@caelo-cms/provisioning 0.10.53 → 0.10.55

package/dist/audit-job-setup.js

@@ -0,0 +1,317 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #875 — set up (and converge) the parallel quality-audit job on a Google
+ * Cloud install (`gcp`, `gcp-firebase`). Run by the wizard after `pulumi up`
+ * and by `cms-provision upgrade`'s converge, both as the operator's own
+ * gcloud identity. App-roll moves the job's image with the admin's
+ * (upgrade/app-roll.ts), because the job runs the admin image.
+ *
+ * Why a separate job at all (CLAUDE.md §11.B Tier 5 exception): Lighthouse
+ * is CPU-bound and simulates the CPU slowdown from observed task durations,
+ * so a run that shares a CPU with another run or with the editor's chat
+ * measures that interference too. One task per run measures the page alone,
+ * and all runs finish in about the time of one.
+ *
+ * Why the CLI owns it and not the stacks: `upgrade` never runs Pulumi, so
+ * existing installs get the job only from here, and a bucket or job both
+ * Pulumi and `upgrade` create would collide on the next wizard re-run (the
+ * same reasoning as operator-access.ts and upgrader-setup.ts).
+ *
+ * Trust boundary. The job's service account, `caelo-<env>-audit`, holds:
+ *
+ *   - `roles/storage.objectCreator` on the audit results bucket — create
+ *     only: it can neither read results back nor overwrite one;
+ *   - on `gcp` only, `roles/storage.objectViewer` on the staging and static
+ *     buckets: it serves the staged build to its own browser, as the admin's
+ *     audit does (admin-core quality/staged-origin.ts). gcp-firebase audits
+ *     the public preview channel and needs no bucket;
+ *   - `roles/logging.logWriter`.
+ *
+ * Nothing else: no Secret Manager, no Cloud SQL, and no VPC egress, so the
+ * database's private IP is not even routable from a task. Plugin data on a
+ * page comes the way any visitor gets it: the task's browser calls the
+ * site's public `/api/*` (the gateway, behind Cloud Armor) over the
+ * internet. The admin's run
+ * SA may run the job WITH overrides (`roles/run.jobsExecutorWithOverrides`:
+ * it passes each audit's batch of orders), read its executions
+ * (`roles/run.viewer`) and read the results bucket. Unlike the
+ * operator-access and upgrader jobs, overrides are acceptable here: a
+ * compromised admin can make the job load other URLs, but the job holds
+ * nothing worth taking. {@link AUDIT_FORBIDDEN_ROLES} names that line; the
+ * tests assert no grant crosses it.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { gcloud as defaultGcloud } from "./gcloud.js";
+import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { auditJobName, auditServiceAccountEmail, auditServiceAccountId, gcpBucketName, runServiceAccountEmail, } from "./gcp-names.js";
+import { readAdminConfig } from "./migration-runner.js";
+import { describeAuditJobImage } from "./upgrade/audit-job-roll.js";
+/** Where the admin image ships the task's entry point. */
+export const AUDIT_TASK_SCRIPT = "/app/packages/admin-core/src/quality/audit-task.ts";
+/** How many audit tasks run at once by default: 5 pages x 3 runs. */
+export const AUDIT_PARALLELISM_DEFAULT = 15;
+/**
+ * Per task: container start, browser start, CPU benchmark and one
+ * Lighthouse run. Matches admin-core `parallelAuditTimeoutMs`, which the
+ * admin also passes per execution.
+ */
+const TASK_TIMEOUT = "5m";
+/**
+ * Roles the audit job's identity must never hold anywhere. Prefix matches
+ * (`roles/secretmanager.` = every Secret Manager role).
