@caelo-cms/provisioning 0.10.60 → 0.10.62

package/src/admin-internal-google.ts

@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * admin-internal.ts on Google Cloud, as the operator's own gcloud identity —
+ * the same path the Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
+ *
+ *   1. the admin's URL: on gcp-firebase the admin Cloud Run service's own
+ *      URL (IAP sits on the service); on gcp `https://admin.<domain>` (IAP
+ *      sits on the load balancer's admin backend, and the service's
+ *      run.app URL accepts only load-balancer traffic);
+ *   2. the install's internal secret from Secret Manager (in memory only),
+ *      which signs a 5-minute token for the endpoint's scope;
+ *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
+ *      API with `aud` = `<admin origin>/*` — the audience IAP's service-
+ *      account JWT path checks on both resource kinds
+ *      (cloud.google.com/iap/docs/authentication-howto). The admin's IAP
+ *      lets that service account in, and every IAP-allowlisted operator may
+ *      sign as it (`cms-provision upgrade` grants both), so the request
+ *      passes IAP first, then Caelo's token.
+ */
+
+import { findService } from "./admin-domain.js";
+import type {
+  AdminInternalAnswer,
+  AdminInternalCall,
+  AdminInternalDeps,
+  AdminInternalResult,
+  GoogleAdminTarget,
+} from "./admin-internal.js";
+import { readAdminAnswer } from "./admin-internal-answer.js";
+import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
+import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
+import { mintInternalToken } from "./internal-token.js";
+
+type Run = (args: string[]) => Promise<GcloudResult>;
+
+/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
+const IAP_JWT_LIFETIME_S = 600;
+
+/** The admin call on a gcp / gcp-firebase install (see the file comment). */
+export async function callGoogleAdmin<T>(
+  target: GoogleAdminTarget,
+  call: AdminInternalCall,
+  deps: AdminInternalDeps,
+): Promise<AdminInternalAnswer<T>> {
+  const run = deps.run ?? defaultGcloud;
+  const doFetch = deps.fetch ?? fetch;
+
+  const admin = await adminUrl(run, target);
+  if (!admin.ok) return admin;
+
+  const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
+  const secret = await run([
+    "secrets",
+    "versions",
+    "access",
+    "latest",
+    `--secret=${secretId}`,
+    `--project=${target.projectId}`,
+  ]);
+  const internalSecret = secret.stdout.trim();
+  if (!secret.ok || internalSecret.length < 32) {
+    return {
+      ok: false,
+      error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
+    };
+  }
+
+  // Installs from before #678 may not have the IAM Credentials API on;
+  // enabling an enabled API is a no-op (codex review on #681).
+  const api = await run([
+    "services",
+    "enable",
+    "iamcredentials.googleapis.com",
+    `--project=${target.projectId}`,
+  ]);
+  if (!api.ok) {
+    return {
+      ok: false,
+      error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
+    };
+  }
+  const iap = await signIapJwt(run, doFetch, target.projectId, admin.value, deps.now);
+  if (!iap.ok) return iap;
+
+  const token = await mintInternalToken(internalSecret, call.scope);
+  let res: Response;
+  try {
