeps the admin URL placeholder the wizard substitutes", () => {
+    expect(html).toContain("{{ADMIN_URL}}");
+  });
+
+  it("uses the sky + relief plate with the inline mark, not the mesh", () => {
+    expect(html).toContain("#c3dbf2 0%, #dce9f6 40%, #efe7ef 72%, #f8e6d8 100%");
+    expect(html).toContain("0 0 0 5px var(--plate-ring)");
+    expect(html).toMatch(/<svg viewBox="0 0 32 32" aria-hidden="true"/);
+    expect(html).not.toMatch(/class="blob|@keyframes (drift|pulse)/);
+  });
+});

package/src/wizards/gcp.ts

@@ -1965,7 +1965,7 @@ async function stepFinalize(installId: string, setupLink: "print" | "secret"): P
       `     click ${bold("New token")} (scope ${bold("chat")}: Caelo's AI does the work; ${bold("admin")}: your agent drives Caelo's tools),`,
       "     copy the bearer (shown once) and run the `claude mcp add` command the page shows.",
       "     The admin is behind Google IAP, so run `gcloud auth application-default login` once on that machine.",
-      `     Details: ${cyan("https://caelo-cms.com/mcp")}`,
+      `     Details: ${cyan("https://caelo-cms.com/docs/mcp/")}`,
       ...adminNote,
       "",
       bold("Lifecycle commands:"),

package/stacks/aws/README.md

@@ -18,6 +18,8 @@ The Caelo runtime never knows it's on AWS — it just consumes `DATABASE_URL` /
 
 ## First-time install
 
+Run this stack from a checkout of the Caelo repository after `bun install` at its root. `@pulumi/aws` + `@pulumi/awsx` are devDependencies of `@caelo-cms/provisioning`: the CLI wizard does not provision AWS yet, so the published package does not make every GCP and self-hosted install download them (the one-click install from Cloud Shell runs in a 5 GB home directory). They move back to `dependencies` when the AWS wizard ships.
+
 ```bash
 cd packages/provisioning/stacks/aws
 pulumi stack init prod

package/stacks/aws/index.ts

@@ -297,7 +297,14 @@ const distribution = new aws.cloudfront.Distribution(`${namePrefix}-cdn`, {
     minimumProtocolVersion: "TLSv1.2_2021",
   },
   restrictions: { geoRestriction: { restrictionType: "none" } },
+  // #802 — unknown URLs get the site's own 404 page (the generator writes
+  // `/404.html` from the designated page) with status 404. The S3 origins
+  // are OAI-only with `s3:GetObject` and no `s3:ListBucket`, so S3 answers
+  // a missing key with 403, not 404; without the 403 entry visitors saw
+  // S3's AccessDenied XML. Both origins on this distribution are private
+  // buckets, so a 403 here always means "no such object".
   customErrorResponses: [
+    { errorCode: 403, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 },
     { errorCode: 404, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 },
   ],
 });

package/stacks/azure/README.md

@@ -17,6 +17,8 @@ The Caelo runtime never knows it's on Azure — every Container App consumes pla
 
 ## First-time install
 
+Run this stack from a checkout of the Caelo repository after `bun install` at its root. `@pulumi/azure-native` is a devDependency of `@caelo-cms/provisioning`: the CLI wizard does not provision Azure yet, so the published package does not make every GCP and self-hosted install download it (the one-click install from Cloud Shell runs in a 5 GB home directory). It moves back to `dependencies` when the Azure wizard ships.
+
 ```bash
 cd packages/provisioning/stacks/azure
 pulumi stack init prod