+ */
+export const AUDIT_FORBIDDEN_ROLES = [
+    "roles/owner",
+    "roles/editor",
+    "roles/run.",
+    "roles/iam.",
+    "roles/secretmanager.",
+    "roles/cloudsql.",
+    "roles/compute.",
+    "roles/resourcemanager.",
+    "roles/storage.admin",
+    "roles/storage.objectAdmin",
+    "roles/storage.objectUser",
+];
+/** Delete results after a day: the admin reads them within minutes. */
+export const AUDIT_RESULTS_LIFECYCLE = {
+    rule: [{ action: { type: "Delete" }, condition: { age: 1 } }],
+};
+/** Ensure the audit job and everything it needs. Never throws for a gcloud failure. */
+export async function ensureAuditJob(target, deps = {}) {
+    const run = deps.run ?? defaultGcloud;
+    const sleep = deps.sleep ?? realSleep;
+    const retry = (args) => runWithRetry(run, sleep, args);
+    const { projectId, region, env, provider } = target;
+    const project = `--project=${projectId}`;
+    const sa = auditServiceAccountEmail(projectId, env);
+    const member = `serviceAccount:${sa}`;
+    const runSaMember = `serviceAccount:${runServiceAccountEmail(projectId, env)}`;
+    const job = auditJobName(env);
+    const results = gcpBucketName(projectId, env, "audit-results");
+    const resultsUrl = `gs://${results}`;
+    const done = [];
+    const fail = (step, r) => ({
+        ok: false,
+        done,
+        error: `${step}: ${r.stderr.trim()}`,
+    });
+    if (!/@sha256:[0-9a-f]{64}$/.test(target.adminImageRef)) {
+        return {
+            ok: false,
+            done,
+            error: `the audit job's image must be pinned by digest, got ${target.adminImageRef}`,
+        };
+    }
+    if (target.parallelism !== undefined &&
+        (!Number.isInteger(target.parallelism) || target.parallelism < 1 || target.parallelism > 15)) {
+        return {
+            ok: false,
+            done,
+            error: `auditParallelism must be a whole number from 1 to 15, got ${target.parallelism}`,
+        };
+    }
+    // 1. The job's own service account.
+    const describe = await run([
+        "iam",
+        "service-accounts",
+        "describe",
+        sa,
+        project,
+        "--format=value(email)",
+    ]);
+    if (!describe.ok) {
+        const create = await run([
+            "iam",
+            "service-accounts",
+            "create",
+            auditServiceAccountId(env),
+            "--display-name=Caelo quality audit",
+            "--description=Runs the quality audit's Lighthouse runs in parallel; reads the staged build, writes audit results, nothing else.",
+            project,
+        ]);
+        if (!create.ok && !/already exists/i.test(create.stderr))
+            return fail(`create ${sa}`, create);
+    }
+    done.push(`service account ${sa}`);
+    // 2. The results bucket: private, results deleted after a day.
+    const owned = await run(["storage", "buckets", "list", project, "--format=value(name)"]);
+    if (!owned.ok)
+        return fail(`list the buckets of project ${projectId}`, owned);
+    const names = owned.stdout.split("\n").map((l) => l
+        .trim()
+        .replace(/^gs:\/\//, "")
+        .replace(/\/$/, ""));
+    if (!names.includes(results)) {
+        const created = await run([
+            "storage",
+            "buckets",
+            "create",
+            resultsUrl,
+            project,
+            `--location=${region}`,
+            "--default-storage-class=STANDARD",
+            "--uniform-bucket-level-access",
+            "--public-access-prevention",
+            "--soft-delete-duration=0",
+        ]);
+        if (!created.ok) {
+            return {
+                ok: false,
+                done,
+                error: /already exists|409/i.test(created.stderr)
+                    ? `${resultsUrl} exists but does not belong to project ${projectId}; delete or rename that bucket, this install needs the name`
+                    : `create ${resultsUrl}: ${created.stderr.trim()}`,
+            };
+        }
+    }
+    // A private directory (mkdtemp, mode 700): no other local user can swap
+    // the file between write and read.
+    const dir = mkdtempSync(join(tmpdir(), "caelo-audit-"));
+    try {
+        const file = join(dir, "lifecycle.json");
+        writeFileSync(file, JSON.stringify(AUDIT_RESULTS_LIFECYCLE), { mode: 0o600 });
+        const lifecycle = await run([
+            "storage",
+            "buckets",
+            "update",
+            resultsUrl,
+            project,
+            `--lifecycle-file=${file}`,
+        ]);
+        if (!lifecycle.ok)
+            return fail(`set the lifecycle of ${resultsUrl}`, lifecycle);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+    done.push(`bucket ${resultsUrl} (results deleted after 1 day)`);
+    // 3. Bucket grants: the job creates results and (gcp) reads the build;
+    //    the admin reads results.
