@caelo-cms/provisioning 0.10.61 → 0.10.64

package/dist/preview-plan.js

@@ -0,0 +1,168 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * What a Pulumi preview would change, per resource (#737). `state migrate`
+ * used to refuse with "a preview shows 36 change(s)" and the installer ran
+ * `pulumi up` blind, so an operator could not tell an IAM tweak from a
+ * Cloud SQL replace without assembling a `pulumi preview --diff` by hand.
+ *
+ * {@link collectPreviewSteps} turns the Automation API's engine events into
+ * {@link PlannedStep}s; {@link formatPlan} groups them (creates / updates /
+ * REPLACES / DELETES) and names the resources whose replace or delete loses
+ * data; {@link writePlanFile} keeps the full diff next to the install.
+ */
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * The step ops that make one planned change. A replace also emits
+ * `create-replacement` / `delete-replaced` sub-steps for the same URN; they
+ * are the same change and are not counted again.
+ */
+const PLANNED = {
+    create: "create",
+    update: "update",
+    replace: "replace",
+    delete: "delete",
+    import: "import",
+    "import-replacement": "replace",
+};
+/**
+ * Resources whose replace or delete loses data, by Pulumi type token, with
+ * the name an operator knows them by. Replacing any of them is never a
+ * "state catching up" detail.
+ */
+const DATA_BEARING = {
+    "gcp:sql/databaseInstance:DatabaseInstance": "Cloud SQL instance (all site data)",
+    "gcp:sql/database:Database": "Cloud SQL database",
+    "gcp:storage/bucket:Bucket": "Cloud Storage bucket (media, published site or state)",
+    "gcp:secretmanager/secret:Secret": "Secret Manager secret",
+    "gcp:secretmanager/secretVersion:SecretVersion": "Secret Manager secret value",
+    "gcp:firebase/project:Project": "Firebase project",
+    "gcp:firebase/hostingSite:HostingSite": "Firebase Hosting site",
+    "gcp:kms/keyRing:KeyRing": "Cloud KMS key ring",
+    "gcp:kms/cryptoKey:CryptoKey": "Cloud KMS key (decrypts the install's state)",
+    "gcp:bigquery/dataset:Dataset": "BigQuery dataset (edge logs)",
+};
+/** What a data-bearing resource holds, or null for any other type. */
+export function dataBearingKind(type) {
+    return DATA_BEARING[type] ?? null;
+}
+/** Whether `step` would destroy data: a replace or delete of a data-bearing resource. */
+export function losesData(step) {
+    return (step.op === "replace" || step.op === "delete") && dataBearingKind(step.type) !== null;
+}
+/** Whether the plan replaces or deletes anything. */
+export function hasReplaceOrDelete(steps) {
+    return steps.some((s) => s.op === "replace" || s.op === "delete");
+}
+/** The URN's last `::` segment: the name the program gave the resource. */
+function urnName(urn) {
+    return urn.split("::").at(-1) ?? urn;
+}
+/** A fresh {@link PreviewCollector}. */
+export function collectPreviewSteps() {
+    const byUrn = new Map();
+    return {
+        onEvent: (event) => {
+            const m = event.resourcePreEvent?.metadata;
+            if (!m)
+                return;
+            const op = PLANNED[m.op];
+            // The stack resource itself and providers are bookkeeping, not cloud changes.
+            if (!op || m.type === "pulumi:pulumi:Stack" || m.type.startsWith("pulumi:providers:")) {
+                return;
+            }
+            const prior = byUrn.get(m.urn);
+            if (prior?.op === "replace")
+                return;
+            byUrn.set(m.urn, {
+                op,
+                type: m.type,
+                name: urnName(m.urn),
+                urn: m.urn,
+                diffs: [...(m.diffs ?? [])],
+                replaceReasons: op === "replace" ? [...(m.keys ?? [])] : [],
+            });
+        },
+        steps: () => [...byUrn.values()],
+    };
+}
+const GROUPS = [
+    { op: "delete", title: "DELETES" },
+    { op: "replace", title: "REPLACES (delete + create)" },
+    { op: "update", title: "Updates in place" },
+    { op: "create", title: "Creates" },
+    { op: "import", title: "Imports" },
+];
+/** One line for `step`: type, name, what changes and why it is replaced. */
+function stepLine(step) {
+    const kind = dataBearingKind(step.type);
+    const data = losesData(step) && kind ? `  <-- LOSES DATA: ${kind}` : "";
+    const why = step.op === "replace" && step.replaceReasons.length > 0
+        ? ` (replaced because ${step.replaceReasons.join(", ")} changes)`
+        : step.diffs.length > 0 && step.op !== "create"
+            ? ` (${step.diffs.join(", ")})`
+            : "";
+    return `  ${step.type} ${step.name}${why}${data}`;
+}
+/**
+ * The plan as grouped lines, destructive groups first. Empty plan: one line
+ * saying so.
+ */
+export function formatPlan(steps) {
+    if (steps.length === 0)
+        return ["The preview plans no changes."];
+    const lines = [];
+    for (const g of GROUPS) {
+        const inGroup = steps.filter((s) => s.op === g.op);
+        if (inGroup.length === 0)
+            continue;
+        lines.push(`${g.title} (${inGroup.length}):`, ...inGroup.map(stepLine));
+    }
+    const lost = steps.filter(losesData);
+    if (lost.length > 0) {
+        lines.push("", `${lost.length} of these would destroy data: ${lost.map((s) => `${dataBearingKind(s.type)} ${s.name}`).join("; ")}.`);
+    }
+    return lines;
+}
+/**
+ * Write the full plan (every step with every changed property) to a file in
+ * `installRoot` and return its path. Names and property paths only, never
+ * values: the file holds no secret.
+ *
+ * @param label what the preview was for, part of the file name (`state-migrate`, `installer`)
+ */
+export function writePlanFile(installRoot, label, steps, now = new Date()) {
+    const path = join(installRoot, `plan-${label}-${now.toISOString().replace(/[:.]/g, "-")}.txt`);
+    const body = [
+        `Pulumi preview (${label}), ${now.toISOString()}: ${steps.length} change(s)`,
+        "",
+        ...formatPlan(steps),
+        "",
+        "Every step:",
+        ...steps.map((s) => [
+            `- ${s.op} ${s.urn}`,
+            ...(s.replaceReasons.length > 0
+                ? [`    replaced because: ${s.replaceReasons.join(", ")}`]
+                : []),
+            ...(s.diffs.length > 0 ? [`    changes: ${s.diffs.join(", ")}`] : []),
+        ].join("\n")),
+        "",
+    ].join("\n");
+    writeFileSync(path, body, { mode: 0o600 });
+    return path;
+}
+/**
+ * The gate for `steps`. A replace or delete is asked about whenever someone
+ * can answer. Without a terminal (`--non-interactive`, the install job)
+ * replaces and deletes of resources without data go ahead, already listed;
+ * a data-bearing one is refused: no flag stands in for that yes.
+ */
+export function planGate(steps, opts) {
+    if (!hasReplaceOrDelete(steps))
+        return { kind: "proceed" };
+    const lost = steps.some(losesData);
+    if (opts.interactive)
+        return { kind: "confirm", losesData: lost };
+    return lost ? { kind: "refuse" } : { kind: "proceed" };
+}
+//# sourceMappingURL=preview-plan.js.map