+    res = await doFetch(`${admin.value}${call.endpoint}`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${iap.value}`,
+        "x-caelo-internal-token": token,
+        "content-type": "application/json",
+      },
+      body: JSON.stringify(call.body),
+    });
+  } catch (e) {
+    return {
+      ok: false,
+      error: `reach the admin at ${admin.value}: ${String(e)}${unreachableHint(target)}`,
+    };
+  }
+  const text = await res.text();
+  if (res.headers.get("x-goog-iap-generated-response") === "true") {
+    return {
+      ok: false,
+      error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
+    };
+  }
+  const answer = readAdminAnswer<T>(res.status, text, call, "cms-provision upgrade");
+  return answer.ok ? { ok: true, value: { answer: answer.value, adminUrl: admin.value } } : answer;
+}
+
+/** Where the admin answers behind IAP (see the file comment, step 1). */
+async function adminUrl(run: Run, target: GoogleAdminTarget): Promise<AdminInternalResult<string>> {
+  if (target.provider === "gcp") return { ok: true, value: `https://admin.${target.domain}` };
+  const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
+  const found = await findService(run, scope, "admin");
+  if (!found.ok) return { ok: false, error: found.error };
+  const url = await run([
+    "run",
+    "services",
+    "describe",
+    found.service,
+    ...scope,
+    "--format=value(status.url)",
+  ]);
+  const value = url.stdout.trim();
+  if (!url.ok || !value) {
+    return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
+  }
+  return { ok: true, value };
+}
+
+/** On gcp the admin's host must resolve to the load balancer and have its certificate. */
+function unreachableHint(target: GoogleAdminTarget): string {
+  return target.provider === "gcp"
+    ? ` — admin.${target.domain} must resolve to the install's load balancer with an ACTIVE certificate (check \`dig +short admin.${target.domain}\`).`
+    : "";
+}
+
+/** A JWT signed as the install's MCP service account, for the admin's IAP. */
+async function signIapJwt(
+  run: Run,
+  doFetch: typeof fetch,
+  projectId: string,
+  adminUrl: string,
+  now: (() => number) | undefined,
+): Promise<AdminInternalResult<string>> {
+  const access = await run(["auth", "print-access-token"]);
+  const accessToken = access.stdout.trim();
+  if (!access.ok || !accessToken) {
+    return {
+      ok: false,
+      error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
+    };
+  }
+  const serviceAccount = mcpIapServiceAccountEmail(projectId);
+  const iat = now ? now() : Math.floor(Date.now() / 1000);
+  const res = await doFetch(
+    `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
+      body: JSON.stringify({
+        payload: JSON.stringify({
+          iss: serviceAccount,
+          sub: serviceAccount,
+          aud: `${new URL(adminUrl).origin}/*`,
+          iat,
+          exp: iat + IAP_JWT_LIFETIME_S,
+        }),
+      }),
+    },
+  );
+  if (!res.ok) {
+    const detail = (await res.text().catch(() => "")).slice(0, 300);
+    return {
+      ok: false,
+      error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
+    };
+  }
+  const { signedJwt } = (await res.json()) as { signedJwt?: string };
+  if (!signedJwt) return { ok: false, error: "IAM signJwt answered without a signedJwt" };
+  return { ok: true, value: signedJwt };
+}