+    const bucketGrants = [
+        { bucket: results, member, role: "roles/storage.objectCreator", why: "tasks write results" },
+        ...(provider === "gcp"
+            ? ["staging", "static"].map((b) => ({
+                bucket: gcpBucketName(projectId, env, b),
+                member,
+                role: "roles/storage.objectViewer",
+                why: "tasks serve the staged build to their browser",
+            }))
+            : []),
+        {
+            bucket: results,
+            member: runSaMember,
+            role: "roles/storage.objectViewer",
+            why: "the admin reads the results",
+        },
+    ];
+    for (const g of bucketGrants) {
+        const r = await retry([
+            "storage",
+            "buckets",
+            "add-iam-policy-binding",
+            `gs://${g.bucket}`,
+            `--member=${g.member}`,
+            `--role=${g.role}`,
+            project,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant ${g.role} on gs://${g.bucket} (${g.why})`, r);
+        done.push(`${g.member === member ? "audit job" : "admin"}: ${g.role} on gs://${g.bucket}`);
+    }
+    // 4. Logs.
+    const logs = await retry([
+        "projects",
+        "add-iam-policy-binding",
+        projectId,
+        `--member=${member}`,
+        "--role=roles/logging.logWriter",
+        "--condition=None",
+        "--quiet",
+        "--format=none",
+    ]);
+    if (!logs.ok)
+        return fail("grant the audit job roles/logging.logWriter", logs);
+    done.push("audit job: roles/logging.logWriter on the project");
+    // 5. The job: the admin image, its own SA, no secrets, no VPC. A job
+    //    created without a parallelism would run every task at once with no
+    //    cap; an existing job keeps its own.
+    let parallelism = target.parallelism;
+    if (parallelism === undefined) {
+        const existing = await describeAuditJobImage(run, { projectId, region, env });
+        if (!existing.ok)
+            return { ok: false, done, error: `read job ${job}: ${existing.error}` };
+        if (existing.image === null)
+            parallelism = AUDIT_PARALLELISM_DEFAULT;
+    }
+    const envVars = [
+        `CAELO_PROVIDER=${provider}`,
+        `CAELO_AUDIT_RESULTS_BUCKET=${results}`,
+        ...(provider === "gcp"
+            ? [
+                `CAELO_STAGING_BUCKET=${gcpBucketName(projectId, env, "staging")}`,
+                `CAELO_STATIC_BUCKET=${gcpBucketName(projectId, env, "static")}`,
+            ]
+            : []),
+    ];
+    const deploy = await run([
+        "run",
+        "jobs",
+        "deploy",
+        job,
+        `--image=${target.adminImageRef}`,
+        `--region=${region}`,
+        project,
+        `--service-account=${sa}`,
+        "--command=bun",
+        `--args=--bun,${AUDIT_TASK_SCRIPT}`,
+        `--set-env-vars=${envVars.join(",")}`,
+        "--max-retries=0",
+        `--task-timeout=${TASK_TIMEOUT}`,
+        // Lighthouse wants two cores: the browser and the trace processing.
+        "--cpu=2",
+        "--memory=2Gi",
+        ...(parallelism !== undefined ? [`--parallelism=${parallelism}`] : []),
+        "--quiet",
+    ]);
+    if (!deploy.ok)
+        return fail(`deploy job ${job}`, deploy);
+    done.push(`job ${job} (${target.adminImageRef.split("@")[1]?.slice(0, 19)}...)`);
+    // 6. The admin may run it with its batch and read its executions.
+    for (const role of ["roles/run.jobsExecutorWithOverrides", "roles/run.viewer"]) {
+        const r = await retry([
+            "run",
+            "jobs",
+            "add-iam-policy-binding",
+            job,
+            `--region=${region}`,
+            project,
+            `--member=${runSaMember}`,
+            `--role=${role}`,
+            "--quiet",
+            "--format=none",
+        ]);
+        if (!r.ok)
+            return fail(`grant the admin ${role} on ${job}`, r);
+        done.push(`admin: ${role} on ${job}`);
+    }
+    return { ok: true, done };
+}
+/**
+ * {@link ensureAuditJob}'s image: the deployed admin's, so the job runs the
+ * code the admin runs.