package/dist/preview-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview-plan.js","sourceRoot":"","sources":["../src/preview-plan.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAoBjC;;;;GAIG;AACH,MAAM,OAAO,GAAiD;IAC5D,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,oBAAoB,EAAE,SAAS;CAChC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAqC;IACrD,2CAA2C,EAAE,oCAAoC;IACjF,2BAA2B,EAAE,oBAAoB;IACjD,2BAA2B,EAAE,uDAAuD;IACpF,iCAAiC,EAAE,uBAAuB;IAC1D,+CAA+C,EAAE,6BAA6B;IAC9E,8BAA8B,EAAE,kBAAkB;IAClD,sCAAsC,EAAE,uBAAuB;IAC/D,yBAAyB,EAAE,oBAAoB;IAC/C,6BAA6B,EAAE,8CAA8C;IAC7E,8BAA8B,EAAE,8BAA8B;CAC/D,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,SAAS,CAAC,IAAiB;IACzC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAChG,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,kBAAkB,CAAC,KAA6B;IAC9D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AACvC,CAAC;AAYD,wCAAwC;AACxC,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,MAAM,CAAC,GAAG,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC;YAC3C,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzB,8EAA8E;YAC9E,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACtF,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,EAAE,EAAE,KAAK,SAAS;gBAAE,OAAO;YACpC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;gBACf,EAAE;gBACF,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;gBACpB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC3B,cAAc,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAkE;IAC5E,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;IAClC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,4BAA4B,EAAE;IACtD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC3C,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;IAClC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE;CACnC,CAAC;AAEF,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,IAAiB;IACjC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,GAAG,GACP,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC,CAAC,sBAAsB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;QACjE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,KAAK,QAAQ;YAC7C,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC/B,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAA6B;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,EAAE,EACF,GAAG,IAAI,CAAC,MAAM,iCAAiC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,KAAa,EACb,KAA6B,EAC7B,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,KAAK,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG;QACX,mBAAmB,KAAK,MAAM,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,MAAM,YAAY;QAC5E,EAAE;QACF,GAAG,UAAU,CAAC,KAAK,CAAC;QACpB,EAAE;QACF,aAAa;QACb,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjB;YACE,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE;YACpB,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;gBAC7B,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;QACD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,KAA6B,EAC7B,IAAuC;IAEvC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAClE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACzD,CAAC"}