package/src/admin-internal-self-hosted.test.ts

@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #770 — the script `docker compose exec caelo-admin bun -e …` runs, executed
+ * here by a real bun against a stand-in admin on 127.0.0.1:$PORT: it reads
+ * the request from stdin, sends the token in `x-caelo-internal-token` and
+ * prints the admin's answer as one JSON line.
+ */
+
+import { afterAll, beforeAll, describe, expect, it } from "bun:test";
+import { IN_CONTAINER_FETCH } from "./admin-internal-self-hosted.js";
+
+let server: ReturnType<typeof Bun.serve>;
+const received: { path: string; token: string | null; body: unknown }[] = [];
+
+beforeAll(() => {
+  server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    async fetch(req) {
+      received.push({
+        path: new URL(req.url).pathname,
+        token: req.headers.get("x-caelo-internal-token"),
+        body: await req.json(),
+      });
+      return Response.json({ ok: true, echoed: true }, { status: 201 });
+    },
+  });
+});
+afterAll(() => server.stop(true));
+
+async function runScript(stdin: string, port: string): Promise<string> {
+  const proc = Bun.spawn([process.execPath, "-e", IN_CONTAINER_FETCH], {
+    env: { PATH: process.env.PATH ?? "", PORT: port },
+    stdin: Buffer.from(stdin),
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const out = await new Response(proc.stdout).text();
+  expect(await proc.exited).toBe(0);
+  return out;
+}
+
+describe("IN_CONTAINER_FETCH", () => {
+  it("POSTs the stdin request to the admin's own port and prints its answer", async () => {
+    const out = await runScript(
+      JSON.stringify({ endpoint: "/api/internal/owner-reset", token: "t.sig", body: { a: 1 } }),
+      String(server.port),
+    );
+    expect(JSON.parse(out)).toEqual({ status: 201, text: '{"ok":true,"echoed":true}' });
+    expect(received).toEqual([
+      { path: "/api/internal/owner-reset", token: "t.sig", body: { a: 1 } },
+    ]);
+  });
+
+  it("reports an admin that does not answer instead of failing silently", async () => {
+    const closed = Bun.serve({ hostname: "127.0.0.1", port: 0, fetch: () => new Response() });
+    const port = String(closed.port);
+    closed.stop(true);
+    const out = await runScript(
+      JSON.stringify({ endpoint: "/api/internal/x", token: "t", body: {} }),
+      port,
+    );
+    expect(Object.keys(JSON.parse(out))).toEqual(["unreachable"]);
+  });
+
+  it("holds no secret: it is visible in the host's process list", () => {
+    expect(IN_CONTAINER_FETCH).not.toMatch(/CAELO_INTERNAL_SECRET|[0-9a-f]{32}/);
+  });
+});