+ */
+export async function resolveAdminImage(opts, deps = {}) {
+    const cfg = await readAdminConfig(opts, deps.run ?? defaultGcloud);
+    if (!cfg)
+        return {
+            ok: false,
+            error: "could not read the admin service's image (is the admin deployed?)",
+        };
+    return { ok: true, imageRef: cfg.imageRef };
+}
+//# sourceMappingURL=audit-job-setup.js.map

package/dist/audit-job-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-job-setup.js","sourceRoot":"","sources":["../src/audit-job-setup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,aAAa,EAAqB,MAAM,aAAa,CAAC;AACzE,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,oDAAoD,CAAC;AAEtF,qEAAqE;AACrE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C;;;;GAIG;AACH,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa;IACb,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,sBAAsB;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,wBAAwB;IACxB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;CAClB,CAAC;AAEX,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;CAC9D,CAAC;AAuBF,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,OAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,SAAS,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,kBAAkB,EAAE,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,kBAAkB,sBAAsB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,QAAQ,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,CAAe,EAAkB,EAAE,CAAC,CAAC;QAC/D,EAAE,EAAE,KAAK;QACT,IAAI;QACJ,KAAK,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,uDAAuD,MAAM,CAAC,aAAa,EAAE;SACrF,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,GAAG,EAAE,CAAC,EAC5F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,6DAA6D,MAAM,CAAC,WAAW,EAAE;SACzF,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC;QACzB,KAAK;QACL,kBAAkB;QAClB,UAAU;QACV,EAAE;QACF,OAAO;QACP,uBAAuB;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,KAAK;YACL,kBAAkB;YAClB,QAAQ;YACR,qBAAqB,CAAC,GAAG,CAAC;YAC1B,oCAAoC;YACpC,iIAAiI;YACjI,OAAO;SACR,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAEnC,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,+BAA+B,SAAS,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC;SACE,IAAI,EAAE;SACN,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC;YACxB,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,cAAc,MAAM,EAAE;YACtB,kCAAkC;YAClC,+BAA+B;YAC/B,4BAA4B;YAC5B,0BAA0B;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI;gBACJ,KAAK,EAAE,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC/C,CAAC,CAAC,GAAG,UAAU,0CAA0C,SAAS,6DAA6D;oBAC/H,CAAC,CAAC,UAAU,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC;YAC1B,SAAS;YACT,SAAS;YACT,QAAQ;YACR,UAAU;YACV,OAAO;YACP,oBAAoB,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,wBAAwB,UAAU,EAAE,EAAE,SAAS,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,UAAU,gCAAgC,CAAC,CAAC;IAEhE,uEAAuE;IACvE,8BAA8B;IAC9B,MAAM,YAAY,GAAoE;QACpF,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,qBAAqB,EAAE;QAC5F,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAE,CAAC,SAAS,EAAE,QAAQ,CAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,MAAM,EAAE,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxC,MAAM;gBACN,IAAI,EAAE,4BAA4B;gBAClC,GAAG,EAAE,+CAA+C;aACrD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP;YACE,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,4BAA4B;YAClC,GAAG,EAAE,6BAA6B;SACnC;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,SAAS;YACT,SAAS;YACT,wBAAwB;YACxB,QAAQ,CAAC,CAAC,MAAM,EAAE;YAClB,YAAY,CAAC,CAAC,MAAM,EAAE;YACtB,UAAU,CAAC,CAAC,IAAI,EAAE;YAClB,OAAO;YACP,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,WAAW;IACX,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC;QACvB,UAAU;QACV,wBAAwB;QACxB,SAAS;QACT,YAAY,MAAM,EAAE;QACpB,gCAAgC;QAChC,kBAAkB;QAClB,SAAS;QACT,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IAE/D,qEAAqE;IACrE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACrC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1F,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI;YAAE,WAAW,GAAG,yBAAyB,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG;QACd,kBAAkB,QAAQ,EAAE;QAC5B,8BAA8B,OAAO,EAAE;QACvC,GAAG,CAAC,QAAQ,KAAK,KAAK;YACpB,CAAC,CAAC;gBACE,wBAAwB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE;gBAClE,uBAAuB,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE;aACjE;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;QACvB,KAAK;QACL,MAAM;QACN,QAAQ;QACR,GAAG;QACH,WAAW,MAAM,CAAC,aAAa,EAAE;QACjC,YAAY,MAAM,EAAE;QACpB,OAAO;QACP,qBAAqB,EAAE,EAAE;QACzB,eAAe;QACf,gBAAgB,iBAAiB,EAAE;QACnC,kBAAkB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,iBAAiB;QACjB,kBAAkB,YAAY,EAAE;QAChC,oEAAoE;QACpE,SAAS;QACT,cAAc;QACd,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,SAAS;KACV,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,cAAc,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAEjF,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,CAAC,qCAAqC,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC;YACpB,KAAK;YACL,MAAM;YACN,wBAAwB;YACxB,GAAG;YACH,YAAY,MAAM,EAAE;YACpB,OAAO;YACP,YAAY,WAAW,EAAE;YACzB,UAAU,IAAI,EAAE;YAChB,SAAS;YACT,eAAe;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAmF,EACnF,OAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG;QACN,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mEAAmE;SAC3E,CAAC;IACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC9C,CAAC"}

package/dist/caddy.d.ts

@@ -31,5 +31,14 @@ export declare function selfHostedAdminHost(domain: string): string;
  * public site, and Caddy refuses two site blocks for the same address.