package/dist/public-role-isolation.d.ts

@@ -1,5 +1,6 @@
 import { type GcloudRunner, type Sleep } from "./gcloud-retry.js";
 import type { EnsureOutcome } from "./runtime-secrets.js";
+import { type GcloudCredentials } from "./upgrade/gcp-lookup.js";
 /** The gcloud call that leaves `public_role` with no database roles. */
 export declare function revokePublicRoleMembershipsArgs(target: {
     readonly projectId: string;
@@ -12,6 +13,7 @@ export declare function revokePublicRoleMembershipsArgs(target: {
 export declare function revokePublicRoleMemberships(install: {
     readonly projectId: string;
     readonly env: string;
+    readonly credentials: GcloudCredentials;
 }, deps?: {
     readonly run?: GcloudRunner;
     readonly sleep?: Sleep;

package/dist/public-role-isolation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-role-isolation.d.ts","sourceRoot":"","sources":["../src/public-role-isolation.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,wEAAwE;AACxE,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,EAAE,CAYX;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC7D,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GACjE,OAAO,CAAC,aAAa,CAAC,CAoBxB"}
+{"version":3,"file":"public-role-isolation.d.ts","sourceRoot":"","sources":["../src/public-role-isolation.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,KAAK,YAAY,EAA2B,KAAK,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,KAAK,iBAAiB,EAAiB,MAAM,yBAAyB,CAAC;AAEhF,wEAAwE;AACxE,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,MAAM,EAAE,CAYX;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE;IACP,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;CACzC,EACD,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GACjE,OAAO,CAAC,aAAa,CAAC,CAyBxB"}

package/dist/public-role-isolation.js

@@ -31,6 +31,7 @@
 import { findSqlInstance } from "./gateway-credentials.js";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import { realSleep, runWithRetry } from "./gcloud-retry.js";
+import { lookupFailure } from "./upgrade/gcp-lookup.js";
 /** The gcloud call that leaves `public_role` with no database roles. */
 export function revokePublicRoleMembershipsArgs(target) {
     return [
@@ -52,10 +53,15 @@ export function revokePublicRoleMembershipsArgs(target) {
 export async function revokePublicRoleMemberships(install, deps = {}) {
     const run = deps.run ?? defaultGcloud;
     const id = "public_role database role memberships";
-    const sqlInstance = await findSqlInstance(install, { run });
-    if (!sqlInstance) {
-        return { id, status: "failed", error: "the Cloud SQL instance was not found" };
+    const lookup = await findSqlInstance(install, { run });
+    if (lookup.status !== "found") {
+        return {
+            id,
+            status: "failed",
+            error: lookupFailure(lookup, "Cloud SQL instance", install.credentials),
+        };
     }
+    const sqlInstance = lookup.name;
     const r = await runWithRetry(run, deps.sleep ?? realSleep, revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance }));
     if (!r.ok) {
         return {