package/static/welcome.html

@@ -5,151 +5,133 @@
   Uploaded by the provisioning wizard the first time it brings up the
   static bucket. Replaced the moment the operator publishes their
   first deploy via the admin app's "Publish" flow.
+
+  #781 — the first arrival screen: the Caelatum sky with the message on
+  a relief plate, matching the admin's sign-in screens. Fully
+  self-contained on purpose: inline CSS, inline SVG mark, no web fonts
+  and no other external requests (the page is served from a bucket that
+  has nothing else in it yet). Schibsted Grotesk is used when installed
+  locally; otherwise the fallback stack renders.
 -->
 <html lang="en">
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width,initial-scale=1">
   <meta name="robots" content="noindex">
+  <meta name="color-scheme" content="light dark">
   <title>Caelo CMS — your install is ready</title>
   <style>
     *,*::before,*::after { box-sizing: border-box; margin: 0; padding: 0; }
     :root {
-      --fg: #0c0d12;
-      --muted: #4a4e5e;
-      --accent: #4f46e5;
-      --accent-glow: #818cf8;
-      --card-bg: rgba(255,255,255,0.78);
-      --card-border: rgba(255,255,255,0.55);
-      --shadow: 0 30px 60px -20px rgba(15,17,40,0.18), 0 8px 18px -8px rgba(15,17,40,0.10);
+      --ink: #0e1a2e;
+      --muted: #4a576b;
+      --card: #ffffff;
+      --line: #e0e5ee;
+      --code-bg: #f2f5fa;
+      --sky-label: #1f5299;
+      --sky: linear-gradient(180deg, #c3dbf2 0%, #dce9f6 40%, #efe7ef 72%, #f8e6d8 100%);
+      --plate-ring: rgba(255, 255, 255, 0.55);
+    }
+    /* The sky is light-mode only; dark mode is the admin's night blue. */
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --ink: #e6ecf5;
+        --muted: #9fb0c8;
+        --card: #111c2e;
+        --line: #22314a;
+        --code-bg: #16233a;
+        --sky-label: #7fb4ff;
+        --sky: none;
+        --plate-ring: rgba(255, 255, 255, 0.08);
+      }
     }
-    html, body { height: 100%; }
+    html, body { min-height: 100%; }
     body {
-      font: 16px/1.55 system-ui, -apple-system, "Segoe UI", Helvetica, Arial, sans-serif;
-      color: var(--fg);
+      font: 16px/1.55 "Schibsted Grotesk", Arial, Helvetica, sans-serif;
+      color: var(--ink);
+      background: #f8f9fc var(--sky);
+      min-height: 100vh;
       display: grid;
       place-items: center;
-      padding: 2rem;
-      background: #f6f6fb;
-      overflow: hidden;
-      position: relative;
-    }
-    /* Animated mesh-gradient background. Three soft blobs orbiting at
-       different speeds; backdrop-filter on the card softens them. */
-    .blob {
-      position: fixed;
-      border-radius: 50%;
-      filter: blur(80px);
-      opacity: 0.55;
-      pointer-events: none;
-      animation: drift 22s ease-in-out infinite;
-      will-change: transform;
+      padding: 3rem 1rem;
     }
-    .blob.b1 { width: 520px; height: 520px; background: #818cf8; top: -120px; left: -160px; animation-delay: -3s; }
-    .blob.b2 { width: 460px; height: 460px; background: #f0abfc; bottom: -180px; right: -140px; animation-delay: -8s; }
-    .blob.b3 { width: 380px; height: 380px; background: #67e8f9; top: 40%; left: 55%; animation-delay: -14s; animation-duration: 27s; }
-    @keyframes drift {
-      0%, 100% { transform: translate(0, 0) scale(1); }
-      33%      { transform: translate(40px, -30px) scale(1.07); }
-      66%      { transform: translate(-30px, 35px) scale(0.96); }
+    @media (prefers-color-scheme: dark) {
+      body { background: #0b1422; }
     }
-    @media (prefers-reduced-motion: reduce) {
-      .blob { animation: none; }
-    }
-
-    main {
-      position: relative;
-      z-index: 1;
-      max-width: 36rem;
-      width: 100%;
-      background: var(--card-bg);
-      border: 1px solid var(--card-border);
-      border-radius: 22px;
-      padding: 2.5rem;
-      box-shadow: var(--shadow);
-      backdrop-filter: blur(14px) saturate(140%);
-      -webkit-backdrop-filter: blur(14px) saturate(140%);
-    }
-
-    .brand {
-      display: flex;
-      align-items: center;
-      gap: 0.65rem;
+    .frame { width: 100%; max-width: 36rem; }
+    .kicker {
+      text-align: center;
+      font-size: 0.75rem;
       font-weight: 600;
-      letter-spacing: -0.01em;
-      color: var(--muted);
-      font-size: 0.95rem;
-      margin-bottom: 1.5rem;
+      letter-spacing: 0.14em;
+      text-transform: uppercase;
+      color: var(--sky-label);
+      margin-bottom: 1rem;
     }
-    .brand .dot {
-      width: 10px; height: 10px; border-radius: 50%;
-      background: var(--accent);
-      box-shadow: 0 0 0 0 var(--accent-glow);