package/src/admin-internal-self-hosted.ts

@@ -0,0 +1,128 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * admin-internal.ts on a self-hosted install: from the install's host into
+ * the admin container, never over the internet.
+ *
+ * The root of trust is the host: whoever may run `docker compose` for the
+ * install already controls its database, its files and its secrets, so
+ * reaching the admin's internal endpoints grants nothing new. The CLI signs
+ * a 5-minute token for the endpoint's scope with `.caelo/internal-secret.json`
+ * (the secret the Compose file gives the admin as `CAELO_INTERNAL_SECRET`)
+ * and runs one `fetch` inside the admin container (`docker compose exec`)
+ * against the admin's own port on 127.0.0.1 — the admin image has bun but
+ * no curl.
+ *
+ * Nothing secret travels in process arguments, which other users of the
+ * host can read in `ps`: the token and the request body go in on the exec's
+ * stdin, the answer comes back on its stdout. `docker compose exec` output
+ * is not part of the container's log (`docker compose logs` shows only the
+ * container's main process), so the answer is written nowhere.
+ */
+
+import type {
+  AdminInternalAnswer,
+  AdminInternalCall,
+  AdminInternalDeps,
+  SelfHostedAdminTarget,
+} from "./admin-internal.js";
+import { readAdminAnswer } from "./admin-internal-answer.js";
+import { mintInternalToken } from "./internal-token.js";
+import { selfCommand } from "./self-command.js";
+import { internalSecretPath, readInternalSecret } from "./self-hosted-internal-secret.js";
+import { bunHostRunner } from "./self-hosted-release.js";
+import { compose } from "./self-hosted-upgrade.js";
+
+/** The admin's Compose service (compose.ts). */
+const ADMIN_SERVICE = "caelo-admin";
+
+/**
+ * What runs inside the admin container. It reads `{ endpoint, token, body }`
+ * from stdin, POSTs to the admin's own port and prints one JSON line:
+ * `{ status, text }`, or `{ unreachable }` when the admin does not answer.
+ * It holds no secret itself — it is visible in `ps` on the host.
+ */
+export const IN_CONTAINER_FETCH = `(async () => {
+  const out = (o) => process.stdout.write(JSON.stringify(o));
+  const req = JSON.parse(await Bun.stdin.text());
+  try {
+    const res = await fetch("http://127.0.0.1:" + process.env.PORT + req.endpoint, {
+      method: "POST",
+      headers: { "x-caelo-internal-token": req.token, "content-type": "application/json" },
+      body: JSON.stringify(req.body),
+    });
+    out({ status: res.status, text: await res.text() });
+  } catch (e) {
+    out({ unreachable: String(e) });
+  }
+})();`;
+
+/** The admin call on a self-hosted install (see the file comment). */
+export async function callSelfHostedAdmin<T>(
+  target: SelfHostedAdminTarget,
+  call: AdminInternalCall,
+  deps: AdminInternalDeps,
+): Promise<AdminInternalAnswer<T>> {
+  const host = deps.host ?? bunHostRunner;
+  const restart = selfCommand("up");
+  let secret: string | null;
+  try {
+    secret = readInternalSecret(target.caeloDir);
+  } catch (e) {
+    return { ok: false, error: (e as Error).message };
+  }
+  if (secret === null) {
+    return {
+      ok: false,
+      error: `${internalSecretPath(target.caeloDir)} does not exist. Run \`${restart}\` (it creates the secret and restarts the admin with it), then run this command again.`,
+    };
+  }
+
+  const token = await mintInternalToken(secret, call.scope);
+  const r = await host.run(
+    compose(target.caeloDir, "exec", "-T", ADMIN_SERVICE, "bun", "-e", IN_CONTAINER_FETCH),
+    { stdinText: JSON.stringify({ endpoint: call.endpoint, token, body: call.body }) },
+  );
+  if (r.exitCode !== 0) {
+    return {
+      ok: false,
+      error: `run a request inside the ${ADMIN_SERVICE} container (docker compose exec, exit ${r.exitCode}): ${tail(r.stderr) || "no output"}. The admin must be running — start it with \`${restart}\`, then run this command again.`,
+    };
+  }
+  let reply: { status?: unknown; text?: unknown; unreachable?: unknown };
+  try {
+    reply = JSON.parse(r.stdout) as typeof reply;
+  } catch {
+    return {
+      ok: false,
+      error: `the request inside the ${ADMIN_SERVICE} container printed no answer: ${tail(r.stdout) || tail(r.stderr) || "empty"}`,
+    };
+  }
+  if (typeof reply.unreachable === "string") {
+    return {
+      ok: false,
+      error: `the admin did not answer on its own port inside the container (${reply.unreachable}). Check \`docker compose -f ${target.caeloDir}/docker-compose.yml logs ${ADMIN_SERVICE}\`, then run this command again.`,
+    };
+  }
+  if (typeof reply.status !== "number" || typeof reply.text !== "string") {
+    return {
+      ok: false,
+      error: `the request inside the ${ADMIN_SERVICE} container answered an unexpected shape`,
+    };
+  }
+  if (reply.status === 401) {
+    return {
+      ok: false,
+      error: `the admin refused the internal token (HTTP 401: ${reply.text.slice(0, 200)}) — the running admin does not hold the secret in ${internalSecretPath(target.caeloDir)} (it was started from an older Compose file). Run \`${restart}\` to restart it with that secret, then run this command again.`,
+    };
+  }
+  const answer = readAdminAnswer<T>(reply.status, reply.text, call, "cms-provision upgrade");
+  return answer.ok
+    ? { ok: true, value: { answer: answer.value, adminUrl: target.adminUrl } }
+    : answer;
+}
+
+/** The last lines of a command's output, for an error message. */
+function tail(text: string): string {
+  return text.trim().split("\n").slice(-5).join("\n").slice(0, 500);
+}