package/dist/public-role-isolation.js.map

@@ -1 +1 @@
-{"version":3,"file":"public-role-isolation.js","sourceRoot":"","sources":["../src/public-role-isolation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAG3F,wEAAwE;AACxE,MAAM,UAAU,+BAA+B,CAAC,MAG/C;IACC,OAAO;QACL,KAAK;QACL,OAAO;QACP,cAAc;QACd,aAAa;QACb,cAAc,MAAM,CAAC,WAAW,EAAE;QAClC,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAA6D,EAC7D,OAAgE,EAAE;IAElE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,EAAE,GAAG,uCAAuC,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,YAAY,CAC1B,GAAG,EACH,IAAI,CAAC,KAAK,IAAI,SAAS,EACvB,+BAA+B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAC/E,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO;YACL,EAAE;YACF,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,wEAAwE,WAAW,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,4FAA4F;SAC3M,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,WAAW,EAAE,EAAE,CAAC;AACvF,CAAC"}
+{"version":3,"file":"public-role-isolation.js","sourceRoot":"","sources":["../src/public-role-isolation.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAqB,SAAS,EAAE,YAAY,EAAc,MAAM,mBAAmB,CAAC;AAE3F,OAAO,EAA0B,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEhF,wEAAwE;AACxE,MAAM,UAAU,+BAA+B,CAAC,MAG/C;IACC,OAAO;QACL,KAAK;QACL,OAAO;QACP,cAAc;QACd,aAAa;QACb,cAAc,MAAM,CAAC,WAAW,EAAE;QAClC,iBAAiB;QACjB,yBAAyB;QACzB,aAAa,MAAM,CAAC,SAAS,EAAE;QAC/B,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAIC,EACD,OAAgE,EAAE;IAElE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,EAAE,GAAG,uCAAuC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE;YACF,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,aAAa,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,CAAC,WAAW,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,YAAY,CAC1B,GAAG,EACH,IAAI,CAAC,KAAK,IAAI,SAAS,EACvB,+BAA+B,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAC/E,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO;YACL,EAAE;YACF,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,wEAAwE,WAAW,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,4FAA4F;SAC3M,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,WAAW,EAAE,EAAE,CAAC;AACvF,CAAC"}

package/dist/release-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAwBjD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"release-contract.d.ts","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,WAAW,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EA4BjD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzD"}

package/dist/release-contract.js

@@ -52,6 +52,10 @@ export const INFRA_CONTRACT_PATHS = [
     "packages/provisioning/src/audit-job-setup.ts",
     // #819 — the converge job, its database login and the admin's grant on it.
     "packages/provisioning/src/converge-job-setup.ts",
+    // #891 — the edge security headers the stacks attach, and the converge's
+    // SVG backfill + CDN purge on `gcp`.
+    "packages/provisioning/src/static-security-headers.ts",
+    "packages/provisioning/src/static-svg-gcp.ts",
 ];
 /**
  * Whether a changed repo-relative path can alter the infrastructure

package/dist/release-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;IAC/C,qEAAqE;IACrE,uDAAuD;IACvD,0CAA0C;IAC1C,uEAAuE;IACvE,uDAAuD;IACvD,6CAA6C;IAC7C,wEAAwE;IACxE,UAAU;IACV,8CAA8C;IAC9C,2EAA2E;IAC3E,iDAAiD;CAClD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"release-contract.js","sourceRoot":"","sources":["../src/release-contract.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+BAA+B;IAC/B,6CAA6C;IAC7C,6CAA6C;IAC7C,8CAA8C;IAC9C,8CAA8C;IAC9C,wCAAwC;IACxC,yEAAyE;IACzE,oEAAoE;IACpE,mDAAmD;IACnD,+CAA+C;IAC/C,sCAAsC;IACtC,+CAA+C;IAC/C,qEAAqE;IACrE,uDAAuD;IACvD,0CAA0C;IAC1C,uEAAuE;IACvE,uDAAuD;IACvD,6CAA6C;IAC7C,wEAAwE;IACxE,UAAU;IACV,8CAA8C;IAC9C,2EAA2E;IAC3E,iDAAiD;IACjD,yEAAyE;IACzE,qCAAqC;IACrC,sDAAsD;IACtD,6CAA6C;CAC9C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC"}

package/dist/self-hosted-internal-secret.d.ts

@@ -0,0 +1,27 @@
+/** `<caeloDir>/internal-secret.json`. */
+export declare function internalSecretPath(caeloDir: string): string;
+/**
+ * The install's internal secret, or null when the file does not exist.
+ * Throws on a malformed file rather than guessing a value: a wrong secret
+ * would only surface later as every internal call failing its signature.
+ */
+export declare function readInternalSecret(caeloDir: string): string | null;
+/** Write a new internal secret (`init`, or {@link ensureInternalSecret}). */
+export declare function writeInternalSecret(caeloDir: string, secret: string): void;
+/**
+ * The secret the Compose file gives the admin. An install whose directory
+ * has none (made by a CLI that did not write the file, or with it deleted)
+ * gets one created here, and `report` says so.
+ *
+ * This is creation of a missing secret, not a fallback (CLAUDE.md §2): no
+ * stored state depends on a previous value — before #770 the admin never
+ * received the secret, so no token was ever signed with it — and the value
+ * is written to disk before the Compose file that uses it, so every later
+ * render and every host-side command read the same one. Same pattern as
+ * the `caeloSecretKek` back-fill in the CLI's `emitConfig`.
+ */
+export declare function ensureInternalSecret(caeloDir: string, deps: {
+    readonly randomSecret: () => string;
+    readonly report: (line: string) => void;
+}): string;
+//# sourceMappingURL=self-hosted-internal-secret.d.ts.map