  */
 export declare function selfHostedSeedDomains(domain: string, stagingDomain: string): CaddyDomainSpec[];
+/**
+ * Why `value` cannot go into the Caddyfile as one token, or null when it can.
+ * `init` checks the operator's domains and email with this before it writes
+ * anything, so a bad value never leaves a half-made install behind.
+ *
+ * @param kind `address` for a site address (hostname), `token` for any other value
+ */
+export declare function caddyTokenProblem(value: string, kind: "address" | "token"): string | null;
+/** Every caller-supplied value is checked before any of it is emitted (#888). */
 export declare function generateCaddyfile(spec: CaddyfileSpec): string;
 //# sourceMappingURL=caddy.d.ts.map

package/dist/caddy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAqC7D"}
+{"version":3,"file":"caddy.d.ts","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AA2DA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CAClD;AAED,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,eAAe,EAAE,CAM9F;AAYD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,CAOzF;AAWD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CA4C7D"}

package/dist/caddy.js

@@ -68,9 +68,47 @@ export function selfHostedSeedDomains(domain, stagingDomain) {
         { hostname: stagingDomain, kind: "public", env: "staging" },
     ];
 }
+/**
+ * Characters that would let a value end its Caddyfile token and start new
+ * directives or blocks: whitespace (incl. newlines), both quote styles Caddy
+ * tokenizes (`"` and backtick), braces (blocks and `{placeholders}`), the
+ * comment marker, escapes and semicolons. A site address additionally may
+ * not hold a comma, which would add further addresses to the same block.
+ */
+const UNSAFE_CADDY_TOKEN_RE = /[\s"`{}#\\;]/;
+const UNSAFE_CADDY_ADDRESS_RE = /[\s"`{}#\\;,]/;
+/**
+ * Why `value` cannot go into the Caddyfile as one token, or null when it can.
+ * `init` checks the operator's domains and email with this before it writes
+ * anything, so a bad value never leaves a half-made install behind.
+ *
+ * @param kind `address` for a site address (hostname), `token` for any other value
+ */
+export function caddyTokenProblem(value, kind) {
+    if (value.length === 0)
+        return "it is empty";
+    const unsafe = kind === "address" ? UNSAFE_CADDY_ADDRESS_RE : UNSAFE_CADDY_TOKEN_RE;
+    if (unsafe.test(value)) {
+        return `it contains whitespace, a quote, a brace, '#', '\\', ';'${kind === "address" ? " or ','" : ""}`;
+    }
+    return null;
+}
+function assertSafeCaddyToken(label, value, kind) {
+    const problem = caddyTokenProblem(value, kind);
+    if (problem) {
+        throw new Error(`Caddyfile: invalid ${label} ${JSON.stringify(value)} — ${problem}. Fix the value in .caelo/config.json (or the domain you added) and run the command again.`);
+    }
+}
+/** Every caller-supplied value is checked before any of it is emitted (#888). */
 export function generateCaddyfile(spec) {
+    assertSafeCaddyToken("ownerEmail", spec.ownerEmail, "token");
+    assertSafeCaddyToken("publicSiteRoot", spec.publicSiteRoot, "token");
+    assertSafeCaddyToken("stagingSiteRoot", spec.stagingSiteRoot, "token");
+    assertSafeCaddyToken("adminUpstream", spec.adminUpstream, "token");
+    assertSafeCaddyToken("gatewayUpstream", spec.gatewayUpstream, "token");
     const hostnames = new Set();
     for (const d of spec.domains) {
+        assertSafeCaddyToken("hostname", d.hostname, "address");
         if (hostnames.has(d.hostname)) {
             // Caddy refuses a config with two site blocks for one address, so a
             // duplicate would take every vhost down, not just this one.