package/src/admin-internal.ts

@@ -1,45 +1,67 @@
 // SPDX-License-Identifier: MPL-2.0
 
 /**
- * The CLI's channel to the admin's `/api/internal/*` endpoints on a
- * gcp-firebase install, for commands that need an answer BACK from the admin
- * (a generated password, a reset link). A one-shot Cloud Run job could only
- * report through Cloud Logging, which would put that secret into the
- * project's logs; this call answers over TLS straight to the CLI process, and
- * nothing is written anywhere (CLAUDE.md §7, #659).
+ * The CLI's channel to the admin's `/api/internal/*` endpoints, for commands
+ * that need an answer BACK from the admin (a generated password, a reset
+ * link). A one-shot job could only report through the platform's logs, which
+ * would put that secret into them; this call answers straight to the CLI
+ * process, and nothing is written anywhere (CLAUDE.md §7, #659).
  *
- * Getting there, as the operator's own gcloud identity — the same path the
- * Power-MCP shim takes (packages/mcp-server/src/ingress-auth.ts):
+ * Each provider reaches the admin its own way (CLAUDE.md §11.B), as the
+ * operator's own identity on that provider:
  *
- *   1. the admin Cloud Run service and its URL;
- *   2. the install's internal secret from Secret Manager (in memory only),
- *      which signs a 5-minute token for the endpoint's scope;
- *   3. a JWT signed as `caelo-mcp@<project>` through the IAM Credentials
- *      API — the admin's IAP lets that service account in, and every
- *      IAP-allowlisted operator may sign as it (`cms-provision upgrade`
- *      grants it) — so the request passes IAP first, then Caelo's token.
+ * - `gcp-firebase` / `gcp` (admin-internal-google.ts): through the admin's
+ *   Google IAP with a JWT signed as `caelo-mcp@<project>`, plus a token
+ *   signed with the internal secret from Secret Manager. gcp-firebase
+ *   addresses the admin's Cloud Run URL (IAP on the service); gcp addresses
+ *   `admin.<domain>` (IAP on the load balancer backend; the Cloud Run URL
+ *   takes no traffic from outside the load balancer).
+ * - `self-hosted` (admin-internal-self-hosted.ts): from the install's host
+ *   into the admin container (`docker compose exec`), plus a token signed
+ *   with `.caelo/internal-secret.json`.
+ *
+ * aws and azure have no such channel yet (#952).
  */
 
-import { findService } from "./admin-domain.js";
-import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
-import { GCP_STACK_ENV, gcpSecretId, mcpIapServiceAccountEmail } from "./gcp-names.js";
-import { mintInternalToken } from "./internal-token.js";
+import { callGoogleAdmin } from "./admin-internal-google.js";
+import { callSelfHostedAdmin } from "./admin-internal-self-hosted.js";
+import type { GcloudResult } from "./gcloud.js";
+import type { HostRunner } from "./self-hosted-release.js";
 
-type Run = (args: string[]) => Promise<GcloudResult>;
+/** Which admin to call, and what the provider needs to reach it. */
+export type AdminInternalTarget = GoogleAdminTarget | SelfHostedAdminTarget;
 
-/** Signed JWTs live at most 1 hour; one call needs a few seconds. */
-const IAP_JWT_LIFETIME_S = 600;
+/** A Google Cloud install (IAP in front of the admin). */
+export type GoogleAdminTarget =
+  | {
+      readonly provider: "gcp-firebase";
+      readonly projectId: string;
+      readonly region: string;
+    }
+  | {
+      readonly provider: "gcp";
+      readonly projectId: string;
+      /** The install's domain; the admin answers on `admin.<domain>`. */
+      readonly domain: string;
+    };
 
-export interface AdminInternalTarget {
-  readonly projectId: string;
-  readonly region: string;
+/** A self-hosted install on this host. */
+export interface SelfHostedAdminTarget {
+  readonly provider: "self-hosted";
+  /** The install's `.caelo/` directory (Compose file, internal secret). */
+  readonly caeloDir: string;
+  /** The admin's public origin, for the links the operator opens. */
+  readonly adminUrl: string;
 }
 
 export interface AdminInternalDeps {
-  readonly run?: Run;
+  /** gcloud (Google providers). */
+  readonly run?: (args: string[]) => Promise<GcloudResult>;
   readonly fetch?: typeof fetch;
   /** Seconds since epoch (IAP JWT); tests pin it. */
   readonly now?: () => number;
+  /** `docker compose` on the install's host (self-hosted). */
+  readonly host?: HostRunner;
 }
 
 /** One endpoint call: where, under which token scope, with what body. */
@@ -55,158 +77,21 @@ export interface AdminInternalCall {
 
 export type AdminInternalResult<T> = { ok: true; value: T } | { ok: false; error: string };
 