package/dist/self-hosted-internal-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-internal-secret.d.ts","sourceRoot":"","sources":["../src/self-hosted-internal-secret.ts"],"names":[],"mappings":"AAoBA,yCAAyC;AACzC,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBlE;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAG1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACrF,MAAM,CASR"}

package/dist/self-hosted-internal-secret.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * #770 — the self-hosted install's `/api/internal/*` secret,
+ * `.caelo/internal-secret.json` (`{ "secret": "<hex>" }`).
+ *
+ * `init` has written it since P15.1, but until #770 nothing handed it to the
+ * admin container, so the admin's internal endpoints answered "not set" on
+ * every self-hosted install. The Compose file now carries it as the admin's
+ * `CAELO_INTERNAL_SECRET`, and the host-side commands that call those
+ * endpoints (`owner-reset`) sign their tokens with the same file.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writePrivateFile } from "./private-file.js";
+/** The admin refuses shorter secrets (apps/admin internal-jwt.ts). */
+const MIN_LENGTH = 32;
+/** `<caeloDir>/internal-secret.json`. */
+export function internalSecretPath(caeloDir) {
+    return join(caeloDir, "internal-secret.json");
+}
+/**
+ * The install's internal secret, or null when the file does not exist.
+ * Throws on a malformed file rather than guessing a value: a wrong secret
+ * would only surface later as every internal call failing its signature.
+ */
+export function readInternalSecret(caeloDir) {
+    const path = internalSecretPath(caeloDir);
+    if (!existsSync(path))
+        return null;
+    let secret;
+    try {
+        secret = JSON.parse(readFileSync(path, "utf8")).secret;
+    }
+    catch (e) {
+        throw new Error(`${path} is not valid JSON (${String(e)}); fix it or delete it and run \`cms-provision up\`.`);
+    }
+    if (typeof secret !== "string" || secret.length < MIN_LENGTH) {
+        throw new Error(`${path} has no "secret" of at least ${MIN_LENGTH} characters; fix it or delete it and run \`cms-provision up\`.`);
+    }
+    return secret;
+}
+/** Write a new internal secret (`init`, or {@link ensureInternalSecret}). */
+export function writeInternalSecret(caeloDir, secret) {
+    if (secret.length < MIN_LENGTH)
+        throw new Error(`internal secret shorter than ${MIN_LENGTH}`);
+    writePrivateFile(internalSecretPath(caeloDir), JSON.stringify({ secret }, null, 2));
+}
+/**
+ * The secret the Compose file gives the admin. An install whose directory
+ * has none (made by a CLI that did not write the file, or with it deleted)
+ * gets one created here, and `report` says so.
+ *
+ * This is creation of a missing secret, not a fallback (CLAUDE.md §2): no
+ * stored state depends on a previous value — before #770 the admin never
+ * received the secret, so no token was ever signed with it — and the value
+ * is written to disk before the Compose file that uses it, so every later
+ * render and every host-side command read the same one. Same pattern as
+ * the `caeloSecretKek` back-fill in the CLI's `emitConfig`.
+ */
+export function ensureInternalSecret(caeloDir, deps) {
+    const existing = readInternalSecret(caeloDir);
+    if (existing !== null)
+        return existing;
+    const secret = deps.randomSecret();
+    writeInternalSecret(caeloDir, secret);
+    deps.report(`Created ${internalSecretPath(caeloDir)} — this install had no internal secret; the admin now gets it as CAELO_INTERNAL_SECRET (needed by \`cms-provision owner-reset\`).`);
+    return secret;
+}
+//# sourceMappingURL=self-hosted-internal-secret.js.map

package/dist/self-hosted-internal-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-hosted-internal-secret.js","sourceRoot":"","sources":["../src/self-hosted-internal-secret.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,sEAAsE;AACtE,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,yCAAyC;AACzC,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0B,CAAC,MAAM,CAAC;IACnF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,uBAAuB,MAAM,CAAC,CAAC,CAAC,sDAAsD,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,gCAAgC,UAAU,gEAAgE,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,MAAc;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAC;IAC9F,gBAAgB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,IAAsF;IAEtF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACnC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CACT,WAAW,kBAAkB,CAAC,QAAQ,CAAC,mIAAmI,CAC3K,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/self-hosted-release.d.ts