-      animation: pulse 1.8s ease-out infinite;
-    }
-    @keyframes pulse {
-      0%   { box-shadow: 0 0 0 0 rgba(79,70,229,0.55); }
-      70%  { box-shadow: 0 0 0 12px rgba(79,70,229,0); }
-      100% { box-shadow: 0 0 0 0 rgba(79,70,229,0); }
+    main {
+      background: var(--card);
+      border: 1px solid var(--line);
+      border-radius: 14px;
+      padding: 2.25rem 2.5rem;
+      box-shadow: 0 0 0 5px var(--plate-ring), 0 18px 40px -26px rgba(42, 64, 110, 0.45);
     }
-    @media (prefers-reduced-motion: reduce) {
-      .brand .dot { animation: none; }
+    @media (max-width: 480px) {
+      main { padding: 1.5rem 1.25rem; }
     }
-
     h1 {
-      font-size: clamp(1.65rem, 1.2rem + 1.6vw, 2.25rem);
+      display: flex;
+      align-items: center;
+      gap: 0.75rem;
+      font-size: clamp(1.5rem, 1.2rem + 1.2vw, 2rem);
       letter-spacing: -0.02em;
       line-height: 1.15;
-      margin-bottom: 0.65rem;
+      margin-bottom: 0.85rem;
     }
-    p { color: var(--muted); margin-bottom: 1rem; }
-    p:last-child { margin-bottom: 0; }
-
-    .cta {
-      display: inline-flex;
-      align-items: center;
-      gap: 0.5rem;
-      margin-top: 1.5rem;
-      padding: 0.75rem 1.1rem;
-      background: var(--fg);
-      color: #fff;
-      text-decoration: none;
-      border-radius: 12px;
-      font-weight: 500;
-      transition: transform 0.15s ease, box-shadow 0.15s ease;
-    }
-    .cta:hover { transform: translateY(-1px); box-shadow: 0 12px 24px -8px rgba(15,17,40,0.25); }
-    .cta svg { width: 14px; height: 14px; }
-
+    h1 svg { flex-shrink: 0; width: 36px; height: 36px; }
+    p { color: var(--muted); }
     .hint {
-      margin-top: 2rem;
-      padding-top: 1.5rem;
-      border-top: 1px solid rgba(15,17,40,0.08);
+      margin-top: 1.75rem;
+      padding-top: 1.25rem;
+      border-top: 1px solid var(--line);
       font-size: 0.875rem;
       color: var(--muted);
     }
     .hint code {
-      font: 0.85em ui-monospace, "SF Mono", Menlo, Consolas, monospace;
-      background: rgba(15,17,40,0.05);
+      font: 0.85em Menlo, Consolas, monospace;
+      color: var(--ink);
+      background: var(--code-bg);
       padding: 0.15em 0.45em;
       border-radius: 6px;
+      overflow-wrap: anywhere;
+    }
+    /* One entrance settle, only for people who have not asked for
+       reduced motion; no looping animation on this page. */
+    @media (prefers-reduced-motion: no-preference) {
+      main { animation: settle 0.5s ease-out both; }
+      @keyframes settle {
+        from { opacity: 0; transform: translateY(8px); }
+        to { opacity: 1; transform: none; }
+      }
     }
-    .hint a { color: var(--accent); text-decoration: none; }
-    .hint a:hover { text-decoration: underline; }
   </style>
 </head>
 <body>
-  <div class="blob b1"></div>
-  <div class="blob b2"></div>
-  <div class="blob b3"></div>
-
-  <main>
-    <div class="brand"><span class="dot"></span>Caelo&nbsp;CMS</div>
-    <h1>Your install is up. One more step.</h1>
-    <p>This is the placeholder Caelo serves on a fresh deploy. The operator who provisioned this install has a one-time bootstrap link in their terminal output — opening it walks through Owner-account setup. After publish, this page disappears.</p>
-    <div class="hint">
-      Bootstrap link expires in 24h and rotates per <code>bunx @caelo-cms/provisioning</code> run. After Owner setup, the admin lives at <code>{{ADMIN_URL}}</code> behind <code>Sign in with Google</code> (IAP allowlist).
-    </div>
-  </main>
+  <div class="frame">
+    <p class="kicker">Caelo CMS</p>
+    <main>
+      <h1>
+        <svg viewBox="0 0 32 32" aria-hidden="true" focusable="false">
+          <path d="M23.07 7.57A11 11 0 1 0 23.07 24.43" fill="none" stroke="currentColor" stroke-width="3.4" stroke-linecap="round"/>
+          <path d="M20.5 10.64A7 7 0 1 0 20.5 21.36" fill="none" stroke="#c9952f" stroke-width="1.1" stroke-linecap="round"/>
+          <circle cx="25.2" cy="16" r="2.6" fill="#e8684a"/>
+        </svg>
+        Your install is up. One more step.
+      </h1>
+      <p>This is the placeholder Caelo serves on a fresh deploy. The operator who provisioned this install has a one-time bootstrap link in their terminal output — opening it walks through Owner-account setup. After publish, this page disappears.</p>
+      <div class="hint">
+        Bootstrap link expires in 24h and rotates per <code>bunx @caelo-cms/provisioning</code> run. After Owner setup, the admin lives at <code>{{ADMIN_URL}}</code> behind <code>Sign in with Google</code> (IAP allowlist).
+      </div>
+    </main>
+  </div>
 </body>
 </html>