+/** What a transport hands back: the admin's answer and the URL it serves on. */
+export type AdminInternalAnswer<T> = AdminInternalResult<{ answer: T; adminUrl: string }>;
+
 /**
  * POST `call.body` to the endpoint and return the admin's JSON answer and
- * the admin URL it was reached at (to build links the operator opens).
- * Every failure names the fix: an IAP refusal or a pre-endpoint admin points
- * at `cms-provision upgrade`, a refusal carries the admin's own message.
+ * the admin URL the operator opens (to build links). Every failure names
+ * the fix: a gate refusal or a pre-endpoint admin points at the command that
+ * repairs it, a refusal carries the admin's own message.
  */
-export async function callAdminInternal<T>(
+export function callAdminInternal<T>(
   target: AdminInternalTarget,
   call: AdminInternalCall,
   deps: AdminInternalDeps = {},
-): Promise<AdminInternalResult<{ answer: T; adminUrl: string }>> {
-  const run = deps.run ?? defaultGcloud;
-  const doFetch = deps.fetch ?? fetch;
-  const scope = [`--region=${target.region}`, `--project=${target.projectId}`];
-
-  const found = await findService(run, scope, "admin");
-  if (!found.ok) return { ok: false, error: found.error };
-  const url = await run([
-    "run",
-    "services",
-    "describe",
-    found.service,
-    ...scope,
-    "--format=value(status.url)",
-  ]);
-  const adminUrl = url.stdout.trim();
-  if (!url.ok || !adminUrl) {
-    return { ok: false, error: `read the admin's URL: ${url.stderr.trim() || "empty"}` };
-  }
-
-  const secretId = gcpSecretId(GCP_STACK_ENV, "internal-secret");
-  const secret = await run([
-    "secrets",
-    "versions",
-    "access",
-    "latest",
-    `--secret=${secretId}`,
-    `--project=${target.projectId}`,
-  ]);
-  const internalSecret = secret.stdout.trim();
-  if (!secret.ok || internalSecret.length < 32) {
-    return {
-      ok: false,
-      error: `read the install's internal secret (${secretId}) from Secret Manager: ${secret.stderr.trim() || "missing or too short"}. Your gcloud account needs secretmanager.versions.access on the project.`,
-    };
-  }
-
-  // Installs from before #678 may not have the IAM Credentials API on;
-  // enabling an enabled API is a no-op (codex review on #681).
-  const api = await run([
-    "services",
-    "enable",
-    "iamcredentials.googleapis.com",
-    `--project=${target.projectId}`,
-  ]);
-  if (!api.ok) {
-    return {
-      ok: false,
-      error: `enable the IAM Credentials API (iamcredentials.googleapis.com), needed to pass the admin's IAP: ${api.stderr.trim()}`,
-    };
-  }
-  const iap = await signIapJwt(run, doFetch, target.projectId, adminUrl, deps.now);
-  if (!iap.ok) return iap;
-
-  const token = await mintInternalToken(internalSecret, call.scope);
-  let res: Response;
-  try {
-    res = await doFetch(`${adminUrl}${call.endpoint}`, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${iap.value}`,
-        "x-caelo-internal-token": token,
-        "content-type": "application/json",
-      },
-      body: JSON.stringify(call.body),
-    });
-  } catch (e) {
-    return { ok: false, error: `reach the admin at ${adminUrl}: ${String(e)}` };
-  }
-  const text = await res.text();
-  if (res.headers.get("x-goog-iap-generated-response") === "true") {
-    return {
-      ok: false,
-      error: `Google IAP refused the request (HTTP ${res.status}: ${text.trim().slice(0, 200)}) — ${mcpIapServiceAccountEmail(target.projectId)} is not allowed on the admin's IAP yet. Run \`cms-provision upgrade\` (it allowlists that service account), then run this command again.`,
-    };
-  }
-  if (res.status === 404) {
-    return {
-      ok: false,