@@ -13,7 +13,8 @@ export interface HostRunner {
     /**
      * Run `argv` to completion. With `stdoutPath`, stdout streams into that
      * file (mode 600) instead of being captured — used for database dumps.
-     * With `stdinPath`, that file is the process's stdin (restores). With
+     * With `stdinPath`, that file is the process's stdin (restores); with
+     * `stdinText`, that text is (secrets that must not appear in argv). With
      * `inherit`, stdout + stderr go to the terminal (long pulls and starts
      * the operator should watch) and come back empty.
      */
@@ -25,6 +26,7 @@ export interface HostRunOptions {
     readonly env?: Readonly<Record<string, string>>;
     readonly stdoutPath?: string;
     readonly stdinPath?: string;
+    readonly stdinText?: string;
     readonly inherit?: boolean;
 }
 /** The real runner: Bun.spawn; a missing binary is exit code 127, not a throw. */

package/dist/self-hosted-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self-hosted-release.d.ts","sourceRoot":"","sources":["../src/self-hosted-release.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAiC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAUjF,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7E;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,UAmB3B,CAAC;AAEF,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAClD;AAID,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAqBtE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAChD,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,EACtC,GAAG,GAAE,IAAiB,GACrB,iBAAiB,CAenB;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACrB,IAAI,CAON;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD,GACA,OAAO,CAAC,eAAe,CAAC,CAmD1B"}
+{"version":3,"file":"self-hosted-release.d.ts","sourceRoot":"","sources":["../src/self-hosted-release.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAiC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAUjF,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;OAOG;IACH,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7E;AAED,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,kFAAkF;AAClF,eAAO,MAAM,aAAa,EAAE,UAwB3B,CAAC;AAEF,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAClD;AAID,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAqBtE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAChD,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,EACtC,GAAG,GAAE,IAAiB,GACrB,iBAAiB,CAenB;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,IAAiB,GACrB,IAAI,CAON;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IACJ,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjD,GACA,OAAO,CAAC,eAAe,CAAC,CAmD1B"}

package/dist/self-hosted-release.js

@@ -27,7 +27,11 @@ export const bunHostRunner = {
         try {
             const proc = Bun.spawn([...argv], {
                 ...(opts?.env ? { env: { ...process.env, ...opts.env } } : {}),
-                stdin: opts?.stdinPath ? Bun.file(opts.stdinPath) : "ignore",
+                stdin: opts?.stdinText !== undefined
+                    ? Buffer.from(opts.stdinText)
+                    : opts?.stdinPath
+                        ? Bun.file(opts.stdinPath)
+                        : "ignore",
                 stdout: opts?.stdoutPath ? Bun.file(opts.stdoutPath) : opts?.inherit ? "inherit" : "pipe",
                 stderr: opts?.inherit ? "inherit" : "pipe",
             });
@@ -130,7 +134,7 @@ export async function resolveVerifiedRelease(tag, deps) {
             ok: false,
             error: "cosign is required to verify the Caelo release image signatures and was not found on PATH.\n" +
                 "Install it (https://docs.sigstore.dev/cosign/system_config/installation/ — e.g. `brew install cosign`,\n" +
-                "or the release binary for Linux), then re-run. --skip-verify skips the check (NOT for production).",
+                "or the signed release binary for Linux), then re-run.",
         };
     }
     for (const service of RELEASE_SERVICES) {