package/dist/caddy.js.map

@@ -1 +1 @@
-{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;;oBAI7C,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}
+{"version":3,"file":"caddy.js","sourceRoot":"","sources":["../src/caddy.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AA4B3B,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,aAAqB;IACzE,OAAO;QACL,EAAE,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE;QAC3E,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE;QACvD,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAC7C,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAyB;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,2DAA2D,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa,EAAE,IAAyB;IACnF,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sBAAsB,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,OAAO,4FAA4F,CAC9J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,iBAAiB,CAAC,IAAmB;IACnD,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC7D,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACvE,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAEvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,oBAAoB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,oEAAoE;YACpE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,cAAc,CAAC,CAAC,QAAQ,iFAAiF,CAC1G,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kBAAkB;IAClB,MAAM,CAAC,IAAI,CAAC;UACJ,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE;;CAE3E,CAAC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9B,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC;;;kBAGE,IAAI,CAAC,aAAa;;CAEnC,CAAC,CAAC;IACD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,KAAK,CAAC,CAAkB,EAAE,IAAmB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;kBAClB,IAAI,CAAC,aAAa;;CAEnC,CAAC;IACA,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,uBAAuB;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9E,6DAA6D;IAC7D,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO;WACvB,IAAI;IACX,oBAAoB,CAAC,IAAI,CAAC;;iCAEG,2BAA2B;;;0CAGlB,uBAAuB;;;;oBAI7C,IAAI,CAAC,eAAe;;;;;;;;;;;CAWvC,CAAC;AACF,CAAC"}

package/dist/cli.js

@@ -38,10 +38,11 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { CAELO_VERSION, defaultStagingHost, normalizeStagingHost, stagingHostProblem, } from "@caelo-cms/shared";
 import { generateBootstrapToken } from "./bootstrap-token.js";
-import { generateCaddyfile, selfHostedAdminHost, selfHostedSeedDomains, } from "./caddy.js";
+import { caddyTokenProblem, generateCaddyfile, selfHostedAdminHost, selfHostedSeedDomains, } from "./caddy.js";
 import { redactCredentials } from "./checkpoint-secrets.js";
 import { cliUsage, initDelegatesToWizard, resolveCliRoute } from "./cli-routing.js";
 import { BOOTSTRAP_DIR, COMPOSE_ADMIN_UPSTREAM, COMPOSE_GATEWAY_UPSTREAM, composeProjectName, generateDockerCompose, isPublishablePort, MEDIA_DIR, SITE_OUTPUT_ROOT, selfHostedSiteUrl, } from "./compose.js";
+import { tightenPrivateTree, writePrivateFile } from "./private-file.js";
 import { selfCommand } from "./self-command.js";
 import { bunHostRunner, readRelease, recordRelease, releaseImages, resolveVerifiedRelease, } from "./self-hosted-release.js";
 import { convergeSelfHostedRoles, decideUp, selfHostedBootstrapScript, } from "./self-hosted-roles.js";
@@ -87,8 +88,8 @@ function loadProvider() {
 }
 function saveProvider(provider) {
     if (!existsSync(CAELO_DIR))
-        mkdirSync(CAELO_DIR, { recursive: true });
-    writeFileSync(PROVIDER_PATH, JSON.stringify({ provider }, null, 2));
+        mkdirSync(CAELO_DIR, { recursive: true, mode: 0o700 });
+    writePrivateFile(PROVIDER_PATH, JSON.stringify({ provider }, null, 2));
 }
 /**
  * P15 review pass — guard for commands that only make sense on
@@ -116,6 +117,16 @@ function randomSecret(bytes = 32) {
 function loadConfig() {
     if (!existsSync(CONFIG_PATH))
         return null;
+    // Every command that works on an install reads its config first, so this
+    // is where an install made by an older CLI loses its world-readable
+    // secrets (#888) — not only once each file happens to be rewritten.