-      error: `the admin has no ${call.endpoint} yet (it runs a release from before ${call.introducedBy}). Run \`cms-provision upgrade\`, then run this command again.`,
-    };
-  }
-  let parsed: { ok?: boolean; error?: string } & Record<string, unknown>;
-  try {
-    parsed = JSON.parse(text) as typeof parsed;
-  } catch {
-    return {
-      ok: false,
-      error: `the admin answered HTTP ${res.status} with a non-JSON body: ${text.slice(0, 200)}`,
-    };
-  }
-  if (!res.ok || parsed.ok !== true) {
-    return {
-      ok: false,
-      error: `the admin refused (HTTP ${res.status}): ${parsed.error ?? text.slice(0, 300)}`,
-    };
-  }
-  return { ok: true, value: { answer: parsed as unknown as T, adminUrl } };
-}
-
-/** A JWT signed as the install's MCP service account, for the admin's IAP. */
-async function signIapJwt(
-  run: Run,
-  doFetch: typeof fetch,
-  projectId: string,
-  adminUrl: string,
-  now: (() => number) | undefined,
-): Promise<AdminInternalResult<string>> {
-  const access = await run(["auth", "print-access-token"]);
-  const accessToken = access.stdout.trim();
-  if (!access.ok || !accessToken) {
-    return {
-      ok: false,
-      error: `get an access token from gcloud: ${access.stderr.trim() || "empty"}. Run \`gcloud auth login\` with the account you provisioned with.`,
-    };
-  }
-  const serviceAccount = mcpIapServiceAccountEmail(projectId);
-  const iat = now ? now() : Math.floor(Date.now() / 1000);
-  const res = await doFetch(
-    `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(serviceAccount)}:signJwt`,
-    {
-      method: "POST",
-      headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
-      body: JSON.stringify({
-        payload: JSON.stringify({
-          iss: serviceAccount,
-          sub: serviceAccount,
-          aud: `${new URL(adminUrl).origin}/*`,
-          iat,
-          exp: iat + IAP_JWT_LIFETIME_S,
-        }),
-      }),
-    },
-  );
-  if (!res.ok) {
-    const detail = (await res.text().catch(() => "")).slice(0, 300);
-    return {
-      ok: false,
-      error: `sign an IAP token as ${serviceAccount} (HTTP ${res.status}): ${detail} — your account needs roles/iam.serviceAccountTokenCreator on it; \`cms-provision upgrade\` grants it to everyone the admin's IAP lets in.`,
-    };
-  }
-  const { signedJwt } = (await res.json()) as { signedJwt?: string };
-  if (!signedJwt) return { ok: false, error: "IAM signJwt answered without a signedJwt" };
-  return { ok: true, value: signedJwt };
+): Promise<AdminInternalAnswer<T>> {
+  return target.provider === "self-hosted"
+    ? callSelfHostedAdmin<T>(target, call, deps)
+    : callGoogleAdmin<T>(target, call, deps);
 }

package/src/admin-memory.test.ts

@@ -76,6 +76,7 @@ describe("self-hosted compose", () => {
     postgresPassword: "pw",
     rolePasswords: { admin: "a", public: "b" },
     caeloSecretKek: "0".repeat(64),
+    internalSecret: "i".repeat(48),
     diskSize: "20Gi",
     ports: { http: 80, https: 443 },
     project: "caelo-example-com",

package/src/agent/command.ts

@@ -59,6 +59,8 @@ export interface AgentCliContext {
   convergeRoles(): Promise<ConvergeOutcome>;
   /** The Compose file for `images` from config.json. */
   renderCompose(images: ReleaseImages): string;
+  /** Re-write the Caddyfile (config + domains table) and reload Caddy (#891). */
+  refreshCaddy(): Promise<{ ok: true } | { ok: false; error: string }>;
   randomSecret(): string;
 }
 
@@ -544,6 +546,7 @@ async function agentApply(argv: readonly string[], ctx: AgentCliContext): Promis
             runner: bunHostRunner,
             renderCompose: (images) => ctx.renderCompose(images),
             convergeRoles: () => ctx.convergeRoles(),
+            refreshCaddy: () => ctx.refreshCaddy(),
             log,
           },
         ),