package/dist/self-hosted-release.js.map

@@ -1 +1 @@
-{"version":3,"file":"self-hosted-release.js","sourceRoot":"","sources":["../src/self-hosted-release.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAiCrC,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAe;IACvC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE;gBAChC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ;gBAC5D,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;gBACzF,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;aAC3C,CAAC,CAAC;YACH,MAAM,MAAM,GACV,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,OAAO;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;CACF,CAAC;AAqBF,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,OAA0B;IACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA+B,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;IAC1C,IACE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC;QAChC,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,8FAA8F,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CACzJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,IAAgD,EAChD,KAAsC,EACtC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAsB;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QAClE,WAAW,EACT,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa;YACxE,CAAC,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;KAC7E,CAAC;IACF,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,OAA0B,EAC1B,SAAiB,EACjB,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;IAEtB,aAAa,CACX,QAAQ,EACR,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,EAC5D,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EACxE,GAAG,CACJ,CAAC;AACJ,CAAC;AAMD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,IAKC;IAED,MAAM,IAAI,GAAiD,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,aAAa,IAAI,cAAc,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,MAAM,qBAAqB,CACnC,aAAa,EACb,GAAG,cAAc,IAAI,OAAO,EAAE,EAC9B,GAAG,EACH,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,qBAAqB,aAAa,IAAI,cAAc,IAAI,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,MAAM;oBACzF,6GAA6G;aAChH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;KAC5B,CAAC;IACF,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,8FAA8F;gBAC9F,0GAA0G;gBAC1G,oGAAoG;SACvG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,4BAA4B,MAAM,CAAC,OAAO,CAAC,8DAA8D;oBACzG,kGAAkG;oBAClG,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"self-hosted-release.js","sourceRoot":"","sources":["../src/self-hosted-release.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAmCrC,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAe;IACvC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI;QAClB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE;gBAChC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,KAAK,EACH,IAAI,EAAE,SAAS,KAAK,SAAS;oBAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;oBAC7B,CAAC,CAAC,IAAI,EAAE,SAAS;wBACf,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;wBAC1B,CAAC,CAAC,QAAQ;gBAChB,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;gBACzF,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;aAC3C,CAAC,CAAC;YACH,MAAM,MAAM,GACV,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,OAAO;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAwB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;CACF,CAAC;AAqBF,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,OAAO,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AACxC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,OAA0B;IACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA+B,CAAC;IACjF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;IAC1C,IACE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,CAAC,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC;QAChC,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,8FAA8F,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CACzJ,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,IAAgD,EAChD,KAAsC,EACtC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAsB;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;QAClE,WAAW,EACT,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa;YACxE,CAAC,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,EAAE;QACR,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;KAC7E,CAAC;IACF,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,OAA0B,EAC1B,SAAiB,EACjB,MAAc,EACd,MAAY,IAAI,IAAI,EAAE;IAEtB,aAAa,CACX,QAAQ,EACR,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,EAC5D,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EACxE,GAAG,CACJ,CAAC;AACJ,CAAC;AAMD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,IAKC;IAED,MAAM,IAAI,GAAiD,EAAE,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,aAAa,aAAa,IAAI,cAAc,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,GAAG,MAAM,qBAAqB,CACnC,aAAa,EACb,GAAG,cAAc,IAAI,OAAO,EAAE,EAC9B,GAAG,EACH,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,qBAAqB,aAAa,IAAI,cAAc,IAAI,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,MAAM;oBACzF,6GAA6G;aAChH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;KAC5B,CAAC;IACF,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,8FAA8F;gBAC9F,0GAA0G;gBAC1G,uDAAuD;SAC1D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,UAAU,EAAE,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EACH,4BAA4B,MAAM,CAAC,OAAO,CAAC,8DAA8D;oBACzG,kGAAkG;oBAClG,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/self-hosted-upgrade.d.ts

@@ -27,6 +27,18 @@ export interface SelfHostedUpgradeDeps {
      * (`convergeSelfHostedRoles`); drops roles a release retired (#635).
      */
     readonly convergeRoles: () => Promise<ConvergeOutcome>;
+    /**
+     * Re-writes the Caddyfile from the install's config + domains table and
+     * reloads Caddy (#891): the edge headers (the SVG CSP, nosniff) live in
+     * the Caddyfile this release's generator writes, so an upgrade that only
+     * rolled the containers would leave the install on the old edge config.
+     */
+    readonly refreshCaddy: () => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        error: string;
+    }>;
     readonly fetchImpl?: typeof fetch;
     readonly sleep?: (ms: number) => Promise<void>;
     readonly now?: () => Date;
@@ -60,7 +72,7 @@ export type SelfHostedUpgradeResult = {
     /** Whether the previous release is running again (true when nothing had changed yet). */
     readonly previousRunning: boolean;
 };
-type UpgradeStage = "target" | "verify" | "converge" | "backup" | "pull" | "migrate" | "roles" | "roll-admin" | "roll-gateway";
+type UpgradeStage = "target" | "verify" | "converge" | "backup" | "pull" | "migrate" | "roles" | "roll-admin" | "roll-gateway" | "caddy";
 /** Where an install from before #696 keeps its original Compose file during the move. */
 export declare function legacyComposePath(caeloDir: string): string;
 /** Where the media of an install from before #696 lives: the checkout's admin cwd. */