+    tightenPrivateTree(CAELO_DIR, [BOOTSTRAP_DIR, "backups"], [
+        "config.json",
+        "provider.json",
+        "internal-secret.json",
+        "docker-compose.yml",
+        `${BOOTSTRAP_DIR}/pending-token.json`,
+    ]);
     const cfg = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
     // #707 — settings added later, back-filled (and stored) with what every
     // install ran before they existed, so `upgrade` / `agent` render the same
@@ -130,8 +141,8 @@ function loadConfig() {
 }
 function saveConfig(c) {
     if (!existsSync(CAELO_DIR))
-        mkdirSync(CAELO_DIR, { recursive: true });
-    writeFileSync(CONFIG_PATH, JSON.stringify(c, null, 2));
+        mkdirSync(CAELO_DIR, { recursive: true, mode: 0o700 });
+    writePrivateFile(CONFIG_PATH, JSON.stringify(c, null, 2));
 }
 function arg(name) {
     const idx = process.argv.indexOf(`--${name}`);
@@ -183,7 +194,7 @@ function emitConfig(cfg, extraDomains = []) {
  * operator-added domains only `up` / `regenerate-caddy` read back).
  */
 function emitComposeFiles(cfg) {
-    writeFileSync(COMPOSE_PATH, renderCompose(cfg, installImages(cfg)), { mode: 0o600 });
+    writePrivateFile(COMPOSE_PATH, renderCompose(cfg, installImages(cfg)));
     // No secrets (it reads the passwords from the container's environment),
     // and the postgres user inside the container must be able to read it.
     writeFileSync(BOOTSTRAP_SCRIPT_PATH, selfHostedBootstrapScript({ agent: activeAgent(cfg) !== undefined }), { mode: 0o755 });
@@ -396,6 +407,19 @@ async function init() {
         console.error(`--staging-domain: ${stagingProblem}`);
         process.exit(2);
     }
+    // The Caddyfile check would only fire in emitConfig, after config.json is
+    // written — and a re-run then stops at "config already exists".
+    for (const [flag, value, kind] of [
+        ["--domain", domain, "address"],
+        ["--staging-domain", stagingArg, "address"],
+        ["--owner-email", ownerEmail, "token"],
+    ]) {
+        const problem = value === undefined ? null : caddyTokenProblem(value, kind);
+        if (problem) {
+            console.error(`${flag} ${JSON.stringify(value)}: ${problem}.`);
+            process.exit(2);
+        }
+    }
     // #696 — the prebuilt release images, resolved to digests and
     // cosign-verified BEFORE anything is written, so a failed check leaves no
     // half-made install. `--dev` (contributors only) runs this checkout instead.
@@ -452,7 +476,7 @@ async function init() {
     // staging file.
     const tok = generateBootstrapToken();
     mkdirSync(resolve(CAELO_DIR, BOOTSTRAP_DIR), { recursive: true, mode: 0o700 });
-    writeFileSync(PENDING_TOKEN_PATH, JSON.stringify(tok, null, 2), { mode: 0o600 });
+    writePrivateFile(PENDING_TOKEN_PATH, JSON.stringify(tok, null, 2));
     // P15.1 — mint the shared HMAC secret for /api/internal/* endpoints.
     // Same secret is read by:
     //   - admin app (process.env.CAELO_INTERNAL_SECRET),
@@ -463,7 +487,7 @@ async function init() {
     // internal-secret`.
     const internalSecret = randomSecret(48);
     const internalSecretPath = resolve(CAELO_DIR, "internal-secret.json");
-    writeFileSync(internalSecretPath, JSON.stringify({ secret: internalSecret }, null, 2));
+    writePrivateFile(internalSecretPath, JSON.stringify({ secret: internalSecret }, null, 2));
     // #696 Phase 4c — the update agent (Linux + systemd): the fresh volume's
     // bootstrap.sh creates its database login on Postgres's first start.
     const { reportAgentSetup, setUpAgent } = await import("./agent/command.js");