package/dist/self-hosted-upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self-hosted-upgrade.d.ts","sourceRoot":"","sources":["../src/self-hosted-upgrade.ts"],"names":[],"mappings":"AAiDA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EACL,KAAK,UAAU,EAMhB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAM9D,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,MAAM,CAAC;IAC1D,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChG;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC,CAAC;AAEN,KAAK,YAAY,GACb,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,MAAM,GACN,SAAS,GACT,OAAO,GACP,YAAY,GACZ,cAAc,CAAC;AAEnB,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAoBD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAcpE;AAqBD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6FAA6F;AAC7F,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAErE;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAuKlC;AA8BD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnE;AAED,mEAAmE;AACnE,eAAO,MAAM,cAAc;IACzB,uFAAuF;;;;CAI/E,CAAC;AAEX;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBtD;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBtD;AAeD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,OAAO,GAAG,gBAAgB,GAAG,kBAAkB,CAAC,GAC5F,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBtD"}
+{"version":3,"file":"self-hosted-upgrade.d.ts","sourceRoot":"","sources":["../src/self-hosted-upgrade.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAA8B,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EACL,KAAK,UAAU,EAMhB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAM9D,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,MAAM,CAAC;IAC1D,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChG;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC,CAAC;AAEN,KAAK,YAAY,GACb,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,QAAQ,GACR,MAAM,GACN,SAAS,GACT,OAAO,GACP,YAAY,GACZ,cAAc,GACd,OAAO,CAAC;AAEZ,yFAAyF;AACzF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAoBD,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAcpE;AAqBD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,6FAA6F;AAC7F,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAErE;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAiLlC;AA+CD;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,EAClB,EAAE,EAAE,IAAI,GACP,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnE;AAED,mEAAmE;AACnE,eAAO,MAAM,cAAc;IACzB,uFAAuF;;;;CAI/E,CAAC;AAEX;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBtD;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBtD;AAeD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,OAAO,GAAG,gBAAgB,GAAG,kBAAkB,CAAC,GAC5F,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBtD"}

package/dist/self-hosted-upgrade.js

@@ -20,7 +20,9 @@
  *      was retired in (run-order.ts): past it, nothing running uses it;
  *   6. recreate the admin, health-check it (`/_caelo/health`, which proves
  *      the DB pool and roles); then the gateway (`/healthz`);
- *   7. record the release in `.caelo/release.json`.
+ *   7. re-write the Caddyfile and reload Caddy — the edge headers live there
+ *      (#891), and only the new release's generator knows them;
+ *   8. record the release in `.caelo/release.json`.
  * Any failure after step 3 puts the previous Compose file back; once a
  * container was recreated the previous images are started again and
  * health-checked (rollback). The database is never restored automatically:
@@ -178,6 +180,11 @@ export async function upgradeSelfHosted(opts, deps) {
         if (!converged.ok) {
             return fail("converge", `${converged.error}\nThe recorded release ${current.version} is not serving healthily — check \`docker compose logs\`.`, false);
         }
+        // A run that stopped after the roll (or an install upgraded before the
+        // Caddyfile was part of the upgrade) gets this release's edge config.
+        const caddy = await refreshCaddy(deps);
+        if (!caddy.ok)
+            return caddy.failure;
         log.info(`Already on ${current.version} (${shortDigest(images.admin)}); nothing to do.`);
         return { ok: true, status: "already-current", version: current.version };
     }
@@ -246,12 +253,29 @@ export async function upgradeSelfHosted(opts, deps) {
         }
         log.info(`${service} healthy ✓`);
     }
-    // 7. Record.
+    // 7. The Caddyfile this release generates (edge headers, #891). The new
+    // containers already serve; a failure is reported before the release is
+    // recorded, so a re-run (the already-current path above) retries it.
+    const caddy = await refreshCaddy(deps);
+    if (!caddy.ok)
+        return caddy.failure;
+    // 8. Record.
     log.phase?.("record");
     recordRelease(caeloDir, { version: target.version, images }, { from: current?.version ?? null, to: target.version, outcome: "upgraded" }, now());
     log.step(`Upgraded to ${target.version}. Backup kept at ${backup.dir}`);
     return { ok: true, status: "upgraded", version: target.version };
 }
+/** Step 7: re-write + reload the Caddyfile; on failure, the result to return. */
+async function refreshCaddy(deps) {
+    deps.log.step("Re-writing the Caddyfile and reloading Caddy");
+    const r = await deps.refreshCaddy();
+    if (r.ok)
+        return { ok: true };
+    return {
+        ok: false,
+        failure: fail("caddy", `${r.error}\nThe new release is running, but Caddy may still serve the previous Caddyfile (without this release's security headers). Fix the cause, then run \`${selfCommand("regenerate-caddy")}\` or re-run the upgrade.`, false),
+    };
+}
 function fail(stage, error, previousRunning) {
     return { ok: false, stage, error, previousRunning };
 }